A1 Flashcards
What are the three objective groups under COSO and what do they do?
- Compliance objectives
based on adherence to governmental laws and compliance regulations. As it relates to cybersecurity, this includes compliance with industry standards such as NIST, HIPPA, and GDR. - Operating objectives
They focus on the effectiveness and efficiency of business operations.
Include performance measures and safeguards that can help increase the likelihood that an organization’s IT assets are protected against cybersecurity threats and fraud. - Reporting objectives\
focus on transparency, reliability, timeliness, and trustworthiness as determined by standard setting bodies, regulators, and an organization’s own policies.
Increasing the likelihood that cybersecurity controls are in place so that they do not affect internal and external financial and non-financial reporting.
What does a VPN do?
Provides an encrypted communication tunnel across the internet that allows remote users secure access to a network.
What does a Pocket Switch network do?
Allows transmission of data across a shared network and not the internet.
What is digital inscription?
The broad idea of encoding a message and not really the specifics through where the information is being transmitted.
What is Need to Know?
Only given what they must know for the job.
Focuses on data needed to perform a job.
What is Least Privilege?
Minimal authority is given.
The applications needed to perform the job.
What does NIST do?
Establish a zero-trust network.
What is a digital signature?
Not very protective.
Electronic stamp of authentication that is usually encrypted and attached to a message.
What are biometrics?
No Voice authentication!!
The use of human physical characteristics or impressions (Fasce recognition or fingerprints)
What is a token?
A Form of multifactor authentication where the token is what gives you that secondary PIN.
What is context-aware authentication?
Identifies devise’s location, time of access, and IP location so that people can’t access data outside of the company.
What is a digital Certificate?
A form of verification that works almost like a passport of license set up by the organization.
What is Batch Processing?
Not a form of access control or denial just an information processor.
Batch processing procedures include collection and grouping of input documents/transactions by type of transaction.
What is the Defense-in-depth cybersecurity strategy?
Focuses on multilayer security containing more than one for of authentication not just technological but physical as well.
What does the Identify NIST cybersecurity framework function do?
Supports the location and identification of vulnerabilities in a system.
