CISSP DOMAIN 1 Flashcards
git r done
Security and Risk Management
Security terminology and Principles, Protection Control Types, Frameworks, Models, Standards, and best practices, Laws and Crimes, Intellectual Property, Data Breaches, Risk Management, Threat Modeling, Business Continuity, Disaster Recovery, Personnel Security, Security Governance
Two Key Concepts
Security and Risk
AIC Triad
Availability
Integrity
Confidentiality
Security Objectives
Availability
Confidentiality
Integrity
Protect Integrity
Access Controls
Intrusion Detection
Hashing
Availability
Reliability and timely access
Integrity
Assurance of the accuracy and reliability of information systems
Confidentiality
Necessary level of secrecy
Threats to Confidentiality
Network monitoring
Shoulder surfing
stealing password files
breaking encryption schemes
social engineering
How to maintain Confidentiality
Encryption
strict access control
data classification
training personnel
Availability Controls
RAID Clustering Load Balancing Redundant power and data line Colocation and offsite rollback Fail over
Integrity Controls
Hashing
Configuration Management
Change Control, Access Control
Software Digital Signing
Transmission cyclic redundancy check (CRC)
Confidentiality Controls
Encryption for data at rest
Whole Disk Encryption
Encryption for data in transit, (IPSEC, TLS, PPTP, SSH,)
Access Control
Encryption for data in transit
IPec
TLS
SSH,
Types of Access Control
Physical and Technical
Transmission CRC
Cyclic Redundancy Check
Vulnerability
Weakness in a system that allows a threat to compromise security
Threat
Potential Danger that can exploit a vulnerability
Threat agent
Person, Process, or employee
Risk definition
Likelihood of a threat source exploiting a vulnerability
Risk function
Ties vulnerability, threat, and likelihood of exploitation
Exposure
instance of being exposed to losses
Control or Countermeasure
Mitigates potential risk
Control functions
Reduce risk an organization faces
Control types
Administrative
Technical
Physical
Administrative Control Types
Security documentation
risk management
personnel security
training
Technical Controls
(also called logical controls) software or hardware components Firewalls IDS encryption identification authentication mechanisms
Physical controls
Security guards
locks
fencing
lighting
Controls must
Must map to threats
Functionalities of Controls
Preventive detective corrective deterrent recovery compensating
Preventive control
Intended to avoid and incident from occurring
Detective Control
Helps identify an incident’s activity and potentially an intruder
Corrective
Fixes components or systems after an incident
Deterrent
Intended to discourage a potential attacker
Recovery
Intended to bring the environment back to regular operations
Compensating controls
Provide alternative measure of control
Preventive Administrative controls
Policies and procedures Effective hiring practices Pre employment background checks Controlled termination processes data classification and labeling Security awareness
Preventive: Physical controls
Badges swipe cards Guards dogs fences locks man traps
Preventive: Technical
Passwords biometrics smart cards encryption protocols, call-back systems, database views constrained user interfaces Antimalware software access control lists firewalls, intrusion prevention system,
A security program is
A framework made up of many entities;
logical, administrative, and physical
ISO/IEC 27000 series
International standards on how to develop and maintain an ISMS. British standard 7799 (BS7799)
7799
British standard for ISMS, 27000 series is based on this
BS 7799
developing standard to provide guidance on how to design, implement policies,processes and technologies to manage risks
BS7799 Part 1
Outlined control objectives and a range of controls to meet those objectives
BS 7799 Part 2
Baselines for organizations could be certified against
ISO/IEC 27000
Overview and vocabulary
ISO/IEC 27001
ISMS requirements
ISO/IEC 27002
Code of practice for information security management
ISO/IEC 27003
ISMS implementation
ISO/IEC 27004
ISMS measurement
ISO/IEC 27005
Risk management
ISO/IEC 27006
Certification body requirements
ISO/IEC 27007
ISMS auditing
ISO/IEC 27008
Guidance for auditors
ISO/IEC 27011
Telecommunication organizations
ISO/IEC 27014
Information Security governance
ISO/IEC 27015
Financial Sector
ISO/IEC 27031
Business Continuity
ISO/IEC 27032
Cybersecurity
ISO/IEC 27033
Network Security
ISO/IEC 27034
Application Security
ISO/IEC 27035
Incident Management
ISO/IEC 27037
Digital collection and preservation
ISO/IEC 27799
Health organizations
Framework
Guideline on how to build an architecture
When developing an architecture
stakeholders first, Views next,
Security through obscurity
Confusion
A security program is
a framework
Clinger-Cohen Act
Requires IT organizations to improve their IT expenditures
Zachman Architecture Framework 6 elements
Two dimensional model 6 elements;
What, How, Where, Who, When, Why
Zachman goal
look at the same organization from different viewpoints
The Open Group Architecture Framework (TOGAF)
Understand the enterprise from 4 different views Business Data Application Technology Is iterative and cyclic
Defense Architecture Framework (DoDAF
Focuses on Command, Control, Communications, computers, intelligence, surveillance, reconnaissance, and processes
Ministry of Defense Architecture Framework (MODAF)
To get data in the right format to the right people as soon as possible
Sherwood Applied Business Security Architecture (SABSA)
Layered Framework What are you trying to do? Why are you doing it? How are you trying to do it? Who is involved? Where are you doing it? When are you doing it? Strategic alignment
Business Enablement means
The core business processes are integrated into the security operating model
Security Effectiveness
deals with metrics meeting Service level agreements achieving ROI meeting set baselines providing management with a dashboard or balanced scorecard
Difference between enterprise and system architectures
Enterprise is the structure of the organization.
System is the structure of the software and computing components
Control Objectives for Information and related Technologies (COBIT) key principles
- Meeting Stakeholder needs
- Covering the enterprise end to end
3, Applying a single integrated framework - Enabling a wholistic approach
- Separating governance from management
Everything in COBIT is linked to
stakeholders through a series of goals.
At any point, we should be able to ask,
“why are we doing this?”
NIST 800-53
Security and privacy controls for Federal information systems
NIST 800-53 control categories
management
operational
technical
COSO Committee on Sponsoring Organizations
Model for corporate governance
Sarbane-Oxley Act
Sends executives to jail for reporting fraudulent accounting.
ITIL
De facto standard for best practices
Six Sigma
Process improvement
Capability Maturity Model Integration CMMI
Level 0 = Nonexistant Level 1 = Unpredictable Processes Level 2 = Repeatable processes Level 3 = Defined Processes Level 4 = Managed processes Level 5 = Optimized processes
Process Life Cycle
Plan and Organize
Implement
Operate and maintain
Monitor and evaluate
Zombies, Bots, Botnets
Compromised system,
Software installed
Multiple systems
Botnets can
carry out DDOS attacks,
transfer spam
Advanced Persistent Threat
Focused and motivated to penetrate a network
Custom developed for a target.
APT activity
Phishing and zero day attack
Back door
Lateral movement
Data gathering
ex-filtrate
Organization for Economic Co-operation and Development (OECD)
Protection of privacy and trans-border flows of personal data.
Organization for Economic Co-operation and Development
OECD principles
Collection Limitation Principle Data Quality Principle Purpose Specification Principle User limitation principle Openness Principle Individualization Principle Accountability Principle
OECD Collection Limitation Principle
Personal data should be limited, obtained lawfully and fair, with the knowledge of the subject
OECD Data Quality Principle
Personal data should be kept complete and current
OECD Purpose specification Principle
Subjects should be notified of the reason for collection
OECD User limitation Principle
Disclosure only by consent of the subject
OECD Security Safeguard Principle
Reasonable protection of data
OECD Openness Principle
Subjects should be able to easily establish existence and nature of the personal data
OECD Accountability Principle
Organizations accountable for complying with other principles
European Union Principles on Privacy
Addresses using and transmitting private information
EU Data Protection Directive
All states in Europe must abide by prionciples to be in compliance
Safe Harbor
Outlines how US based companies can comply with EU principles
Wassenaar Arrangement
Export comtrols for conventional arms and dual use goods and technologies
Civil Code Law System
Used in continental Europe Different from England's Common law Rule based not precedent based Not civil (tort) Most widespread system in the world
Common Law System
Developed in England
Based on previous judgments
Reflects community’s morals and expectations
Led to creation of lawyers
Criminal Law
Based on common law or statutory law
Addresses behavior considered harmful to society
Punishment is loss of freedom or incarceration
Prosecution beyond a reasonable doubt
Civil (tort)
offshoot of criminal law
defendant owes a legal duty to victim
Civil law types
Intentional Wrongs against property Wrongs against a person Negligence Nuisance Dignitary wrongs Economic wrongs Strict labiliy
Administrative Law
Created by administrative agencies.
Customary Law system
Deals with personal conduct and patterns of behavior
Based on rules of the region
Religious Law system
Covers all aspects of life
Mixed law system
Two or more legal sysstems
Trade Secret
Violation of a resource that provides value
Something that is proprietary and important to survival and profitability
Copyright
Protects the right of a creator of original works to control publication and distribution
Covers categories of work
Includes Computer programs and manuals
People are covered for their lifetime plus 70 years
Trademark
Used to protect a word, name, symbol sound, shape or color
Patent
Given to grant legal ownership to an individual or company to exclude others from using or copying
Good for 20 years from date of approval
Patent is the strongest form of intellectual property protection
Software piracy
when intellectual or creative work of an author is used without permission
Freeware
Publicly available software available free of charge.
Can be copied, studied,modified
Shareware
User can try out software then buy it
Commercial software
Sold commercially
academic software
provided at reduced cost
Personal Identifiable Information
data that can uniquely identify contact, or locate a single person
HIPPA
Framework and guidelines to ensure security, integrity, , and privacy
Health Information Technology and Clinical Health Act (HITECH)
Expands HIPPA
USA Patriot Act
Reduces restrictions on law enforcement agencies
Graham-Leach-Bliley ACT GLBA
Financial Privacy Rule
Safeguards Rule
Pretexting Protection
Personal Information Protection and Electronic Documents Act
Canadian law protects personal information
Payment Card Industry Data Security Standard PCI-DSS
Credit card industry program
12 requirements
Use firewalls, Do not use vendor defaults, Protect stored cardholder data, Encrypt,
Employee privacy
Employee must be aware of monitoring, Monitoring must be work related, Must be explained to employee by policy and constantly reminded, Signed Acceptable Use Policy.
Reasonable Expectation of Privacy
Employees must be informed of monitoring or privacy rights will be violated
Data Breach
The opposite of privacy
Security Policy
Overall general statement by senior management.
Must be technology independent
Regulatory Policy
Detailed and specific industry regulations
Standards
Mandatory activities actions or rules
Baseline
Comparison for future changes
Guidelines
Recommended actions and operational guides
Risk Management
Process of identifying and assessing risk, reducing it to an acceptable level, and ensuring it remains at that level
Risk categories
Physical, Human interaction, Equipment malfunction, Inside/outside attacks, misuse of data, Loss of data, application error
NIST SP 800-39 tiers to risk management
Organizational, Business Process, Information Systems,
NIST 800-39 four components of risk management
Frame Risk
Assess Risk
Respond to Risk
Monitor Risk
Threat Modeling
Process of describing feasible adverse effects on our assets caused by threat sources
Interested in vulnerabilities in our systems that could lead to compromise
Who would want to exploit this vulnerability and why
Determine whether a given threat source has the means to attack
The weakest link in security
People
Social Engineering
Process of getting a person to violate a security procedure or policy
Attack Tree
Vulnerability-threat-attack triad
Risk Assessment
method of identifying vulnerabilities and threats
Risk Analysis
Used to ensure that security is cost effective, relevant, timely, and responsive to threats
Four goals of Risk Analysis
Identify assets
Identify vulnerabilities and threats
Quantify the probability and business impact of the threat and cost of the countermeasure
Risk Analysis provides
a cost/benefit comparison
Business and Security objectives must be
Aligned
Purpose and scope are determined by
Senior Management
Cascading errors
Errors passed on to other processes
Loss potential
What would be lost if a threat agent exploited a vulnerability
Delayed loss
Secondary in nature like reputation, market share, late penalties, civil suits, delayed collection of funds
NIST 800-30
Guide for conducting Risk Assessments
NIST 800 30 Risk Assessment steps
Prepare for the assessment
Conduct the assessment
Communicate results
Maintain assessment
FRAP
Facilitated risk analysis process.
Qualitative methodology
only focused on systems that really need assessing
Used to analyze one system, application, or business process at a time
Operationally Critical Threat, Asset, and vulnerability evaluation (Octave)
Created by Canegie Mellon
Places people who work in the areas in decision making positions
Used to assess all systems
AS/NZS 4360
Focused on the health of a company
ISO 27005
International Standard for risk management ISMS
Failure Mode Effect Analysis (FMEA)
Determines functions, identifies functional failures, and assesses the causes of failure
Frequently used in product development and operational environments
Identifies single point of failure
FMEA Steps
Start with a block diagram
Consider what happens if each block fails
Draw a table with failures paired with effect
Correct the design of the system
Have several engineers review
CRAMM Central computing and telecom Agency Risk Analysis and Management Method
Works in stages
Define objectives
Assess Risks
identify countermeasures
Two approaches to risk analysis
Qualitative and Quantitative
Quantitative Risk Analysis
Assign monetary and numeric values to all elements
Qualitative Analysis
Assigns subjective ratings to risk as in Red, Yellow, and Green
Single Loss Expectancy SLE
Dollar amount assigned to a single event
Asset Value x Exposure Factor =
SLE
Exposure Factor EF
percentage of loss a realized threat could have on an asset
SLE x Annualized Rate of Occurrence =
Annualized Loss Expectancy ALE
Qualitative Risk Analysis
Walk through different scenarios of risk possibilitoes and rank the seriousness of the threats
Qualitative Risk Analysis includes
judgement, best practices, intuition, and experience
To gather qualitative data
Delphi, Brainstorming, story-boarding, focus groups, surveys, questionnaires, checklists, one-on-one meetings, and interviews
Value of a safeguard to the company =
(ALE before implementing a safeguard) - (ALE after a safeguard) - (Annual cost of a safeguard)
Residual Risk =
threats x vulnerability x asset value = total risk (threats x vulnerability x asset value) x controls gap = residual risk
or
Total Risk - countermeasure = residual risk
Risk can be dealt with in 4 ways
Transfer
avoid
reduce
accept
Transfer risk
insurance
Risk avoidance
Discontinue risk behavior
Accepts the Risk
Acknowledge the risk and decides to live with it without countermeasures
SAS 70
an internal controls audit carried out by a third party auditing organization
NIST RMF (SP 800-37r1)
US government system life-cycle approach to Risk management
ISO 31000-2009
Risk management framework
ISACA
Working group of academic and corporate risk professionals
COSO Enterprise Risk Management
Generic. Not IT centric
NIST RMF 800-37 six step process
- Categorize information system
- Select Security controls
3 Implement security controls
4 Assess security controls
5 Authorize information system
6 Monitor security controls
Goal of disaster recovery
Minimize the effects of a disaster or disruption
Continuity planning
provides methods and procedures for dealing with long term outages and disasters
NIST 800-34
Continuity Planning Guide for Federal Information Systems
Steps
- Develop the continuity planning policy statement
- Conduct the business impact analysis
3, Identify preventive controls - Create contingency strategies
5 Develop an information system contingency plan
6 Ensure plan testing, training and exercises
7 Develop plan maintenance
SWOT
Strengths
Weaknesses
Opportunities
Threats
Due Diligence
Doing everything in one’s power to prevent a bad thing from happening by setting appropriate policies researching the threats and incorporating them into a risk management plan
Due Care
Taking precautions that a reasonable and competent person would take.
Prudent man rule
Business Impact Analysis
Functional analysis.
BIA Risk Assessment =
Threat x Impact x Probability + time`
Threats can be
Man made, natural, or technical
BIA Steps
- Select individuals to interview for data gathering
- Create Data gathering techniques (surveys, questionnaires, qualitative and quantitative approaches
- Identify company’s critical functions
- Identify the resources these functions depend upon
- Calculate how long these functions can survive without these resources
- Identify vulnerabilities and threats to functions
- Calculate the risk for each different business function
- Document findings and report to management
Maximum Tolerable Downtime (MTD)
Outage time that can be endured
MTD estimates for each business function and asset
Critical = minutes to hours Urgent = 24 hours Important = 72 hours Normal = 7 days Nonessential = 30 days
Separation of Duties
One individual cannot complete a critical task alone.
Is a preventive administrative control to reduce fraud
Collusion
at least 2 people are working together to cause description or fraud
Two variations of separation of duties
Split knowledge and dual control
Split knowledge
No one has all the details
Dual control
Two people work together
Rotation of duties
administrative detective control
Put in place to uncover fraud
Mandatory vacations
Someone else discovers fraudulent errors or activities
Non Disclosure Agreements
Protect the company and information
Security Awareness
What
Security Training
How
Security Education
Why
ISO/IEC 27004
Used to assess the effectiveness of an ISMS and controls
ISC2 Code of Ethics
Protect society, the common good, necessary public trust and confidence, and the infrastructure
Act honorably, honestly, justly, responsibly and legallly
Provide diligent and competent service to principals
Advance and protect the profession
Internet Architecture Board
Depends on availability and accessibility
IAB unethical and unacceptable behavior
Purposely seeking unauthorized access to internet resources Disrupting the intended use of the internet Wasting resources (people, capacity, and computers) Destroying the integrity of computer based information Compromising the privacy of others Conducting internet wide experiments in a negligent manner
Asset
Includes people, partners, equipment, facilities,reputation, and information
Asset life cycle stages
Acquisition
Use
Archival
Disposal
Data Backup
Copy of data currently in use
Data Archive
Copy of data no longer in use, but kept
Usually removed from its original location
Rationale behind assigning values to data (Classification)
To gauge the amount of funds and resources that should go to protecting the data
Purpose of Data Classification
Indicate the level of Confidentiality, Integrity, Availability
Commercial Classifications
Public
Sensitive
Private
Confidential
Government Classifications
Confidential
Unclassified
Sensitive but unclassified
Secret
Top Secret
Public classification
Disclosure not welcome.
No adverse impact if disclosed
Sensitive Classification
Requires special precautions.
Higher than normal protection
Private Classification
Personal information for company use
Government Classifications
Confidential Unclassified Sensitive but unclassified Secret Top Secret
Always carries the ultimate responsibility for the organization
Senior Management
Has day to day management responsibilities of an organization
CEO
Responsible for a corporation’s accounting and financial activities
CFO
Responsible for strategic use and management of information systems
CIO
Ensuring that customer, company, and employee data are kept safe
Chief Privacy Officer
The amount of control an individual should be able to have and expect
Privacy
Mechanisms that can be put into place to provide
Privacy
Responsible for understanding the risks the company faces and for mitigating risks to an acceptable level
Chief security officer
Member of management who is in charge of a specific business unit. Ultimately responsible for a sub set of information. Decides on data classification.
Data Owner
Responsible for maintaining and protecting data
Data Custodian
Responsible for systems that may hold data owned by different data systems
System owner
Responsible for implementing and maintaining specific network security devices and software in the enterprise. May include creating new accounts implementing new security software and issuing passwords
Security Administrator
User Manager responsible for user actions
Supervisor
Responsible for approving or rejecting requests to change systems
Change control Analyst
Ensures data is stored in a way that makes most sense
Data Analyst
Any individual who routinely uses data for work related tasks
User
Periodically checks that everyone is doing what they are supposed to be doing
Auditor
Data Retention policy should include
What data do we keep
How long do we keep it
Where do we keep the data
Taxonomy
Scheme for classifying data
Classification
Sensitivity will determine controls
Normalization
Tagging schema to keep data searchable
Indexing
Makes data searchable
Electronic Discovery Reference Model (EDRM) steps
- Identification of data = data required by the order
- Preservation
- Collection
- Processing
5 Review - Analysis
- Production
- Presentation
Data Processors
Must understand acceptable use.
Key issues are training and auditing
Data Remanence 4 approaches
Overwriting
Dequassing
Encryption
Physical Destruction
NIST SP 800-88
Guidelines for media sanitation
Data at Rest
Resides in external or auxillary devices like
hard drives
SSDs
optical disks
tape
Data in motion
moving between computer nodes should be encrypted by TLS 1,1 and later, or IPSEC.
Weaknesses are in backward compatibility,
TLS relies on
digital certificates to certify one or both endpoints.
Server uses a certificate. but the client doesn’t
Man in the middle attack
attacker intercepts one way authentication between server and client
Virtual Private Networks
used to provide secure connections between remote users and corporate resources by trusted channels
Data in use
data residing in primary storage devices such as volatile memory. Data in memory is not encrypted
Side channel attack
information leaked by a cryptosystem.
Cryptosystem
Connects 2 channels. A plaintext channel and an encrypted channel
Side channel
by product of a plaintext channel connecting with an encrypted channel
Heartbleed
2014 demonstrated unchecked boundaries could expose information from one process to other processes running on the same system
When media is erased or cleared it is
sanitized
Clearing media is acceptable when
media will be used in the same environment for the same purposes
Media not susceptible to degassing
Optical media, and overwriting may not be effective when dealing with solid state drives
Guiding principle for method and cost of data erasure
Recovery must cost more than the value of the data
Media management tasks
Tracking
Effectively implementing access controls
Tracking the number and location of backup versions
Documenting the history of changes to media
Ensuring environmental conditions do not endanger media
Ensuring media integrity
Inventory the media on a scheduled basis
Carrying out secure disposal activities
Internal and external labeling
Internal and external labeling includes
Date created Retention period Classification level Who created it Date to be destroyed Name and version
Most common cause of breach
Negligence. Lack of awareness and discipline among employees
Data loss
do not know where data is
Data leak
Confidentiality has been comprised
Risk at data life cycles
When data moves from one stage to another
Misuse cases describe
threat actors and tasks they want to perform on a system
Use cases
used by system analysts to document tasks that authorized actors perform on a system
Resiliency
ability to deal with challenges
