9. Security

Question 1

Confidentiality =

Answer 1

Permitting authorized access while protecting information and resources from improper disclosure

Question 2

Confidentiality - 5 main threats

Answer 2

Snooping; Dumpster Diving; Eavesdropping; Wiretapping (electronic eavesdropping - use encryption); Social Engineering

Question 3

Integrity =

Answer 3

protecting against unauthorized changes to information

Question 4

Integrity - 4 main types of attacks

Answer 4

Unauthorized modification; Impersonation; Man in the Middle; Replay

Question 5

Availability

Answer 5

Insuring systems and information are accessible by authorized users when they need access

Question 6

Availability - 5 main types of disruptions

Answer 6

DDoS; Power Outages; Hardware Failures; Destruction of Equipment; Service Outages

Question 7

Device Security - 5 ways to protect

Answer 7

Anti-virus software; Host Firewalls; Passwords/MFA; Security Updates; secure browsing

Question 8

3 Main privacy concerns

Answer 8

protecting our own data; educating our users; protecting data collected by our organization

Question 9

2 Common types of private information

Answer 9

PHI and PII

Question 10

PII =

Answer 10

all information that can be tied back to a specific individual

Question 11

PHI =

Answer 11

health care records regulated under HIPPA

Question 12

Security Policy Framework - 4 types of documents

Answer 12

policies (mandatory); standards (mandatory); Guidelines (optional); procedures

Question 13

3 elements of access control

Answer 13

Identification; authentication; authorization

Question 14

Identification (access control)

Answer 14

Individual makes a claim of their identity (username)

Question 15

Authentication (access control)

Answer 15

proving a claim of identity (password/mfa)

Question 16

Authorization (access control)

Answer 16

verifying that the user is allowed access (regulating specific access and permissions)

Question 17

Security Policy Framework (4 different types of documents)

Answer 17

Policies, Standards, Guidelines, Proceedures

Question 18

3 Steps for Access Control

Answer 18

Identification; Authentication; Authorization

Question 19

3 Types of access control systems

Answer 19

Mandatory Access Control (MAC) - OS; Discretionary Access Control (DAC) - xrw; Role-based Access Control - job-based roles/permissions

Question 20

Account Types (5)

Answer 20

User; System Administrator; Guest; Shared/Generic; Service

Question 21

2 different environments for encryption

Answer 21

Data at rest; Data in transit

Question 22

Business continuity scope (3)

Answer 22

Activities covered; systems covered; controls implemented

Question 23

Tools to remediate availability (2):

Answer 23

Redundancy (duplication of data); Fault tolerance (automatic failover)