Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Cissp > Cissp Domain 1 > Flashcards

Cissp Domain 1 Flashcards

1
Q

Difference between least privilege and need to know

A

Least privilege is all about type of access rights - read , write

Need to know - required access

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What are the 3 perspectives integrity can be examined?

A

Modifications from unauthorised

Modifications from authorised

Data to be consistent internal and external

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Availability concepts

A

Usability

Accessibility

Timeliness : low latency response

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What is Authorization about ?

A

Rights and previliges

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Accountability is dependent on ?

A

Tracking activities of individual

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Defense in depth

A

Layering or parallel

Multiple control in place

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Abstraction

A

Simplify security by enabling you to assign security controls, restrictions or permissions to a group of objects

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Data hiding Vs security through obscurity

A

Intentionally position data being accessed by unauthorised users

Hiding data in plain sight

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What is purpose of Security Governance?

A

Alignment of security function to business stratergy, Goals , mission and objectives

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What are the 3 types of Plans devloped by security management?

A

Stratergic: Long term - 5 years

Tactical:Midterm - 1 Year

Operational: Product design, system deployment

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What are the process to be considered when evaluating 3rd party ?

A

On site assessment

Document exchange and review

Process/policy review

Third party audit

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What is role of asset owner ?

A

To classify assets

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What is role of custodian?

A

Implementation of prescribed security protection

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

6 key principles of cobit ?

A

Provide stakeholders value

Holistic approach

Dynamic Governance system

Governance distinct from management

Tailored to enterprise needs

End to end governance system

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What is Security policy?

A

Scope of security needed by organization and discusses assets needed protection

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What is AuP ?

A

Level of acceptable performance and behaviour and activity

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Security standards?

A

Compulsory documents for homogeneous use of hardware

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Baseline

A

Minimum level of security that every system to meet

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Guidelines

A

Offer recommendations on how standard and baseline to be implemented

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

SoP

A

Detailed step by step implement a security mechanism, control or solution

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Threat modelling

A

Proactive measure during design and development

Reactive after product has been designed

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

How to identify threats? (Focus area)

A

Focused on assets

Focused on attackers

Focused on software

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

STRIDE

A

Spoofing

Tampering

Repudiation

Information disclosure

DoS

Elevation of prevlige

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Process of attack stimulation and threat analysis - 7 steps

A

Definition of objectives

Definition of technical scope

Application decomposition and analysis

Threat analysis

Weakness and vulnerability analysis

Attack modelling and simulation

Risk analysis and management

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

Steps in Threat modelling - 5

A

Identify threats

Determining and diagram ing potential threats

Perform Reduction analysis

Prioritisation and response

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

What does diagramming potential attacks ?

A

Creation of diagram of the elements involved in a transaction along with data flow and previliges boundaries

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

What is reduction analysis and decomposition process ?

A

Gain greater understanding of the logic of the product, it’s internal components as well as it’s interactions with external elements

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

What are 5 key concepts in decomposition process ?

A

Trust boundaries- level of trust or security changes

Data flow paths - Movement of data between locations

Input points - location where external input is received

Previliged operations - Any activity that requires greater previliges than of a user account

Details about security stance and approach

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

DREAD system to rate threats

A

Damage potential

Reproducibility

Exploitablity

Affected users

Discoverablity

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

What is Concept of supply chain ?

A

Most computers, devices, networks , systems and cloud services are not built by a single entity

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

What is SLR ?

A

Service level requirment a statement of the expectations of service and performance from the product or service of a vendor

Prior to SLA and should incorporate above

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

Collusion in crime

A

When several people work together to prepetrate crime

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

Purpose of mandatory vacation

A

Detect abuses, verify the work tasks and previliges

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

Mutiparty risk

A

Several entities or organisation involved in project

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

Outsourcing

A

Used to describe the use of an external third party such as vendor consultant

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

Privacy

A

Active prevention of unauthorised access to pii

Freedom from unauthorised access to info deemed personal or confidential

Freedom from being observed, monitored or examined without consent or knowledge

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

Primary goal of Risk management

A

Reduce risk to an acceptable level

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

2 primary elements of risk management

A

Risk assessment: PXI

Risk response : Evaluating countermeasures, safeguards and security controls using c/b analysis

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

Countermeasures Vs Safeguards

A

Protection mechanism

Anything that removes or reduces a vulnerability or protects against one or more specific threats

40
Q

Cyclic relationship of risk elements

A

Threats exploits vulnerabilities which results in exposure.

Exposure is risk and risk is mitigated by Safeguards which are endangered by threats

41
Q

Primary goal of Risk analysis

A

C-b Safeguards are applied

42
Q

Risk management steps

A

Threat based RA or Asset based RA

1.Asset valuation

2.Identify threats and vulnerabilities

3.Risk assessment Analysis

  1. Quantitative:
    AV and Threat Identification
    EF
    SLE
    ARO
    ALE
    Research countermeasures
    C-B countermeasures
  2. Qualitative: Scenario based

Brainstorm
Delphi : Anonymous feedback
Interviews

Risk Response

  • Reduction
  • Transfer
  • Deterrence
  • Avoidance
  • Acceptance
  • Reject
43
Q

6 major elements of Quantitative RA

A

AV
EF
SLE
ARO
ALE
Perform c-b countermeasures

44
Q

Define exposure factor aka loss potential

A

Percentage of loss that an organisation would experience if specific assets were violated by risk

45
Q

Risk appetite Vs Risk capacity Vs Risk Tolerance Vs Risk limit

A

Total amount of risk that organization is willing to shoulder in aggregate across all assets

Level of risk an organisation is able to shoulder

RA>RC

Amount of risk that an organization will accept per individual asset threat pair

Maximum level of risk above risk target that will be tolerated before further risk management actions are taken

46
Q

Residual risk

A

Upper management has chosen not to implement a response

47
Q

Total risk, Inherent risk and residual risk

A

No Safeguards

Before security control

After security control

48
Q

Total risk

A

Amount of risk an organisation would face if no safeguards implemented

ThreatsVulnerabilityAsset Value

49
Q

Control Gap

A

Total risk- Residual risk

50
Q

Control risk

A

Risk introduced by introduction of countermeasures

51
Q

ALE1 and ALE2- Safeguards evaluation to see if safeguards are cost effective

A

For each asset threat pairing an inventory of potential and available Safeguards must be made

ALE1 - Pre Safeguards

ALE 2- Post Safeguards

52
Q

Annual cost of the Safeguards (ACS) and value of Safeguards to company

A

[ALE1 - ALE2] - ACS = Value of Safeguards to company

If it’s-ve not good choice

53
Q

C/B analysis of Safeguards 3 elements

A

Pre safeguards ALE for an asset threat pairing ( ALE1)

Potential post Safeguard ALE for an asset threat pairing (ALE2)

ACS

54
Q

Categories of security controls

A

Administrative: Management controls,
Policy, procedure, hiring practices

Technical or logical: H/W or S/W mechanism to manage access and provide protection for IT resources

Physical control

55
Q

Preventive control

A

Unwanted or unauthorised activity

Fences, locks, SoD, job rotation, dlp

56
Q

Deterent control

A

Deployed to discourage security policy violations

CCTV, awareness

57
Q

Detective control

A

Discover or detect unwanted or unauthorised activity

58
Q

Corrective

A

Modifies the environment to return systems to normal after an unwanted or unauthorised activity has occurred

Reboot System, IPS, back and restore, antimalware solution

59
Q

Recovery controls

A

Extension of corrective controls

Attempt to repair or restore resources after a security violation

BCP, DR, Reciprocal agreement, cloud providers

60
Q

Directive controls

A

Deployed to direct to force or encourage compliance with security policies

Guidance from security gaurd, monitoring and supervision

61
Q

Security controls assessment

A

Effectiveness of security mechanism, evaluate toughness of the risk management process of the organization, produce a report of relative strengths and weakness of devloped security infra

62
Q

EOL vs EOSL

A

EOL: Manufacturer no longer produces product.

Service and support may continue for a period of time after EOL

EOSL: Those systems that longer receiving updates and support from vendor

63
Q

Risk management framework

A

Prepare : Process initiation

Categorize

Select

Implement: Controls

Asses

Authorize

Monitor

64
Q

Two primary forms: Social engineering

A

Convincing someone to perform an unauthorised operation

Convincing someone to reveal confidential information

65
Q

Social engineering principles

A

Authority

Intimidating

Consensus: Social proof or following herd

Scarcity

Familiarity

Trust

66
Q

Eliciting information

A

Research method in order to craft a more effective pretext

Pretext - False statement crafted to sound believable

67
Q

Prepending in email

A

Adding RE: or FW: infront of message to make it look genuine

It can fool spam filters

68
Q

Drive by download

A

Installs itself without users knowledge
It takes advantage of web browser vulnerability or plug ins

69
Q

How can you stop shoulder surfing?

A

Dividing worker groups by sensitivity levels and limiting access to certain areas of building by using locked doors

70
Q

Invoice scam and protection

A

To steal funds by providing false invoice

Proper file sharing mechanism

71
Q

Impersonation Vs Masquerading

A

Identity theft and identity fraud are also related to impersonation. Impersonation is
the act of taking on someone’s identity. This might be accomplished by logging into their account with stolen credentials or claiming to be someone else when on the phone.

Masquerading- amateurishly

72
Q

Tailgating Vs piggyback

A

Unauthorised entry gains under authorisation of valid worker without knowledge

Tricking victim into providing consent - Piggyback

73
Q

Typo squatting

A

User is re directed to fake website after typo

74
Q

Difference between awareness, training and education

A

Awareness - Baseline for understanding

Training - Bring change

Education - Certificate

75
Q

Difference between BCP and DR ?

A

Stratergic focused at high level and center around business process and operations

DR- Tactical and describe technical details such as recovery sites, backups and fault tolerance

76
Q

4 main steps of BCP

A

Project scope and planning

BIA

Continuity planning

Approval and implementation

77
Q

Project scope and planning

A

Organization review

  • Identify core department
  • Critical support services to upkeep system

BCP team selection

Resource requirements
BCP devlopment
BCP testing, training and maintenance
BCP implementation

Legal and regulatory requirements

78
Q

BIA

A

Identifies business process and tasks that are critical to an organisation

Impact assessment
1. Quantitative impact assessment

  • AV
    *MTD or MTO
  • RTO
    *RPO
  1. Qualitative impact assessment

Identifying priorities

Create a comprehensive list of critical business functions and rank them in order of importance

Risk identification - Purely Qualitative

  • Natural
  • Man made

Likelihood assessment

ARO for the risks

Impact analysis

EF
SLE
ALE

Resource prioritisation
Risk to be prioritised based on ALE to be addressed

Merge both quantitative and qualitative risks

79
Q

Continuity planning - 2 primary sub tasks

A

Devlop continuity stratergy
1. Stratergy devlopment

Implementation of zero down time posture

Risk to be acceptable and mitigated based on MTD

  1. Provision and processes

Meat of BCP

Designs procedures and mechanism that will mitigate the risks deemed unacceptable during strategy development

Three categories to be protected

People

Building and facilities- Hardening and alternate sites

Infrastructure - “

80
Q

Plan approvals and implementation

A

Plan approvals

Plan implementation- Implementation of resources, Deploying resources

Training and education

BCP documentation:

Continuity planning goals

1.Statement of importance: Address employee on why we need BCP

2.Statement of priorities

  1. Statement of organisation responsibility
  2. Statement of urgency and timing
  3. Risk assessment
  4. Risk acceptance/Mitigation
  5. Vital records program: Where critical records will be stored and backups
  6. Emergency response guidelines
  7. Maintanence
  8. Testing and exercise
81
Q

Civil law

A

Govern matters that are not crime

Difference between civil and criminal law is how it’s enforced

  • govt. through enforcement authorities does not get involved in civil law
82
Q

Administrative laws

A

Immigration policies

83
Q

Intellectual property

A

Intangible assets

84
Q

Copyright

A

Expression of ideas

Protection against unauthorised duplication

85
Q

Trademark

A

Avoid confusion

Words, slogan and logos

86
Q

Patents

A

IP rights of inventors

3 main requirements:

  • Invention must be new
  • Invention must be useful
  • Invention must not be obvious
87
Q

Trade secrets

A

IP absolutely critical to business could damage if disclosed

Patents and copyright can be protected using trade secrets but:

  • Removes secrecy
  • Protection limited period of time
88
Q

Liscencing types

A

Contractual: vendor and customer

Shrink wrap: Agreement acknowledgement outside of sw package

Click through: Browser click

Cloud services: Same as above

89
Q

Import/Export

A

Transborder data flow of IP, PII, new tech

90
Q

Key provision of GDPR

A

Lawfulness, fairness and transparency

Purpose limitation

Data minimisation

Accuracy

Storage limitation: Right to be forgotten

Security

Accountability

91
Q

4 actions of project scope and planning

A

Structured analysis of organisation

Creation of BCP team

Assessment of available resources

Analysis of legal and regulatory landscape

92
Q

Risk acceptance

A

Taking no action and accept

93
Q

IAAAA

A

Identification Identification is claiming to be an identity when attempting to access a secured area or system.
Authentication Authentication is proving that you are that claimed identity. Authorization Authorization is defining the permissions (i.e., allow/grant and/or deny)
of a resource and object access for a specific identity or subject.
Auditing Auditing is recording a log of the events and activities related to the system and subjects.
Accounting Accounting (aka accountability) is reviewing log files to check for com- pliance and violations in order to hold subjects accountable for their actions, especially violations of organizational security policy.

94
Q

SLR

A

An SLR is a statement of the expectations of service and performance from the product or service of a vendor. Often, an SLR is provided by the customer/client prior to the establishment of the SLA (which should incorporate the elements of the SLR if the vendor expects the customer to sign the agreement).

95
Q

What is security control assessment and its goal?

A

A security control assessment (SCA) is the formal evaluation of a security infrastructure’s individual mechanisms against a baseline or reliability expectation. The SCA can be per- formed in addition to or independently of a full security evaluation, such as a penetration test or vulnerability assessment.
The goals of an SCA are to ensure the effectiveness of the security mechanisms, evaluate the quality and thoroughness of the risk management processes of the organization, and pro- duce a report of the relative strengths and weaknesses of the deployed security infrastructure.

Cissp (9 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions