Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

06. CISM - Chapter 6 - Information Security Program Management > Chapter 6 Review > Flashcards

Chapter 6 Review Flashcards

1
Q

Chatper 6 Review

These things are the procedures, mechanisms, systems, and other measures designed to reduce risk through compliance to policies

A

CONTROLS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Chatper 6 Review

To ensure that its business objectives will be met, risks are reduced, and errors will be prevented or corrected, an organisation will develope what.

A

CONTROLS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Chatper 6 Review

To achieve desired outcomes, an organisation may adopt one or more of these to identify and implement controls

A

CONTROL FRAMEWORKS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Chatper 6 Review

Each control consumes this and should therefore be carefully considered

A

RESOURCES

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Chapter 6 Review

This person need to understand the various types of controls (such as preventive, detective, deterrent, manual, automatic, and so on) so that the correct types of controls can be implemented.

A

SECURITY MANAGER

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Chatper 6 Review

This is done to Controls so that security professionals can better understand and work with them.

A

CLASSIFIED

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Chatper 6 Review

Control type descriptors include;

  1. P____ ; Tangiable such as fench
  2. T____ ; Uses software configuration
  3. A____ ; Managing a system effectively
  4. P____ ; To stop something happening
  5. D____ ; To identify something happening
  6. M____ ; To do something by hand
  7. A____ ; To allow a system to respond
  8. C____ ; To reduce or counteract something
  9. R____ ; To restore
A
  1. PHYSICAL
  2. TECHNICAL
  3. ADMINISTRATIVE
  4. PREVENTIVE
  5. DETECTIVE
  6. MANUAL
  7. AUTOMATIC
  8. COMPENSATING
  9. RECOVERY
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Chatper 6 Review

These things are general in nature and implemented in different ways on different information systems based on their individual capabilities, limitations, and applicaibility

A

GENERAL COMPUTING CONTROLS
(GCCs)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Chatper 6 Review

A control framework is a collection of controls organized into these things

A

LOGICAL CATEGORIES

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Chatper 6 Review

Well-known control frameworks are intended to address a broad set of information risks common to most organizations. Examples include;

  1. ISO/IEC ____
  2. NIST SP 800-____
  3. C____ C ____
A
  1. ISO/IEC 27002
  2. NIST SP 800-53
  3. CIS CSC
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Chatper 6 Review

This is a term/method which maps two or more control frameworks together.

A

CROSSWALK

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Chatper 6 Review

Before a control can be designed, the security manager needs to have some idea of this otherwise they will bit have a clear objective.

A

THE NATURE OF THE RISKS THE CONTROL IS INTENDED TO ADDRESS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Chatper 6 Review

In this program, new risks may be identified during a risk assessment that led to the creation of additional controls.

A

RISK MANAGEMENT PROGRAM

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Chatper 6 Review

After a control has been designed, it should be put into service and then it should have this done to it.

A

MANAGED THROUGHOUT ITS LIFE

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Chatper 6 Review

Management of a control throughout its life could involve this happening in the form of changes to business processes and information systems.

A

OPERATIONAL IMPACT

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Chatper 6 Review

Management of a control throughout its life could involve operational impact through changes to business process or information systems. Changes with this will require greater care so that business processes are not adversely affected.

A

GREATER IMPACT

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Chatper 6 Review

Controls should include this information which describes the purpose, applicability, scope, classification, measurements, testing procedures, cross references, and more.

A

METADATA

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Chapter 6 Review

Controls should include Metdata that describes the;

  1. P____ ; A reasons for existing
  2. A____ ; What the control services
  3. S____ ; The extent of coverage
  4. C____ ; A category something is put into
  5. M____ ; Ability to take metrics
  6. T____ P ____ ; A number of criteria to determine effectiveness
  7. C____ R ____ ; Refer to other systems and relationships
A
  1. PURPOSE
  2. APPLICABILITY
  3. SCOPE
  4. CLASSIFICATION
  5. MEASUREMENTS
  6. TESTING PROCEDURES
  7. CROSS REFERENCES
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Chatper 6 Review

The implementation of a new control should be guided by formal processes. A new control should have a the following things met;

  1. This is the purpose of its existence
  2. This will be done to validate the control is effective
  3. This endorsement is needed to implement the control
  4. This processes should be followed to identify potential risk through implementation and ensure a valid plan
A
  1. CONTROL OBJECTIVE
  2. TEST PLAN
  3. AUTHORIZATION
  4. CHANGE MANAGEMENT
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Chatper 6 Review

Controls that have been placed into service will transition into this

A

ROUTINE OPERATIONS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Chatper 6 Review

These inidividuals will operate their controls and try to be aware of any problems, especially early on.

A

CONTROL OWNERS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Chatper 6 Review

Whether controls are automatic or manual, preventive or corrective, these individuals are responsible for ensuring that their controls operate correctly in every respect.

A

CONTROL OWNERS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Chatper 6 Review

It is essential for security managers to understand the technology underpinning controls to ensure that these 2 things are effectively met

A

DESIGN and OPERATION

24
Q

Chatper 6 Review

Any organization that implements controls to address risks should periodically examine those controls to determine that this is being achieved.

A

WORKING AS INTENDED and DESIGNED

25
Q

Chatper 6 Review

SOC 1 and SOC 2 audits provide assurances of effective control design (Type I and Type II) and implementation (Type II only) in who

A

THIRD-PARTY SERVICE PROVIDERS

26
Q

Chpater 6 Review

These 2 audits provide assurances of effective control design (Type I and Type II) and implementation (Type II only) in third-parties

A

SOC 1 and SOC 2

27
Q

Chatper 6 Review

An essential function in information security management is to set activities that determine that these 2 things in regards to security safeguarding are happening

A

IN PLACE and WORKING PROPERLY

These activities range from informal security reviews to formal and highly structured security audits.

28
Q

Chatper 6 Review

This is a systematic and repeatable process whereby a competent and independent professional evaluates one or more controls, interviews personnel, obtains and analyzes evidence, and develops a written opinion on the effectiveness of a control.

29
Q

Chapter 6 Review

An audit is a systematic and repeatable process whereby a competent and independent professional;

  1. ____ ; Evaluates one or more of these safeguards
  2. ____ ; Interviews these people
  3. ____ ; Obtains and analyses this which is proof of results
  4. ____ ; Develops a written opinion on this in regards to control(s)
A
  1. CONTROLS
  2. PERSONNEL
  3. EVIDENCE
  4. EFFECTIVENESS OF A CONTROL
30
Q

Chatper 6 Review

This is a methodology used by an organization to internally review these 3 components;

  1. Key business objectives
  2. Risks related to achieving objectives
  3. Key controls designed to manage risks.
A

CONTROL SELF-ASSESSMENT
(CSA)

31
Q

Chatper 6 Review

This organisation asset is generally considered the largest and most vulnerable portion of an organization’s attack surface.

32
Q

Chapter 6 Review

Personnel are the primary weak point in information security, mainly because of;

  1. ____ ; a decision that can often cause a mistake
  2. ____ ; Someone not paying complete attention
  3. ____ ; A person feeling run down or tired
  4. ____ ; a feeling when you recognise the importance or deadlines of duties
  5. ____ ; Lack of training
A
  1. LAPSE IN JUDGEMENT
  2. INATTENTIVENESS
  3. FATIGUE
  4. WORK PRESSURE
  5. SHORTAGE OF SKILLS
33
Q

Chatper 6 Review

This critical activity attempts to identify risks in third-party organizations that have access to critical or sensitive data or that perform critical operational functions.

A

THIRD-PARTY RISK MANAGEMENT

34
Q

Chatper 6 Review

Various techniques are needed to identify and manage risks with third-parties because with their internal operations and risks, they are not seen to be very what.

A

TRANSPARENT

35
Q

Chatper 6 Review

Third parties are assessed mainly through the use of these 2 methods

A
  1. QUESTIONNAIRES
  2. REQUESTS FOR EVIDENCE
36
Q

Chatper 6 Review

Most organizations depend on large numbers of third-party services, so they employ a this matrix to identify the third parties that are the most critical to the organization.

A

RISK TIER SCHEME

Third Parties at a higher level of risk undergo more frequent and rigorous risk assessments, while those at lower levels undergo less frequent and less rigorous risk assessments.

37
Q

Chatper 6 Review

The management of business relationships with third parties is a what sort of process.

A

LIFE-CYCLE

The life cycle begins when an organization contemplates the use of a third party to augment or support the organization’s operations in some way.

38
Q

Chatper 6 Review

The life cycle management process with third-parties continues during the ongoing relationship with the third party and concludes when the organization has no what

A

REQUIREMENT OF THE SERVICE

39
Q

Chatper 6 Review

This is the lifeblood of an effective information security program.

A

COMMUNICATIONS

40
Q

Chatper 6 Review

Lacking effective communication, the security manager will have difficulty interacting with these people for the exchange of objectives, risk information and metrics.

A

EXECUTIVE MANAGEMENT

41
Q

Chatper 6 Review

If communication is Ineffective it will hamper these 2 security-related things throughout the business

A

ACTIVITIES and PROCESSES

42
Q

Chatper 6 Review

Security programs include a variety of these activities that are vital to its success.

A

ADMINISTRATIVE

43
Q

Chatper 6 Review

One important success factor of a security program is the development of these with internal departments external organisations.

A

STRATEGIC PARTNERSHIPS / RELATIONSHIPS

44
Q

Chatper 6 Review

Strategic partnerships with internal departments and external organisations enable the security manager to do this in terms of events.

A

BETTER INFLUENCE

It also allows them to learn more about external events, and obtain assistance from outside entities as needed

45
Q

Chatper 6 Review

This represents a collection of operational activities designed to ensure the quality of IT services and includes several business processes such as;

  1. service desk
  2. incident management
  3. problem management
  4. change management
  5. configuration management
  6. release management
  7. service-level management
  8. financial management
  9. capacity management
  10. service continuity management
  11. availability management
A

IT SERVICE MANAGEMENT

46
Q

Chatper 6 Review

When senior management express concerns for the effectiveness of the information security program, the security manager should carry out this activity with senior managers to address their concerns

A

INTERVIEW SENIOR MANAGEMENT

47
Q

Chatper 6 Review

Achieving this in regards to resources is the best indication a security manager is achieving value delivery

A

HIGH RESOURCE UTILIZATION

48
Q

Chatper 6 Review

This is the best metric a security manager can use to evaluate the result of a security program

A

PERCENTAGE OF CONTROL OBJECTIVES ACHIEVED

49
Q

Chatper 6 Review

Control objectives are directly related to these objectives

A

BUSINESS OBJECTIVES

50
Q

Chatper 6 Review

Obtaining another party’s public key is required to initiate this activity

A

AUTHENTICATION

51
Q

Chatper 6 Review

This type of secret key encryption is computationally more intensive

A

PUBLIC KEY

  • Public key encryption is computationally intensive due to the long key lengths required
  • Secret key encryption requires much shorter key lengths to achieve equivalent strength
52
Q

Chatper 6 Review

This type of key is more problematic for scaling as it requires a key for each pair of individuals

A

SYMMETRICAL KEY
(secret key encryption)

Symmetrical or secret key encryption requires a key for each pair of individuals who wish to have confidential communications resulting in an exponential increase in the number of keys resulting in intractable distribution and storage problems

53
Q

Chatper 6 Review

Wi-Fi Protected Access 2 (WPA2) and this type of authentication is the strongest form of wireless authentication currently available

A

802.1x

WPA2 and 802.1x authentication is the strongest form of wireless authentication currently available. WPA2 combined with 802.1x forces the user to authenticate using strong Advanced Encryption Standard encryption

54
Q

Chatper 6 Review

This service is an authrotiy within an organisation network that verifies (authenticates) user requests for a digital certificate which tells the Certificate Authority (CA) to issue it

A

REGISTRATION AUTHORITY
(RA)

The registration authority’s (RA’s) private key is in the possession of the RA, often stored on a smart card or laptop, and is typically protected by a password and, therefore, is potentially accessible. If the RA’s private key is compromised, it can be used to register anyone for a certificate using any identity, compromising the entire public key infrastructure for that CA

55
Q

Chatper 6 Review

This service is either internal or public and is responsible for the issuing and revoking of certificates

A

CERTIFICATE AUTHORITY
(CA)

06. CISM - Chapter 6 - Information Security Program Management (10 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2025 Bold Learning Solutions. Terms and Conditions