Brainscape's Knowledge GenomeTM


Top Flashcards (Certified)
All Flashcards

Cyber Security (CompTIA Security+) > Chapter 5 - Governance, Risk, and Compliance > Flashcards

Chapter 5 - Governance, Risk, and Compliance Flashcards

1
Q

Managerial Controls

A

Controls that address security design and implementation
Security policies, standard operating procedures

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Operational Controls

A

Controls that are implemented by people
Security guards, awareness programs

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Technical Controls

A

Controls implemented by system
Operating systems, firewalls, anti-virus

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Control Type - Preventative

A

Physically control access
Door lock, security guard, firewall

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Control Type - Detective

A

May not prevent access but identifies and records any intrusion attempt
Motion detector, IDS/ IPS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Control Type - Corrective

A

Designed to mitigate damage
IPS - block an attacker, Backups - mitigate a ransomware infection, Backup site - can provide options when a storm hits

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Control Type - Deterrent

A

May not directly prevent access but discourages an intrusion attempts
Warning signs, login banner

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Control Type - Compensating

A

Doesn’t prevent an attack but can restore using other means
Re-image or restore from backup, hot site, backup power system, generator

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Control Type - Physical

A

Real-world security
Fences, locks, man traps

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Security Controls

A

Prevent security events, minimize the impact, and limit the damage

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

General Data Protection Regulation (GDPR)

A

A set of rules and regulations that allows someone in the EU to control what happens with their private information
Name, address, photo, email, bank
Controls export of personal data and can decide where it goes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

National, Territory, or State Laws

A
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Payment Card Industry Data Security Standard (PCI DSS)

A

A standard for protecting credit cards and transactions
Objectives: build/maintain a secure network and systems, protect cardholder data, maintain vulnerability management program, implement strong access control, regularly monitor, information security policies

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Center for Internet Security (CIS) Critical Security Controls for Effective Cyber Defense (CSC)

A

Improves security posture of organization
Has 20 keys actions and is designed for implementation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

National Institute of Standards and Technology (NIST) Risk Management Framework (RMF)

A

Mandatory for US federal agencies and organizations that handle federal data
Six step process: categorize, select, implement, assess, authorize, monitor

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF)

A

A voluntary commercial implementation framework
Framework core - identify, protect, detect, respond, recover
Framework implementation tiers - view and process of handling risk
Framework profile - standards, guidelines, and practices of core

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

International Organization for Standardization (ISO)/ International Electrotechnical Commission (IEC)
27001/ 27002/ 27701/ 31000

A

ISO/ IEC 27001 - standard for information security management systems (ISMS)
ISO/ IEC 27002 - Code of practice for information security controls
ISO/ IEC 27701 - Privacy information Management systems (PIMS)
ISO 31000 - International standards for risk management practices

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

SSAE SOC 2 Type I/II

A

American Institute of Certified Public Accountants auditing standard
SOC 2 - Trust services criteria (security controls)
Type I Audit - Tests controls in place at a particular point in time
Type II Audit - Tests controls over a period of at least six consecutive months

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Cloud Security Alliance (CSA)

A

Security in cloud computing
Not-for-profit organization

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Cloud Control Matrix

A

Cloud-specific security controls
Controls are mapped to standards, best practices, and regulations

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Reference Architecture

A

Methodology and tools, assessing internal organization, security capabilities, and building a road map

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Platform/ Vendor-specific Hardening Guides

A

Guides that are specific to the software and platform
Get feedback from manufacturer or internet interest group

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Web Server Hardening Guide

A

Provides information on how to prevent data leakage and server access, what permissions the server should run on, configuring SSL, and monitoring/ reporting on access logs

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Operating System Hardening Guide

A

Provides latest OS updates/ service packs, user accounts limitations and password complexity/ length, and how to control network access and security

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Application Server Software
Middleware - between web server and database Disables all unnecessary devices, updates security patches, and limits access and rights
26
Network Infrastructure Devices
Switches, routers, firewalls, IPS, etc. Purpose-built devices, configure authentication, and check with manufacturer for known updates
27
Acceptable Use Policy
Detailed documentation of acceptable use of a companies assets Used by an organization to limit legal liability
28
Job Rotation
Keep people moving between responsibilities so no one person maintains control for long periods of time
29
Mandatory Vacation
Rotate others through job to make sure everything is operating correctly Not used often but especially important in high security environment
30
Separation of Duties
Split knowledge - No one person has all of the details Example: half of a safe combination Dual control - two people must be present to perform a task Example: two keys opening a safe (or launch missile)
31
Least Privilege
Rights and permissions set to the bar minimum so a user only has exact access needed to perform an objective
32
Clean Desk Space
Whenever leaving desk, not important information is left on desk
33
Background Checks
Pre-employment screening to verify the applicant's claims, discover criminal history, workers compensation claims
34
Non-disclosure Agreements (NDA)
Confidentiality agreement where both sides decide what information can be shared and what information should be kept private
35
Social Media Analysis
Gathering information from social media platforms to be able to see what the potential employee is like outside of a professional atmosphere
36
Onboarding
Bring a new person into the organization IT agreements need to be signed, create accounts, provide hardware
37
Offboarding
Someone leaving the organization in a pre-planned way Returning of hardware, access of data, deactivate accounts
38
User Training
Helps the user in operating the system in efficient way by learning, executing, and implementation policies
39
Gamification
Train while giving people points, competing with other, and collecting badges
40
Capture the Flag
Security competition where someone hacks into a system in order to steal the flag and create simulations
41
Phishing Campaigns
A scam that impersonates a reputable person or organization with the intent to steal credentials or sensitive information
42
Phishing Simulations
Send simulated emails/ make vishing calls See which users need additional training is susceptible
43
Computer-based Training (CBT)
Automated pre-built training to do on your own time What I am doing now
44
Role-based Training
Specialized training that requires each user to experience with their unique security responsibilities
45
Third Party Risk Management - Vendors
Important company data is shared Perform a risk assessment for each vendor and use contracts Payroll, travel, raw material, customer relations
46
Third Party Risk Management - Supply Chain
The system involved when creating a product Perform a supply chain assessment Organizations, people, activities, and resources
47
Third Party Risk Management - Business Partners
Closer to data than a vendor Involves communication over trusted connection
48
Service Level Agreement (SLA)
Sets a minimum set of service terms for a particular service or product Between customers and service providers uptime, response time agreement
49
Memorandum of Understanding (MOU)
Memo sent between two different parties so that they understand what the requirements might be for a particular business process
50
Measurement of Systems Analysis (MSA)
Provides a way for a company to evaluate and assess the quality of the process used in their measurement systems
51
Business Partnership Agreement (BPA)
A legally binding document that determines the roles and responsibilities between two individuals or entities acting as business partners
52
End of Life (EOL)
When a manufacturer stops selling a product but may still support the product Security patches, updates
53
End of Service Life (EOSL)
When a manufacturer stops selling and supporting the product Security patches, updates Could maybe pay a premium fee to get security patch or update
54
Data Classification
Identify data types - use and protect data efficiently Personal, public, restricted, etc.
55
Data Governance
Rules, processes, and accountability associated with an organization's data - data is used in the right ways Data steward
56
Data Retention
Keep files that change frequently for version control Corporate tax information, customer PII, tape backups, etc.
57
Credential Management
All that stands between the outside world and all of the data Everything needs to reside on the server and not the client Encryption
58
Personnel Accounts
An account on a computer associated with a specific person Storage and files can be private to that user
59
Third-party Accounts
Access to external third-party systems Cloud platforms for payroll, enterprise resource planning, etc.
60
Device Accounts
Access to devices Mobile devices Mobile Device Manager
61
Service Accounts
Used exclusively by services running on a computer No interactive/ user access Web server, database server, etc.
62
Administrator/ Root Accounts
Elevated access to one or more systems Complete access to operating system Manage hardware, drivers, and software installation
63
Change Management
How to make a change Upgrade software, change firewall configuration, modify switch ports Have clear policies Frequency, duration, installation process, fallback procedures
64
Change Control
A formal process for managing change Avoid downtime, confusion, and mistakes
65
Asset Management
Identify and tracking computing assets - hardware and data Respond fast to security problem Who, what, and where
66
Risk Assessment
Identifying assets that could be affected by an attack as well as the threats that could affect those assets and the amount of risk of the attack
67
External Threats
Outside the organization Hacker, former employee
68
Internal Threats
Inside the organization Employees, partners
69
Legacy Systems
Outdated or older technologies that may not be supported by the manufacturer or may not have security updates
70
Multiparty Risks
Breaches involving multiple parties Personal information held by an organization for customers
71
Intellectual Party (IP) Theft
Theft of ideas, inventions, and creative expressions Human error, hacking, employees with access
72
Software Compliance/ Licensing
The process of ensuring that your company is only using software it is authorized to use Not too many licenses and not too few licenses
73
Risk Management Strategy - Acceptance
Not making changes and taking the risk
74
Risk Management Strategy - Avoidance
Stop participating in a high-risk activity
75
Risk Management Strategy - Transference
Buying some cybersecurity insurance - helps financially if a threat occurs
76
Cybersecurity Insurance
Helps an organization pay for any financial losses they may incur in the event of a cyberattack or data breach
77
Risk Management Strategy - Mitigation
Decrease the risk level by investing in security systems
78
Risk Register
Document used as a risk management tool Applies possible solutions to the identified risks Monitors the results
79
Risk Matrix/ Heat Map
Visually determining the risk assessment based on color that help make strategic decisions Combines the likelihood of an event with the potential impact
80
Risk Control Assessment
After determining risks we need to build and maintain security systems based on the requirements
81
Risk Control Self-assessment
A procedure for assessing and examining operational hazards and the efficacy of risk management controls
82
Risk Awareness
Having an understanding of what risks exist, what impact they can have, and how to deal with them, but also constantly keeping an open eye for new risks
83
Inherent Risk
Risk that exists in the absence of security controls Impact + likelihood
84
Residual Risk
Inherent risks combined with the effectiveness of security controls Inherent risk + control effectiveness
85
Control Risk
Define methods, procedures, technologies, or other measures that can help the organization mitigate the risks
86
Risk Appetite
How much an organization may be willing to take
87
Regulations That Affect Risk Posture
Protection of personal information, disclosure of information breaches HIPPA, GDPR
88
Risk Assessment - Qualitative
Identifying significant risk factors and displaying visually with a traffic light grid or similar method Red, yellow, green
89
Risk Assessment - Quantitative
Method using measurable, objective data to determine an asset's value, the probability of loss and other associated risks
90
Likelihood of Occurrence
How likely it is that something will happen ARO
91
Impact
How much something happening will effect the organization Life, property, safety, finance, and reputation
92
Asset Value
The value or amount spent on a singular asset Computer = $1,000
93
Single-loss Expectancy (SLE)
Describes how much money an organization is going to lose if that single event occurs If computer that is $1,000 the SLE is $1,000
94
Annualized Loss Expectancy (ALE)
ARO x SLE ARO = 7, SLE = $1,000; 7 x 1,000 = $7,000 (ALE)
95
Annualized Rate of Occurrence (ARO)
Describes the likelihood of an attack or disaster of occurring per year
96
Disasters - Environmental Threats
Tornadoes, hurricanes, earthquakes, or severe weather
97
Disasters - Person-made Threats
Created by a person Human-intent, negligence, or error Arson, crime, civil disorder, fires, riots, etc.
98
Disasters - Internal
Threats from employees or partners
99
Disasters - External
Threats from outside the organization
100
Recovery Time Objective (RTO)
How long it would take to get back up and running to a particular service level Do not need to get to complete recover but need to get to a certain point
101
Recovery Point Objective (RPO)
Set an objective to meet a certain set of minimum requirements to get a system up and running Part of it may be available but part of it may be unavailable
102
Mean Time to Repair (MTTR)
Time required to fix the issue
103
Mean Time Between Failures (MTBF)
Predicting the time between failures or outages
104
Functional Recovery Plans
A set of processes and procedures that can take us from the very beginning of solving the issue all the way through to getting back up and running - step-by-step guide Contact information, technical processes, recover and test
105
Single Point of Failure
A part of a system that, if it fails, will stop the entire system from working
106
Disaster Recovery Plan (DRP)
Detailed step-by-step plan for resuming operations after a disaster has occurred Application, data center, building, campus, region, etc.
107
Mission Essential Functions
Functions that are the most essential to an organization depending on the type of disaster that occurred
108
Identification of Critical Systems
Identifying critical systems that are the most essential to an organization depending on the type of disaster that occurred
109
Site Risk Assessment
Assessments that have been adapted to a specific site, and only contain relevant information for that particular project Applications, personnel, equipment, work environment
110
Consequences - Reputation Damage
Opinion of the organization becomes negative in turn can have an impact on products, services, and stock price
111
Consequences - Identity Theft
Company or customer information becomes public
112
Consequences - Fines
Can be fined in someone's PII becomes available due to the company's fault
113
Consequences - IP Theft
Stealing company secrets that could make them go out of business
114
Internal Escalation
Providing a process of importance for when internal employees find breaches
115
External Escalation
Providing a process of importance for when a breach is too difficult to find or manage - ask a third party
116
Public Notifications and Disclosures
Information the public of a previous notification breach that can inform them before it happens to them
117
Data Types - Public
No restrictions on viewing the data - everyone can see it
118
Data Types - Private
Restricted access for viewing the data - must be authorized Might require NDA
119
Data Types - Sensitive
Intellectual property, PII, PHI
120
Data Types - Confidential
Very sensitive - must be authorized to view
121
Data Types - Critical
Data should always be available Processes we use in the organization or public
122
Data Types - Proprietary
Information that is private and the property of an organization Trade secrets
123
Data Types - Personally Identifiable Information (PII)
Data that can be used to identify and individual Name, DOB, biometric information, etc.
124
Data Types - Protected Health Information (PHI)
Health information associated with an individual Health status, health insurance, health records
125
Data Types - Financial Information
Internal company financial information Customer financial details
126
Data Types - Government Data
Open data that is transferred between government entities May be protected by law
127
Data Types - Customer Data
Data associated with customers Could be user-specific details
128
Data Minimization
Only collecting data that would be used to perform the necessary function HIPPA, GDPR
129
Data Masking
Hide some of the original data Data obfuscation Bank card ************2671
130
Tokenization
Replacing sensitive data with a non-sensitive placeholder SSN - 226-12-1112 is now SSN 691-61-8539
131
Anonymization
Make it impossible to identify individual data from a dataset
132
Pseudo-anonymization
Replacing personal information with pseudonyms Random placement James Messer -> Jack O'Neill -> Sam Carter -> Daniel Jackson
133
Data Owners
Person who is responsible for a certain set of data Treasurer own financial data
134
Data Controller
Manages the purposes and means by which personal data is processed Payroll department
135
Data Processor
Processes the data on behalf of the data controller Often a third-party Payroll company
136
Data Custodian/ Steward
Responsible for data accuracy, privacy, and security of data Set labels to the data Laws and regulations Access rights
137
Data Protection Officer (DPO)
Responsible for the organization's privacy Policies, implements processes and procedures
138
Information Lifecycle
Creation and receipt - create data internally/receive data externally Distribution - records are sorted and stored Use - business decisions, create products and services Maintenance - ongoing data retrieval and transfers Disposition - Archiving or disposal of data
139
Privacy Impact Assessment (PIA)
Understanding how processes and products will affect the privacy of a organization's customers or data New projects, initiatives, systems, processes, strategies, policies, business relationships etc
140
Terms of Agreement
A set of legal conditions used to ensure that all parties involved in a contract or transaction understand the responsibilities and obligations of each party
141
Privacy Notice
Documents the handling of personal data Provides additional data options and contact information

Cyber Security (CompTIA Security+) (41 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2025 Bold Learning Solutions. Terms and Conditions