1000 Flashcards
A network that does not have servers - so each device simultaneously functions as both a client and a server to all other devices connected to the network.
Peer-To-Peer (P2P) Network
A policy that outlines how the organization uses personal information it collects.
Privacy Policy
A written document that states how an organization plans to protect the company’s information technology assets.
Security Policy
Grouping individuals and organization into cluster or groups based on a like affiliation.
Social Networking
Web sites that facilitate linking individuals with common interests like hobbies - religion - politics - or school or work contacts.
Social Networking Sites
A type of action that has the potential to cause harm.
Threat
A person or element that has the power to carry out a threat.
Threat Agent
A flaw or weakness that allows a threat agent to bypass security.
Vulnerability
The likelihood that the threat agent will exploit the vulnerability.
Risk
An event that - in the beginning - is considered to be risk yet turns out not to be.
False Positive
List and describe the 3 strategies for controlling risks.
1- privilege management- is the process of assigning and revoking privileges to objects; it covers the procedures of managing object authorizations
2- change management- refers to a methodology for making modifications and keeping track of those changes
3- incident management- is defined as the “framework” and functions required to enable incident response and incident handling within an organization.
A subject’s access level over an object - such as a user’s ability to pen a payroll file.
Privilege
Periodic reviewing of a subject’s privileges over an object - in which the objective is to determine if the subject has the correct privileges.
Privilege Auditing
What is a CMT and what is is duties?
Change Management Team
1- review proposed changes
2- ensure risk and impact of the planned changes are understood
3- recommend approval - disapproval - deferral - withdrawal of a requested change
4- communicate proposed and approved changes to coworkers
The planning - coordination - communications - and planning functions that are needed in order to resolve an incident in an efficient manner.
Incident Handling
The components required to identify - analyze - and contain an incident.
Incident Response
What are the functions of an organization’s information security policy?
1- it can be an overall intention and direction. A security policy is a vehicle for communicating an organization’s information security culture and acceptable information security behavior.
2- it details specific risks and how to address them - and provide controls that executives can use to direct employee behavior.
3- it can help to create a security-aware organization culture
4- it can help to ensure that employee behavior is directed and monitored to ensure compliance with security requirements.
What must an effective security policy balance?
Trust and Control
What are the 3 approaches to trust?
1- Trust everyone all of the time- easiest model to enforce because there are not restrictions; impractical because it leaves system vulnerable to attacks
2- Trust no one at any time- most restrictive model; impractical because few employees would work for an organization that did not trust them
3- Trust some people some of the time- this approach exercises caution in the amount of trust given; access is provided as needed with technical controls to ensure the trust is not violated.
A collection of requirements specific to the system or procedure that must be met by everyone.
Standard
A collection of suggestions that should be implemented.
Guideline
A document that outlines specific requirements or rules that must be met.
Policy
What is the three-phase cycle in the development and maintenance of a security policy?
1- vulnerability assessment
2- create the security policy using information from risk management study
3- compliance monitoring and evaluation
What does a vulnerability assessment attempt to identify?
1- asset identification (what needs to be protected)
2- threat identification (what the pressures are against it)
3- vulnerability appraisal (how susceptible the current protection is)
4- risk assessment (what damages could result from the threats)
5- risk mitigation (what to do about it)
What MUST a security policy do?
1- be implementable and enforceable
2- be concise and easy to understand
3- balance protection with productivity
What SHOULD a security policy do?
1- state reasons the policy is necessary
2- describe what is covered by the policy
3- outline how violations will be handled
Ideally - who should comprise the team who designs a security policy?
1- Senior level administrator
2- member of management who can enforce the policy
3- member of the legal staff
4- representative from the user community
What is due care?
is the obligations that are imposed on owners and operators of assets to exercise reasonable care of the assets and take necessary precautions to protect them. It is the care that a reasonable person would exercise under circumstances.
Defines requirements for using cryptography.
Acceptable encryption policy
Established guidelines for effectively reducing the threat of computer viruses on the organization’s network and computers.
Anti-virus policy
Outlines the requirements and provides the authority for an information security team to conduct audits and risk assessments - investigate incidents - to ensure conformance to security policies - or to monitor user activity.
Audit vulnerability scanning policy
Prescribes that no e-mail will be automatically forwarded to an external destination without prior approval from the appropriate manager or director.
Automatically forwarded e-mail policy
Defines requirements for storing and retrieving database usernames and passwords.
Database credentials coding policy
Defines standards for all networks and equipment located in the DMZ.
Demilitarized zone security policy
Creates standards for using corporate e-mail.
E-mail policy
Helps employees determine what information sent or received by e-mail should be retained and for how long.
E-mail retention policy
Defines the requirements for third-party organizations to access the organization’s networks.
Extranet policy
Establishes criteria for classifying and securing the organization’s information in a manner appropriate to its level of security.
Information sensitivity policy
