Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CISSP - All-in-One > Chapter 1: Security and Risk Management > Flashcards

Chapter 1: Security and Risk Management Flashcards

1
Q

What is CIA triad?

A

It’s an acronym that means confidentiality, integrity, and availability.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What HVAC stands for?

A

Heating, ventilation, and air conditioning

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What is Availability protection ensure?

A

Availability protection ensures reliability and timely access to data and resources to authorized individuals.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What does integrity guarantee from a security point of view?

A

Integrity is upheld when the assurance of the accuracy and reliability of information and systems is provided and any unauthorized modification is prevented.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What is Confidentiality protection ensure?

A

Confidentiality ensures that the necessary level of secrecy is enforced at each junction of data processing and prevents unauthorized disclosure.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Six examples of Integrity

A

Hashing (data integrity)

Configuration management (system integrity)

Change control (process integrity)

Access control (physical and technical)

Software digital signing

Transmission cyclic redundancy check (CRC) functions

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What is a Vulnerability?

A

A vulnerability is a weakness in a system that allows a threat source to compromise its security

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What is a Threat?

A

A threat is any potential danger that is associated with the exploitation of a vulnerability

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What is a Risk?

A

A risk is the likelihood of a threat source exploiting a vulnerability and the corresponding business impact.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What is an Exposure?

A

An exposure is an instance of being exposed to losses.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What is an Administrative Control?

A

Commonly referred to as “soft controls”, like security documentation, risk management, personnel security, and training.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What is a Technical Control?

A

Also called logical controls, they are software or hardware components, as in firewalls, IDS, encryption, and identification and authentication mechanisms.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What is a Physical Control?

A

Items put into place to protect facilities, personnel, and resources, like security guards, locks, fencing, and lighting.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What is the functionality of a Preventive Control?

A

Intended to avoid an incident from occurring

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What is the functionality of a Detective Control?

A

Helps identify an incident’s activities and potentially an intruder

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What is the functionality of a Corrective Control?

A

Fixes components or systems after an incident has occurred

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What is the functionality of a Deterrent Control?

A

Intended to discourage a potential attacker

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What is the functionality of a Recovery Control?

A

Intended to bring the environment back to regular operations

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What is the functionality of a Compensating Control?

A

Controls that provide an alternative measure of control

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What type of control are administrative, physical, and technical?

A

They are preventive in nature.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Security Program Development

A

ISO/IEC 27000 series

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Enterprise Architecture Development

A

Zachman Framework, TOGAF, DoDAF, MODAF and SABSA model

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Security Controls Development

A

COBIT 5, NIST SP 800-53 and COSO Internal Control— Integrated Framework

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Process Management Development

A

ITIL, Six Sigma and Capability Maturity Model Integration (CMMI)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

What BS7799 Part 1 outlined?

A

Control objectives and a range of controls that can be used to meet those objectives

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

What BS7799 Part 2 outlined?

A

How a security program (ISMS) can be set up and maintained

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

Why the companies seek for ISO/IEC 27001?

A

Check Information Security Management System (ISMS) requirements and attests to the organization’s compliance level

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

What are the four architecture types that TOGAF framework can develop?

A

Business architecture, Data architecture, Applications architecture and Technology architecture

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

What is the difference between an ISMS and an enterprise security architecture?

A

An ISMS outlines the controls that need to be put into place (risk management, vulnerability management, business continuity planning, data protection, auditing, configuration management, physical security, etc.) and provides direction on how those controls should be managed throughout their life cycle

The enterprise security architecture illustrates how these components are to be integrated into the different layers of the current business environment

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

What Business enablement means?

A

Business enablement means the core business processes are integrated into the security operating model—they are standards based and follow a risk tolerance criteria.

Help the business to achieve their goals but adding security controls to make it work securely.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

What Process enablement means?

A

So while business enablement means “we can do new stuff,” process enhancement means “we can do stuff better.”

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

What Security Effectiveness means?

A

It’s a way to determine how useful the current security solutions and architecture as a whole are performing (using SLA, metrics, ROI…)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

What is the difference between Enterprise and System Architectures
?

A

An enterprise architecture addresses the structure of an organization. A system architecture addresses the structure of software and computing components.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

COBIT five key principles

A

Meeting stakeholder needs

Covering the enterprise end to end

Applying a single integrated framework

Enabling a holistic approach

Separating governance from management

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

What is the different between COSO IC and COBIT?

A

COSO IC deals more at the strategic level, while COBIT focuses more at the operational level

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

What is the different between Polymorphic and Metamorphic malware

A

A polymorphic virus decrypts its code, runs that code, and then when propagating itself encrypts the decrypted code with a different key. A metamorphic virus simply runs its code and then when propagating itself mutates its code into different but functionally identical code

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

What is Data subject?

A

The individual to whom the data pertains

38
Q

What is Data controller?

A

Any organization that collects data on EU residents

39
Q

What is Data processor?

A

Any organization that processes data for a data controller

40
Q

When Criminal law is used?

A

Criminal law is used when an individual’s conduct violates the government laws, which have been developed to protect the public.
Jail sentences are commonly the punishment

41
Q

What do administrative/regulatory laws deal with?

A

Administrative/regulatory law deals with regulatory standards that regulate performance and conduct.

42
Q

What are the two types of Intellectual Property?

A

Industrial property—such as inventions (patents), industrial designs, and trademarks—and copyrighted property, which covers things like literary and artistic works.

43
Q

What Trade Secret protects?

A

Trade secret law protects certain types of information or resources from unauthorized use or disclosure.

A trade secret is something that is proprietary to a company and important for its survival and profitability.

44
Q

What copyright law protects?

A

Copyright law protects the right of the creator of an original work to control the public distribution, reproduction, display, and adaptation of that original work.

45
Q

What trademark law protects?

A

A trademark is used to protect a word, name, symbol, sound, shape, color, or combination of these

46
Q

What is a patent?

A

Patents are given to individuals or companies to grant them legal ownership of, and enable them to exclude others from using or copying, the invention covered by the patent

47
Q

What is a privacy horizontal approach?

A

Rules that stretch across all industry boundaries

48
Q

What is a privacy vertical approach?

A

Defines requirements for specific verticals, such as the financial sector and health care

49
Q

What is PII?

A

Personally identifiable information (PII) is data that can be used to uniquely identify, contact, or locate a single person or can be used with other sources to uniquely identify a single individual.

50
Q

What is privacy?

A

Privacy is an individual’s right to determine what data they would like others to know about themselves, which people are permitted to know that data, and when those people can access it.

51
Q

Federal Privacy Act of 1974

A

Agencies can gather information about individuals, but it must be relevant and necessary to the agency’s official functions. In addition, an agency cannot share people’s private information. If it does, private citizens have the right to sue that agency to protect their privacy.

52
Q

The Federal Information Security Management Act (FISMA)

A

FISMA requires agency program officials, chief information officers, and inspectors general (IGs) to conduct annual reviews of the agency’s information security program and report the results to the Office of Management and Budget (OMB).

53
Q

Health Insurance Portability and Accountability Act (HIPAA)

A

HIPAA outlines how security should be managed for any facility that creates, accesses, shares, or destroys medical information.

54
Q

What REP stands for?

A

Reasonable Expectation of Privacy

55
Q

Ways to deal with Privacy

A

Laws on government FPA, VA ISA, USA PATRIOT

Laws on corporations HIPAA, HITECH, GLBA, PIDEDA

Self-regulation PCI DSS

Individual user Passwords, encryption, awareness

56
Q

What are the three policy types?

A

The organizational security policy provides scope and direction for all future security activities within the organization

An issue-specific policy, also called a functional policy, addresses specific security issues that management feels need more detailed explanation and attention to make sure a comprehensive structure is built and all employees understand how they are to comply with these security issues.

A system-specific policy presents the management’s decisions that are specific to the actual computers, networks, and applications.

57
Q

What is the difference between strategic and tactical goal?

A

A strategic goal can be viewed as the ultimate endpoint, while tactical goals are the steps necessary to achieve it.

58
Q

What is the difference between security policies, standards, procedures, baselines, and guidelines

A

Security policy - Is an overall general statement produced by senior management that dictates what role security plays within the organization.

Standard - Refer to mandatory activities, actions, or rules.

Procedure - Detailed step-by-step tasks that should be performed to achieve a certain goal.

Baseline - Refers to a point in time that is used as a comparison for future changes.

Guideline - Recommended actions and operational guides to users, IT staff, operations staff, and others when a specific standard does not apply.

59
Q

What is risk?

A

Risk is the probability of a threat agent exploiting a vulnerability to cause harm to an asset resulting in a business impact.

60
Q

Types of Risk

A

PHEIMiLoA

Physical Damage
Human Interaction
Equipment Malfunction
Inside and Outside Attacks
Misuse of Data
Loss of Data
Application error
61
Q

What is the purpose of NIST 800-53?

A

Security and Privacy

62
Q

What is the purpose of NIST 800-39?

A

Risk

  • Organizational tier
  • Business process tier
  • Information systems tier
63
Q

What is a Threat?

A

Potential cause of an unwanted incident, which may result in harm to a system or organization

64
Q

What is the difference between risk assessment and risk analysis?

A

Risk assessment is a broader effort, which is reinforced by specific risk analysis tasks as needed.

65
Q

Questions to evaluate a risk

A

What event could occur (threat event)?

What could be the potential impact (risk)?

How often could it happen (frequency)?

What level of confidence do we have in the answers to the first three questions (certainty)?

66
Q

What is the focus area of NIST SP 800-30?

A

Risk assessments

67
Q

What is FRAP?

A

Facilitated Risk Analysis Process is a qualitative methodology focused only on the systems that really need assessing, to reduce costs and time obligations

68
Q

What is OCTAVE?

A

Operationally Critical Threat, Asset, and Vulnerability Evaluation is a methodology that is intended to be used in situations where people manage and direct the risk evaluation for information security within their company

69
Q

What is the focus of AS/NZS ISO 31000 ?

A

This risk methodology is more focused on the health of a company from a business point of view, not security.

70
Q

What is FMEA?

A

Failure Modes and Effect Analysis is a method for determining functions, identifying functional failures, and assessing the causes of failure and their failure effects through a structured process.

71
Q

What is the difference between Risk Assessment and Risk Analysis?

A

Risk assessment is used to gather data. A risk analysis examines the gathered data to produce results that can be acted upon.

72
Q

What SLE stands for?

A

Single loss expectancy (SLE)

Asset Value × Exposure Factor (EF) = SLE

73
Q

What ALE stands for?

A

Annual loss expectancy (ALE)

SLE × Annualized Rate of Occurrence (ARO) = ALE

74
Q

What HVAC stands for?

A

Heating, ventilation, and air conditioning

75
Q

What is the goal of NIST SP 800-161?

A

Supply Chain Risk Management Practices for Federal Information Systems and Organizations

76
Q

What RMF stands for?

A

Risk Management Framework

77
Q

What TTP stands for?

A

Tactics, techniques, and procedures

78
Q

What is the difference between Disaster Recovery, Business Continuity Plan and Business Continuity Management?

A

Disaster recovery is to minimize the effects of a disaster or disruption.
Business continuity plan provides methods and procedures for dealing with longer-term outages and disasters.
Business continuity management is the holistic management process that should cover both of them

79
Q

What are the three pillars of BCM?

A

Availability, Reliability and Recoverability

80
Q

What is the NIST SP 800-34 attached to?

A

Contingency Planning Guide for Federal Information Systems

81
Q

What MDT stands for?

A

Maximum Downtime Tolerable

82
Q

Who should be part of the BCP committee?

A

Business units, Senior management, IT department, Security department, Communications department, Legal department

83
Q

What SWOT stands for?

A

Strengths/Weaknesses (internal)

Opportunities/Threats (external)

84
Q

What is due diligence?

A

Do everything in our power to prevent something bad from happening.

85
Q

What is due care?

A

Taking the precautions that a reasonable and competent person would take in the same situation.

86
Q

Which threats BPC should identify?

A

Maximum tolerable downtime and disruption for activities

Operational disruption and productivity

Financial considerations

Regulatory responsibilities

Reputation

87
Q

What is the equation of Risk?

A

Risk = Threat × Impact × Probability

Could add time

88
Q

what can be a threat?

A

Threats can be manmade, natural, or technical

89
Q

What MPTD stands for?

A

Maximum Period Time of Disruption

90
Q

How RFC 1087 is called?

A

Ethics and the Internet

This RFC outlines the concepts pertaining to what the IAB considers unethical and unacceptable behavior

CISSP - All-in-One (2 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions