Chapter 1 - Security Fundamentals

Question 1

What does AIC/CIA stand for?

Answer 1

1. Availability
2. Integrity
3. Confidentiality

Question 2

Define Confidentiality in the context of AIC/CIA.

Answer 2

The implementation of Authentication and Access controls as well as Encryption of data to protect against unauthorized disclosure of information.

Question 3

Define Integrity in the context of AIC/CIA.

Answer 3

The implementation of controls that prevent unauthorized or unwanted modification of data and systems.

Data hashing and audit logging are two methods of verifying data integrity.

Question 4

Define Availability in the context of AIC/CIA.

Answer 4

The implementation of fault tolerance, backups and redundancy to support availability of systems and data as well as provide for recovery in the event of server failure.

Backups, redundant disks, servers, connections and sites all support availability.

Question 5

What is Least Privilege?

Answer 5

Users are granted permissions only to those systems and data they need to perform their job.

Question 6

What is Separation of Duties?

Answer 6

Ensures that no single person has complete control over a process. This can reduce the risk of fraud in an organization.

For example, the approval of an invoice and payment of an invoice would belong to two different people.

Question 7

What are the 3 different types of Sensitive Data?

Answer 7

1. PII - Personally Identifiable Information
2. PHI - Protected Health Information
3. IP - Intellectual Property

Question 8

What is Defense In Depth?

Answer 8

A strategy that provides a layered approach to security by implementing multiple controls at different layers.

Question 9

What is Nonreprudiation?

Answer 9

Ensures that a party cannot believably deny (repudiate) taking an action.

This is managed via means such as secure audit logging and digital signatures.

Question 10

What are the AAAs of Security

Answer 10

1. ) Authentication - Verifies Who you are
2. ) Authorizations - Verifies what you have permissions to/for.
3. ) Accounting - Monitoring and Tracking of your activity

Question 11

What is due diligence?

Answer 11

Investigative steps that are taken prior to taking on something new such as signing a contract with a Vendor.

Question 12

What is due care?

Answer 12

The practice of implementing security policy and practice to protect resources.