Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CISSP > CISSP Domain 1 - Flashcards > Flashcards

CISSP Domain 1 - Flashcards

1
Q

CIA - Confidentiality

A
  • High level of assurance that info is kept from unauthorized parties
  • Attacks: Shoulder surfing, social engineering, decryption, brute-force
  • Defense: Encryption, access controls
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

CIA - Confidentiality - Definition

A

High level of assurance that info is kept from unauthorized parties

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

CIA - Confidentiality - Attacks

A
  • Shoulder surfing
  • Social engineering
  • Decryption
  • Brute-force
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

CIA - Confidentiality - Defense

A
  • Encryption

* Access Controls

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

CIA - Confidentiality - Related concepts

A
  • Sensitivity: What could happen if this info was disclosed
  • Discretion: When you choose to control the information disclosure to limit damage
  • Concealment: Act of hiding or preventing disclosure
  • Secrecy: Keeping something secret
  • Privacy: Keeping sensible info confidential
  • Seclusion: Storing something in an out-of-the-way manner
  • Isolation: Keeping something separated from others
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

<p>Sensitivity</p>

A

<p>What could happen if this info was disclosed</p>

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

<p>Discretion</p>

A

<p>When you choose to control the information disclosure to limit damage</p>

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

<p>Concealment</p>

A

<p>Act of hiding or preventing disclosure</p>

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

<p>Secrecy</p>

A

<p>Keeping something secret</p>

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

<p>Privacy</p>

A

<p>Keeping sensible info confidential</p>

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

<p>Seclusion</p>

A

<p>Storing something in an out-of-the-way location. This<br></br>
location can also provide strict access controls. Seclusion can help enforcement of<br></br>
confidentiality protections</p>

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

<p>Isolation</p>

A

<p>Keeping something separated from others</p>

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

<p>CIA - Integrity</p>

A

<p>When info remains unaltered by unauthorized parties<br></br>
Approaches:<br></br>
Preventing intentional unauthorized modification<br></br>
Preventing accidental modifications<br></br>
Ensure internal and external consistency of the information</p>

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

<p>CIA - Availability</p>

A 
<p>Usable access to a resource is always provided in a timely and uninterrupted manner<br>
* Examples:<br>
- Load Balancing<br>
- Clustering<br>
- Backups<br>
- Redundancy</p>
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

<p>AAA (IAAAA)</p>

A

<p>- Identification: A subject claims a specific identity<br></br>

- Authentication: A subject proves he is who he claims to be<br></br>
- Authorization: Deciding what the subject can access and how can it be used<br></br>
- Auditing: Recording activities of the subject in a log<br></br>
- Accountability: Reviewing the log to check for compliance</p>

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

<p>From Vulnerability to Exposure - Vulnerability</p>

A

<p>A weakness in a system that allows a threat to compromise security<br></br>
Examples:<br></br>
* AP without security enabled<br></br>
* Too many ports allowed on a firewall<br></br>
* Unneeded service running on a server</p>

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

<p>From Vulnerability to Exposure - Exploit</p>

A

<p>Occurs when a vulnerability is taken advantage of by an attacker</p>

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

<p>From Vulnerability to Exposure - Threat</p>

A

<p>Danger that a vulnerability will be exploited</p>

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

<p>From Vulnerability to Exposure - Threat Agent</p>

A

<p>Entity that exploits a vulnerability</p>

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

<p>From Vulnerability to Exposure - Risk</p>

A

<p>The likelihood that a threat agent will exploit a vulnerability combined with the damage that could result</p>

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

<p>From Vulnerability to Exposure - Exposure</p>

A

<p>Single real-world instance of a vulnerability being exploited by a threat agent</p>

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

<p>From Vulnerability to Exposure - Control</p>

A

<p>Countermeasure put into place to mitigate the risk</p>

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

<p>Controls - Categories</p>

A

<p>* Administrative Controls: Controls put in place by management<br></br>
Examples<br></br>
Training<br></br>
Security Policy<br></br>
* Technical Controls: Software elements such as hashing, encryption or authentication enforcement<br></br>
* Physical Controls: Controls that are physical<br></br>
* Examples<br></br>
- Lighting<br></br>
- Fences<br></br>
- Keycards<br></br>
- Security Guards</p>

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

<p>Controls - Functions</p>

A

<p>* Preventative: Avoid an incident<br></br>

* Corrective: Fix a component or system<br></br>
* Deterrent: Discourage an attacker<br></br>
* Detective: Identify an intruder<br></br>
* Recovery: Bring environment back to normal operation<br></br>
* Compensating: Alternative control if the first choice is unavailable</p>

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

<p>Security Frameworks - ISO 27000 Series - BS7799</p>

A

<p>* Created in 1995<br></br>
* Published by British Standards Institute<br></br>
* Outlines how an ISMS should be created and maintained<br></br>
* Part 1<br></br>
Describes controls<br></br>
* Part 2<br></br>
Shows how an ISMS can be setup</p>

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

<p>Security Frameworks - ISO 27000 Series (1-8,11, 14-15,31-35,37,799)</p>

A 
<p>ISO 27000<br>
Overview and vocabulary for the rest of the 27000 series<br>
ISO 27001<br>
Standard for creation, implementation, control and improvement of ISMS<br>
ISO 27002<br>
General guidelines for implementing an ISMS<br>
ISO 27003<br>
ISMS implementation<br>
ISO 27004<br>
ISMS measurement<br>
ISO 27005<br>
Risk management<br>
ISO 27006<br>
Certification body requirements<br>
ISO 27007<br>
ISMS auditing<br>
ISO 27008<br>
Guidance for auditors<br>
ISO 27011<br>
Telecommunications organizations<br>
ISO 27014<br>
Information security governance<br>
ISO 27015<br>
Financial sector<br>
ISO 27031<br>
Business continuity<br>
ISO 27032<br>
Cybersecurity<br>
ISO 27033<br>
Network security<br>
ISO 27034<br>
Application security<br>
ISO 27035<br>
Incident management<br>
ISO 27037<br>
Digital evidence collection and preservation<br>
ISO 27799<br>
Health organizations</p>
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

<p>ISO 27000</p>

A

<p>Overview and vocabulary for the rest of the 27000 series</p>

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

<p>ISO 27001</p>

A

<p>Standard for creation, implementation, control and improvement of ISMS</p>

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

<p>ISO 27002</p>

A

<p>General guidelines for implementing an ISMS</p>

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

<p>ISO 27003</p>

A

<p>ISMS implementation</p>

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

<p>ISO 27004</p>

A

<p>ISMS measurement</p>

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

<p>ISO 27005</p>

A

<p>Risk management</p>

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

<p>ISO 27006</p>

A

<p>Certification body requirements</p>

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

<p>ISO 27007</p>

A

<p>ISMS auditing</p>

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

<p>ISO 27008</p>

A

<p>Guidance for auditors</p>

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

<p>ISO 27011</p>

A

<p>Telecommunications organizations</p>

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

<p>ISO 27014</p>

A

<p>Information security governance</p>

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

<p>ISO 27015</p>

A

<p>Financial sector</p>

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

<p>ISO 27031</p>

A

<p>Business continuity</p>

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
40
Q

<p>ISO 27032</p>

A

<p>Cybersecurity</p>

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
41
Q

<p>ISO 27033</p>

A

<p>Network security</p>

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
42
Q

<p>ISO 27034</p>

A

<p>Application security</p>

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
43
Q

<p>ISO 27035</p>

A

<p>Incident management</p>

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
44
Q

<p>ISO 27037</p>

A

<p>Digital evidence collection and preservation</p>

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
45
Q

<p>ISO 27799</p>

A

<p>Health organizations</p>

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
46
Q

<p>Security Frameworks - Enterprise Architecture Development - Introduction</p>

A

<p>* Addresses the structure and behavior of an organization<br></br>

* It's a guidance on how to build an architecture<br></br>
* Allows each group of people within an organization to view the business in terms they can understand</p>

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
47
Q

<p>Security Frameworks - Enterprise Architecture Development - Zachman</p>

A

<p>* Created by John Zachman in the 80s<br></br>
* This framework is not security oriented, but it is a good template to work with because it offers direction on how to understand an actual enterprise in a modular fashion<br></br>
* 2-dimensional matrix<br></br>
X-axis<br></br>
5 different audiences<br></br>
Y-axis<br></br>
6 different views</p>

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
48
Q

<p>Security Frameworks - Enterprise Architecture Development - Zachman (audiencies - views)</p>

A

<p>Audiences:<br></br>

* Executives<br></br>
* Business Managers<br></br>
* System Architects<br></br>
* Engineers<br></br>
* Technicians<br></br>
* Entire enterprise</p>

<p>Views<br></br>

* What<br></br>
* How<br></br>
* Where<br></br>
* Who<br></br>
* When<br></br>
* Why</p>

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
49
Q

<p>Security Frameworks - Enterprise Architecture Development - TOGAF</p>

A

<p>* Created by US DoD<br></br>
* Architecture types<br></br>
Business<br></br>
Data<br></br>
Application<br></br>
Technology<br></br>
* Architecture Development Method (ADM)<br></br>
Used to create each type<br></br>
The last step feeds back into the first step<br></br>
After each iteration, the process has been improved to reflect changing requirements<br></br>
Each iteration addresses each of the four views</p>

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
50
Q

<p>Security Frameworks - Enterprise Architecture Development - Military Oriented</p>

A

<p>* Department of Defense Architecture Framework:<br></br>
- Involves things as command, control, surveillance and reconnaissance<br></br>
- One of its primary objectives is to ensure a common communication protocol and standard payloads<br></br>
* Ministry of Defence Architecture Framework<br></br>
- British version of DoDAF</p>

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
51
Q

<p>Security Frameworks - Enterprise Architecture Development - Sherwood Applied Business Security Architecture (SABSA)</p>

A 
<p>* It's an Enterprise Security Architecture: Ensures an organization has an effective ISMS in place<br>
* Similar to Zachman<br>
* Views:<br>
- Assets (What)<br>
- Motivation (Why)<br>
- Process (How)<br>
- People (Who)<br>
- Location (Where)<br>
Time (When)<br>
* Y-Axis from wide to narrow<br>
- Contextual<br>
- Conceptual<br>
- Logical<br>
- Physical<br>
- Component<br>
- Operational<br>
* Difference between SABSA and the others<br>
- It is also a methodology<br>
- Provides an actual process to follow<br>
- It is geared toward security</p>
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
52
Q

<p>Security Frameworks - Architecture Framework Terms</p>

A

<p>* Strategic Alignment: An architecture is strategically aligned when it meets the needs of the business and all legal or regulatory requirements<br></br>

* Business Enablement: A good security architecture must enable the business to thrive by not getting in the way, but still providing proper security<br></br>
* Process Enhancement: Security forces us to take a closer look at existing processes. This could lead us to improve them<br></br>
* Security Effectiveness: Most quantifiable of the attributes. Examples: ROI, SLA achievements</p>

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
53
Q

<p>Security Frameworks - Frameworks for Implementation</p>

A

<p>* COSO Internal Control<br></br>

* COBIT<br></br>
* NIST SP 800-53</p>

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
54
Q

<p>Security Frameworks - Frameworks for Implementation - COSO IC</p>

A 
<p>* Identifies 17 control principles grouped into 5 categories<br>
* Created in the 80s as a result of financial fraud<br>
* Provides Corporate Governance<br>
* Categories<br>
- Control Environments<br>
- Risk Assessments<br>
- Control Activities<br>
- Information and Communication<br>
- Monitoring Activities</p>
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
55
Q

<p>Security Frameworks - Frameworks for Implementation - COBIT</p>

A

<p>* Created by ISACA and ITGI<br></br>
* Defines 17 enterprise and 17 IT goals<br></br>
* It's not strictly security related<br></br>
* It is an IT related subset of COSO IC<br></br>
* Principles<br></br>
Meeting stakeholder needs<br></br>
Covering the enterprise end-to-end<br></br>
Applying a single integrated framework<br></br>
Enabling a holistic approach<br></br>
Separating governance from management</p>

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
56
Q

<p>Security Frameworks - Frameworks for Implementation - NIST SP 800-53</p>

A

<p>* Created by the US government<br></br>

* Specifies the control that federal agencies must implement<br></br>
* If an agency doesn't comply, they are violating the FISMA (Federal Information Security Management Act of 2002)<br></br>
* Contains a list of 18 control categories</p>

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
57
Q

<p>Security Frameworks - Frameworks for Implementation - Private vs Federal controls</p>

A 
<p>Administrative = Management<br>
Technical = Technical<br>
Physical = Operational</p>
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
58
Q

<p>Security Frameworks - Process Development</p>

A

<p>* ITIL<br></br>

* Six Sigma<br></br>
* Capability Maturity Model Integration (CMMI)</p>

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
59
Q

<p>Security Frameworks - Process Development - ITIL</p>

A

<p>* Developed in the UK in the 80s<br></br>
* De facto standard for IT management best practices<br></br>
* Focuses on achieving SLAs between the IT department and its customer<br></br>
* Stages<br></br>
- Design<br></br>
- Transition<br></br>
- Operation<br></br>
* Each stage has between 3 and 5 steps</p>

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
60
Q

<p>Security Frameworks - Process Development - Six Sigma</p>

A

<p>* Measures process quality by using statistical calculations<br></br>
* A sigma rating is applied to a process to indicate the percentage of defects it contains</p>

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
61
Q

<p>Security Frameworks - Process Development - Capability Maturity Model Integration (CMMI)</p>

A

<p>* Created by Carnegie Mellon for US DoD<br></br>
* Determines the maturity of an organization's processes<br></br>
* Designed to make improvements in an incremental and standard manner<br></br>
* Levels:<br></br>
- Level 0: Nonexistent Management<br></br>
- Level 1: Unpredictable Processes<br></br>
- Level 2: Repeatable Processes<br></br>
- Level 3: Defined Processes<br></br>
- Level 4: Managed Processes<br></br>
- Level 5: Optimized Processes</p>

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
62
Q

<p>Security Frameworks - The Process Life Cycle</p>

A

<p>* Focuses on how to keep processes up-to-date and healthy<br></br>

* Four steps, and the last one feeds right back into the first one to start a new iteration<br></br>
* Steps: Plan, Implement, Operate, Evaluate</p>

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
63
Q

<p>Security Frameworks - The Process Life Cycle - Steps - 1: Plan (6)</p>

A

<p>- Establish MGMT and oversight committees<br></br>
- Identify business drivers and threats<br></br>
- Perform a risk assessment<br></br>
- Create security architectures for the business, data, application and infrastructure<br></br>
- Select possible solutions for the problems identified<br></br>
- Get mgmt approval to move to the next steps</p>

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
64
Q

<p>Security Frameworks - The Process Life Cycle - Steps - 2: Implement (8)</p>

A

<p>- Assign duties<br></br>
- Establish baselines<br></br>
- Put security policies into operation<br></br>
- Identify data that needs to be secured<br></br>
- Create blueprints<br></br>
- Implement controls based on the blueprints<br></br>
- Implement solutions to monitor the controls based on the blueprints<br></br>
- Establish goals, SLAs and metrics based on the blueprints</p>

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
65
Q

<p>Security Frameworks - The Process Life Cycle - Steps - 3: Operate (4)</p>

A

<p>- Follow established procedures to ensure baselines met the blueprints<br></br>
- Execute audits<br></br>
- Execute tasks defined by the blueprints<br></br>
- Ensure SLAs are met</p>

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
66
Q

<p>Security Frameworks - The Process Life Cycle - Steps - 4: Evaluate (4)</p>

A

<p>- Review logs, audit results, metrics and SLAs<br></br>

- Determine if the blueprint goals have been met<br></br>
- Hold quarterly meetings with the steering committee<br></br>
- Identify actions to improve as an input into the first step</p>

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
67
Q

<p>Computer Crime Law - Cyberlaw</p>

A

<p>Any law that deals with computer-based crime</p>

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
68
Q

<p>Computer Crime Law - Computer Crime Categories</p>

A

<p>* Computer-assisted: Computer is a tool<br></br>
- Example: Stealing money from a bank across the Internet<br></br>
* Computer-targeted: Computer is the victim<br></br>
- Example: DoS attack<br></br>
* Computer is incidental: Computer is involved but didn't play a significant role in the crime<br></br>
- Example: If a computer is used to temporarily store stolen or illegal goods</p>

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
69
Q

<p>Computer Crime Law - Computer Crime</p>

A

<p>* Script Kiddies: Unsophisticated individuals who know just enough about pre-built hacking tools<br></br>
*Types of serious hackers<br></br>
1- The ones who randomly sniff around<br></br>
2- APT (Advanced Persistent Threats)<br></br>
- Most dangerous<br></br>
- They target specific persons or organizations</p>

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
70
Q

<p>Computer Crime Law - Computer Crime - OECD</p>

A 
<p>* OECD has issued guidelines on how to deal with data that is transfered between countries<br>
* Core principles:<br>
Collection Limitation<br>
Data Quality<br>
Purpose Specification<br>
Use Limitation<br>
Security Safeguards<br>
Openness<br>
Individual Participation<br>
Accountability</p>
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
71
Q

<p>Computer Crime Law - Computer Crime - Safe Harbor Privacy Principles</p>

A 
<p>* They deal with US and EU data transfer requirements<br>
* Rules:<br>
- Notice<br>
- Choice<br>
- Onward Transfer<br>
- Security<br>
- Data Integrity<br>
- Access<br>
- Enforcement</p>
72
Q

<p>Computer Crime Law - Computer Crime - Import and Export Law</p>

A

<p>* Each country has its own laws regarding import and export of goods<br></br>
* Wassenaar Agreement<br></br>
- Followed by 41 countries including the US<br></br>
- Goal: To prevent the buildup of further military capabilities<br></br>
- The Information Security part deals with the exchange of cryptography</p>

73
Q

<p>Computer Crime Law - Types of Legal Systems (CCCRM)</p>

A

<p>* Civil (Code) Law System: Lower courts are not compelled to follow the decisions made by upper courts<br></br>

* Common Law System: Based on precedence<br></br>
* Customary Law System: deals with personal conduct and behavior,<br></br>
* Religious Law System: Based on religious beliefs of that region<br></br>
* Mixed Law System: Two or more of the previously mentioned systems used together</p>

74
Q

<p>Computer Crime Law - Types of Legal Systems - Common Law System types</p>

A

<p>* Criminal<br></br>
- To be convicted, guilt beyond reasonable doubt must be established<br></br>
- Cases are usually brought about by government prosecutors with a guilty or not guilty verdict<br></br>
* Civil/Tort<br></br>
- Offshoot of Criminal Law<br></br>
- Deals with wrongs commited against an individual or company that has resulted in injury or damages<br></br>
- If found liable, monetary reparations are usually made by the defendant, but loss of freedom is never a result<br></br>
* Administrative<br></br>
It addresses issues such as international trade, manufacturing, environment and immigration</p>

75
Q

<p>Computer Crime Law - Intellectual Property</p>

A 
<p>* Law that allows individuals or companies to protect what is rightly theirs from illegal duplication or use<br>
* IP types:<br>
- Trade Secret<br>
- Copyright<br>
- Trademark<br>
- Patent</p>
76
Q

<p>Computer Crime Law - Intellectual Property - Trade Secret (def-expiry-nda-example)</p>

A

<p>* Something a company creates or owns that is crucial to its survival and profitability<br></br>

* Doesn't expire until it's not a trade secret<br></br>
* Most companies with trade secrets make their employees sign an NDA<br></br>
* Example: Coca-Cola formula</p>

77
Q

<p>Computer Crime Law - Intellectual Property - Copyright</p>

A

<p>* Gives the author of a work the rights to control the display, adaptation, reproduction or distribution of that original work<br></br>
* Protects the expression of the idea rather than the idea itself<br></br>
* Expires after a limited amount of time<br></br>
* Specific to the computer industry<br></br>
- Protects source code and object code<br></br>
- Protects user interfaces</p>

78
Q

<p>Computer Crime Law - Intellectual Property - Trade Mark</p>

A

<p>* Protects a name, symbol, word, sound, shape, color or any combination thereof<br></br>

* Represents a company's brand identity to its potential consumers<br></br>
* WIPO (World Intellectual Property Organization) oversees International Trademark Law</p>

79
Q

<p>Computer Crime Law - Intellectual Property - Patent</p>

A

<p>* Given to individuals or companies to protect an invention<br></br>
* Strongest form of IP protection<br></br>
* The invention must be novel, useful and non-obvious<br></br>
* Has an expiration date (20 years)<br></br>
* Specific to computer industry<br></br>
- Algorithms are commonly patented<br></br>
- Patent infringement prosecution is a matter of everyday life<br></br>
- Patent trolls buy patents only to sue infringing companies</p>

80
Q

<p>Computer Crime Law - Intellectual Property - Protection of Intellectual Property</p>

A

<p>* A company must properly classify the data and implement sufficient protection (Due care)<br></br>
* If Due Care is not taken, litigation will fail<br></br>
* Software Piracy: Occurs whem protected works or data is duplicated or used without permission or compensation to the author<br></br>
* Software Licensing: Freeware, Shareware, Commercial, Academic<br></br>
* EULA: Used for communicating the licensing requirements<br></br>
* FAST/BSA: Promote enforcement of software rights in order to combat piracy<br></br>
* DMCA:<br></br>
- Prohibits attempts to circumvent copyright protection mechanisms<br></br>
- In Europe, a similar law is the Copyright Directive</p>

81
Q

<p>Computer Crime Law - Privacy - Personally Identified Information (PII)</p>

A 
<p>* Any data that can be used to identify, contact or locate an individual<br>
* It's sensitive data because it can be used for identity theft<br>
* Typical PII components<br>
Full Name<br>
ID Number<br>
Biometrics<br>
Digital Identities<br>
Birthdate</p>
82
Q

<p>Computer Crime Law - Privacy - Laws and Regulations</p>

A

<p>* Federal Privacy Act of 1974<br></br>

* Federal Information Security Management Act of 2002 (FISMA)<br></br>
* Department of Veterans Affairs Information Security Protection Act<br></br>
* Health Insurance Portability and Accountability Act (HIPAA)<br></br>
* Health Information Technology for Economic and Clinical Health Act (HITECH)<br></br>
* USA Patriot Act<br></br>
* Gramm-Leach-Bliley Act (GLBA)<br></br>
* Personal Information Protection and Electronic Documents Act (PIPEDA)<br></br>
* Payment Card Industry Data Security Standard (PCI DSS)<br></br>
* Economic Espionage Act of 1996</p>

83
Q

<p>Computer Crime Law - Privacy - Laws and Regulations - Federal Privacy Act of 1974</p>

A

<p>Federal agencies could collect and store info about an individual's academic, medical, financial, criminal and employment history only if the agency had a necessary and relevant need to</p>

84
Q

<p>Computer Crime Law - Privacy - Federal Information Security Management Act of 2002 (FISMA)</p>

A 
<p>* Requires high-level officials of each agency to hold annual reviews of the information security programs and report the results to the Office of Management and Budget (OMB), which in turn reports to congress on the level of compliance achieved<br>
* Requirements<br>
- Inventory of Information Systems<br>
- Categorization of the information and information systems according to risk<br>
- Security controls<br>
- Risk Assessment<br>
- System security plan<br>
- Certification and accreditation<br>
- Continuous monitoring</p>
85
Q

<p>Computer Crime Law - Privacy - Department of Veterans Affairs Information Security Protection Act</p>

A

<p>* FISMA + Additional requirements on that agency alone<br></br>
* Due to an incident in 2006</p>

86
Q

<p>Computer Crime Law - Privacy - Health Insurance Portability and Accountability Act (HIPAA)</p>

A

<p>* PHI (Patient Health Information): PII+specific health details<br></br>

* Defines rules for any facility that creates, accesses, shares or destroys patient data<br></br>
* Works with fines<br></br>
* Does not require notification of data breaches</p>

87
Q

<p>Computer Crime Law - Privacy - Health Information Technology for Economic and Clinical Health Act (HITECH)</p>

A

<p>* Created in 2009<br></br>
* Subtitle D<br></br>
- Electronic transmission of health information<br></br>
- Helps enforce HIPAA rules<br></br>
* It directs the US Secretary of Health and Services (HHS) to provide guidance on effective controls to protect data<br></br>
* Companies that comply with this guidance do not have to report data breaches. Otherwise, they have 60 days to report to HHS and the affected individuals</p>

88
Q

<p>Computer Crime Law - Privacy - Patriot Act</p>

A

<p>* Reduces restrictions on law enforcement when searching electronic records<br></br>

* Allows greater foreign intelligence gathering within the US<br></br>
* Gives the Secretary of Treasury greater power to regulate financial transactions<br></br>
* Broadens the ability to detain or deport immigrants suspected of terrorism<br></br>
* Expands the definition on terrorism to include domestic terrorism<br></br>
* Now the government can monitor individual's electronic communications at will</p>

89
Q

<p>Computer Crime Law - Privacy - Gramm-Leach-Bliley Act (GLBA)</p>

A

<p>* aka Financial Services Modernization Act<br></br>

* Requires financial institutions to create privacy notices and give their customers the ability to opt out of sharing their information with third parties<br></br>
* In the event of a data breach the institution must report it to the federal regulators, law enforcement and affected customers</p>

90
Q

<p>Computer Crime Law - Privacy - Personal Information Protection and Electronic Documents Act (PIPEDA)</p>

A

<p>Canadian protection of privacy law regarding e-commerce</p>

91
Q

<p>Computer Crime Law - Privacy - Payment Card Industry Data Security Standard (PCI DSS)</p>

A

<p>* It's a standard for data security created by the major credit companies<br></br>
* Credit companies will not work with a company that it's not PCI compliant</p>

92
Q

<p>Computer Crime Law - Privacy - Economic Espionage Act of 1996</p>

A

<p>* Passed in 1996<br></br>

* Defines who can investigate data breaches<br></br>
* Protects IP</p>

93
Q

<p>Computer Crime Law - Privacy - International Data Breaches</p>

A

<p>USA: Has a number of laws on the book<br></br>

| EU data protection regulation: Standardized data breach notification</p>

94
Q

<p>Policies-Standards - Baselines - Guidelines and Procedures - Policies - Security Policy</p>

A

<p>High-level statement that describes how security works within the organization.</p>

95
Q

<p>Policies-Standards - Baselines - Guidelines and Procedures - Policies - Security Policy Types (OIS)</p>

A

<p>* Organizational Security Policy:<br></br>

- Dictates how a security program will be constructed and describes how enforcement will be implemented.<br></br>
- Sets the various goals.Addresses laws and regulations. Provides direction on the amount of risk management it's willing to accept.<br></br>
- Should be periodically reviewed and updated.<br></br>
- Documentation should be version-controlled and applicable for several years into the future.<br></br>
* Issue-specific policy: Provides more detail on an area that needs further explanation. Must not be technology-specific. Examples: E-mail policy<br></br>
* System-specific policies: Contain details that are specific to a system. Sufficiently generic to allow for other technologies and solutions</p>

96
Q

<p>Policies-Standards - Baselines - Guidelines and Procedures - Policies - Another Policy Classification (IRA)</p>

A

<p>* Informative:Informs employees on a broad range of topics in an unenforceable manner<br></br>

* Regulatory: Addresses regulatory requirements for a specific industry such as GLBA, PCI or HIPAA<br></br>
* Advisory: Advises employees on enforceable rules governing actions and behaviors</p>

97
Q

<p>Policies-Standards - Baselines - Guidelines and Procedures - Standards</p>

A

<p>* Provide instruction on how to meet the policy<br></br>

| * Standards must always be enforced</p>

98
Q

<p>Policies-Standards - Baselines - Guidelines and Procedures - Baselines</p>

A

<p>* Point in time that is used as a comparison for future changes<br></br>
* A baseline results in a consistent reference point</p>

99
Q

<p>Policies-Standards - Baselines - Guidelines and Procedures - Guidelines</p>

A

<p>Reflect recommendations and guides for employees when a specific standard does not really apply</p>

100
Q

<p>Policies-Standards - Baselines - Guidelines and Procedures - Procedures</p>

A

<p>Where policies tell us where we want to go and standards provide the tools, procedures give us the step-by-step instructions on how to do it</p>

101
Q

<p>Risk Management - NIST SP 800-53 three tiers to risk management (OBI)</p>

A

<p>* Organizational<br></br>

* Business Process<br></br>
* Information Systems (Our focus)</p>

102
Q

<p>Risk Management - Information Systems Risk Management</p>

A

<p>ISRM policy should address the following elements<br></br>

- The objectives of the ISRM team<br></br>
- What is considered an acceptable level of risk<br></br>
- How risks will be identified<br></br>
- How the ISRM policy fits within the organization's strategic planning<br></br>
- Roles and responsibilities for the ISRM<br></br>
- Mapping of risk to controls, performance targets and budgets<br></br>
- How staff behavior and resource allocation will be modified<br></br>
- How the effectiveness of controls will be monitored</p>

103
Q

<p>Risk Management - The Risk Management Team</p>

A

<p>* It can be a single person or more<br></br>

| * Usually not 100% of their time in ISRM</p>

104
Q

<p>Risk Management - The Risk Management Process - Four components: (FARM)</p>

A

<p>* Frame: Define the assumptions, constraints, priorities and the amount of risk the organization can tolerate<br></br>

* Assess: Determine threats, vulnerabilities and attack vectors<br></br>
* Respond: Match the available resources against a prioritized list of risks<br></br>
* Monitor: Continuously watch the controls to assess their effectiveness against the risk each was designed to protect the organization from</p>

105
Q

<p>Modeling Threats - Vulnerabilities</p>

A

<p>* Information: Data at rest / Data in motion / Data in use<br></br>

* Processes: Blocks of code executing in-memory<br></br>
* People: Usual attack vector / Social engineering / Social networks / Passwords</p>

106
Q

<p>Modeling Threats - Threats</p>

A

<p>* Potential cause of an unwanted incident, which may result in harm to a system or organization<br></br>
* Sources:<br></br>
- Deliberate outsiders<br></br>
- Deliberate insiders (The most dangerous group)<br></br>
- Accidental insiders</p>

107
Q

<p>Modeling Threats - Attacks</p>

A

<p>* There are two ends to an attack<br></br>
- Attacker<br></br>
- Target<br></br>
- Means to an attack<br></br>
* Attack Tree: Steps and substeps in an attack<br></br>
* Attack Chain: One path that can be contained in an attack tree</p>

108
Q

<p>Modeling Threats - Reduction Analysis</p>

A

<p>* Reduces the number of attacks to consider by identifying commonalities<br></br>
* Reduces the threat posed by attackers: the closer to the root a mitigation is implemented, the more risks it is likely to control<br></br>
Assessing and Analyzing Risk - Risk Assessment,* Method of identifying vulnerabilities and threats and assessing the possible impacts to determine where to implement security controls<br></br>
* Outputs a list of vulnerabilities and threats</p>

109
Q

<p>Assessing and Analyzing Risk - Risk Analysis</p>

A

<p>* Prioritizes the list obtained through the Risk Assessment<br></br>

* Assesses the amount of resources to properly mitigate the top threats<br></br>
* Goals<br></br>
- Identify and valuate assets<br></br>
- Identify vulnerabilities and associated threats<br></br>
- Quantify the likelihood of the threats<br></br>
- Calculate an economic balance between each threat and the cost of a countermeasure<br></br>
* Outputs a cost/benefit comparison</p>

110
Q

<p>Assessing and Analyzing Risk - Risk Analysis Team</p>

A
  • Individuals from all departments
  • Good questions for this team to ask are
    1. What could happen?
    2. What would the impact be?
    3. How often could it happen?
    4. Do we really believe the first three answers?
111
Q

<p>Assessing and Analyzing Risk - Calculating Value</p>

A

<p>* Calculating currency-based value for each asset<br></br>
* Issues to be examined<br></br>
- Cost to acquire or develop the asset<br></br>
- Cost to maintain and protect the asset<br></br>
- Value of the asset to owners and users<br></br>
- Value of the asset to adversaries<br></br>
- Price others are willing to pay for the asset<br></br>
- Cost to replace the asset if lost<br></br>
- Operational and production activities affected if the asset is unavailable<br></br>
- Liability issues if the asset is compromised<br></br>
- Usefulness and role of the asset in the organization<br></br>
* Two questions should be asked:<br></br>
- What is the cost to protect an asset?<br></br>
- What is the cost if we did not protect an asset?<br></br>
* Allows us to do the following<br></br>
- Perform an effective cost/benefit analysis<br></br>
- Select proper controls<br></br>
- Determine the amount of insurance to purchase<br></br>
- Define exactly what is at risk<br></br>
- Comply with legal and regulatory requirements</p>

112
Q

<p>Assessing and Analyzing Risk - Identifying Vulnerabilities and Threats</p>

A

<p>* Threats can arise from seemingly innocuous sources such as our own applications and users<br></br>
Examples:<br></br>
- An application could have a logic flaw, known as illogical processing, which destroys or compromises data or resources. This can then lead to cascading errors wherein a small flaw is passed to another process, which can amplify the flaw<br></br>
- A user can enter invalid data or even accidently delete important data<br></br>
* Loss Potential:Each risk has it<br></br>
* Delayed Loss: It happens after the vulnerability has been exploited. Example: Your company's reputation takes a hit</p>

113
Q

<p>Assessing and Analyzing Risk - Methodologies for Risk Assessment</p>

A

<p>* NIST SP 800-30<br></br>
* Facilitated Risk Analysis Process (FRAP)<br></br>
* Operationally Critical Threat Asset and Vulnerability Evaluation (OCTAVE)<br></br>
* AS/NZS 4360<br></br>
* ISO 27005<br></br>
* Failure Mode and Effect Analysis (FMEA)<br></br>
* Central Computing and Telecommunications Agency<br></br>
Risk Analysis and Management Method (CRAMM)</p>

114
Q

<p>Assessing and Analyzing Risk - Methodologies for Risk Assessment - NIST SP 800-30</p>

A 
<p>1- Prepare for the assessment<br>
2- Conduct the assessment<br>
a. Identify threats<br>
b. Identify vulnerabilities<br>
c. Determine likelihood<br>
d. Determine magnitude<br>
e. Calculate risk<br>
3- Communicate the results<br>
4- Maintain the assessment</p>
115
Q

<p>Assessing and Analyzing Risk - Methodologies for Risk Assessment - Facilitated Risk Analysis Process (FRAP)</p>

A

<p>Stresses a qualitative measurement of risk instead of trying to actually calculate a risk value</p>

116
Q

<p>Assessing and Analyzing Risk - Methodologies for Risk Assessment - Operationally Critical Threat Asset and Vulnerability Evaluation (OCTAVE)</p>

A

<p>* The premise of this methodology is that the people involved with a system or process should be the only ones making the decisions on security, as opposed to higher-level or external influences<br></br>
* Meant for entire organization</p>

117
Q

<p>Assessing and Analyzing Risk - Methodologies for Risk Assessment - AS/NZS 4360</p>

A

<p>Focuses on the organization's overall health, but could be used in Security</p>

118
Q

<p>Assessing and Analyzing Risk - Methodologies for Risk Assessment - ISO 27005</p>

A

<p>Describes how RM should be carried out for ISMS</p>

119
Q

<p>Assessing and Analyzing Risk - Methodologies for Risk Assessment - Failure Mode and Effect Analysis (FMEA)</p>

A

<p>* Focuses on identifying functions, their failures and the causes of those failures<br></br>

* Excels when examining a single system, but tends to break down when considering multiple systems<br></br>
* Steps<br></br>
1) Create a block diagram<br></br>
2) Consider what happens when each block fails<br></br>
3) Create a table of each failure and the corresponding impact<br></br>
4) Correct the design and repeat #3 until the system no longer has unacceptable weaknesses<br></br>
5) Have engineers review the design and table</p>

120
Q

<p>Assessing and Analyzing Risk - Methodologies for Risk Assessment - Central Computing and Telecommunications Agency Risk Analysis and Management Method (CRAMM)</p>

A

<p>* UK originated<br></br>

* Siemens has an automated tool for it<br></br>
* Stages<br></br>
1) Define objectives<br></br>
2) Assess risk<br></br>
3) Identify countermeasures</p>

121
Q

<p>Assessing and Analyzing Risk - Risk Analysis Approaches - Quantitative Risk Analysis</p>

A

<p>* Asset Value (AV): Given by the Risk Assessment phase<br></br>
* Exposure Factor (EF): The percentage of loss that a realized threat could have on that asset<br></br>
Single Loss Expectancy (SLE): SLE=AVEF<br></br>
* Annual Rate of Occurence (ARO): Number of times per year that we can expect the threat to take place<br></br>
* Annualized Loss Expectancy (ALE):<br></br>
- ALE=SLE*ARO<br></br>
- We shouldn't expend more than the ALE in protecting that asset</p>

122
Q

<p>Asset Value (AV)</p>

A

<p>Given by the Risk Assessment phase</p>

123
Q

<p>Exposure Factor (EF)</p>

A

<p>The percentage of loss that a realized threat could have on that asset</p>

124
Q

<p>Single Loss Expectancy (SLE) - Formula</p>

A

<p>SLE=AV*EF</p>

125
Q

<p>Annual Rate of Occurence (ARO)</p>

A

<p>Number of times per year that we can expect the threat to take place</p>

126
Q

<p>Annualized Loss Expectancy (ALE) - Formula</p>

A

<p>ALE=SLE*ARO</p>

127
Q

<p>Assessing and Analyzing Risk - Risk Analysis Approaches - Qualitative Risk Analysis</p>

A

<p>* Various scenarios are discussed and threats and possible controls are ranked based on opinions<br></br>

* Each threat is ranked<br></br>
* A matrix is usually used to facilitate this discussion<br></br>
- Y-Axis: Likelihood of occurrence<br></br>
- X-Axis:The impact<br></br>
* Delphi technique<br></br>
- Each group member provides a written opinion on each threat and gives the answer to the risk assessment team<br></br>
- The team then compiles the results and distributes it to the group who write down comments anonymously<br></br>
- The results are then compiled and redistributed until a consensus is reached</p>

128
Q

<p>Delphi technique</p>

A

<p>- Each group member provides a written opinion on each threat and gives the answer to the risk assessment team<br></br>

- The team then compiles the results and distributes it to the group who write down comments anonymously<br></br>
- The results are then compiled and redistributed until a consensus is reached</p>

129
Q

<p>Assessing and Analyzing Risk - Protection Mechanisms - Value of a control</p>

A

<p>VC = ALE_before - ALE_after</p>

130
Q

<p>Assessing and Analyzing Risk - Protection Mechanisms - Hidden costs</p>

A

<p>* The actual product<br></br>

* Design and planning<br></br>
* Implementation<br></br>
* Environment modifications<br></br>
* Compatibility with other controls<br></br>
* Maintenance<br></br>
* Testing<br></br>
* Repair, replacement or upgrades<br></br>
* Operating and support<br></br>
* Negative impacts on productivity<br></br>
* Subscription<br></br>
* Time for monitoring and responding to alerts</p>

131
Q

<p>Assessing and Analyzing Risk - Protection Mechanisms - List of desirable attributes for a control</p>

A

<p>* Can be installed without affecting other mechanisms<br></br>

* Provides uniform protection<br></br>
* Administrator can override<br></br>
* Defaults to least privilege<br></br>
* Ability to enable/disable as desired<br></br>
* Does not distress users<br></br>
* Differentiation between user and administrator roles<br></br>
* Minimum human interaction<br></br>
* Assets are still protected during a reset<br></br>
* Easily updated<br></br>
* Provide sufficient audit trail<br></br>
* Not have heavy dependence on other components<br></br>
* Does not introduce heavy barriers for users<br></br>
* Produce human-readable output<br></br>
* Easy reset to baseline configuration<br></br>
* Testable<br></br>
* Does not introduce compromises<br></br>
* Does not impact system performance<br></br>
* Does not require many exceptions across the environment<br></br>
* Proper alerting<br></br>
* Does not impact existing assets<br></br>
* Is not highly-visible</p>

132
Q

<p>Assessing and Analyzing Risk - Total Risk vs. Residual Risk</p>

A

<p>* Total Risk: TR = threats x vulnerability x asset value<br></br>

* Residual Risk: RR = total risk x controls gap<br></br>
* You can't plug in numbers into these formulas, as they are conceptual<br></br>
* How to deal with the risk<br></br>
- Transfer the risk<br></br>
- Risk avoidance<br></br>
- Risk reduction<br></br>
- Accept the risk</p>

133
Q

<p>Total Risk</p>

A

<p>TR = threats x vulnerability x asset value</p>

134
Q

<p>Residual Risk</p>

A

<p>RR = total risk x controls gap</p>

135
Q

<p>How to deal with the risk</p>

A

<p>* Transfer the risk<br></br>

* Risk avoidance<br></br>
* Risk reduction<br></br>
* Accept the risk</p>

136
Q

<p>Assessing and Analyzing Risk - Outsourcing</p>

A

<p>* Not a viable option unless you can verify how the partner handles risk<br></br>
* An organization can still be found liable if an outsourcing partner failed to mitigate a risk</p>

137
Q

<p>Managing Risk - Risk Management Frameworks (What they do)</p>

A

<p>Allow an organization to:<br></br>

1) Identify and assess risk<br></br>
2) Reduce it to an acceptable level<br></br>
3) Ensure the risk remains at an acceptable level</p>

138
Q

<p>Managing Risk - Commonly Used RMF's</p>

A

<p>* NIST RMF (SP 800-37)<br></br>

- Operates around a systems life-cycle<br></br>
- Focuses on certification and accreditation<br></br>
* ISO 31000:2009<br></br>
- Acknowledges that there are things which we cannot control<br></br>
- Focuses instead on managing the fallout<br></br>
- It can be broadly applied to an entire organization<br></br>
* ISACA Risk IT: Attempts to integrate NIST, ISO 31000 and COBIT<br></br>
* COSO Enterprise Risk Management-Integrated Framework<br></br>
- Generic framework<br></br>
- Takes a top-down approach</p>

139
Q

<p>Managing Risk - Categorize Information System</p>

A

<p>* Identification of systems, subsystems and boundaries that the organization has<br></br>
* This will give you the info you need to select the controls</p>

140
Q

<p>Managing Risk - Select Security Controls</p>

A

<p>* Assumptions<br></br>

- Risk Assessment has been done<br></br>
- Common controls across the organization have been identified<br></br>
* When considering a new system<br></br>
- Are there new risks specific to it or into your architecture by introducing this new system?<br></br>
- Perform new Risk Asessment on the new system and its effect on the larger ecosystem<br></br>
- Compare results to determine if we need to modify controls or new controls are needed</p>

141
Q

<p>Managing Risk - Implement Security Controls</p>

A

<p>* Implementing is simple<br></br>

* Documenting is important<br></br>
- So everyone will understand the what, where and why of each control<br></br>
- Allows the controls to be integrated into an overall assessment and monitoring plan</p>

142
Q

<p>Managing Risk - Assess Security Controls</p>

A

<p>* The control must be assessed to see how effective it has been<br></br>

* Should be done by individuals who did not implement the control<br></br>
* Results should be added to the documentation to be referred during the next round of assessments</p>

143
Q

<p>Managing Risk - Authorize Information System</p>

A

<p>Forwarding all documentation and assessment results to the person or the group who can authorize integration of the system into the general architecture</p>

144
Q

<p>Managing Risk - Monitor Security Controls</p>

A

<p>* Once the system is in general operation, it must be monitored to ensure it remains effective<br></br>
* If any changes in operation or threats are detected, the system must be updated</p>

145
Q

<p>Business Continuity and Disaster Recovery - Disaster recovery (DR)</p>

A

<p>Is how an organization will minimize the effects of a disaster or disruption to business and return to some level of acceptable productivity</p>

146
Q

<p>Business Continuity and Disaster Recovery - Disaster Recovery Plan (DRP)</p>

A

<p>Goes into effect during the emergency</p>

147
Q

<p>Business Continuity and Disaster Recovery - Continuity planning</p>

A

<p>Addresses how the organization will return to full capacity, including backup data centers, spinning up new locations for people to work, or altering processes during the interim</p>

148
Q

<p>Business Continuity and Disaster Recovery - Business continuity management (BCM)</p>

A

<p>* Encompasses both DR and CP<br></br>

* Must address all CIA<br></br>
* Much more than buildings and hardware: People run the systems and must know them<br></br>
* Example: During a disaster, you can't just leave a sensitive server sitting in an abandoned building (Confidentiality), you can't assume storage media will remain safe and secure (integrity) and you have to make sure those resources are back up and running as soon as possible (availability)</p>

149
Q

<p>Business Continuity and Disaster Recovery - Business Continuity Planning (BCP)</p>

A

<p>* It's the way to implement BCM<br></br>

* Contains strategy documents providing detailed procedures: To ensure critical functions are maintained that will minimize loss<br></br>
* The procedures cover<br></br>
- Emergency responses<br></br>
- Extended backup operations<br></br>
- Post-disaster recovery<br></br>
* Can quickly become outdated due to turnover and undocumented changes</p>

150
Q

<p>Business Continuity and Disaster Recovery - Standards and Best Practices - NIST SP 800-34</p>

A

<p>1) Write the continuity planning policy statement: Write a policy and assign authority to carry out the policy tasks<br></br>

2) Conduct the business impact analysis (BIA):<br></br>
- Identify critical functions and systems<br></br>
- Prioritize the list<br></br>
3) Identify preventative controls: Select and implement controls to address the BIA<br></br>
4) Create contingency strategies: Make sure systems can be brought online quickly<br></br>
5) Develop an information system contingency plan: Write procedures and guidelines on how the organization will remain functional in a crippled state<br></br>
6) Ensure plan testing, training and exercises<br></br>
7) Ensure plan maintenance: Put in place steps to ensure the BCP is updated regularly</p>

151
Q

<p>Business Continuity and Disaster Recovery - Standards and Best Practices - Other standards</p>

A

<p>* ISO 27031: Describes the concepts of information communication technology (ICT) readiness for business continuity<br></br>

* ISO 22301: The ISO standard for BCM<br></br>
* Business Continuity Institute's Good Practice Guidelines (GPG)<br></br>
* DRI International Institute's Professional Practices for Business Continuity Planners</p>

152
Q

<p>Business Continuity and Disaster Recovery - Making BCM Part of the Enterprise Security Program</p>

A

<p>* BCM must be built upon a solid understanding of<br></br>

- How the organization operates<br></br>
- The organizational components that are critical to continuing its reason for being<br></br>
* BCP<br></br>
- Living entity that is continually revisited and updated as-needed<br></br>
- Should define and prioritize the organization's critical mission and business functions, and provide a sequence for recovery<br></br>
- Must have management's full support</p>

153
Q

<p>Business Continuity and Disaster Recovery - BCP Project Components - Business Continuity Coordinator</p>

A

<p>* Leader for the BCP team<br></br>

| * Will oversee the development, implementation, and testing of the business continuity and disaster recovery plans</p>

154
Q

<p>Business Continuity and Disaster Recovery - BCP Project Components - BCP Committee</p>

A

<p>* Specific, qualified people<br></br>

* People who are familiar with the different departments within the company<br></br>
* People from at least the following departments<br></br>
- Business units<br></br>
- Senior management<br></br>
- IT department<br></br>
- Security department<br></br>
- Communications department<br></br>
- Legal department</p>

155
Q

<p>Business Continuity and Disaster Recovery - Scope of the Project</p>

A

<p>Should it cover one or all facilities? Should it encompass large threats or smaller ones as well?<br></br>
This kind of decision is for Senior Executives</p>

156
Q

<p>Business Continuity and Disaster Recovery - BCP Project Components - BCP Policy - Components</p>

A

<p>* Scope<br></br>

* Mission<br></br>
* Principles<br></br>
* Guidelines<br></br>
* Standards</p>

157
Q

<p>Business Continuity and Disaster Recovery - BCP Project Components - BCP Policy - Process of drawing up the policy</p>

A

<p>1. Identify and document the components of the policy<br></br>

2. Identify and define policies of the organization that the BCP might affect<br></br>
3. Identify pertinent legislation, laws, regulations, and standards<br></br>
4. Identify "good industry practice" guidelines by consulting with industry experts<br></br>
5. Perform a gap analysis. Find out where the organization currently is in terms of continuity planning, and spell out where it wants to be at the end of the BCP process<br></br>
6. Compose a draft of the new policy<br></br>
7. Have different departments within the organization review the draft<br></br>
8. Incorporate the feedback from the departments into a revised draft<br></br>
9. Get the approval of top management on the new policy<br></br>
10. Publish a final draft, and distribute and publicize it throughout the organization</p>

158
Q

<p>Business Continuity and Disaster Recovery - BCP Project Components - Project Management (PM)</p>

A

<p>* To ensure BCP doesn't run out of funds * SWOT analysis - Strengths: Characteristics of the project team that give it an advantage over others Weaknesses: Characteristics that place the team at a disadvantage relative to others Opportunities: Elements that could contribute to the project's success Threats: Elements that could contribute to the project's failure</p>

159
Q

<p>Business Continuity and Disaster Recovery - BCP Project Components - Business Continuity Planning Requirements</p>

A

<p>* Due Dilligence<br></br>

- Doing everything within one's power to prevent a disaster from happening<br></br>
- Applicable to leaders<br></br>
* Due Care<br></br>
- Taking precautions that a reasonable and competent person would have done<br></br>
- Applicable to everyone</p>

160
Q

<p>Business Continuity and Disaster Recovery - BCP Project Components - Business Impact Analysis (BIA)</p>

A

<p>* Activity at the beginning of BCP where interviews are executed and data collected to identify and classify business and individual functions<br></br>

* Steps<br></br>
1) Select individuals for interviewing<br></br>
2) Create data-gathering techniques<br></br>
3) Identify critical functions<br></br>
4) Identify resources<br></br>
5) Calculate how long functions can survive without resources<br></br>
6) Identify vulnerabilities and threats<br></br>
7) Calculate risk (risk = threat x impact x probability)<br></br>
8) Document findings and report to management</p>

161
Q

<p>Maximum Tolerable Downtime (MTD)</p>

A

<p> Each critical system must be examined to see how long the organization can survive without it</p>

162
Q

<p>Business Continuity and Disaster Recovery - BCP Project Components - Responsibilities for BCP management</p>

A

<p>* Committing fully to the BCP<br></br>

* Setting policy and goals<br></br>
* Ensuring the required funds and resources are available<br></br>
* Taking responsibility of the outcome of the BCP<br></br>
* Appointing a team</p>

163
Q

<p>Business Continuity and Disaster Recovery - BCP Project Components - BCP team's responsibilities</p>

A

<p>* Identifying legal and regulatory requirements<br></br>

* Identifying vulnerabilities and threats<br></br>
* Estimating threat likelihood and potential loss<br></br>
* Perform a BIA<br></br>
* Indicate which functions and processes must be running before others<br></br>
* Identifying interdependencies<br></br>
* Developing procedures and steps to resume business after a disaster<br></br>
* Identify individuals who will interact with external players</p>

164
Q

<p>Executive Succession Plan</p>

A

<p>Dictates who will step in until an absent executive returns or a permanent replacement can be found</p>

165
Q

<p>Personnel Security - Separation of Duties</p>

A

<p>* Process that ensures a single person cannot complete a critical task by himself<br></br>

* Example: Before launching a nuclear missile, two people have to insert a key. This is an example of dual control<br></br>
* In businesses, usually put into place to prevent fraud in the form of split knowledge<br></br>
* Example: One person can create a named user in a system (authentication), but cannot assign rights to that user (authorization). Another user must assign authorization. To create a rogue account, two employees must collude with each other, thereby reducing the likelihood of this happening</p>

166
Q

<p>Personnel Security - Rotation of duties</p>

A

<p>* Administrative detection control to uncover fraudulent activities<br></br>
* Goal: Move employees around so that each does not have control over the same business function for too long</p>

167
Q

<p>Personnel Security - Mandatory Vacation</p>

A

<p>For employees operating in sensitive areas, it should be implemented in order to detect fraud</p>

168
Q

<p>Personnel Security - Hiring practices</p>

A

<p>* Before hiring new employees: HR should always look into the individual's background for character traits<br></br>

* NDA's must be signed by new employees<br></br>
* Background checks<br></br>
- Social security number trace<br></br>
- County/state criminal history<br></br>
- Federal criminal history<br></br>
- Sexual offender registry check<br></br>
- Employment verification<br></br>
- Education verification<br></br>
- Reference verification<br></br>
- Immigration check<br></br>
- License or certification validations<br></br>
- Credit report<br></br>
- Drug screening</p>

169
Q

<p>Personnel Security - Termination process</p>

A

<p>* Surrender of ID badges or keys<br></br>

* Escort from the premises<br></br>
* Immediate disabling of user accounts or other access<br></br>
* Severance package dependent upon completion of an exit interview and surrender of company property. This encourages terminated employees to comply</p>

170
Q

<p>Personnel Security - Security-Awareness Training</p>

A

<p>* During the hiring process<br></br>

* Attributes<br></br>
- Repeats the most important messages in different formats<br></br>
- Up-to-date<br></br>
- Entertaining and positive<br></br>
- Simple to understand<br></br>
- Supported by senior management<br></br>
* Audiences for this training<br></br>
- Management: Short orientation that focuses on how security pertains to corporate assets and financial goals and losses<br></br>
- Staff: Policies, procedures, standards and guidelines<br></br>
- Technical employees: In-depth training on daily activities</p>

171
Q

<p>Security Governance - Definition</p>

A

<p>Framework providing Oversight, Accountability and Compliance</p>

172
Q

<p>Security Governance - Metrics</p>

A

<p>* ISO 27004: How to measure Security Program effectiveness<br></br>
* NIST SP 800-55: Government's version of ISO 27004</p>

173
Q

<p>Ethics - ISC2 Code of Ethics</p>

A

<p>* Protect society, the common good, necessary public trust and confidence, and the infrastructure<br></br>

* Act honorably, justly, responsibly and legally<br></br>
* Provide diligent and competent service to principals<br></br>
* Advance and protect the profession</p>

174
Q

<p>Ethics - Computer Ethics Institute</p>

A

<p>1) Thou shalt not use a computer to harm other people<br></br>

2) Thou shalt not interfere with other people's computer work<br></br>
3) Thou shalt not snoop around in other people's computer files<br></br>
4) Thou shalt not use a computer to steal<br></br>
5) Thou shalt not use a computer to bear false witness<br></br>
6) Thou shalt not copy or use proprietary software for which you have not paid<br></br>
7) Thou shalt not use other people's computer resources without authorization or proper compensation<br></br>
8) Thou shalt not appropriate other people's intellectual output<br></br>
9) Thou shalt think about the social consequences of the program you are writing or the system you are designing<br></br>
10) Thou shalt always use a computer in ways that insure consideration and respect for your fellow humans</p>

175
Q

Ethics - Internet Architecture Board (IAB) unethical acts

A
  • Seeks to gain unauthorized access to the resources of the Internet
  • Disrupts the intended use of the Internet
  • Wastes resources (people, capacity, computer) through such actions
  • Destroys the integrity of computer-based information<
  • Compromises the privacy of users

CISSP (4 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2025 Bold Learning Solutions. Terms and Conditions