Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CISM (Certified Information Security Manager) > CISM Vocabulary > Flashcards

CISM Vocabulary Flashcards

1
Q

Administrative controls

A

policies, processes, procedures, standards

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Annualized Loss Expectancy

A

ALE = SLExARO

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

architecture standard

A

defines technology architecture at the database, system, or network level

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

assessment

A

an examination that determines the effectiveness of a system or process

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

asset value

A

the value of an IT asset - usually but not always the Replacement Value

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Asynchronous Replication

A

writing to data in a remote system is not synchronized with the local system.

No guarantee that remote system is identical to local system

Might be a time lag

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Attestation of compliance

A

assertion of compliance to a law, standard or requirement

Typically signed by high ranking official

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

authentication

A

asserting an identity and providing proof of it

typically requires an ID (assertion) and a password (proof)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

business email compromise

ceo fraud

A

perpetrator impersonates a CEO and gets company personnel to transfer large amounts of money, typically for a “secret merger” or “acquisition”

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Business Impact Analysis

A

Study to identify the impact that different disaster scenarios will have on business operations

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Business Recovery Plan

A

activities required to recover and resume critical business processes and activities

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

capability maturity model

A

measures relative maturity of an organization and its processes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

capability maturity model for Development

CMMi-DEV

A

maturity model used to measure software development process maturity

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

certification practicer statement (CPS)

A

describes practices used by the CA to issue and manage digital certificates

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Change Control Board
aka
Change Advisory Board

A

stakeholders from IT and Business who propose, discuss, approve changes to the IT systems

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

CIS Controls

A

framework maintained by the Center for Internet Security (CIS)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

COBIT

A

published by ISACA

control framework for managing information systems and security

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

COSO

A

Committee of Sponsoring Organizations of the Treadway Commission

Organization providing control frameworks and guidance on enterprise risk management

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

COOP

A

Continuity of Operations Plan

activities required to continue critical and strategic business functions at alternate site

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Control

A

Policy, Process or Procedure created to ensure desired outcomes or to avoid unwanted outcomes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Control Framework

A

Collection of controls organized in logical categories

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Covered Entity

A

any organization that stores or processes information covered by HIPAA

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Critical Path Methodology (CPM)

A

Technique used to identify the most critical path in a project to understand which tasks are most likely to affect the project schedule

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Criticality Analysis (CA)

A

Study of each system and process, a consideration of the impact on the organization if it’s incapacitated, the likelihood of incapacitation and the estimated cost of mitigating the impact (risk)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

Digital envelope

A

method of using two layers of encryption

symmetric key is used to encrypt a message and a public or private key is used to encrypt the symmetric key

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

Disaster

A

unexpected and unplanned event that results in the disruption of business operations

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

Dwell Time

A

amount of time from the start of an incident to the organization’s awareness of the incident

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

e-vaulting

A

backing up information to an off-site location, usually a 3rd-party service provider

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

Exposure Factor

A

financial loss resulting from realization of a threat.

expressed as a percentage of the asset’s total value

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

Facilities Classification

A

methods for assigning risk levels to facilities based based on their operational criticality or other risk factors

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

fiduciary

A

person who has a legal trust relationship with another party

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

fiduciary duty

A

highest standard of care that a fiduciary renders to a beneficiary

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

File Activity Monitoring (FAM)

A

monitoring the use of files on a computer as a way to detect indicators of compromise

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

File Integrity Monitoring (FIM)

A

periodically scanning file systems to detect changes to file contents or permissions that may indicate compromise

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

HITRUST

A

healthcare control framework and certification

servers as external attestation of an organization’s IT controls

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

Hybrid cryptography

A

cryptosystem that uses two or more iterations of cryptography

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

Impact

A

actual or expected result from a threat or disaster

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

incident

A

any event not part of standard operation of a service and that causes or may cause interruption or reduction in quality of service

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

Information Risk

A

business risk associated with use, ownership, operation, involvement, influence and adoption of information in an enterprise

40
Q

ISMS

Information Security Management System

A

ISO/IEC 27001 - activities for managing information security in an organization

41
Q

inherent risk

A

the risk that there are material weaknesses in existing business processes and no compensating controls to detect or prevent them

42
Q

integrated audit

A

financial and operational audit

43
Q

intrusion kill chain

A

intrusion model developed by Lockheed Martin

Phases are: 
reconnaissance
weaponization
delivery
exploitation
installation
command and control
actions on objective
44
Q

ISAE 3402

International Standard on Assurance Engagement

A

external audit of a service provider

performed according to rules from International Auditing and Assurance Standards Board

45
Q

ISO/IEC 20000

A

standard for IT service management (ITSM)

46
Q

ISO/IEC 27001

A

standard for IT security management

47
Q

ISO/IEC 27002

A

standard for IT security controls

48
Q

ITIL

A

standard for IT service management

49
Q

Key Performance Indicator (KPI)

A

Measure of business process’ performance and quality

Used to reveal trends related to efficiency and effectiveness of key processes in the organization

50
Q

Key Risk Indicator (KRI)

A

measure of information risk

used to reveal trends related to levels of risk of security incidents in the organization

51
Q

Maximum Tolerable Downtime (MTD)

A

Amount of time after a disaster, after which, an organization’s survival is at risk

52
Q

Maximum Tolerable Outage (MTO)

A

Maximum period of time that an organization can tolerate operating in recovery mode

53
Q

North American Reliability Corporation (NERC)

A

maintains resilience and security controls for use by public utitilities

54
Q

North American Reliability Corporation Infrastructure Protection (NERC CIP)

A

Standards and Requirements defined by NERC to protect power plants and grids

55
Q

Operationally Critical Threat Asset and Vulnerability Evaluation (OCTAVE)

A

Qualitative risk analysis methodology from Carnegie Mellon

56
Q

orchestration

A

in context of SIEM, it is the scripted automated response when specific events occur

57
Q

PCI-DSS

A

Security standard to protect credit card numbers in storage, processing and transmission.

Developed by consortium of credit card companies

58
Q

Policy

A

Specifies what must be done or not done in an organization

Defines who is responsible for monitoring and enforcing policy

59
Q

Population

A

Complete set of entities, transactions or events that are the subject of an audit

60
Q

Process

A

collection of procedures that perform a business function

61
Q

Responsible, Accountable, Consulted, Informed (RACI) Chart

A

Tool to assign roles to people and groups according to their responsibilities

62
Q

Recovery Capacity Objective (RCapO)

A

Processing and/or Storage capacity of an alternate system as compared to the normal system.

Usually expressed as a percentage compared to the primary processing site

63
Q

Recovery Capacity Objection (RCO)

A

Measure of the consistency and integrity of processing at a recovery site, compared to the primary site.

Calculated as 1 - (number of inconsistent objects) / (number of objects)

64
Q

Recovery Consistency Objective (RCO)

A

Measure of the consistency and integrity of processing at a recovery site, compared to the primary site.

Calculated as 1 - (number of inconsistent objects) / (number of objects)

65
Q

Recovery Point Objective (RPO)

A

Period of acceptable data loss from an incident.

Usually measured in hours or days

66
Q

Recovery Time Objective (RTO)

A

Time from the onset of an outage until the resumption of service.

Usually measured in hours or days

67
Q

Reperformance

A

audit technique where an IS auditor repeats actual tasks done by auditees in order to confirm they were performed correctly

68
Q

Replication (aka Synchronous replication)

A

activity where data written to a storage system is also copied to another storage system.

Result is the presence of up-to-date data on two or more storage systems, each of which could be in different locations

69
Q

Residual Risk

A

risk that remains after being reduced through other risk treatments

70
Q

Response Document

A

Required action of personnel after a disaster strikes.

Includes business recovery plan, occupant emergency plan, emergency communication plan, contact lists, disaster recovery plan, continuity of operations plan, security incident response plan

71
Q

Risk

A

event scenario that can result in property damage or disruption

72
Q

Risk Appetite (Risk Tolerance)

A

level of risk an organization is willing to accept to pursue its mission and before action is needed to treat the risk

73
Q

Risk Capacity

A

Objective amount of loss an organization can tolerate without its existence being called into question

74
Q

Risk Treatments

A

mitigate
avoid
transfer
accept

75
Q

Roadmap

A

steps needed to achieve strategic objective

76
Q

Sample

A

portion of a population that’s selected for auditing

77
Q

Sample Mean

A

sum of all samples divided by number of samples

78
Q

Sample Standard Deviation

A

measures the spread of values in the sample

Computation of the variance of sample values from the sample mean

79
Q

Sarbanes Oxley

A

law requiring public corporations to enact controls, perform internal and external audits

80
Q

SAS 70

Statement of Accounting Standards No. 70

A

external audit of a service provider

81
Q

Security Incident

A

event where the confidentiality, integrity or availability of information has been compromised

82
Q

Service Delivery Objective (SDO)

A

level of service needed after an event, compared to normal business operations

83
Q

Single Loss Expectancy (SLE)

A

financial loss when a threat is realized

SLE = AV x EF

84
Q

Snapshot

A

a continuous auditing technique

Uses special audit modules embedded in online applications, that sample specific transactions

85
Q

Standard

A

defines technologies, protocols, suppliers, methods used by an IT organization

86
Q

Statements on Standards for Attestation Engagements No. 16 (SSAE 16)

A

Audit standard superseded by SSAE 18

87
Q

Statements on Standards for Attestation Engagements No. 18 (SSAE 18)

A

Audit standard for financial service provider audits

Performed by AICPA (American Institute of CPAs)

88
Q

System and Organization Controls 1 (SOC1)

A

External audit of a service provider

SOC1 audit is performed according to the SSAE 18 standard

89
Q

System and Organization Controls 2 (SOC2)

A

External audit of a service provider on one or more of the following trust principles:

security
availability
processing integrity
confidentiality
privacy

SOC 2 audits performed according to audit standards from the AICPA

90
Q

System and Organization Controls 3 (SOC3)

A

external audit of a service provider like SOC 2

91
Q

Stratified Sampling

A

sampling technique where population is divided into classes (strata) based on the value of one of the attributes

Samples selected from each class (strata)

92
Q

The Open Group Architecture Framework (TOGAF)

A

lifecycle architecture framework

used for the design, plan, implementation and governance of a security architecture

93
Q

Threat modeling

A

activity of looking for potential threats in a business process, information system or application

94
Q

Zachman Framework

A

architecture framework used to describe IT architecture in increasing levels of details

95
Q

Procedure

A

Written sequence of instructions to perform a task

CISM (Certified Information Security Manager) (3 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions