CISSP Domain-1 Flashcards
Q:Accountability vs. Auditing
“Auditing recording a log of the events and activities related to the system and subjects
Accounting (aka accountability) reviewing log files to check for compliance and violations in order to hold subjects accountable for their actions”
confidentiality
no unautorized can access the data ,prevent disclosure of information “for data at Rest Encryption AES 256
for Data at motion Secure transmission protocol SSL TLS IPSEC
for Data in Use clean desk, shoulder surfing, screen view angle protector
PC locking (automatic and when leaving)
“
Integrity
unauthorized modification of DATA
Availability
Authorized people can access data when they need
Threats on CIA
“Cryptanalysis : attack on encryption
Social Engineering
Key logger
IoT: the going number of connected devices
may create backdoor to access another device”
Non repudation
Digital signature with my own private key
Framework
is a logical structure to ducument and organize processes ,”Intl Framework : ISO 27000
National : NIST cybersecurity framework
Regulrity : FDIC cybersecurity assestment tool (CAT)
Industry : HITRUST common security framework Health care
PCS DSS credit card industry
“
Benchmark
“information secuirty benchmark is intended
to help an org indentify their cybesecurity
capabilites and initiatives and compare those
efforts to peers or competetiors in same industry .
“
CIS Benchmark
” >Center for Internet Secuirty
>Hardening Vulnerability Checklist across all platform
>secure configuration guidance
> consensus-derived checklists”
NIST SP800
“National institute of standard and tech NIST SP 800
govt sector configuration guidelines”
NCP
“National Checklist program , us govt repository
of publically configuration checklist of different products
“
NIST cybersecurity framework
“This voluntary Framework consists of standards, guidelines,
and best practices to manage cybersecurity-related risk.”
HITRUST
“HITRUST CSF is a controls-based risk management framework that aligns with and supports the NIST Framework,widely adopted in healthcare
“
NVD
NVD is the U.S. government repository of standards based vulnerability management data represented using the Security Content Automation Protocol (SCAP).
Due Care Vs Due Deligence
“Due care is what a prudent man should do under a similar condition
Due deligence is investigation before engaging in a contact or business”
Downstream Liability
“when your organizations IT system is compromised
and they become source of attack to another systems
then it is called the downstream liability .”
Owners/Custodian/users
“Owners: part of management who will protect subset of information
Custodian : IT guys , implement solution, maintenance monitor
User: follow regular organizational policy”
Security Governance
“security governence emphasizes on securit is no only
itissues.security gooverence is the practices that are taken
to define,support and direct the secuirty efforts of an origaization.
NIST SP 8–053 and NIST800-100 are security frame work for
govt and military ,
but they can be adopted in other organizations also
security governence managed by board of directors.”
Security Management
“Security managment planning ensures that
security policies should be aligned with
the goals , mission and objectives of the organizations.
This includes design and implementing seurity based on
business cases.”
Business Case
“Documented arguent in order define a need
to make decission , its often needed before a start of a new project .It is also necessary to allocate budget.
“
Key note
“The best security plan is useless without the approval from sr management
if company does not practice due care and due deligence then
manager can be held liable for negligence and held accountable
for both asset and financial looses”
Strategic Tactical operational planning
“Strategic planning : 5 years , should include a risk assesment
Tactical Planning 1 year , planning to achieve goals set in
strategic planning , or canbe crafted adhoc based
upon unpredicted events.
Operational plans short term , monthly quarter , step by step
“
Security alignment
” align security policies with
business cases to support orginizational goals”
value delivery
“optimize investments in support of business objectives
“
Synergy
“A synergy is where the whole is greater than the sum of its parts.
In other words, when two or more people or organizations combine their efforts, they can accomplish more together than they can separately”
Governance Ecosystem
"board of directors: > promoting effective governance > Determine risk tolerance > allocate funds > Ensure compliance with laws > Reviewing audut and examination results > Due care due diligence" "Executive Management > strategic alignment > Value delivery > Risk management > process assurance "
Point to be remembered
CISO must apply to Sr management directly not to CIO
OECD privacy principles,privacy framework , every policy follows it Eight driving principles
“Collection Limitation Principle: There should be limits to the collection of personal data and any such data should be obtained by lawful and fair means and, where appropriate, with the knowledge or consent of the data subject.
Data Quality Principle: Personal data should be relevant to the purposes for which they are to be used, and, to the extent necessary for those purposes, should be accurate, complete and kept up-to-date.
Purpose Specification Principle: The purposes for which personal data are collected should be specified not later than at the time of data collection and the subsequent use limited to the fulfilment of those purposes or such others as are not incompatible with those purposes and as are specified on each occasion of change of purpose.
Use Limitation Principle: Personal data should not be disclosed, made available or otherwise used for purposes other than those specified in accordance with [the Purpose Specification Principle] except: (a) with the consent of the data subject; or (b) by the authority of law.
Security Safeguards Principle: Personal data should be protected by reasonable security safeguards against such risks as loss or unauthorised access, destruction, use, modification or disclosure of data.
Openness Principle: There should be a general policy of openness about developments, practices and policies with respect to personal data. Means should be readily available of establishing the existence and nature of personal data, and the main purposes of their use, as well as the identity and usual residence of the data controller.
Individual Participation Principle: An individual should have the right: a) to obtain from a data controller, or otherwise, confirmation of whether or not the data controller has data relating to him; b) to have communicated to him, data relating to him within a reasonable time; at a charge, if any, that is not excessive; in a reasonable manner; and in a form that is readily intelligible to him; c) to be given reasons if a request made under subparagraphs (a) and (b) is denied, and to be able to challenge such denial; and d) to challenge data relating to him and, if the challenge is successful to have the data erased, rectified, completed or amended.
Accountability Principle: A data controller should be accountable for complying with measures which give effect to the principles stated above.”
Openness principles
Openness. The principle of Openness states that an organization shall make its policies and procedures about how it manages personal information readily available. … When providing the information, it should be available in a form that’s generally understandable
