Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

BEC > 15 IT Security and Controls > Flashcards

15 IT Security and Controls Flashcards

1
Q

Why is the audit trail in a computer-based environment volatile?

A

In any computer-based environment, a complete trail useful for audit purposes might exist for only a short time or in only computer-readable form. In online and real-time systems, data are entered directly into the computer, eliminating portions of the audit trail traditionally provided by source documents.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What does a firewall do?

A

A firewall limits access to a private network connected to the internet rather than completely blocking information to and from the private network. Information with granted authorization (satisfying predefined security rules) is still accessible.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What is malware (malicious software)?

A

Malware is a term describing any program code that enters a computer system that has the potential to degrade that system.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What are some common forms of malware?

A
  • Trojan horse
  • virus
  • worm
  • denial-of-service
  • phishing
  • back door
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What is a Trojan horse malware?

A

A Trojan horse is an apparently innocent program (ex- spreadsheet) that includes a hidden function that may do damage when activated.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What is a virus malware?

A

A virus is a program that copies itself from file to file. The virus may destroy data or programs. A common way of spreading a virus is by email attachments and downloads.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What is a logic bomb virus?

A

Logic bombs are a type of virus triggered by a predetermined event (such as Friday the 13th, April Fool’s day, etc.)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What is a worm malware?

A

A worm copies itself not from file to file but from computer to computer, often very rapidly. Repeated replication overloads a system by depleting memory or overwhelming network traffic capacity.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What is a denial-of-service (DoS) malware attack?

A

A denial-of-service (DoS) attack is an attempt to overload a system (ex- network or web server) with messages so that it cannot function (a system crash).

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What is a distributed denial-of-service (DDoS) malware attack?

A

A distributed denial-of-service (DDoS) attack comes from multiple sources, for example, the machines of innocent parties infected by Trojan horses. When activated, these programs send messages to the target and leave the connection open.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What is phishing malware?

A

Phishing is a method of electronically obtaining confidential information, such as a password or credit card number, through deceit. The perpetrator may set up a website that appears to be legitimate but actually serves no other purpose than to obtain the victim’s information.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

How are phishing scams often initiated?

A

Through email spoofing, in which the perpetrator sends out emails that appear to be from a real financial institution. When the victim clicks on the link to what (s)he thinks is the institution’s website, the victim is unknowingly redirected to the perpetrator’s website.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What is a back door malware?

A

A back door is a program that allows unauthorized access to a system and bypasses the normal login procedures (front door). Trojan horses and viruses can create a back door that allows unauthorized access to the system or data.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What is COBIT?

A

Control Objectives for Information and Related Technology - the best-known control and governance framework that addresses IT-related governance and management.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What are the COBIT information criteria?

A
  • Effectiveness (doing the right things)
  • Efficiency (doing things right)
  • Confidentiality
  • Integrity
  • Availability
  • Compliance
  • Reliability
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What does the COBIT information criteria effectiveness mean?

A

Effectiveness (doing right things) deals with information’s relevance to the business process and receipt in a timely, correct, consistent, and usable manner.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What does the COBIT information criteria efficiency mean?

A

Efficiency (doing things right) concerns the provision of information through the optimal (most productive and economical) use of resources.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What does the COBIT information criteria confidentiality mean?

A

Confidentiality concerns the protection of sensitive information from unauthorized disclosure.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What does the COBIT information criteria integrity mean?

A

Integrity relates to the accuracy and completeness of information, as well as to its validity in accordance with the business values and expectations.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What does the COBIT information criteria availability mean?

A

Availability relates to information being available when required by the business process now and in the future. It also concerns the safeguarding of necessary resources and associated capabilities.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

What does the COBIT information criteria compliance mean?

A

Compliance deals with complying with the laws, regulations, and contractual arrangements to which the business process is subject, i.e., externally imposed business criteria as well as internal policies.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

What does the COBIT information criteria reliability mean?

A

Reliability relates to the provision of appropriate information for management to operate the entity and exercise its fiduciary and governance responsibilities.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

What are the IT governance focus areas?

A
  • strategic alignment
  • value delivery
  • resource management
  • IT risk
  • Risk management
  • Performance measurement
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

What is the IT governance focus area strategic alignment?

A

Strategic alignment focuses on ensuring the linkage of business and IT plans; defining, maintaining, and validating the IT value proposition; and aligning IT operations with enterprise operations.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

What is the IT governance focus area value delivery?

A

Value delivery is about executing the value proposition throughout the delivery cycle, ensuring that IT delivers the promised benefits against the strategy, concentrating on optimizing costs, and proving the intrinsic value of IT.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

What is the IT governance focus area resource management?

A

Resource management is about the optimal investment in, and the proper management of, critical IT resources.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

What is the IT governance focus area IT risk?

A

IT risk is the business risk associated with the use, ownership, operation, involvement, influence, and adaption of IT within an enterprise or organization.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

What is the IT governance focus area risk management?

A

Risk management involves risk awareness by senior corporate officers, understanding of compliance requirements, transparency about the significant risks to the enterprise, and embedding of risk management responsibilities into the organization.

29
Q

What is the IT governance focus area performance measurement?

A

Performance measurement tracks and monitors strategy implementation, project completion, resource usage, process performance, and service delivery.

30
Q

What are the 5 key principles of COBIT?

A
  1. meeting stakeholder needs
  2. covering the enterprise end-to-end
  3. applying a single, integrated framework
  4. enabling a holistic approach
  5. separating governance from management
31
Q

How is value creation achieved in the COBIT model?

A

By balancing 3 components

  1. realization of benefits
  2. optimization (not minimization) of risk
  3. optimal use of resources
32
Q

What are the factors referred to as stakeholder drivers?

A

internal factors (such as changes in organizational culture) and external factors (such as disruptive technologies). COBIT 5 recognizes that stakeholder needs are not fixed and evolve under the influence of these factors.

33
Q

What is the process in COBIT 5 described as the goals cascade?

A
  1. COBIT 5 supplies 17 generic enterprise goals that are tied directly to the balanced scorecard model.
  2. next, IT-related goals (referred to as alignment goals) are drawn up to address the enterprise goals
  3. Finally, enablers (referred to as components by COBIT 2019) that support the pursuit of the IT-related goals are identified
34
Q

What are the 7 categories of enablers described in COBIT 5 that support comprehensive IT governance and management?

A
  1. principles, polices, and frameworks - to translate desired behavior into guidance
  2. Processes - which are sets of practices to achieve the objectives
  3. organizational structures - which are decision-making entities
  4. culture, ethics, and behavior - of individuals and the enterprise
  5. information - produced and used by the enterprise
  6. services, infrastructure, and applications - that provide the enterprise with IT processing and services
  7. people, skills, and competencies - required for operations, error detections, and corrections
35
Q

Why are enablers interconnected?

A
  • they need the input of other enablers to be fully effective
  • they deliver output for the benefit of other enablers
36
Q

In COBIT 5, principle 5, Separating Governance from Management, what is governance?

A

Governance is the setting of overall objectives and monitoring progress toward those objectives. COBIT 5 associates governance with the board of directors.

37
Q

What are the 3 practices that must be addressed within any governance process?

A
  1. evaluate
  2. direct
  3. monitor
38
Q

In COBIT 5, principle 5, Separating Governance from Management, what is management?

A

Management is the carrying out of activities in pursuit of enterprise goals. COBIT 5 associates these activities with executive management under the leadership of the CEO.

39
Q

What are the 4 responsibility areas that must be addressed within any management process?

A
  1. plan
  2. build
  3. run
  4. monitor
40
Q

COBIT 5 divides governance and management into 5 domains, what are the 5 domains (key areas)?

A

Governance:
1. evaluate, direct, and monitor (EDM) - evaluate stakeholder needs, conditions, and options. Set direction through prioritization and decision making. Monitor performance and compliance

Management:

  1. align, plan, and organize (APO) - Plan how IT can be used to achieve the company’s goals and objectives
  2. build, acquire and implement (BAI) - Identify IT requirements, build or acquire the technology, and incorporate into business processes.
  3. deliver, service, and support (DSS) - Execute and support the application of the technology in business processes.
  4. monitor, evaluate, and assess (MEA) - Monitor and evaluate whether the current IT system and internal control system meet the company’s goals and objectives.
41
Q

What is the difference between COBIT 2019 and COBIT 5?

A

COBIT 2019 expands on COBIT 5’s key principles for a governance system applicable to IT governance to include 6 governance system principles and 3 governance framework principles.

42
Q

What is a governance system?

A

A governance system is the rules, practices, and processes that direct and regulate an entity.

43
Q

What is a governance framework?

A

A governance framework is the structure upon which the governance system is built?

44
Q

What are the 6 principles for a governance system in COBIT 2019?

A
  1. provide stakeholder value
  2. holistic approach
  3. dynamic governance system
  4. governance distinct from management
  5. tailored to enterprise needs
  6. end-to-end governance system
45
Q

What are the two types of governance system components (enablers)?

A

Generic - components applied in principle to any circumstances
Variant - components designed for a given purpose or context in a focus area

46
Q

What are the 3 principles for a governance framework in COBIT 2019?

A
  1. it is based on a conceptual model - the governance framework achieves consistency and automation by identifying components and their relationships
  2. it is open and flexible - the governance framework is flexible and permits inclusion of new content and issues without loss of consistency and integrity
  3. it is aligned with major standards - the governance framework aligns with relevant regulations, standards, frameworks, and best practices (ex - the latest IT standards and compliance regulations)
47
Q

What are the 7 phases of COBIT implementation?

A
  1. program initiation - what are the drivers? - involves recognizing change drivers and establishing management’s desire to change
  2. problems and opportunities definition - where are we now? - involves assessing the current state or capability and forming an implementation team
  3. road map definition - where do we want to be? - involves defining the target state and identifying the gap as well as potential solutions
  4. program planning - what needs to be done? - involves planning implementation to close the gap
  5. plan execution - how do we get there? - involves implementing the plan and establishing monitoring systems
  6. benefits realization - did we get there? - involves monitoring progress and achievement
  7. effectiveness review - how do we keep the momentum going? - involves reviewing the overall program and reinforcing improvements.
48
Q

What is the COBIT Performance Management (CPM) model?

A

The COBIT Performance Management (CPM) model measures performance using capability and maturity levels.

49
Q

What are capability levels?

A

The CPM measures performance by using the capability level to quantify how well a process is operating, ranging from 0 (no capability or not meeting the intent of any process practices) to 5 (well defined process or continues improvement enabled).

50
Q

What are maturity levels?

A

The CPM measures performance by using focus area maturity levels.

0 - incomplete
1- initial
2 - managed
3- defined
4- quantitative
5- optimizing
51
Q

What are the challenges when starting a data governance program or improving an existing program?

A
  • enterprises cannot easily quantify the benefits of data governance, which leads to a lack of management commitment
  • unclearly defined data ownership
  • disaggregated data sets from siloed departments
52
Q

What are the 5 stages of the data management approach to overcome challenges published in 2020 by ISACA?

A
  1. establish a data governance foundation
  2. establish and evolve the data architecture
  3. define, execute, assure data quality and clean polluted data
  4. realize data democratization
  5. focus on data analytics
53
Q

What is a data governance foundation?

A

A data governance foundation guides how to collect and use data by addressing legal, business intellectual property, and customer sensitivity considerations.

54
Q

What is data taxonomy?

A

Data taxonomy, the amount of data collected and the functional classification of the information (ex- manufacturing data, product data, financial data, etc.) is defined.

55
Q

What is data classification?

A

Data classification identifies data categories (ex - public data, internal data, confidential data, or sensitive date) for data protection purposes.

56
Q

What are the data life cycle phases?

A
  1. plan/design
  2. build/acquire
  3. store
  4. use
  5. share
    6 archive/destroy
57
Q

Who is responsible for data governance?

A

First a data governance structure is created to strategically evaluate, direct, and monitor (EDM) data governance activities. Next, a data stewardship structure is set to operationally define roles and responsibilities for data management activities.

  • data owners
  • data stewards
  • data custodians
58
Q

What is a data owner?

A

Data owners make decisions about data as well as their business definitions, ex - forecasting sales using current sales data

59
Q

What is a data steward?

A

Data stewards ensure that data assets are used and adopted properly, ex - ensuring that the sales data used for forecasting are accurate and authorizing who can access the sales data.

60
Q

What is a data custodian?

A

Data custodians ensure the IT controls and safeguards for the data, ex - controlling the storage of the sales data and ensuring that only authorized personnel can access the data

61
Q

What is data democratization?

A

Data democratization is the creation of a self-serviced enterprise-wide platform, which allows permitted users to access the data, facilitates the sharing of data and insights, and provides a single source of reference for searching data.

62
Q

What is the Cybersecurity Framework (CSF)?

A

Created by the U.S. National Institute of Standards and Technology (NIST) the CSF is the Framework for Improving Critical Infrastructure Cybersecurity.

63
Q

What are the 5 functions defined by the CSF to control cyber risk activities and outcomes?

A
  1. identify - understanding of cybersecurity risk management
  2. protect - protection of critical services
  3. detect - detective measures to identify occurrence of cybersecurity breaches
  4. respond - corrective measures to tackle identified breaches
  5. recover - plans to restore services impacted by breaches
64
Q

What are the 4 tiers of management processes in CSF?

A

tier 1 - partial
tier 2 - risk-informed
tier 3 - repeatable
tier 4 - adaptive

65
Q

What is tier 1 - partial - management process?

A
  • cybersecurity management practices are informal and not based on risks
  • awareness of cyber risk is limited
  • processes to enable internal sharing of cybersecurity information may not exist
  • the organization does not collaborate (receive and share) cybersecurity risk-related information with other entities
66
Q

What is tier 2 - risk-informed - management process?

A
  • cybersecurity management practices are informal and not based on risks
  • awareness of cyber risk exists, but the consideration of risk is not at all levels
  • processes to enable internal information sharing are informal
  • the organization receives cybersecurity risk-related information from other entities but may not share such information
67
Q

What is tier 3 - repeatable - management process?

A
  • cybersecurity management practices are established as formal policies
  • awareness of cyber risks exist at all levels of the organization
  • processes to enable internal information sharing are formal
  • the organization receives and shares cybersecurity risk-related information, but not practively
68
Q

What is tier 4 - adaptive - management process?

A
  • cybersecurity management policies are constantly improving to respond to risks promptly
  • awareness of current and evolving cyber risks is incorporated in the organization’s culture
  • information is continuously shared internally
  • the organization collaborates with other entities proactively in real time
69
Q

In the context of COBIT 2019, CSF is implement incrementally in 7 steps, what are the 7 steps?

A
  1. prioritize and scope - identify objectives, roles, and responsibilities - the goals cascade of COBIT 2019 is conducted
  2. orient - understand IT-related factors
  3. create a current profile - access current state using four tiers and CPM
  4. conduct a risk assessment - assess internal and external factors
  5. create a target profile - determine target capacity
  6. determine, analyze, and prioritize gaps - identify gap and plan to close gap
  7. implement action plan - implement the plan

BEC (16 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions