Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

cissp > Chapter 4: Frameworks > Flashcards

Chapter 4: Frameworks Flashcards

1
Q

framework

A

a guiding document which provides structure to the ways in which we manage risks, develop enterprise architecture, and secure all our assets

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

RMF

A

risk management frameworks

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

common RMFs

A

NIST RMF, ISO/IEC 27005, OCTAVE, and FAIR

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Seven steps of NIST RMF

A

Prepare, categorize, select, implement, assess, authorize, and monitor

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

common security controls in NIST framework

A

they exist outside of a system and apply to multiple systems

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

system-specific security controls in NIST framework

A

they exist inside a system boundary and protect only the one system

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

hybrid security controls in NIST framework

A

they are a combination of the other two (common and system-specific)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Four risk treatments

A

mitigated, accepted, transferred, or avoided

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

OCTAVE

A

Operationally Critical Threat, Asset, and Vulnerability Evaluation; team-oriented risk management methodology which employs workshops and is commonly used in the commercial sector

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

FAIR

A

Factor Analysis of Information Risk; only internationally recognized quantitative approach to risk management

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Most common info security program frameworks

A

ISO/IEC 27001 and NIST cybersecurity framework

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

ISO/IEC 27001

A

standard for the establishment, implementation, control, and improvement of the info security mgmt system (ISMS)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

NIST Cybersecurity Framework official name

A

Framework for Improving Critical Infrastructure Cybersecurity

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Five higher-level functions of NIST Cybersecurity Framework

A

Identify, protect, detect, respond, and recover

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Most common security controls frameworks

A

NIST SP 800-53, CIS Controls, and COBIT

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

NIST SP 800-53

A

over 1,000 security controls grouped into 20 families; Security and Privacy Controls for Info Systems and Orgs

17
Q

CIS

A

Center for Internet Security Controls

18
Q

CIS Controls framework

A

20 controls and 171 subcontrols organized in implementation groups to address any org’s security needs from small to enterprise level

19
Q

COBIT

A

framework of control objectives and allows for IT governance; developed by ISACA and ITGI (IT Governance Institute)

20
Q

Enterprise architecture frameworks

A

used to develop architectures for specific stakeholders and present information in views; used to build individual architectures that best map to individual organizational needs and business drivers

21
Q

Blueprints

A

functional definitions for the integration of technology into business processes

22
Q

Most common enterprise architecture frameworks

A

Zachman and SABSA; TOGAF and DoDAF

23
Q

Zachman Framework

A

enterprise architecture framework

24
Q

SABSA

A

security enterprise architecture framework

25
Q

ITIL

A

set of best practices for IT service management

26
Q

Six Sigma

A

used to identify defects in processes so that the processes can be improved upon

27
Q

CMM

A

Capability Maturity Model

28
Q

what is the CMM

A

allows for processes to improve in an incremented and standard approach

29
Q

ISO/IEC 27005

A

describe risk management frameworks

30
Q

NIST SP 800-37

A

describe risk management frameworks

31
Q

ISO/IEC 27001

A

describes information security management system

32
Q

OCTAVE

A

developed by Carnegie Mellon University; focused only on risk assessments; team-oriented risk management methodology which employs workshops

33
Q

Key benefit of Zachman Framework

A

Allows different groups within the org to look at it from different viewpoints

34
Q

Key benefit of the DoDAF

A

ensures all systems, processes, and personnel are interoperable in a concerted effort to accomplish organizational missions

35
Q

Key benefit of the TOGAF

A

Use of the iterative and cyclic Architecture Development Method (ADM)

36
Q

Key benefit of the ITIL

A

Focus on internal SLAs between the IT department and the “customers” it serves

37
Q

COBIT 2019

A

Balances resources utilization, risk levels, and realization of benefits by explicitly tying stakeholder needs to organizational goals to IT goals

38
Q

NIST RMF categorization

A

NIST RMF relies on the Federal Information Processing Standard Publication 199 (FIPS 199) which breaks down a system’s criticality by security objective (confidentiality, integrity, availability) and then applies the highest security objective category (out of low, medium, high) to determine the overall category of the system

39
Q

SC

A

security category; SC = {(confidentiality, high), (integrity, medium), (availability, low)}= high

cissp (29 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions