Ch2 Flashcards
Define privacy
- active prevention of unauthorized access to information that can be directly linked to a person or organization
- freedom from unauthorized access to information deemed personal or confidential
- freedom from being observed, monitored or examined without consent or knowledge
what information is considered PII
- name
- SSN
- phone number
- mailing address
- email address
- Date of Birth
- Place of Birth
- biometric records
- mother’s maiden name
- medical, educational, financial & employment info
What is NCA
Non-compete Agreement - prevent an employee with special knowledge of secrets from one organization from working in a competing organization in order
to prevent that second organization from benef ting from the worker’s special knowledge
of secrets.
Are personal items considered a company asset
No - such as personal files on company computer
vulnerability
weakness or absence of an asset or safeguard or countermeasure
Delphi Technique
anonymous feedback and response process
define Total Risk
amount of risk an organization would have if no safeguards were implemented
total risk formula
threats * vulnerabilities * asset value = total risk
define residual risk
amount of risk remaining after safeguards were implemented that is assumed by management
what is the difference between total risk and residual risk
controls gap - amount of risk reduced by implementing safeguards
residual risk formula
total risk - controls gap = residual risk
countermeasures
- directly affect the ARO
- countermeasure is designed to prevent/reduce the occurrence of the risk, which reduces the frequency per year
What is the clearest and most direct example of management of the security function to drive the security policy.
Risk Assessment
Risk Management Framework
■ Categorize the information system and the information processed, stored, and
transmitted by that system based on an impact analysis.
■ Select an initial set of baseline security controls for the information system based on
the security categorization; tailoring and supplementing the security control baseline as needed based on an organizational assessment of risk and local conditions.
■ Implement the security controls and describe how the controls are employed
within the information system and its environment of operation.
■ Assess the security controls using appropriate assessment procedures to
determine the extent to which the controls are implemented correctly,
operating as intended, and producing the desired outcome with respect to
meeting the security requirements for the system.
■ Authorize information system operation based on a determination of the risk
to organizational operations and assets, individuals, other organizations, and
the Nation resulting from the operation of the information system and the
decision that this risk is acceptable.
■ Monitor the security controls in the information system on an ongoing
basis including assessing control effectiveness, documenting changes to the
system or its environment of operation, conducting security impact analyses
of the associated changes, and reporting the security state of the system to
designated organizational officials.”
Deterrent access control
- discourage violation of security policies
- depend on individuals deciding not to take an unwanted action
- examples include policies, security-awareness training, locks, fences, security badges, guards, mantraps, and security cameras
Preventive access control
- thwart or stop unwanted or unauthorized activity
from occurring - Examples of preventive access controls include fences, locks, biometrics,mantraps, lighting, alarm systems, separation of duties, job rotation, data classifcation,penetration testing, access-control methods, encryption, auditing, presence of security cameras or CCTV, smartcards, callback procedures, security policies, security-awareness training, antivirus software, frewalls, and intrusion prevention systems (IPSs)
Detective access control
- discover or detect unwanted or unauthorized activity
- operate after the fact and can discover the activity only after it has occurred
- Examples of detective access controls include security guards, motion detectors,recording and reviewing of events captured by security cameras or CCTV, job rotation,mandatory vacations, audit trails, honeypots or honeynets, IDSs, violation reports, supervision and reviews of users, and incident investigations.
Compensating access control
- provide various options to other existing
controls to aid in enforcement and support of security policies - any controls used in addition to, or in place of, another control
Corrective access control
- modifies the environment to return systems to normal after an unwanted or unauthorized activity has occurred
- repair or restore resources, functions, and capabilities after a violation of security policies.
- attempts to correct any problems that occurred as a result of a security incident
- terminating malicious activity, rebooting a system, antivirus solutions that can remove or quarantine a virus, backup and restore plans to ensure that lost data can be restored, and active IDS that can modify the environment to stop an attack in progress.
Recovery access control
- extension of corrective controls but have more advanced or complex abilities
- Examples of recovery access controls include backups and restores, faulttolerant drive systems, system imaging, server clustering, antivirus software, and database or virtual machine shadowing
Directive access control
- to direct, confne, or control the actions of subjects
to force or encourage compliance with security policies - Examples of directive access controls include security policy requirements or criteria, posted notifications, escape route exit signs, monitoring, supervision, and procedures.
Administrative access control
- policies and procedures def ned by an organization’s security policy and other regulations or requirements
- Examples of administrative access controls include policies, procedures, hiring practices, background checks, data classifcations and labeling, security awareness and training efforts, vacation
history, reports and reviews, work supervision, personnel controls, and testing
Physical access controls
- items you can physically touch
- Examples of physical access controls include guards, fences, motion detectors,
locked doors, sealed windows, lights, cable protection, laptop locks, badges, swipe cards, guard dogs, video cameras, mantraps, and alarms.
Technical access controls
- hardware or software mechanisms used to manage access and to provide protection for resources and systems
- Examples of logical or technical access controls include authentication methods (such as usernames, passwords, smartcards, and biometrics), encryption, constrained interfaces, access
control lists, protocols, firewalls, routers, intrusion detection systems (IDSs), and clipping levels
