Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CC Practice > Chapter 1: Security Principles > Flashcards

Chapter 1: Security Principles Flashcards

1
Q

Understanding and prioritizing risks, using governance and elements to lead and organize the cybersecurity operation

A

Risk Management

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Secret of information with asset being protected

A

Confidentiality

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Provide confidentiality

A

Access Controls

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Another method of confidentiality that makes data unreadable except to authorized persons

A

Cryptography

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Ensures data is not changed by unauthorized users. Hashes are used for protection.

A

Integrity

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Attacks known as DoS Attacks

A

Availability

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Make sure a website is able to operate for their customers

A

Availability

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Something you know (password)

A

Type 1 Verification

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Something you have (smart card)

A

Type 2 Verfiication

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Something you are (biometric fingerprint)

A

Type 3 Verification

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Refers to the measure of the information security, verifies the (CIA) of data and assets

A

Information Assurance

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Gather as much information as possible to carry out attack

A

Conduct Research (Cyberattack Step 1)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Identify organization’s info assets and vulnerabilities that can be exploited

A

Identity Targets (Cyberattack Step 2)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Attacker designs and executes the attack while gaining unauthorized access to the enterprise

A

Exploit Targets (Cyberattack Step 3)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Gain deeper access and attack more, resulting in stealing personal info and credit card data

A

Do Bad Things (Cyberattack Step 4)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Compromise of confidentiality

A

Stealing Data

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Compromise of integrity

A

Modifying Data

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Compromise of availability

A

Destroying data/disrupting environment

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

First step an organization will take to understand threats, discipline of how an organization chooses & implements the right level of security protecting the organization.

In business environment, they protect assets and threats from occurring in a risk management process, deciding on how much to spend on security based on tolerance for risk

A

Risk Management

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Where setting up improper file permissions/configure admin accounts w/default passwords

A

Misconfigured Devices

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

One of the weakest links in cybersecurity

A

Human vulnerabilities

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Potentially damaging event with exploitation of a vulnerability

A

Threat

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Attempt to destroy or disrupt a computer system or network

A

Cyberattacks

24
Q

Attempts to influence a person to do something that may not be in their best interest

A

Social Engineering

25
Q

Exploit vulnerabilities

A

Threat Actors

26
Q

Likelihood that a vulnerability could be exploited and the corresponding impact of such an event

A

Risk

27
Q

Potential that a security breach can occur

A

Risk Exposure

28
Q

Anything that’s put in place to mitigate a risk

A

Countermeasure

29
Q

Makes decisions about how much and what kind of security is needed based on threats and risks most likely to face

A

Risk Management Process

30
Q

Someone(s) who’s responsible for risk

A

The Chief of Security or Chief Information Security Officer

31
Q

Identifies potential threats the organization may face. Each asset is identified, cataloged and described in a database

A

Risk Identification (framing the risk)

32
Q

Exact info to be gathered during the risk management process. Using quantitative risk assessment and qualitative risk assessment.

A

Risk Assessment (understanding the risk)

33
Q

Handles specific risks and recommendations are made to the decision making authority “management”. Regarding the best way to give an asset or organization as a whole.

A

Risk Treatment (taking action on what to do about risks)

34
Q

Assigns numerical or financial values to assets with factors with numerical weights. Includes labor and materials costs or estimates from outside vendors to determine asset value.

A

Quantitative Risk Assessment

35
Q

Potential value of loss for single threat event like a cyberattack or single physical break-in.

A

Single Loss Expectancy (SLE)

36
Q

Cost of asset or assets that are subject to event. Can be the replacement cost of the asset or be if the asset were lost, downtime and costs from loss of business.

A

Asset Value (AV)

37
Q

The percentage of loss, likely to occur for subject events. A threat can be a fire and the asset is the entire datacenter, it may be 40% as an estimate for potential loss if predicted as a significant loss. Should be backed up by data, research, or documented.

A

Exposure Factor (EF)

38
Q

An element of time, used to predict potential value of a loss on an annual basis.

A

Annualized Loss Expectancy (ALE)

39
Q

Estimates how many times the event is estimated to occur in a given year. An analysis allows an organization to predict loss in terms of dollar amounts for particular events on an annual basis.

A

Annualized Rate of Occurrence (ARO)

40
Q

Non-numerical terms using ratings and priorities. Require information about assets, threats, vulnerabilities and probabilities of different events. It ranks the seriousness of each threat and the effectiveness of controls and countermeasures.

A

Qualitative Risk Assessment

41
Q

Making it somebody else’s problem. Most common form is to buy insurance.

A

Risk Transfer

42
Q

Acceptable levels the organizations can live with the risk and take their chances. Willing to accept due to its unlikeliness or high cost of mitigation.

A

Risk Accept

43
Q

Stops related activity or shutting down a system entirely. Best to stop an activity that’s too risky. Example is the software applications have known flaws or vulnerabilities.

A

Risk Avoid

44
Q

Reduce the risk by putting in a control or countermeasure.

A

Risk Mitigate

45
Q

Defines strategies the entire organization or specific subset meets organizational goals and objectives

A

Governance

46
Q

Subset of organization governance focused on developing strategies to oversee security program with goals and objectives of organization

A

Security Governance

47
Q

Typically established by a governmental body or similar agency that specify requirements that are legally enforceable. Are often specific to a certain region, industry or data type.

A

Laws and Regulations

48
Q

U.S. federal agencies and contractors who handle federal data to implement minimum information security requirements. Managed by National Institute of Standards and Technology (NIST).

A

Federal Information Security Management Act of 2002 (FISMA)

49
Q

Process of ensuring alignment with applicable laws, regulations, external standards, ethical conduct and other organizational goals and objectives

A

Compliance

50
Q

Documents developed and published by external standard organizations with the development of security program elements

A

Standards

51
Q

Independent international standard development organization that develops and publishes best practice standards on information technology and information security

A

International Standards of Organization (ISO)

52
Q

U.S. agency that publishes free standards and best practice frameworks on information technology and cybersecurity

A

National Institute of Standards and Technology (NIST)

53
Q

Professional organization that develops and maintains a large portfolio of standards for information technology, telecommunications and computer networking

A

Institute of Electrical and Electronics Engineers (IEEE)

54
Q

Develops technical standards around Internet protocols, network management and other technical specifications

A

Internet Engineering Task Force (IETF)

55
Q

Create standards and best practices for cloud security for service providers and customers

A

Cloud Security Alliance (CSA)

56
Q

A governance element used by many organizations for things such as vulnerability management plan, business continuity plan or incident response plan

A

Plan

57
Q
A

CC Practice (2 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions