Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Cyber Security (CompTIA Security+) > Chapter 5 - Governance, Risk, and Compliance > Flashcards

Chapter 5 - Governance, Risk, and Compliance Flashcards

1
Q

Managerial Controls

A

Controls that address security design and implementation
Security policies, standard operating procedures

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Operational Controls

A

Controls that are implemented by people
Security guards, awareness programs

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Technical Controls

A

Controls implemented by system
Operating systems, firewalls, anti-virus

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Control Type - Preventative

A

Physically control access
Door lock, security guard, firewall

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Control Type - Detective

A

May not prevent access but identifies and records any intrusion attempt
Motion detector, IDS/ IPS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Control Type - Corrective

A

Designed to mitigate damage
IPS - block an attacker, Backups - mitigate a ransomware infection, Backup site - can provide options when a storm hits

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Control Type - Deterrent

A

May not directly prevent access but discourages an intrusion attempts
Warning signs, login banner

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Control Type - Compensating

A

Doesn’t prevent an attack but can restore using other means
Re-image or restore from backup, hot site, backup power system, generator

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Control Type - Physical

A

Real-world security
Fences, locks, man traps

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Security Controls

A

Prevent security events, minimize the impact, and limit the damage

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

General Data Protection Regulation (GDPR)

A

A set of rules and regulations that allows someone in the EU to control what happens with their private information
Name, address, photo, email, bank
Controls export of personal data and can decide where it goes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

National, Territory, or State Laws

A
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Payment Card Industry Data Security Standard (PCI DSS)

A

A standard for protecting credit cards and transactions
Objectives: build/maintain a secure network and systems, protect cardholder data, maintain vulnerability management program, implement strong access control, regularly monitor, information security policies

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Center for Internet Security (CIS) Critical Security Controls for Effective Cyber Defense (CSC)

A

Improves security posture of organization
Has 20 keys actions and is designed for implementation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

National Institute of Standards and Technology (NIST) Risk Management Framework (RMF)

A

Mandatory for US federal agencies and organizations that handle federal data
Six step process: categorize, select, implement, assess, authorize, monitor

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF)

A

A voluntary commercial implementation framework
Framework core - identify, protect, detect, respond, recover
Framework implementation tiers - view and process of handling risk
Framework profile - standards, guidelines, and practices of core

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

International Organization for Standardization (ISO)/ International Electrotechnical Commission (IEC)
27001/ 27002/ 27701/ 31000

A

ISO/ IEC 27001 - standard for information security management systems (ISMS)
ISO/ IEC 27002 - Code of practice for information security controls
ISO/ IEC 27701 - Privacy information Management systems (PIMS)
ISO 31000 - International standards for risk management practices

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

SSAE SOC 2 Type I/II

A

American Institute of Certified Public Accountants auditing standard
SOC 2 - Trust services criteria (security controls)
Type I Audit - Tests controls in place at a particular point in time
Type II Audit - Tests controls over a period of at least six consecutive months

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Cloud Security Alliance (CSA)

A

Security in cloud computing
Not-for-profit organization

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Cloud Control Matrix

A

Cloud-specific security controls
Controls are mapped to standards, best practices, and regulations

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Reference Architecture

A

Methodology and tools, assessing internal organization, security capabilities, and building a road map

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Platform/ Vendor-specific Hardening Guides

A

Guides that are specific to the software and platform
Get feedback from manufacturer or internet interest group

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Web Server Hardening Guide

A

Provides information on how to prevent data leakage and server access, what permissions the server should run on, configuring SSL, and monitoring/ reporting on access logs

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Operating System Hardening Guide

A

Provides latest OS updates/ service packs, user accounts limitations and password complexity/ length, and how to control network access and security

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

Application Server Software

A

Middleware - between web server and database
Disables all unnecessary devices, updates security patches, and limits access and rights

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

Network Infrastructure Devices

A

Switches, routers, firewalls, IPS, etc.
Purpose-built devices, configure authentication, and check with manufacturer for known updates

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

Acceptable Use Policy

A

Detailed documentation of acceptable use of a companies assets
Used by an organization to limit legal liability

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

Job Rotation

A

Keep people moving between responsibilities so no one person maintains control for long periods of time

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

Mandatory Vacation

A

Rotate others through job to make sure everything is operating correctly
Not used often but especially important in high security environment

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

Separation of Duties

A

Split knowledge - No one person has all of the details
Example: half of a safe combination
Dual control - two people must be present to perform a task
Example: two keys opening a safe (or launch missile)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

Least Privilege

A

Rights and permissions set to the bar minimum so a user only has exact access needed to perform an objective

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

Clean Desk Space

A

Whenever leaving desk, not important information is left on desk

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

Background Checks

A

Pre-employment screening to verify the applicant’s claims, discover criminal history, workers compensation claims

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

Non-disclosure Agreements (NDA)

A

Confidentiality agreement where both sides decide what information can be shared and what information should be kept private

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

Social Media Analysis

A

Gathering information from social media platforms to be able to see what the potential employee is like outside of a professional atmosphere

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

Onboarding

A

Bring a new person into the organization
IT agreements need to be signed, create accounts, provide hardware

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

Offboarding

A

Someone leaving the organization in a pre-planned way
Returning of hardware, access of data, deactivate accounts

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

User Training

A

Helps the user in operating the system in efficient way by learning, executing, and implementation policies

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

Gamification

A

Train while giving people points, competing with other, and collecting badges

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
40
Q

Capture the Flag

A

Security competition where someone hacks into a system in order to steal the flag and create simulations

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
41
Q

Phishing Campaigns

A

A scam that impersonates a reputable person or organization with the intent to steal credentials or sensitive information

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
42
Q

Phishing Simulations

A

Send simulated emails/ make vishing calls
See which users need additional training is susceptible

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
43
Q

Computer-based Training (CBT)

A

Automated pre-built training to do on your own time
What I am doing now

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
44
Q

Role-based Training

A

Specialized training that requires each user to experience with their unique security responsibilities

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
45
Q

Third Party Risk Management - Vendors

A

Important company data is shared
Perform a risk assessment for each vendor and use contracts
Payroll, travel, raw material, customer relations

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
46
Q

Third Party Risk Management - Supply Chain

A

The system involved when creating a product
Perform a supply chain assessment
Organizations, people, activities, and resources

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
47
Q

Third Party Risk Management - Business Partners

A

Closer to data than a vendor
Involves communication over trusted connection

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
48
Q

Service Level Agreement (SLA)

A

Sets a minimum set of service terms for a particular service or product
Between customers and service providers
uptime, response time agreement

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
49
Q

Memorandum of Understanding (MOU)

A

Memo sent between two different parties so that they understand what the requirements might be for a particular business process

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
50
Q

Measurement of Systems Analysis (MSA)

A

Provides a way for a company to evaluate and assess the quality of the process used in their measurement systems

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
51
Q

Business Partnership Agreement (BPA)

A

A legally binding document that determines the roles and responsibilities between two individuals or entities acting as business partners

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
52
Q

End of Life (EOL)

A

When a manufacturer stops selling a product but may still support the product
Security patches, updates

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
53
Q

End of Service Life (EOSL)

A

When a manufacturer stops selling and supporting the product
Security patches, updates
Could maybe pay a premium fee to get security patch or update

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
54
Q

Data Classification

A

Identify data types - use and protect data efficiently
Personal, public, restricted, etc.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
55
Q

Data Governance

A

Rules, processes, and accountability associated with an organization’s data - data is used in the right ways
Data steward

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
56
Q

Data Retention

A

Keep files that change frequently for version control
Corporate tax information, customer PII, tape backups, etc.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
57
Q

Credential Management

A

All that stands between the outside world and all of the data
Everything needs to reside on the server and not the client
Encryption

58
Q

Personnel Accounts

A

An account on a computer associated with a specific person
Storage and files can be private to that user

59
Q

Third-party Accounts

A

Access to external third-party systems
Cloud platforms for payroll, enterprise resource planning, etc.

60
Q

Device Accounts

A

Access to devices
Mobile devices
Mobile Device Manager

61
Q

Service Accounts

A

Used exclusively by services running on a computer
No interactive/ user access
Web server, database server, etc.

62
Q

Administrator/ Root Accounts

A

Elevated access to one or more systems
Complete access to operating system
Manage hardware, drivers, and software installation

63
Q

Change Management

A

How to make a change
Upgrade software, change firewall configuration, modify switch ports
Have clear policies
Frequency, duration, installation process, fallback procedures

64
Q

Change Control

A

A formal process for managing change
Avoid downtime, confusion, and mistakes

65
Q

Asset Management

A

Identify and tracking computing assets - hardware and data
Respond fast to security problem
Who, what, and where

66
Q

Risk Assessment

A

Identifying assets that could be affected by an attack as well as the threats that could affect those assets and the amount of risk of the attack

67
Q

External Threats

A

Outside the organization
Hacker, former employee

68
Q

Internal Threats

A

Inside the organization
Employees, partners

69
Q

Legacy Systems

A

Outdated or older technologies that may not be supported by the manufacturer or may not have security updates

70
Q

Multiparty Risks

A

Breaches involving multiple parties
Personal information held by an organization for customers

71
Q

Intellectual Party (IP) Theft

A

Theft of ideas, inventions, and creative expressions
Human error, hacking, employees with access

72
Q

Software Compliance/ Licensing

A

The process of ensuring that your company is only using software it is authorized to use
Not too many licenses and not too few licenses

73
Q

Risk Management Strategy - Acceptance

A

Not making changes and taking the risk

74
Q

Risk Management Strategy - Avoidance

A

Stop participating in a high-risk activity

75
Q

Risk Management Strategy - Transference

A

Buying some cybersecurity insurance - helps financially if a threat occurs

76
Q

Cybersecurity Insurance

A

Helps an organization pay for any financial losses they may incur in the event of a cyberattack or data breach

77
Q

Risk Management Strategy - Mitigation

A

Decrease the risk level by investing in security systems

78
Q

Risk Register

A

Document used as a risk management tool
Applies possible solutions to the identified risks
Monitors the results

79
Q

Risk Matrix/ Heat Map

A

Visually determining the risk assessment based on color that help make strategic decisions
Combines the likelihood of an event with the potential impact

80
Q

Risk Control Assessment

A

After determining risks we need to build and maintain security systems based on the requirements

81
Q

Risk Control Self-assessment

A

A procedure for assessing and examining operational hazards and the efficacy of risk management controls

82
Q

Risk Awareness

A

Having an understanding of what risks exist, what impact they can have, and how to deal with them, but also constantly keeping an open eye for new risks

83
Q

Inherent Risk

A

Risk that exists in the absence of security controls
Impact + likelihood

84
Q

Residual Risk

A

Inherent risks combined with the effectiveness of security controls
Inherent risk + control effectiveness

85
Q

Control Risk

A

Define methods, procedures, technologies, or other measures that can help the organization mitigate the risks

86
Q

Risk Appetite

A

How much an organization may be willing to take

87
Q

Regulations That Affect Risk Posture

A

Protection of personal information, disclosure of information breaches
HIPPA, GDPR

88
Q

Risk Assessment - Qualitative

A

Identifying significant risk factors and displaying visually with a traffic light grid or similar method
Red, yellow, green

89
Q

Risk Assessment - Quantitative

A

Method using measurable, objective data to determine an asset’s value, the probability of loss and other associated risks

90
Q

Likelihood of Occurrence

A

How likely it is that something will happen
ARO

91
Q

Impact

A

How much something happening will effect the organization
Life, property, safety, finance, and reputation

92
Q

Asset Value

A

The value or amount spent on a singular asset
Computer = $1,000

93
Q

Single-loss Expectancy (SLE)

A

Describes how much money an organization is going to lose if that single event occurs
If computer that is $1,000 the SLE is $1,000

94
Q

Annualized Loss Expectancy (ALE)

A

ARO x SLE
ARO = 7, SLE = $1,000; 7 x 1,000 = $7,000 (ALE)

95
Q

Annualized Rate of Occurrence (ARO)

A

Describes the likelihood of an attack or disaster of occurring per year

96
Q

Disasters - Environmental Threats

A

Tornadoes, hurricanes, earthquakes, or severe weather

97
Q

Disasters - Person-made Threats

A

Created by a person
Human-intent, negligence, or error
Arson, crime, civil disorder, fires, riots, etc.

98
Q

Disasters - Internal

A

Threats from employees or partners

99
Q

Disasters - External

A

Threats from outside the organization

100
Q

Recovery Time Objective (RTO)

A

How long it would take to get back up and running to a particular service level
Do not need to get to complete recover but need to get to a certain point

101
Q

Recovery Point Objective (RPO)

A

Set an objective to meet a certain set of minimum requirements to get a system up and running
Part of it may be available but part of it may be unavailable

102
Q

Mean Time to Repair (MTTR)

A

Time required to fix the issue

103
Q

Mean Time Between Failures (MTBF)

A

Predicting the time between failures or outages

104
Q

Functional Recovery Plans

A

A set of processes and procedures that can take us from the very beginning of solving the issue all the way through to getting back up and running - step-by-step guide
Contact information, technical processes, recover and test

105
Q

Single Point of Failure

A

A part of a system that, if it fails, will stop the entire system from working

106
Q

Disaster Recovery Plan (DRP)

A

Detailed step-by-step plan for resuming operations after a disaster has occurred
Application, data center, building, campus, region, etc.

107
Q

Mission Essential Functions

A

Functions that are the most essential to an organization depending on the type of disaster that occurred

108
Q

Identification of Critical Systems

A

Identifying critical systems that are the most essential to an organization depending on the type of disaster that occurred

109
Q

Site Risk Assessment

A

Assessments that have been adapted to a specific site, and only contain relevant information for that particular project
Applications, personnel, equipment, work environment

110
Q

Consequences - Reputation Damage

A

Opinion of the organization becomes negative in turn can have an impact on products, services, and stock price

111
Q

Consequences - Identity Theft

A

Company or customer information becomes public

112
Q

Consequences - Fines

A

Can be fined in someone’s PII becomes available due to the company’s fault

113
Q

Consequences - IP Theft

A

Stealing company secrets that could make them go out of business

114
Q

Internal Escalation

A

Providing a process of importance for when internal employees find breaches

115
Q

External Escalation

A

Providing a process of importance for when a breach is too difficult to find or manage - ask a third party

116
Q

Public Notifications and Disclosures

A

Information the public of a previous notification breach that can inform them before it happens to them

117
Q

Data Types - Public

A

No restrictions on viewing the data - everyone can see it

118
Q

Data Types - Private

A

Restricted access for viewing the data - must be authorized
Might require NDA

119
Q

Data Types - Sensitive

A

Intellectual property, PII, PHI

120
Q

Data Types - Confidential

A

Very sensitive - must be authorized to view

121
Q

Data Types - Critical

A

Data should always be available
Processes we use in the organization or public

122
Q

Data Types - Proprietary

A

Information that is private and the property of an organization
Trade secrets

123
Q

Data Types - Personally Identifiable Information (PII)

A

Data that can be used to identify and individual
Name, DOB, biometric information, etc.

124
Q

Data Types - Protected Health Information (PHI)

A

Health information associated with an individual
Health status, health insurance, health records

125
Q

Data Types - Financial Information

A

Internal company financial information
Customer financial details

126
Q

Data Types - Government Data

A

Open data that is transferred between government entities
May be protected by law

127
Q

Data Types - Customer Data

A

Data associated with customers
Could be user-specific details

128
Q

Data Minimization

A

Only collecting data that would be used to perform the necessary function
HIPPA, GDPR

129
Q

Data Masking

A

Hide some of the original data
Data obfuscation
Bank card ****2671

130
Q

Tokenization

A

Replacing sensitive data with a non-sensitive placeholder
SSN - 226-12-1112 is now SSN 691-61-8539

131
Q

Anonymization

A

Make it impossible to identify individual data from a dataset

132
Q

Pseudo-anonymization

A

Replacing personal information with pseudonyms
Random placement
James Messer -> Jack O’Neill -> Sam Carter -> Daniel Jackson

133
Q

Data Owners

A

Person who is responsible for a certain set of data
Treasurer own financial data

134
Q

Data Controller

A

Manages the purposes and means by which personal data is processed
Payroll department

135
Q

Data Processor

A

Processes the data on behalf of the data controller
Often a third-party
Payroll company

136
Q

Data Custodian/ Steward

A

Responsible for data accuracy, privacy, and security of data
Set labels to the data
Laws and regulations
Access rights

137
Q

Data Protection Officer (DPO)

A

Responsible for the organization’s privacy
Policies, implements processes and procedures

138
Q

Information Lifecycle

A

Creation and receipt - create data internally/receive data externally
Distribution - records are sorted and stored
Use - business decisions, create products and services
Maintenance - ongoing data retrieval and transfers
Disposition - Archiving or disposal of data

139
Q

Privacy Impact Assessment (PIA)

A

Understanding how processes and products will affect the privacy of a organization’s customers or data
New projects, initiatives, systems, processes, strategies, policies, business relationships etc

140
Q

Terms of Agreement

A

A set of legal conditions used to ensure that all parties involved in a contract or transaction understand the responsibilities and obligations of each party

141
Q

Privacy Notice

A

Documents the handling of personal data
Provides additional data options and contact information

Cyber Security (CompTIA Security+) (41 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions