Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CISSP > Chapter 2 - Governance and Risk > Flashcards

Chapter 2 - Governance and Risk Flashcards

0
Q

Availability?

A

Uptime and timeliness

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
1
Q

What is AIC or CIA?

A

Availability Integrity Confidentiality

Used to define security platform and threat surfaces

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Integrity?

A

Unaltered information accuracy

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Confidentiality?

A

Authorized disclosure

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Shoulder surfing

A

Looking over the shoulder to view screen data or passwords

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Social engineering

A

Tricking someone into divulging information

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Vulnerability?

A

Lack of or weakness in a countermeasure that is exploitable

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Threat?

A

The potential danger if a vulnerability is exploited

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Threat Agent?

A

The entity that takes action on the threat and vulnerability

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Risk?

A

The likelihood a threat agent will exploit a vulnerability and the impact that could cause to the business

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Exposure?

A

This is the damage caused by a successful attack

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Control?

A

Countermeasure to reduce risk a vulnerability may cause

Also known as safeguard

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Deterrent control?

A

Discourage attacker

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What three categories make for defense in depth ?

A

Administrative
Technical
Physical controls

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Preventive control?

A

Avoid an incident entirely

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Corrective control?

A

Fixes after an incident

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Recovery control?

A

Intended to bring the environment back

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Detective control?

A

Detect what occurred and who did it

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Compensating control?

A

Alternative controls (a proxy server instead of a port block)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What three controls commonly make up a security policy?

A

Preventative, detective, and recovery

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Why is security by obscurity a bad thing?

A

It assumes you are smarter than the attacker and in most cases lowers productivity

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

What cycle does the ISO standards follow?

A

Plan-Do-Check-Act (PDCA)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

What is the BS7799? What did it become?

A

BS7799 was a British security defacto standard that was adopted by ISO 27000 it also goes by the name ISO 17799

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

What is the difference between framework and architecture?

A

Framework is an outline blueprint and architecture is the blueprint that fits the specific need

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Define a view in terms of an enterprise architecture..

A

A view is how an individual element of a business supports the architectural integrity of a business

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

What is the benefit of having an architecture?

A

It shows the company as an organism and how each part has a role

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

An architecture is to a human body as views are to what?

A

A circulatory system
A bone structure
A digestive track
Etc.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

What is the zachman framework best at illustrating?

A

A two dimensional view of each view in an architecture asking the 5 w’s for each

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

TOGAF is a comprised of what views of architecture?

A

In order:

Business
Data
Applications
Technology

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

What framework uses ADM as part of its definition?

A

TOGAF

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

What is the primary benefit of the complex DoD architectures like DODAF and MODAF?

A

Synchronous data types and standard communication channel so everyone is quickly on the same page

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

When do stakeholders become important?

A

When choosing an architecture that fits the business model. There concerns will help guide that decision.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

What does tactical, strategic, and operational mean?

A

Strategic - the long term goals..(a retirement)
Tactical - the medium goals (a security plan in place)
Operational - short term (lock down that port)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

ISMS

A

Information security management system

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

SABSA

A

It is a 2 dimension model like Zachman, using the 5 w’s to define security in increasing detail

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

What is a methodology?

A

A step by step process to implement and architecture

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

Strategic alignment?

A

The alignment of the business within an enterprise architecture

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

Business enablement?

A

Business needs and productivity come before security

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

Process enhancement?

A

Architecture planning will force diagnostics of business process and give a rich opportunity to fine tune the business process

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

Security effectiveness?

A

Use of tools like ROI SLA or baselines to see security efficiency

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
40
Q

CobiT?

A

Controls oriented private business framework with 32 domains and complete checklist of it governance policies

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
41
Q

NIST 800-53

A

Government version of a cobit like framework with specific steps

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
42
Q

What is unique about the NIST categories?

A

Management
Technical
Operational

Instead of the standard:
Administrative
Technical
Physical

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
43
Q

COSO

A

Architecture model focused on corporate governance instead of IT governance

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
44
Q

What common law is built on COSO?

A

SOX

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
45
Q

What is the primary focus of ITIL?

A

SLA

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
46
Q

Six Sigma?

A

Process methodology architecture

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
47
Q

CMMI?

A

Capability Maturity Model Integration

Used to help define maturity level of process, similar to cobit maturity model

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
48
Q

Top-Down approach vs bottom-up approach

A

Top down is starting from senior management and working down. Bottom up is the other way around starting from the janitor up

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
49
Q

What are the 4 domains of a security program life cycle?

A

Plan and organize
Implement
Operate and maintain
Monitor and evaluate

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
50
Q

What is a blueprint?

A

Specific roles, outlines, responsibilities, or guidelines within the architecture

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
51
Q

What is the first thing you do when securing and environment?

A

Find out how the business works down to the user and client experiences and up to the board members day to day

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
52
Q

What is IRM?

A

Information Risk Management

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
53
Q

What are the types of risk?

A 
Physical damage (fire)
Human interaction (disruptive interaction)
Equipment failure
Attacks (hacking)
Misuse of data (sharing trade secrets)
Loss of data (format /s /f)
Application error (bad loops)
54
Q

What allows a company to pick and choose vulnerabilities?

A

Risk management

55
Q

What does risk effect in a company?

A

Everything in an organization.

56
Q

What is the key thing for management to contribute to risk management?

A

A definition of what is considered and acceptable level of risk

57
Q

What are the goals of a risk assessment?

A

Identify assets and value
Identify vulnerabilities and threats
Quantify the probability and business impact of threats
Provide an economic balance between impact and cost of control

Cost/Benefit

58
Q

Finally got that risk assessment done? Now what?

A

React to it and make adjustments to reduce risk

59
Q

What level of a department should be working with the risk assessment team?

A

The top level, far too often it is delegated to the lower people due to time, but they don’t know the amswers

60
Q

What 4 questions should be asked in a risk assessment?

A

Threat event?
Risk?
Frequency?

Certainty of the last 3 questions?

61
Q

How does the value of an object or piece of information dictate risk assessment?

A

More value, more risk

62
Q

What is an intangible risk assessment?

A

Something not physical.

Reputation
Data
Intellectual property

It is critical to be able to assign a cost to these

63
Q

Loss potential?

A

What would the company lose of the threat agent exploited the vulnerability

64
Q

Delayed loss?

A 
Damage reputation
Loss of market share
Late penalties
Civil suits
Etc.

This happens long after the exploit took place.

65
Q

What is SP 800-30?

A

NIST methodology guide focused only on it security

66
Q

What is FRAP?

A

This is a to the point risk methodology that focuses only on the most critical risks for cost and time efficiency

67
Q

OCTAVE?

A

This a high level it security methodology focused on allowing the upper people within each department to make the risk assessment

68
Q

AS/NZS 4360

A

This is a methodology focused on business health particularly financially and economically

69
Q

FMEA ?

A

Failure modes and effect analysis

Used in development and operations to find flaws and potentially failures before they happen

70
Q

Failure mode?

A

How a system can break?

71
Q

Effect analysis

A

Impact of a failure

72
Q

Fault Tree Analysis

A

Used for complex failure modes with multiple dependencies.

This model starts from what can go wrong and diagrams everything that can cause that to happen

73
Q

Logic diagrams are used in what methodology?

A

Failure tree analysis

74
Q

CRAMM

A

A UK methology that is fully automated with Siemens products

75
Q

Risk assessment vs risk analysis?

A

Assessment is gathering information

Analysis is using and acting on the assessment

76
Q

What 4 things can be done with a risk?

A

Accept
Mitigate
Transfer
Avoid

77
Q

Qualitative analysis ?

A

Financial estimate of a risk

78
Q

Quantitative analysis?

A

Assigning rating to risk like red, yellow, green.

79
Q

Single loss expectancy ?

A

Dollar amount assigned to a single event if a threat took place

Asset value * exposure factor

80
Q

Exposure factor

A

% of an asset lost

81
Q

Annual loss expectancy

A

SLE * ARO = ALE

82
Q

ARO?

A

Annualized rate of occurrence

83
Q

Uncertainty?

A

This is the amount of guessing put into a risk analysis. This should be tracked.

84
Q

Delphi?

A

A group discussion technique designed to anonymously give opinions

85
Q

Cost/benefit analysis?

A

Prevent spending more money than the threat would cost annually (ALE)

86
Q

Safeguard considerations?

A

Must be visible to evildoer but non discoverable

87
Q

Residual risk?

A

No countermeasure is fully affective. The remainder is the residual risk.

Mitigation not prevention

88
Q

Total risk?

A

The entire risk quotient .. Companies will accept this only if the cost/benefit supports that action

89
Q

How can one deal with risk?

A

Accept it
Avoid it
Mitigate it
Transfer it

90
Q

Transfer risk?

A

“It’s not my risk anymore, it’s his”

91
Q

Risk avoidance

A

We will discontinue using that product.due to the risk

92
Q

Mitigated risk

A

I implemented a new security device to reduce risk

93
Q

Acceptable risk

A

I’m okay with that!

94
Q

Security policy

A

General statement of security by senior management that dictates the role of security

95
Q

Organizational security policy

A

Shows the tactical and strategic value of a security policy and a defined acceptable level of risk

96
Q

Issue specific policies or functional policies

A

Specific security policy to one segment of the master organizational policy

97
Q

System specific policy

A

This is an IT specific acceptable use policy defining roles access system security

98
Q

Regulatory policy

A

Very detailed and specific standards used by industry, medical, and government

Ie. HIPPA, SOX

99
Q

Advisory policy

A

Strongly shows exactly what is acceptable and unacceptable with consequences

100
Q

Informative policy

A

Non-enforceable policy telling people relevant information

101
Q

What is a baseline?

A

Clean data at a point on time to reference against

102
Q

Guidelines

A

Recommended actions and operational guides

103
Q

Procedure

A

Very detailed step-by-step task list

104
Q

Data classification

A

Level of confidentiality of stored data

105
Q

Board of directors?

A

Shareholder elected individuals in a public traded company used for steering a company from the shareholder side

106
Q

CPO

A

Chief privacy officer - business legal advisor

107
Q

Privacy impact analysis

A

Risk assessment specifically for the protection of sensitive data

108
Q

Privacy

A

Controlled and expected release of sensitive data

109
Q

PII

A

Personal identifiable information

110
Q

Convergence

A

The combination of all security realms

111
Q

Security steering committee

A

Everyone who is personally responsible or in charge of directing security in an organization

112
Q

Audit committee

A

Independent auditing among the board of directors

113
Q

Data owner

A

The person responsible for a subset of data and it’s business access and defined sensitivity

114
Q

Data custodian

A

This is the person who manages where the data is stored .. Typically the IT person

115
Q

System owner

A

The person to call when xyz application had a problem

116
Q

Security administrator

A

Controls network security devices like IDS , IPS , firewalls , anti malware, etc

117
Q

Security analyst

A

Works at a higher level and analyses the environment for security flaws. Works with risk analysis

118
Q

Application owner

A

The person directly responsible for the security of an application

119
Q

Supervisor

A

This is someone who is responsible for the users themself

120
Q

Change control analyst

A

Ensure change control happens and stays secure

121
Q

Data analyst

A

Ensures data is placed where it needs to be and is secured correctly

122
Q

Solution provider

A

An external provider of a solution to a business ailment

123
Q

Product line manager

A

Similar to a systems analyst, more specifically targeting products and licensing

124
Q

Separation of duties

A

When multiple people are necessary to enable a control or process

125
Q

Collision

A

This means working together.

separation of duties implies collusion occurred if the process became fraudulent

126
Q

Split-knowledge

A

Two people required for a task, each knowing how to do half the task

127
Q

Dual control

A

Both people understand the entire process but no one person can accomplish the task

128
Q

Rotation of duties

A

Changing roles and shifts and handing them to others in order to encourage employee auditing

129
Q

Mandatory vacation

A

Forcing people to take vacation and relinquish their role to someone else who could potentially find fraud

130
Q

Non disclosure agreements

A

Used to link employees to a policy stating you cannot share sensitive data

131
Q

Security Governance

A

This is how well the security is integrated into the organization as a whole

132
Q

ISO 27004:2009 / NIST 800-55

A

Tells how to measure a security program

CISSP (11 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2025 Bold Learning Solutions. Terms and Conditions