Chapter 1: Controls

Question 1

Prevents the disclosure of data to unauthorized people so that authorized people have access to data (CIA Triad)

Answer 1

Confidentiality

Question 2

you know the data has not been altered or tampered with. (CIA Triad)

Answer 2

Integrity

Question 3

Data is always available; example is RAID (CIA Triad)

Answer 3

Availability

Question 4

where you give someone only the most limited access required

Answer 4

Least Privilege

Question 5

Concept of protecting a company’s data with a series of protective layers so that if one layer fails another layer will already be in place to thwart attack

Answer 5

Defense in Depth

Question 6

Written by managers to create organizational policies and procedure to reduce risk within companies; annual risk assessments/penetration testing vulnerability scanning (Control Type)

Answer 6

Managerial Control

Question 7

Executed by company personnel during their day to day operations; annual security awareness training/change management/business continuity plan; (Control Type)

Answer 7

Operational Control

Question 8

Those implemented by IT team to reduce the risk to the business; firewall rules/antivirus/screensavers/IDS/IPS (Control Type)

Answer 8

Technical Controls

Question 9

CCTV and Motion Sensors (Control Type)

Answer 9

Deterrent Controls

Question 10

Used to investigate and incident that has happened and needs to be investigated (Control Type)

Answer 10

Detective Controls

Question 11

The actions you take to recover from an incident; file suppression systems-fire destroyed data (Control Type)

Answer 11

Corrective Controls

Question 12

Can be used instead of a primary control that has failed or is not available; use a credit card when all cash is gone (Control Type)

Answer 12

Compensating Controls

Question 13

Are in place to deter any attack; could be having a security guard with a large dog whaling around the perimeter of building (Control Type)

Answer 13

Preventative Controls

Question 14

The user is only given the access needed to perform their job; also known as user based. (Type of Access Control)

Answer 14

Discretionary Access Control

Question 15

Based on the classification level of the data-looks at how much damage could be inflicted to the interests of the nation; Top Secret/Secret/Confidential (Type of Access Control)

Answer 15

Mandatory Access Control

Question 16

subset of the department carrying out a subset of duties within a department; example would be two people within the finance department who only handle petty cash (type of Access Control)

Answer 16

Role Based Access Control (RBAC)

Question 17

a rule is applied to all the people within a department; contractors only have access between 8am and 5 pm (type of access control)

Answer 17

Rule-Based Access Control

Question 18

access is restricted based on an attribute in the account; John could be an executive and some data could be restricted to those with only the executive attribute (type of access control)

Answer 18

Attribute Based Access Control

Question 19

people may be put into groups to simplify access (type of access control)

Answer 19

Group-Based Access Control

Question 20

Signage/Fences/Visitor Logs/Badges/Lighting/Cameras/Robot Sentries (type of physical control)

Answer 20

Perimeter

Question 21

Security guards/key management/mantraps/proximity cards/tokens/biometric locks/electronic locks/burglar alarms/fire alarms/conduits/environmental controls; (type of physical control)

Answer 21

Building Security

Question 22

Cable Locks/Air gap/laptop safe/usb data blocker/vault/faraday cage; (type of physical control)

Answer 22

Device Protection

Question 23

Steps in the Digital Forensic Cycle

Answer 23

Collection–>Examination–>Analysis–>Reporting

Question 24

the data is examined; then extracted from the media that is on it, and then converted into a format that can be examined by forensic tools

Answer 24

Collection

Question 25

prior to this the data will be hashed and then an investigation will be carried out with the relevant forensic tools

Answer 25

Examination

Question 26

When all of the forensic data has been collected it is _____ and transformed into information that can be used as evidence

Answer 26

Analysis

Question 27

a report is compiled that can be used as evidence for a conviction

Answer 27

Reporting

Question 28

is collecting the most perishable evidence first. In a web based attack, we should collect the network traffic with a packet sniffer

Answer 28

Order of Volatility

Question 29

Cloud Service Providers may be subpoenaed so that we can collect, review, and interpret electronic documents located on hard disks, USB drives, and other forms of storage

Answer 29

E-Discovery

Question 30

Lists the evidence and who has handled it along the way.

Answer 30

Chain of Custody

Question 31

when the chain of custody has been carried out properly and the original data presented to the court has not been tampered with

Answer 31

Provenance

Question 32

is the process of protecting any documents that can be used in evidence from being altered or destroyed.

Answer 32

Legal Hold