Ch3

Question 1

Audit

Answer 1

Independent review and examination of records and activities to assess the adequacy of system controls, to ensure compliance with established policies and operational procedures. NIST SP 1800-15B

Question 2

Crime Prevention through Environmental Design (CPTED)

Answer 2

An architectural approach to the design of buildings and spaces which emphasizes passive features to reduce the likelihood of criminal activity.

Question 3

Defense in Depth

Answer 3

Information security strategy integrating people, technology, and operations capabilities to establish variable barriers across multiple layers and missions of the organization. Source: NIST SP 800-53 Rev 4

Question 4

Discretionary Access Control (DAC)

Answer 4

A certain amount of access control is left to the discretion of the object’s owner, or anyone else who is authorized to control the object’s access. The owner can determine who should have access rights to an object and what those rights should be. NIST SP 800-192

Question 5

Encrypt

Answer 5

To protect private information by putting it into a form that can only be read by people who have permission to do so.

Question 6

Firewalls

Answer 6

Devices that enforce administrative security policies by filtering incoming traffic based on a set of rules.

Question 7

Insider Threat

Answer 7

An entity with authorized access that has the potential to harm an information system through destruction, disclosure, modification of data, and/or denial of service. NIST SP 800-32

Question 8

iOS

Answer 8

An operating system manufactured by Apple Inc. Used for mobile devices.

Question 9

Layered Defense

Answer 9

The use of multiple controls arranged in series to provide several consecutive controls to protect an asset; also called defense in depth.

Question 10

Linux

Answer 10

An operating system that is open source, making its source code legally available to end users.

Question 11

Log Anomaly

Answer 11

A system irregularity that is identified when studying log entries which could represent events of interest for further surveillance.

Question 12

Logging

Answer 12

Collecting and storing user activities in a log, which is a record of the events occurring within an organization’s systems and networks. NIST SP 1800-25B.

Question 13

Logical Access Control Systems

Answer 13

An automated system that controls an individual’s ability to access one or more computer system resources, such as a workstation, network, application or database. A logical access control system requires the validation of an individual’s identity through some mechanism, such as a PIN, card, biometric or other token. It has the capability to assign different access privileges to different individuals depending on their roles and responsibilities in an organization. NIST SP 800-53 Rev.5.

Question 14

Mandatory Access Control

Answer 14

1. Access control that requires the system itself to manage access controls in accordance with the organization’s security policies.
2. A means of restricting access to system resources based on the sensitivity (as represented by a label) of the information contained in the system resource and the formal authorization (i.e., clearance) of users to access information of such sensitivity.
   Source(s): NIST SP 800-44 Version 2 under Mandatory Access Control

Question 15

Mantrap

Answer 15

An entrance to a building or an area that requires people to pass through two doors with only one door opened at a time.

Question 16

Object

Answer 16

Passive information system-related entity (e.g., devices, files, records, tables, processes, programs, domains) containing or receiving information. Access to an object (by a subject) implies access to the information it contains. See subject. Source: NIST SP 800-53 Rev 4

Question 17

Physical Access Controls

Answer 17

Controls implemented through a tangible mechanism. Examples include walls, fences, guards, locks, etc. In modern organizations, many physical control systems are linked to technical/logical systems, such as badge readers connected to door locks.

Question 18

Principle of Least Privilege

Answer 18

The principle that users and programs should have only the minimum privileges necessary to complete their tasks. NIST SP 800-179

Question 19

Privileged Account

Answer 19

An information system account with approved authorizations of a privileged user. NIST SP 800-53 Rev. 4

Question 20

Ransomware

Answer 20

A type of malicious software that locks the computer screen or files, thus preventing or limiting a user from accessing their system and data until money is paid.

Question 21

Role-based access control (RBAC)

Answer 21

An access control system that sets up user permissions based on roles.

Question 22

Rule

Answer 22

An instruction developed to allow or deny access to a system by comparing the validated identity of the subject to an access control list.

Question 23

Segregation of Duties

Answer 23

The practice of ensuring that an organizational process cannot be completed by a single person; forces collusion as a means to reduce insider threats. Also commonly known as Separation of Duties.

Question 24

Subject

Answer 24

Generally an individual, process or device causing information to flow among objects or change to the system state. Source: NIST SP800-53 R4

Question 25

Technical Controls

Answer 25

The security controls (i.e., safeguards or countermeasures) for an information system that are primarily implemented and executed by the information system through mechanisms contained in the hardware, software or firmware components of the system.

Question 26

Turnstile

Answer 26

A one-way spinning door or barrier that allows only one person at a time to enter a building or pass through an area.

Question 27

Unix

Answer 27

An operating system used in software development.

Question 28

User Provisioning

Answer 28

The process of creating, maintaining and deactivating user identities on a system.