CIA Triad Flashcards
CIA Strategy steps.
Risk assessment, Disaster recovery, Employee security policy, Security Audit, Regulatory Standard, and Security Dashboard
Identify risks that could occur. ie. DDoS, or insider fraud
Step 2 of Risk Assessment
Regulatory Standard that requires health plans, and medical service providers to regulate the use and disclosure of an individual’s health information.
Health Insurance Portability and Accountability Act
Perform cost-benefit analysis. How much security is worth the risk
Step 7 Risk Assessment
Assess frequency, and likelihood of events.
Step 3 of Risk Assessment
What part of the CIA strategy involves checking how well implemented a security policy is?
Security Audit
Determine how each threat can be mitigated. How can we minimize damage?
Step 5 Risk Assessment
Determine wether or not to implement, or reassess
Step 8 Risk Assessment
Regulatory Standard that requires financial institutions to assist U.S. government to detect and prevent money laundering
Bank Secrecy Act of 1970
Regulatory Standard that requires organizations doing business with those in the EU with a mechanism to comply with EU data protection requirements
European Union - United states privacy shield
Identify assets that support mission, or primary goals. Most important assets.
Step 1 of Risk Assessment
Regulatory standard that requires every federal agency to provide information security for the data and information systems that support the agency’s operations and assets.
Federal Information Security Management Act
Regulatory standard that requires any person that engages in foreign engagements to not make certain payments to foreign persons, and to maintain accurate records
Foreign Corrupt Practices Act
Determine the impact of each threat. How bad will it hurt?
Step 4 of Risk Assessment
Regulatory Standard that requires companies that offer financial products or services to take care with the collection, disclosure, and protections of consumers nonpublic personal information.
Gramm-Leach-Bliley Act
what rule of the GLBA prohibits deceptive methods of obtaining personal financial information, and encourages financial institutions to safeguard against doing so?
Pretexting provisions
What rule of the GLBA requires the establishment of security measures to prevent data breeches?
Safeguard Rule
Rule of the GLBA that the financial institution must tell the customer what data is gathered, who get’s to use it, how it’s used and how it’s protected.
Privacy Rule
Assess feasibility of implementing mitigation options
Step 6 Risk Assessment
Regulatory Standard that requires all organizations that transmit payment card data to ensure the safe handling of cardholder information.
Payment Card Industry Data Security Standard
Regulatory Standard that requires all public corporations to protect shareholders and general public from accounding errors and fraud.
Sarbanese-Oxley Act
CIA Strategy step used to display key performance indicators related to an organization’s security defense
Security Dashboard
Methods for implementing CIA at the application level
Authentication methods, User Roles and Accounts, and data encryption
Methods for implementing CIA at the End-User Level
Security Education, Authentication Methods, Anti-virus software, and data encryption
