Chapter 1

Question 1

AAA

Answer 1

Identification
Authentication
Authorization
Auditing
Accounting

Question 2

Security Management Planning

Answer 2

Strategic plan - long term 5 years
Tactical plan - 1 year
Operational plan - detailed short-term to support strategic and tactical plans

Question 3

Most important to do for organization, hardware, software, service acquisition

Answer 3

Identify risks

Question 4

Security roles (CISSP)

Answer 4

Senior management (approve policy)
Security professional (write policy and implement)
Asset owner (responsible for protection; security classifications)
Custodian (day to day protection activities)
User
Auditor

Question 5

COBIT
- security framework reference
- used for auditing

Answer 5

Provide Stakeholder Value
Holistic Approach
Dynamic Governance System
Governance Distinct from Management
Tailored to Enterprise Needs
End-to-End Governance System

Question 6

Due Diligence - planning
Due Care - implementing

Answer 6

Senior management - show due diligence and due care

Question 7

Documentation review

Answer 7

For gov’t agencies
ATO

Question 8

Security Management Plan:
Policy, Standards, Procedures, Guidelines

Answer 8

Policy - scope
Standards - support policy
Baseline - minimum level of security for all assets, systems, etc. must meet
Procedures - satisfy standards
Guidelines - recommendations only

Question 9

Threat Modeling
- Identify
- Categorize
- Analyze

Answer 9

STRIDE - Microsoft, s/w development, threat categorization
PASTA - risk centric around value of assets
VAL - for agile development

Question 10

STRIDE

Answer 10

Spoof
Tampering
Repudiation
Info disclosure
Denial of service
Elevation of privilege

Question 11

PASTA
(Threat modeling)

Answer 11

7 stages:
Stage I: Definition of the Objectives (DO) for the Analysis of Risks
Stage II: Definition of the Technical Scope (DTS)
Stage III: Application Decomposition and Analysis (ADA)
Stage IV: Threat Analysis (TA)
Stage V: Weakness and Vulnerability Analysis (WVA)
Stage VI: Attack Modeling & Simulation (AMS)
Stage VII: Risk Analysis & Management (RAM)

Question 12

Reduction analysis or decomposition of system

Answer 12

Diagram that shows:
Trust boundaries
Data flow
Input points
Privilege operations
Security policy

Question 13

Threat modeling - Focus on threats
Risk assessment - Focus on assets

Question 13

Rank threats (Threat modeling)

Answer 13

Probability x Damage
High/Med/Low Matrix
DREAD

Question 14

DREAD
(Rank threats)

Answer 14

Damage potential
Reproducibility
Exploitability
Affected users
Discoverability