Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CISSP > Chapter 1 - Security Governance Through Principles and Policies > Flashcards

Chapter 1 - Security Governance Through Principles and Policies Flashcards

1
Q

Define Confidentiality

A

Protection of secrecy of the data/Prevention of unauthorized access to data.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Encryption would prevent a violation of which area of the CIA triad.

A

Confidentiality

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Define Integrity

A

Protecting reliability and correctness of data/prevention of unauthorized alteration of data.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Intrusion detection systems and strict access control are countermeasures to ensure which area of the CIA triad?

A

Integrity

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Availability

A

Timely and uninterrupted access to data/prevention of DDoS attacks.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Implementing redundancy, installing firewalls, and maintaining backup systems are countermeasures that ensure which are of the CIA triad?

A

Availability

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

In the DAD triad, what is the opposite of Confidentiality

A

A failure in confidentiality results in Disclosure

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

In the DAD triad, what is the opposite of Integrity

A

A failure in integrity results in Alteration

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

In the DAD triad, what is the opposite of Availability

A

A failure in availability results in Destruction

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Authenticity

A

Users have a high level of confidence that data was sent from the alleged source without being manipulated in transit.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Non-Repudiation

A

Users are not able to take actions on the network without the action being attributed to them.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

How many services are aligned to the AAA security mechanism?

A

5

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Identification

A

The mechanism for presenting who the user is to the system (username, smart card, facial presentation).

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Authentication

A

Proof that identity is accurate - password or pin.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Authorization

A

Defining permissions and assigning them to the user for resources.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Auditing

A

recording logs of events and activities related to system and subjects

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Accounting

A

reviewing the log files to check for compliance and violations in order to hold users accountable for their actions.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

The use of multiple controls in series is known as…?

A

Defense in Depth

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Is defense-in-depth done in parallel or in series?

A

In series - if one layer of the defense fails, the system is uncompromised. If done in parallel, one failure could expose the whole system compromise.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Name other terms often used in relation to defense-in-depth besides layering.

A

Classifications, zones, realms, compartments, silos, segmentations, lattice structure, protection rings.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Abstraction

A

Used for efficiency - used when classifying objects or assigning roles.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Data Hiding

A

Users cannot see or access data in a higher classification than they are able to see

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Encryption

A

Hiding the meaning of communication from unintended recipients.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

What is the line of intersection between any two areas, subnets, or environments that have different security needs?

A

Security Boundary

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

The system of external entity oversight that may be mandated by law, regulation, industry standards, contractual obligations, or licensing requirements

A

Third-Party Governance

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

An example of auditing protocols that have a specific checklist of requirements to investigate:

A

COBIT - Control Objectives for Information and Related Technology

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

What is COBIT?

A

Control Objectives for Information and Related Technology - An example of auditing protocols that have a specific checklist of requirements to investigate.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

If an organization fails to provide sufficient documentation to meet the requirements of third-party governance, what are the repercussions?

A

Loss or void of ATO - ATO cannot be reestablished without an on-site review showing full compliance.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

What is a business case?

A

Documented need within the organization that conveys the purpose of the security approach.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

Should security management planning be led by the IT staff in a bottom-up approach or from the management in a top-down approach?

A

Top-down approach.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

Should security management planning be led by the IT staff in a bottom-up approach or from the management in a top-down approach?

A

Top-down approach.

32
Q

What is a strategic plan

A

Fairly stable
long term
5-year lifespan maintained annually
includes risk assessment

33
Q

What is a tactical plan

A

Provides more details on accomplishing the goals of the strategic plan
Can be crafted ad hoc due to unpredicted events
midterm
1-year lifespan

34
Q

What is an operational plan

A

Highly detailed
short term
useful for a month or a quarter and updated often

35
Q

Who is the person ultimately responsible for the security maintained by the organization and who should be most concerned about the protection of its assets?

A

Security Manager

36
Q

Who implements and writes security policies but does not have the authority to make final decisions or sign the security policies?

A

Security Professional

37
Q

What is the asset owner responsible for?

A

Classifying information for placement and protection within the security solution.

38
Q

What is the custodian responsible for?

A

All activities necessary to provide adequate protection for the CIA triad of data and to fulfill the requirements established by senior management.

39
Q

What do you call any person who has access to the secured system? What is their responsibility?

A

User - responsible for understanding and upholding the security policy of the organization.

40
Q

What is an auditor responsible for?

A

reviewing and verifying that security policy is properly implemented and derived security solutions are adequate.

41
Q

Who produces compliance and effectiveness reports that are reviewed by senior management?

A

Auditor

42
Q

Six key principles of Cobit

A 
Provide Stakeholder Value
Holistic Approach
Dynamic Governance System
Governance Distinct from Management
Tailored to Enterprise Needs
End-to-end governance system
43
Q

NIST 800-53 Rev. 5 Security and privacy controls for information systems and organizations

A

US government sourced general recommendations for organization security.

44
Q

Center for Internet Security

A

OS, application, and hardware security configuration guides

45
Q

NIST Risk Management framework

A 
establishes mandatory requirements for federal agencies.
Six phases
Categorize
Select
Implement
Assess
Authorize 
Monitor
46
Q

NIST Cybersecurity Framework

A 
critical infrastructure, commercial organizations
Five Functions
Identify,
Protect
Detect
Respond
Recover
47
Q

International Organization for Standardization (ISO) / International Electrotechnical Commission (IEC)

A

International Standard that is the basis of implementing organizational security and related management practices

48
Q

Information Technology Infrastructure Library (ITIL)

A

set of recommended best practices for optimization of IT services to support business growth, transformation, and change.

How IT and security are best integrated with and aligned to the objectives of an organization

49
Q

Due Diligence

A

Establishing the plan, policy, and process to protect the interests of the organization.

50
Q

Due Care

A

Practicing individual activities that maintain due diligence effort. Actual execution.

51
Q

Security Policies

A

The document that defines the scope of security required by the organization and defines which assets require protection.
Objectives
Visions
Goals

52
Q

Organizational Security Policy

A

Issues relevant to the aspects of the organization

53
Q

Issue Specific Security Policy

A

focuses on specific network, function, department, service of the org that is separate from the organization

54
Q

System-specific Security Policy

A

Focuses on prescribing hardware/software specific to the individual systems or system types.

55
Q

Standards

A

Compulsory requirements for the homogeneous use of hardware, software, technology, security control

56
Q

Baseline

A

The minimum level of security every system throughout the organization must meet.

If the system does not meet the baseline it should be taken out of production until it can be brought up to the baseline.

57
Q

Guideline

A

Recommendations on how standards and baselines are implemented. Operational guide for security professionals and users.

58
Q

Procedure

A

A detailed step-by-step how-to document that describes the exact actions necessary to implement a specific security mechanism, control, or solution.

59
Q

What does the threat categorization scheme STRIDE stand for?

A 
Spoofing
Tampering
Repudiation
Information Disclosure
Denial of Service
Elevation of privilege
60
Q

Spoofing

A

Falsifying identity to gain unauthorized access to the system.

61
Q

Tampering

A

Any action that changes or manipulates data in transit or in storage.

62
Q

Repudiation

A

The ability of users to deny taking action on the network by maintaining plausible deniability.

63
Q

Information Disclosure

A

The release of private, confidential, or controlled information.

64
Q

Denial of Service

A

Attack that attempts to prevent authorized use of a resource.

65
Q

Elevation of privilege

A

A limited user account is transformed into an account with many more privileges and accesses with power that the account should not have.

66
Q

What are the stages of PASTA

A

Process for Attack Simulation and Threat Analysis
I. Definition of the objectives (DO)
II. Definition of the technical scope (DTS)
III. Application decomposition and analysis (ADA)
IV. Threat Analysis (TA)
V. Weakness and Vulnerability Analysis (WVA)
VI. Attack Modeling & Simulation (AMS)
VII. Risk Analysis & Management (RAM)

67
Q

In the decomposition process, there are five key concepts - what are they?

A 
Trust Boundaries
Dataflow  paths
Input points
Privileged Operations
Details about Security Stance and Approach
68
Q

In the decomposition process, what is any location where the level of trust or security changes?

A

Trust Boundary

69
Q

In the decomposition process, what is described by the movement of data between locations?

A

Dataflow path

70
Q

In the decomposition process, what is any location where external input is received?

A

Input Location

71
Q

In the decomposition process, what describes an activity that requires greater privileges than that of a standard user account/process.

A

Privileged Operation

72
Q

In the decomposition process, what encompasses the declaration of the security policy, security foundations, and security assumptions?

A

Details about security stance and approach

73
Q

What are three systems used to prioritize threats

A

Probability (1-10) x Damage potential ranking (1-10): Overall score of 1-100

High Medium Low Heat Map of probability/damage

DREAD (damage potential | reproducibility | exploitability | affected users | discoverability)

74
Q

Goals of a secure supply chain

A

sufficient quality
meets performance/operational goals
provides stated security mechanisms

75
Q

What agreement exists between the organization and the supplier to ensure security expectations of the final product.

A

Service Level Agreement (SLA) ensures that security is a prescribed component of the contracted service. Should incorporate elements of the SLR

CISSP (4 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions