Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CISSP > CISSP (Domain 3 - Information Security Governance and Risk Management) > Flashcards

CISSP (Domain 3 - Information Security Governance and Risk Management) Flashcards

1
Q

4 Item for a Business Model for Information Security

OPPT

A
  • Organization Design/Strategy
  • People
  • Process
  • Technology
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

6 Interconnections for a Business Model in Information Security
(GCEEHA)

A
  • Governance
  • Culture
  • Enablement & Support
  • Emergence
  • Human Factors
  • Architecture
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Corporate Governance

A

Set of responsibilities and practices exercised by the board and executive management with the goal of providing strategic direction, objectives achieved.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Plan Do Check Act (PDCA)

E/IO/MR/MI

A

Approach to continuous process improvement

  • Establish ISMS
  • Implement/Operate ISMS
  • Monitor/Review ISMS
  • Maintain/Improve ISMS
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

ISO 27001 (Governance)

A

PDCA model to structure the processes, and reflects the principals set out in the OECD guidelines

  • How to implement
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

ISO 27002 (Governance)

A

AKA ISO 17799, basic outline of hundreds of potential controls and control mechanisms

  • What should be secured
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

3 Goals of a Security Model
(long/mid/short)
(STO)

A
  • Long Term: Strategic Goals (supported by med/short term, all PCs on VPN)
  • Mid Term: Tactical Goals (Put in domains, add Firewalls)
  • Short Term: Operational Goals (Patches)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Due Care

A
  • *Do Connect
  • Do the right thing and protect assets
  • Functional Requirements
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Due Diligence

A
  • *Do Detect
  • Senior Management
  • Investigate actual threats and risks (Determine Risk Exposure)
  • Assurance Requirements
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

CIA Triad

A
  • Confidentiality: Prevent unauthorized disclosure of sensitive information
  • Integrity: Prevent unauthorized modification of systems and information
  • Availability: Prevent disruption of service and productivity
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Confidentiality (CIA Triad) - Threats and Solutions

A

Threats:

  • Hackers
  • Malicious Software
  • Social Engineering
  • System Failure/Employee Error

Solutions:

  • Identification
  • AuthN
  • AuthZ
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Integrity (CIA Triad) - Threats and Solutions

A

Threats:

  • Hackers
  • Malicious Software
  • Social Engineering
  • System Failure/Employee Error

Solutions:

  • Least Privilege
  • Separation of Duties (SoD), prevents collusion
  • Rotation of Duties (Mandatory Vacation)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Availability (CIA Triad) - Threats and Solutions

A

Threats:

  • Deliberate Attacks
  • System Failure/User Error
  • Natural Disasters

Solutions:
- Redundancy

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

3 Reasons Why We Have Security Policies

OSR

A
  • Objective/Goal or Purpose
  • Scope
  • Responsibility
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What is a Security Policy

A

General statement products by senior management/board/committee to dictate what type of role security plays within the organization.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Security Policy Document Relationship

Drivers/MgmtSS/MgmtSD

A
  • Drivers: Laws, Regulations, Best Practices
    Program or Organizational Policy
  • Managements Security Statement: Program/Organizational Policy
  • Managements Security Directive: Functional Policies (issue and system specific)
    + standards/procedures/baselines/guidelines
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

NIST SP 800-12: Program Policy

A

Programs security policy driving by Laws/Regulations/Best Practices. Large scope

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

NIST SP 800-12: Issue-Specific Policies

A

Addresses specific security threats management feels need more detailed explanation and attention.

Ex: Acceptable use of resources agreement, e-mail policy where management can read your email

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

NIST SP 800-12: System-Specific Policies

A

Includes two components: Security Objectives and Operational Security Rules.

Usually only on one system

Ex. Payroll and HR can only modify Payroll system

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Regulatory Policy

A

Government ordinance, all who fall under must comply

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Advisory Policy

A

NOT mandated by law. Company puts in place on self.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Informative Policy

A

Educate who reads the policy.

Ex: No smoking in the aircraft

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

4 Functions for Support Policies

SBPG

A
  • Standards
  • Baselines
  • Procedures
  • Guidelines
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Standards - Supporting Policies

A
  • Binding

- Common practice all adhere to (RHEL only)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

Baselines - Supporting Policies

A
  • Binding
  • Min level of protection and security
  • Password length 8 characters
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

Procedures - Supporting Policies

A
  • Binding

- Set of instructions to meet policy

27
Q

Guidelines - Supporting Policies

A
  • non-binding
  • Recommendation or suggestion to improve the overall quality of a policy
  • Use ISO/ITIL
28
Q

3 Cā€™s of Data Classification

A
  • Cost Value: Identified during risk analysis
  • Classify: Organize according to sensitivity to loss or disclosure (Priority)
  • Control: Data segmented into sensitivity levels (Level)
29
Q

4 Commercial Data Classification Types

CPSP

A
  • Confidential
  • Private
  • Sensitive
  • Public
30
Q

4 Military Data Classification Types

TSCU

A
  • Top Secret
  • Secret
  • Confidential
  • Unclassified
31
Q

Difference Between Data Owner and Data Custodian

A

Data owner directs the data custodian on how to protect the data

32
Q

Data Owners Responsibilities (2 things)

A
  • Level of priority/classification to a resource. (what makes it special)
  • Define level of protection of asset at the priority
33
Q

Data Custodian Responsibilities (2 things)

A
  • Implement controls that meet the level of protection needed
  • Maintain the data and monitor
34
Q 
Risk Management (IAR)
(RA/RM/CE)
A

The process of identifying, analyzing, and reducing the risk to an acceptable level.

  • Risk Assessment
  • Risk Mitigation
  • Controls Evaluation
35
Q

Risk Assessment

A

Identification of companies assets, associated risks, and potential loss the organization could suffer.

36
Q

Asset - Risk Management

A

Any resource with value to the organization

37
Q

Threat - Risk Management

A

Potential danger to an asset

38
Q

Threat-Source/Threat-Agent - Risk Management

A

Anyone/thing that has the potential to cause threat

39
Q

Vulnerability - Risk Management

A

Flaw or weakness of an asset

40
Q

Risk

A

Likelihood of a threat agent taking advantage of a vulnerability

41
Q

Exposure

A

An opportunity for a threat to cause loss (Firewall ports opened)

42
Q

Event/Exploit

A

Instance of loss experienced

43
Q

Loss

A

Real or perceived devaluation of an asset

44
Q

Controls (2 types)

A
  • Technical and nontechnical risk mitigation mechanisms (Safeguards/Countermeasures)
  • Good controls reduce exposure
45
Q

Safeguards

A

Preventative (proactive, avoid)

46
Q

Countermeasures

A

Detective and corrective (reactive, respond)

47
Q

4 Steps to Perform Risk Analysis

WC/HB/LR/HR

A
  • What could happen
  • How bad would it be (loss)
  • Likelihood to be realized (chance)
  • How real are they
48
Q

NIST 800-30: Risk Assessment Activities (9 Steps)

SC/TI/VI/CA/L/IA/R/CR/D

A
  • System Characterization (identify systems)
  • Threat ID
  • Vulnerability ID
  • Control Analysis
  • Likelihood (Will it happen)
  • Impact Analysis (loss?)
  • Risks
  • Control Recommendations
  • Documentation
49
Q

Quantitative - Risk Approach

A

Assigning numeric/monetary values to risk ($$$$)

50
Q

Qualitative - Risk Approach

A

Subjective rating assigned, opinion based,

51
Q

Delphi Method - Risk Approach

A

People can express their ideas anonymously

52
Q

Annualized Loss Expectancy (ALE)*

Tornado damage 50% of facility. Worth 200,000. Once in 10 years

A

SLE x ARO = ALE

Tornado damage 50% of facility. Worth 200,000. Once in 10 years

SLE: 200,000 x .50 = 100,000
ARO: 1/10 = .1 (remember x in # of years)

100,000 x .1 = 10,000 in countermeasures

53
Q

Single Loss Expectancy (SLE)*

A

Asset Value (AV) x Exposure Factor (EF) = SLE

54
Q

Annualized Rate of Occurrence (ARO)*

A

Value that represents the estimated possibility of a specific threat taking place

55
Q

Exposure Factor (EF)

A

Percentage of asset loss caused by threat

56
Q

Residual Risk

A

Risk after countermeasures or safeguards

Total Risk - Acceptable Risk = Residual Risk

57
Q

Total Risk

A

Exposure before control put in place

58
Q

Acceptable Risk

A

What ā€œCā€ are ok with

59
Q

Control Gap

A

Risk between Total Risk and Acceptable risk

60
Q

3 Risk Mitigation Options(RTA)

A
  • Reduce
  • Transfer
  • Accept
61
Q

Cost-Benefit Analysis Formula

Tornado

  • 10k Asset
  • 1k deductible
  • 2k year policy
A

Value of the control of the company

Tornado

  • 10k Asset
  • 1k deductible
  • 2k year policy

ALE Before - ALE After - Annual Cost of Control

10k - 1k - 2k = 7k cost benefit

62
Q

Security Awareness Training

A
  • Employees wont follow them unless they know about them
  • Employees must know expectations and ramification if not met
  • Employee recognition award program
  • Part of due care
  • Administrative control
63
Q

2 Approaches to Security Management

TD/BU

A
  • Top-Down: Senior management directed (ISC^2)

- Bottom-Up: IT defines

CISSP (21 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions