Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CISSP > Chapter 1- Security Governance Through Principles and Policies > Flashcards

Chapter 1- Security Governance Through Principles and Policies Flashcards

1
Q

5 Pillars of Information Security

A

Confidentiality
Integrity
Availability
Authenticity
Nonrepudiation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

DAD Triad

A

Disclosure
Alteration
Destruction

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Authenticity

A

Data is genuine and originates from its alleged source

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Nonrepudiation

A

Ensures that the subject of an activity or who caused an event cannot deny that the event occurred.
Prevents subjects from claiming not to have sent a message, performed an action, been the cause of an event, etc
Enforced through digital certificates, session identifiers, transaction logs, etc

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

AAA Services

A

Identification
Authentication
Authorization
Auditing
Accounting

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Authentication

A

Proving that you are a claimed identity

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Authorization

A

Defines permissions of a resource and object access for a specific identity

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Accounting

A

Reviewing log files to check for compliance and violations to hold subjects accountable

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Abstraction

A

Similar elements put into groups, classes, or roles that are collectively assigned security controls, restrictions, or permissions

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Data Hiding

A

Intentionally positioning data so that it is not viewable or accessible to an unauthorized subject

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Security Boundary

A

Line of intersection between areas, subnets, or environments with different security requirements or needs

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Security Governance

A

Collection of practices related to supporting, evaluating, defining, and directing an organization’s security efforts

Seeks to compare organization’s security processes and infrastructure with knowledge and insight from external sources

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Security Function

A

Aspect of operating a business that focuses on evaluating and improving security over time

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Strategic Plan

A

Long term, defines organization’s security purpose and aligns it with goals, mission, and objectives of the organization. 5+ years

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Tactical Plan

A

Mid term plan developed to provide more details on accomplishing the goals set in the strategic plan, but can also be ad hoc based on unpredicted events. Approximately 1 year

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Organizational Plan

A

Short term, highly detailed plan based on strategic and tactical plans. Useful only for a short time, must be updated often to align with tactical plans

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Senior Manager

A

Ultimately responsible for security maintained by the organization. Signs off on all security policy issues. Decision makers.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Security Professional

A

Writes and implements security policy. Implementers.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Asset Owner

A

Responsible for classifying information for placement/protection within the security solution. Typically a high-level manager but delegates data management tasks to custodian

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Custodian

A

Responsible for the tasks of implementing the prescribed protection defined by policy and senior management

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Auditor

A

Responsible for reviewing and verifying that the security policy is properly implemented and the derived security solutions are adequate. Provides compliance and effectiveness reports to management.

22
Q

ISO

A

International Organization for Standardization. Worldwide standards-setting group of representatives from various national standards organizations. Cover equipment, software, protocols, etc

23
Q

ISO 27000

A

International security standard that can be the basis for implementing organizational security and related management policies

24
Q

NIST

A

National Institute of Standards and Technology. US Federal Agency that promotes and maintains measurement standards, as well as advance technology and innovation.

25
Q

NIST SP 800-53

A

Security and Privacy Controls for Information Systems and Organizations

26
Q

COBIT

A

Control Objectives for Information and Related Technologies. Documented set of best IT security practices by ISACA, mapping security ideals to business objectives

27
Q

COBIT Six Key Principles

A

Provide stakeholder value
Holistic approach
Dynamic governance system
Governance distinct from management
Tailored to enterprise needs
End to end governance system

28
Q

SABSCA

A

Sherwood Applied Business Security Architecture. For developing risk-driven enterprise security and information assurance architectures.

29
Q

PCI DSS

A

Payment Card Industry Data Security Standard. Ensures protection of sensitive credit/debit card info.

30
Q

FedRAMP

A

Federal Risk and Authorization Management Program. US government-wide program designed to standardize cloud security in products and services used by federal agencies.

31
Q

ITIL

A

Information Technology Infrastructure Library. Set of recommended best practices for optimization of IT services to support business growth, transformation, and change. Focuses on how IT and security should be aligned to organization’s objectives. Used as a starting point for crafting a customized security solution.

32
Q

Due Diligence

A

Establishing a plan, policy, process to protect the interests of an organization. Knowing what should be done and planning for it.

33
Q

Due Care

A

Practicing the individual activities that maintain the due diligence effort. Doing the right action at the right time.

34
Q

Threat Modeling

A

Security process where potential threats are identified, categorized, and analyzed. Continuous process.

35
Q

STRIDE

A

Microsoft developed threat categorization scheme. Stands for:
Spoofing
Tampering
Repudiation
Information Disclosure
Denial of Service
Elevation of Privilege

36
Q

PASTA

A

Seven stage threat modeling methodology. Process for attack simulation and threat analysis. Risk-centric, aimed at selecting countermeasures in relation to asset value

37
Q

VAST

A

Visual, Agile, and Simple Threat. Threat modeling concept that integrates threat and risk management into an Agile programming environment on a scalable basis

38
Q

Diagramming

A

Creation of a diagram of the elements involved in a transaction, with indications of data flows and privilege boundaries. Use the diagram to identify all technologies involved, and attacks that could be targeted at each element.

39
Q

Reduction Analysis/Decomposing

A

Breaking down a system into its individual components for a greater understanding of how it operates and potential vulnerabilities. Understanding trust boundaries, data flow paths, input points, privileged operations, and details about security stance

40
Q

Probability x Damage Potential

A

Risk ranking technique that produces a risk severity between 1 and 100. Can be arbitrary and subjective.

41
Q

High/Medium/Low Rating Process

A

Risk ranking technique that uses a risk matrix or heat map to help establish criticality prioritization

42
Q

DREAD

A

Damage, Reproducibility, Exploitability, Affected Users, and Discoverability. Risk rating system designed to provide a flexible rating solution based on the data for those five categories

43
Q

SCRM

A

Supply Chain Risk Management. Ensuring that all vendors or links in the supply chain are reliable, trustworthy, reputable organizations that disclose their practices and security requirements to their business partners

44
Q

Silicon Root of Trust

A

Foundational and tamper resistant component within a computer’s hardware that provides a secure starting point for establishing trust and security in a system. Ensures the CIA of the system’s boot process and software

45
Q

Secure Boot

A

Verifies the integrity of firmware, bootloader, and OS during the boot sequence to ensure no unauthorized or malicious code is executed

46
Q

Remote Attestation

A

Enables a remote entity to verify the trustworthiness of a system

47
Q

Physically Unclonable Function (PUF)

A

Specialized physical electronic component or function that generates a unique, unpredictable digital identifier

48
Q

SBOM

A

Software Bill of Materials. Structured and comprehensive inventory of all software components and dependencies that make up a software application or system

49
Q

Risks of Mergers and Acquisitions

A

Inappropriate information disclosure
Data Loss
Downtime
Failure to achieve a sufficient return on investment (ROI)

50
Q

When doing a third party risk assessment, you discover several serious issues with the vendor such as failing to require encryption for all communications and not requiring MFA on management interfaces. What should you do?

A

Void the authorization to operate (ATO) of the vendor.

CISSP (2 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions