5.0 Governance, Risk, and Compliance Flashcards
What is a managerial security control?
A managerial security control provides the guidance, policies, and procedures for implementing a secure environment, such as an acceptable use policy.
A managerial security control gives oversight of the information system. Examples could include risk identification or a tool allowing the evaluation and selection of other security controls.
Administrative security controls are used to determine behavior through policies, procedures, and guidance. A fair use policy is an example of an administrative control.
What do operational security control refer to??
What can do they do?
Who are they implemented by?
2 Examples of Operational controls?
An operational security control refers to an item that can physically be touched. Operational controls are used to prevent or detect unauthorized access to physical areas, systems, and assets.
An operational security control is implemented primarily by people rather than systems.
For example, security guards and training programs are operational controls rather than technical controls.
What is a technical security control?
A technical security control includes hardware or software mechanisms used to protect assets. Antivirus software, firewalls, and intrusion detection systems are examples of a technical control.
A technical security control is implemented as a system (hardware, software, or firmware). For example, firewalls, anti-virus software, and OS access control models are technical controls.
A technical control is implemented in operating systems, software, and security appliances. An Access Control List (ACL) or intrusion prevention system (IPS) are examples.
What does is a preventive control do?
What are 4 examples?
A preventive control aims to prevent security incidents in a system.
Security training and
change management are examples of a preventive security control.
A preventive control physically or logically restricts unauthorized access. A
system password and
physical door lock are
examples of preventive controls.
What is a detective control?
A detective control will identify and record any attempted or successful intrusion. A detective control operates during the progress of an attack.
A detective control identifies when incidents or vulnerabilities have occurred. Auditing and monitoring are examples of detective controls.
A detective control may not prevent or deter access, but it will identify and record any attempted or successful intrusion. A security camera system is an example of a detective contro
What is a corrective control?
Whats an example?
A corrective control responds to and fixes an incident, and prevents reoccurrence. Antivirus software is an example of a corrective control.
What does a compensating control do?
What’s an example?
A compensating control does not prevent an attack but can restore functionality of systems through other means, such as a backup.
What are Administrative security controls?
Administrative security controls are used to determine behavior through policies, procedures, and guidance. A fair use policy is an example of an administrative control.
What is Containment?
A control type or a step in incident management?
Containment does not refer to a security control type; rather, it refers to a step in the incident management lifecycle for handling a threat.
What is a deterrent control?
A deterrent control may not physically or logically prevent access, but psychologically discourages an attacker from attempting an intrusion. A warning sign is an example of a deterrent control.
Which of the following protection and accountability principles does the General Data Protection Regulation (GDPR) provide to consumers?
Purpose limitation
The General Data Protection Regulation (GDPR) provides consumers with purpose limitation by ensuring organizations must process data that was collected for the explicit purposes specified to the data subject.
Data minimization
A data controller should only collect and process as much data as necessary for the purposes specified. This procedure is considered data minimization.
Integrity and confidentiality
Organizations must process personal data in such a way that it ensures the integrity and confidentiality of the consumers’ information.
What is layered security?
Layered security is the practice of providing prevention, detection, and response simultaneously as defense in depth. It includes multiple forms of security.
Think Antivitus, IDS, Firewall.
Patching isn’t part of layerd security as it’s done once the vulnerabilities are found and fixed.
What is The Payment Card Data Security Standard (PC DSS)?
The Payment Card Data Security Standard (PC DSS) is a set of 12 requirements aimed to ensure companies that process, store, or transmit credit card information maintain a secure environment.
What is The Health Insurance Portability and Accountability Act of 1996 (HIPAA)?
The Health Insurance Portability and Accountability Act of 1996 (HIPAA) mandates that medical facilities and patient representatives protect private health information of an individual.
What is The National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF)?
The National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF) provides a security policy for how private sector organizations can assess and improve their ability to prevent, detect, and respond to cybersecurity attacks
What are Regulatory frameworks based on?
What do regulatory frameworks do?
Regulatory frameworks are based on specific laws and regulations and ensure compliance of those standards. These regulatory frameworks are highly-controlled and regulated. Medical records are governed by regulatory laws, for example.
What does the Federal Information Security Management Act (FISMA) of 2002 dictate?
Who does this apply to?
The Federal Information Security Management Act (FISMA) of 2002 requires federal agencies to develop, document, and implement an information security and protection program. The FISMA is a United States NATIONAL law.
What is a non-regulatory framework?
A non-regulatory framework identifies common standards and best practices that companies can follow but is not required by law.
What is The International Organization for Standardization (ISO)?
The International Organization for Standardization (ISO) is an independent international standard for information technology security. This non-governmental organization develops standards to ensure the quality, safety, and efficiency of systems.
What are Industry-specific frameworks?
Industry-specific frameworks govern certain industries, such as financial and healthcare organizations. The Payment Card Data Security Standard (PC DSS) and Health Insurance Portability and Accountability Act of 1996 (HIPAA) are industry specific.
What does a Service Organization Control (SOC) Type II report do?
A Service Organization Control (SOC) Type II report provides assurances about the effectiveness of controls in place in an organization within a given timeframe.
What does a Service Organization Control (SOC) Type III report do ?
Service Organization Control (SOC) Type III report is not as detailed of a report certifying compliance with SOC2.
What is the International Organization for Standardization (ISO) 27701?
The International Organization for Standardization (ISO) 27701 provides specific requirements and guidance for establishing, implementing, maintaining, and continually improving an information system containing private data.
What does a A Service Organization Control (SOC) Type I report do?
A Service Organization Control (SOC) Type I report addresses internal controls over financial reporting.
What is The Center for Internet Security (CIS) Risk Assessment Method (CIS-RAM)?
The Center for Internet Security (CIS) publishes the “20 CIS Controls.” The Risk Assessment Method (CIS-RAM) can be used to perform an overall evaluation of security posture.
What does the Department of Defense Cyber Exchange do?
Department of Defense Cyber Exchange provides Security Technical Implementation Guides (STIGs) with hardening guidelines for a variety of software and hardware solutions.
What is the National Checklist Program (NCP)?
National Checklist Program (NCP), by the National Institute of Standards and Technology (NIST), provides checklists and benchmarks for a variety of operating systems and applications.
What is The Center for Internet Security Configuration Access Tool (CIS-CAT)?
The Center for Internet Security Configuration Access Tool (CIS-CAT) can be used with automated vulnerability scanners to test compliance against these benchmarks
What is The European Union’s General Data Protection Regulation (GDPR)?
The European Union’s General Data Protection Regulation (GDPR) states that personal data cannot be collected, processed, or retained without the individual’s informed consent. Informed consent means that the data must be collected and processed only for the stated purpose, and that purpose must be clearly described to the user in plain language, not legalese.
What is The Gramm–Leach–Bliley Act (GLBA)?
The Gramm–Leach–Bliley Act (GLBA) is a federal law in the United States and is a vertical law for the financial sector.
What is The Sarbanes-Oxley Act (SOX)?
The Sarbanes-Oxley Act (SOX) mandates the implementation of risk assessments, internal controls, and audit procedures in the United States.
What are the Cloud Controls Matrix?
Who is it produced by?
What does it mean for cloud customers?
The not-for-profit organization Cloud Security Alliance (CSA) produces various resources to assist cloud service providers (CSP) in setting up and delivering secure cloud platforms.
The cloud controls matrix lists specific controls and assessment guidelines that should be implemented by CSPs.
For cloud consumers, the matrix acts as a starting point for cloud contracts and agreements as it provides a baseline level of security competency that the CSP should meet.
What is Security guidance (Coud Enviroments)?
Security guidance is a best practice summary analyzing the unique challenges of cloud environments and how on-premises controls can be adapted to them.
What is Enterprise reference architecture?
Enterprise reference architecture are best practice methodology and tools for CSPs to use in architecting cloud solutions.
What is The Statements on Standards for Attestation Engagements (SSAE)?
The Statements on Standards for Attestation Engagements (SSAE) are audit specifications developed by the American Institute of Certified Public Accountants (AICPA).
The Cloud Security Alliance Cloud Controls Matrix (CSA CCM) maps to which of the following compliance standard
SOX
The Sarbanes-Oxley (SOX) Act helps to protect investors from fraudulent financial reporting by large corporations. It maps to CSA CCM.
ISO
The International Organization for Standardization (ISO) is an international standard for information technology security. It maps to CSA CCM.
NIST
The National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF) provides a security policy for how private sector organizations can assess and improve their ability to prevent, detect, and respond to cybersecurity attacks. It maps to CSA CCM.
The Statements on Standards for Attestation Engagements (SSAE) is an audit specification guide developed for accountants. It does not map to CSA CCM.
What does International Organization for Standardization (ISO) 27701 do?
International Organization for Standardization (ISO) 27001 is a standard that sets out the best practice specification for an information system. The ISO guides information security by addressing people and processes as well as technology.
International Organization for Standardization (ISO) 27701 provides specific requirements and guidance for establishing, implementing, maintaining, and continually improving an information system with private data.
What does International Organization for Standardization (ISO) 31000 do?
International Organization for Standardization (ISO) 31000 is a risk management framework that assists an organization in integrating risk management into day to day functions.
Whatr is the International Organization for Standardization (ISO) 27001 do ?
What does it address?
International Organization for Standardization (ISO) 27001 is a standard that sets out the best practice specification for an information system.
The ISO guides information security by addressing people and processes as well as technology.
What does International Organization for Standardization (ISO) 27002 do?
International Organization for Standardization (ISO) 27002 is a supplementary standard that focuses on the information security controls that organizations might choose to implement.
Which classifications of data does Health Insurance Portability And Accountability Act (HIPAA) protect?
Personal health information (PHI) is personally identifiable information about an individual’s health and medical wellbeing.
Personally identifiable information (PII) is personal information that can be used to identify an individual. A social security number and health information are considered PII.
No confidential!
What is an impact assessment?
An impact assessment identifies risks and vulnerabilities and the potential impact they could cause an organization or information technology asset.
The assessment further identifies methods to limit or mitigate the risks.
What is a quantitative risk assessment?
A quantitative risk assessment measures risks in a program using a specific dollar amount to identify cost and asset value.
What is a qualitative risk assessment?
A qualitative risk assessment prioritizes identified risks based on their probability or likelihood of occurring.
What is a service level agreement (SLA)?
A service level agreement (SLA) is a contractual arrangement that details terms under which a service is provided between a service provider and a consumer.
What is a Data Processor?
A data processor collects and analyzes data based on a data collector’s set of predefined instructions.
What is a data custodian?
The data custodian manages a system on which the data assets are stored by enforcing access control, encryption, and backup measures. A data owner is an individual who is accountable for all data assets in an organization.
