Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Cyber Security > Chapter 1 - Information Assurance, Risk Management, Security Controls, Governance, Ethics > Flashcards

Chapter 1 - Information Assurance, Risk Management, Security Controls, Governance, Ethics Flashcards

1
Q

What does CIA stand for?

A

Confidentiality
Integrity
Availability

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What types of environment does the CIA triad apply to? (Name two.)

A

Logical
Physical

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Confidentiality means…

A

Data should only be available to authorised parties.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Integrity means…

A

The data must be correct, whole, and not in any way corrupted.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Availability means…

A

The data must be available to authorised users when it is required.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Give an example of how we protect Confidentiality.

A

Physical example: locks, perimeters, safes.

Technical/logical: encryption, usernames, passwords, access controls, file permissions, authentication.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

The technical realm is also called the …

A

Logical realm

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Why is Integrity important?

A

We want to ensure that files are managed and authorised. We need to make sure a file is not accidentally changed or corrupted, or changed maliciously by a threat actor.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What technical control can be used to protect Integrity?

A

Hashing- this adds a fingerprint to a file.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

In the physical world, what can help protect Availability?

A

A back-up generator which keeps the electricity supply going if the main supply has gone down.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Name the three types of Security Controls

A

Physical
Technical
Administrative

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Give an example of a Physical Control…

A

Physical hardware devices, e.g badge-readers, lift passes

Architectural features of buildings and facilities that address process-based security needs.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Give an example of a technical/logical control…

A

Security controls that computer systems and networks directly implement.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Give an example of an administrative control…

A

Directives
Guidelines
Policies
Procedures

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

How do you calculate the level of risk?

A

Probability + Impact = Level of Risk

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What is an Asset?

A

Anything of value that is owned by an organisation. Includes information systems and physical property and intellectual property.

Data is an asset, as is a laptop or a mobile phone.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What is a baseline?

A

A documented, lowest level of security configuration allowed by a standard or organisation.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What is biometric data?

A

The biological characteristics of an individual, such as a fingerprint, hand geometry, voice or iris patterns.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What is encryption?

A

The process and act of converting plain text to ciphertext. Sometimes called enciphering

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Define Governance

A

The process of how an organisation is managed - e.g. how decisions are made, and what policies, roles and procedures are used to make those decisions

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Define Impact

A

The magnitude of harm that could be caused by a threat’s exploitation of a vulnerability.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Define Multi-Factor Authentication

A

When you use two or more distinct instances of the three factors of authentication (something you know, something you have, something you are) for identity verification

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

What is Non-Repudiation?

A

The inability to deny taking an action such as creating information, modifying it, approving information or sending/receiving a message.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

What is NIST?

A

Part of the US Dept of Commerce. It addresses the measurement infrastructure within science and technology efforts within the US federal government. It sets standards in various areas, including information security within the Computer Security Resource Center of the Computer Security Divisions.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

What is Privacy?

A

The right of an individual to control the distribution of information about themselves.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

What is Risk?

A

A possible event which can have a negative impact on an organisation.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

What is Risk Management?

A

The process of identifying,evaluating and controlling threats, including all the phases of risk context (or frame), risk assessment, risk treatment and risk monitoring.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

What is a Risk Management Framework?

A

A structured approach used to oversee and manage risk for an enterprise.

29
Q

Define Risk Acceptance

A

When the potential benefits of a business function outweigh the possible risk impact/likelihood, meaning the business function continues with no other action to reduce the risk.

This risk is within tolerance.

30
Q

What is Risk Mitigation?

A

This is when controls are put in place to reduce the risk level/likelihood.

31
Q

What is Risk Avoidance?

A

When the impact/likelihood of a particular risk is too great to be offset by the potential benefits, meaning that a particular business function cannot be performed.

32
Q

What is Risk Transference?

A

When an external party (e.g. insurers) are paid to accept the financial impact of a given risk.

33
Q

What is Risk Treatment?

A

The determination of the best way to address an identified risk.

34
Q

Define Sensitivity.

A

A measure of the level of importance assigned to information by its owner (e.g. Classification) in order to determine the level of protection needed.

35
Q

What is a Threat Actor?

A

An individual or entity that attempts to exploit vulnerabilities to cause or force a threat to occur.

36
Q

What is a Threat Vector?

A

This is how a threat actor carries our their objectives.

37
Q

What is a Vulnerability?

A

Thus is a weakness in an information system, system security procedures, internal controls or implementation that could be exploited by a threat source. See NIST SP800-30 Rev 1.

38
Q

What is a Token?

A

A physical object a user possesses that is used to authenticate their identity, e.g. an HSBC secure code device.

39
Q

What are Technical Controls?

A

These are security controls for an information system that are usually implemented and executed by the information system through mechanisms contained in the hard-ware, software or firmware.

40
Q

Define Risk Tolerance.

A

The level of risk an organisation is willing to assume in order to achieve a desired result. Risk threshold, Risk appetite and acceptable risk are synonymous terms.

41
Q

The use of biometrics and a password is an example of what?

A

Multi-Factor Authentication (something you are & something you know)

42
Q

Give two examples of “something you know” commonly used for MFA.

A

Pin-code
Password

43
Q

Give examples of “something you are” for MFA purposes.

A

Iris recognition (your iris pattern is individual)
Fingerprint
Voice
Facial recognition
Retinal scanning

44
Q

What concerns are there regarding the use of biometrics?

A

Throughput (how long do they take to work, and is this practical if large umber need to be processed swiftly.

Privacy concerns and acceptability. Is this data adequately protected? Could it be used against you?

45
Q

We would use MFA when?

A

When a higher level of assurance is required.

46
Q

If your bank asks you for a username, some digits from a pass code and a password, is this MFA?

A

No. It’s single-factor authentication . They are three separate bits of information, but they are all of the same type (something you know).

47
Q

If you use MFA and one of those factors is compromised, what does this mean?

A

That they can’t access your account. The threat actor would need both pieces of assurance.

48
Q

Is a one-time password single-factor or multi?

A

Single-factor only, but may also be used in conjunction with other processes to complement the MFA process.

49
Q

Three concerns regarding the use of biometrics are…

A

Throughput
Acceptability
Accuracy

50
Q

What does FRR stand for?

A

False Rejection Rate.

How likely or fast a system is likely to reject a valid login attempt. How often a legitimate attempt is declined.

51
Q

What does FAR stand for?

A

False Acceptance Rate.

How likely it is for someone with the wrong details to sign in. Think of brute force attacks, risky logins, etc.

52
Q

It is important to consider at the design stage the — and the —? This is normally balanced in the middle and is determined by risk appetite.

A

FAR - False Acceptance Rate
FRR - False Rejection Rate

53
Q

Repudiate means…

A

Deny

54
Q

Why is non-repudiation important?

A

You need to trust that when a transaction takes place, it is the right individual and that they can’t deny having done it.

55
Q

The United Declaration of Human Rights Article 12, says…

A

Gist: Everyone has the right to privacy.

UN classes privacy as a human right. Technology has always been intertwined with this right. Technology has boosted the visibility of privacy issues.

56
Q

Administrative controls comprise (name three)…

A

Directives
Guidelines
Advisories

57
Q

Define Authorization

A

The right or a permission that is granted to a system entity to access a system resource. NIST 800-82 Rev.2

58
Q

What is a Bot?

A

Malicious code that acts like a remotely controlled “robot” for an attacker, with other worm or Trojan capabilities.

59
Q

What is HIPAA?

A

Health and Insurance Portability and Accountability Act (U.S. Federal Law) concerned with the adoption of national standards for electronic health care transactions whilst protecting privacy.

60
Q

Define Impact

A

The magnitude of harm that could be caused by a threat’s exercise of a vulnerability

61
Q

What does ISO stand for?

A

International Organisatiob of Standards

62
Q

What is the IETF?

A

Internet Engineering Task Force

63
Q

Define Likelihood

A

The probability that a potential vulnerability may be exercised within the construct of the associated threat.

64
Q

What does NIST stand for?

A

National Institute of Standards and Technology

65
Q

What is Risk Transference?

A

Paying an external party to accept the financial kmoact of a risk.

66
Q

What is a Threat Vector?

A

The means by which a threat actor carries out their objectives.

67
Q

What is a Threat Actor?

A

An individual or a group that attempts to exploit vulnerabilities to cause of force a threat to occur.

68
Q

What is a Token?

A

A physical object a user possesses and controls that is used to authenticate the user’s identity.

Cyber Security (1 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions