Chapter 19 2013 Flashcards
Consist of measures and controls that ensure confidentiality, integrity, and availability of information systems assets including hardware, software, firmware, and information being processed, stored, and communicated.
COMPUSEC
What are the three core disciplines of information assurance
COMSEC, COMPUSEC, Emissions Security (EMSEC)
Examples of malicious logic attacks
Virus, worm, botnet, Trojan horse
What is the maximum quantity of PII information that can be stored on removal devices
500 or more
Who must report lost or suspected lost removal media containing sensitive information to immediately
Local security manager or IA office
An IT threat that is received via email with embedded scripts or false links to provide access for hacker to control the users computer or install malicious logic
Phishing
Measures and controls taken to deny unauthorized persons information derived from information systems of the government related to national security and to ensure the authenticity of such information systems
Communication security (COMSEC)
What is the difference between transmission security and Emissions security
Transmission security falls under COMSEC and protects against exploitation by means of cryptoanalysis.
EMSEC prevents interception and analysis of compromising emanations from crypto equipment.
Process of identifying, analyzing, and controlling critical information
Operation security
Five steps of OPSEC
ID critical info, Analyse threats, analyze Vulnerabilities, Assess risk, Apply measures
What are the five basic characteristics of OPSEC indicators
Signatures, associations, profiles, contrasts, exposure
The characteristic of an indicator that makes it identifiable or causes it to stand out
Signatures
Relationship of an indicator to other information or activities
Associations
The sum of signatures and associations in an activities profile
Profiles
Differences observed between an activity standard profile and it’s most recent or current actions
Contrasts
When or for how long an indicator is observed
Exposure
Classification, safeguarding, and sanctions are all components of what
Information security (INFOSEC)
What are the three levels of classification
Top secret, secret, and confidential
Who may classify information
Secretary defense, secretaries of military departments, officials specifically delegated authority
Document which details the original classification decision
Security classification guide