CISSP Quick Tips Flashcards
Vulnerability
The absence of a safeguard (in other words, it is a weakness) that can be exploited.
Threat
the possibility that someone or something would exploit a vulnerability, intentionally or accidentally, and cause harm to an asset.
Risk
the probability of a threat agent exploiting a vulnerability and the loss potential from that action.
What reduces risk?
Reducing vulnerabilities and/or threats
Exposure
An instance of being exposed to losses from a threat.
Countermeasure
Also called a safeguard, mitigates the risk.
• A countermeasure can be an application, software configuration, hardware, or procedure.
Due care
If someone is practicing due care, they are acting responsibly and will have a lower probability of being found negligent and liable if a security breach takes place.
Why is the importance of Security Management growing?
• Security management has become more important over the years because networks have evolved from centralized environments to distributed environments.
The objectives of security
To provide availability, integrity, and confidentiality protection to data and resources.
Planning horizon
Strategic planning is long term, tactical planning is midterm, and operational planning is day to day. These make up a planning horizon.
ISO/IEC 27002 (formerly ISO 17799 Part 1)
A comprehensive set of controls comprising best practices in information security and provides guidelines on how to set up and maintain security programs.
Security components
Can be technical (firewalls, encryption, and access control lists) or nontechnical (security policy, procedures, and compliance enforcement).
Asset identification
Should include tangible assets (facilities and hardware)
and intangible assets (corporate data and reputation).
Project sizing
Means to understand and document the scope of the project
Must be done before a risk analysis is performed.
Assurance
The degree of confidence that a certain security level is being provided.
CobiT
A framework that defines goals for the controls that should be used to
properly manage IT and to ensure that IT maps to business needs.
Four domains of CobiT
- Plan and Organize
- Acquire and Implement
- Deliver and Support
- Monitor and Evaluate.
ISO/IEC 27001
The standard for the establishment, implementation,
control, and improvement of the Information Security Management System.
How should security management work?
It should work from the top down (from senior management down to the staff).
Governance
The set of responsibilities and practices exercised by the board
and executive management with the goal of providing strategic direction,
ensuring that objectives are achieved, ascertaining that risks are managed
appropriately, and verifying that the enterprise’s resources are used responsibly.
What should determine which security model a company chooses?
Should depend on the type of business, its critical missions, and its objectives.
The OECD
an international organization that helps different governments
come together and tackle the economic, social, and governance challenges of
a globalized economy.
How can risk be treated?
It can be transferred, avoided, reduced, or accepted.
What is an example of risk transference?
When a company buys insurance.
Ways to reduce risk
Improving security procedures and implementing safeguards.
Formula for total risk
Threats × vulnerability × asset value = total risk
Formula for residual risk
(Threats × vulnerability × asset value) × controls gap = residual risk
Main goals of risk analysis
- Identify assets and assign values to them - Identify vulnerabilities and threats - Quantify the impact of potential threats - provide an economic balance between the impact of the risk and the cost of the safeguards.
Information risk management (IRM)
The process of identifying, assessing,
and reducing risk to an acceptable level and implementing the right
mechanisms to maintain that level of risk.
Failure Modes and Effect Analysis (FMEA)
A method for determining
functions, identifying functional failures, and assessing the causes of failure
and their failure effects through a structured process.
Fault tree analysis
A useful approach to detect failures that can take place within complex environments and systems.
Quantitative risk analysis
Attempts to assign monetary values to components within the analysis.
Is a purely quantitative risk analysis possible?
No, because qualitative items
cannot be quantified with precision.
Why is capturing the degree of uncertainty when carrying out a risk analysis
important?
because it indicates the level of confidence the team and management should have in the resulting figures.
What must be considered when determining the value of information?
- the cost to acquire and develop data
- the cost to maintain and
protect data - the value of the data to owners, users, and adversaries
- the cost of replacement if the data is lost
- the price others are willing to pay for the
data - lost opportunities
- the usefulness of the data,
Automated risk analysis tools
Reduce the amount of manual work involved in the analysis.
They can be used to estimate future expected losses and calculate
the benefits of different security measures.
Single loss expectancy (SLE)
The amount that could be lost if a specific
threat agent exploited a vulnerability.
Formula for Annualized Loss Expectancy (ALE)
Single loss expectancy × frequency per year = annualized loss expectancy
(SLE × ARO = ALE).
Qualitative risk analysis
Uses judgment and intuition instead of numbers.
• Involves people with the requisite experience and education evaluating threat scenarios and rating the probability, potential loss, and severity of each threat based on their personal experience.
The Delphi technique
A group decision method where each group member can communicate anonymously.
What must be considered when choosing the right safeguard to reduce a specific risk?
the cost, functionality, and effectiveness must be evaluated and a cost/benefit analysis performed.
A security policy
A statement by management dictating the role security plays in the organization.
Procedures
Detailed step-by-step actions that should be followed to achieve a certain task.
A standard
Specifies how hardware and software are to be used. Standards are
compulsory.
A baseline
A minimum level of security.
Guidelines
Recommendations and general approaches that provide advice and flexibility.
Job rotation
A control to detect fraud.
Mandatory vacations
A control type that can help detect fraudulent activities.
Separation of duties
Ensures no single person has total control over an activity or task.
Split knowledge and dual control
Two aspects of separation of duties.
Why is data classified?
to assign priorities to data and ensure the appropriate level of protection is provided.
• Data owners specify the classification of data.
What requirements does security have?
- Functional requirements, which define the expected behavior from a product or system
- Assurance requirements, which establish
confidence in the implemented products or systems overall.
How should the security program fit into the business plan?
Security program should be integrated with current business objectives and goals.
What is management’s role in security?
Management must define the scope and purpose of security management,
provide support, appoint a security team, delegate responsibility, and review
the team’s findings.
Who should be included in the risk management team?
should include individuals from different
departments within the organization, not just technical personnel.
How would qualitative and quantitative ratings be expressed?
A qualitative rating would be expressed in high, medium, or low, or on a
scale of 1 to 5 or 1 to 10. A quantitative result would be expressed in dollar
amounts and percentages.
What should safeguards default to?
They should default to least privilege, and have fail-safe defaults and override capabilities.
How should safeguards be imposed?
Uniformly, so everyone has the same
restrictions and functionality.
What is a key element during the initial security planning process?
To define reporting relationships.
The data custodian (information custodian) is responsible for _____________?
Maintaining and protecting data.
What does a security analyst do?
Works at a strategic level and helps develop policies, standards, and guidelines, and also sets various baselines.
Application owners are responsible for _____________.
Dictating who can and cannot access
their applications, as well as the level of protection these applications provide
for the data they process and for the company.
Access
A flow of information between a subject and an object.
A subject
An active entity that requests access to an object, which is a passive entity.
A subject
can be a user, program, or process.
Confidentiality
The assurance that information is not disclosed to unauthorized subjects.
Security mechanisms that provide confidentiality
Encryption, logical and physical access control, transmission protocols, database views, and controlled traffic flow.
Identity management solutions
Directories, web access management,
password management, legacy single sign-on, account management, and profile update.
Password synchronization
Reduces the complexity of keeping up with different passwords for different systems.
Self-service password reset
Reduces help-desk call volumes by allowing users to reset their own passwords.
Assisted password reset
Reduces the resolution process for password issues for the help-desk department.
IdM directories
contain all resource information, users’ attributes, authorization profiles, roles, and possibly access control policies so other IdM applications have one centralized resource from which to gather this information.
Automated workflow component
Common in account management
products that provide IdM solutions.
User provisioning
Refers to the creation, maintenance, and deactivation of user objects and attributes, as they exist in one or more systems, directories, or applications.
HR database
Usually considered the authoritative source for user identities because that is where it is first developed and properly maintained.
Three main access control models:
discretionary, mandatory, and
nondiscretionary.
Discretionary access control (DAC)
Enables data owners to dictate what
subjects have access to the files and resources they own.
Mandatory access control (MAC)
Uses a security label system. Users have
clearances, and resources have security labels that contain data classifications.
MAC compares these two attributes to determine access control capabilities.
Nondiscretionary access control
uses a role-based method to determine access rights and permissions.
Role-based access control
Based on the user’s role and responsibilities within the company.
Three main types of restricted interface measurement
menus and shells, database views, and physically constrained interfaces.
Access control lists
are bound to objects and indicate what subjects can use them.
A capability table
Bound to a subject and lists what objects it can access.
Access control can be administered in two main ways:
centralized and decentralized
Some examples of centralized administration access control technologies are RADIUS, TACACS+, and Diameter.
A decentralized administration example is a peer-to-peer working group.
Examples of administrative controls
A security policy, personnel controls,
supervisory structure, security-awareness training, and testing.
Examples of physical controls
Network segregation, perimeter security,
computer controls, work area separation, data backups, and cable.
Examples of technical controls
System access, network architecture,
network access, encryption and protocols, and auditing.
Access control mechanisms provide one or more of the following
functionalities
Preventive, detective, corrective, deterrent, recovery, or compensative.
For a subject to be able to access a resource, it must be ___________.
Identified, authenticated,
and authorized, and should be held accountable for its actions.
Authentication can be accomplished by ___________.
Biometrics, a password, a passphrase,
a cognitive password, a one-time password, or a token.
Type I error in biometrics
means the system rejected an authorized
individual, and a Type II error means an imposter was authenticated.
Difference between a memory care and a smart card
A memory card cannot process information, but a smart card can.
Access controls should default to _________.
no access
Least-privilege and need-to-know principles
limit users’ rights to only what is
needed to perform tasks of their job.
Single sign-on technology
Requires a user to be authenticated to the network only one time.
Single sign-on capabilities can be accomplished through ____________.
Kerberos, SESAME, domains, and thin clients.
How does Kerberos authenticate users?
In Kerberos, a user receives a ticket from the KDC so they can authenticate to a
service.
What does the Kerberos user receive?
The Kerberos user receives a ticket granting ticket (TGT), which allows him to
request access to resources through the ticket granting service (TGS). The TGS
generates a new ticket with the session keys.
Types of access control attacks
- Denial of service
- Spoofing, dictionary
- Brute force
- Wardialing.
Audit logs
can track user activities, application events, and system events.
Keystroke monitoring
A type of auditing that tracks each keystroke made by a user.
Audit logs should be ____________.
protected and reviewed.
Object reuse
can unintentionally disclose information.Just removing pointers to files is not always enough protection for proper
object reuse.
Information can be obtained via __________.
electrical signals in airwaves. The ways to
combat this type of intrusion are TEMPEST, white noise, and control zones.
User authentication is accomplished by what ___________.
someone knows, is, or has.
One-time password-generating token devices can use 2 methods:
synchronous or asynchronous methods.
Strong authentication requires
two of the three user authentication attributes (what someone knows, is, or has).
Kerberos addresses:
privacy and integrity but not availability.
Weaknesses of Kerberos
- the KDC is a single point of failure
- it is susceptible to password guessing
- session and secret keys are locally stored
- KDC needs to always be available
- there must be management of secret keys.
IDSs can be:
statistical (monitor behavior) or signature-based (watch for known attacks).
Degaussing
A safeguard against disclosure of confidential information because it returns media back to its original state.
Phishing
A type of social engineering with the goal of obtaining personal information, credentials, credit card number, or financial data.
Do all systems with similar components have the same security level?
Two systems can have the exact same hardware, software components, and
applications, but provide different levels of protection because of the different
security policies and security models the two systems were built upon.
Components of a CPU
A CPU contains a control unit, which controls the timing of the execution of
instructions and data, and an ALU, which performs mathematical functions
and logical operations.
Protection rings
Most systems use protection rings. The more privileged processes run in the
lower-numbered rings and have access to all or most of the system resources.
Applications run in higher-numbered rings and have access to a smaller amount of resources.
What are the modes for operating system processes and applications?
Operating system processes are executed in privileged or supervisor mode, and
applications are executed in user mode, also known as “problem state.”
Secondary storage
Nonvolatile and can be a hard drive, CD-ROM drive, floppy drive, tape backup, or a jump drive.
Virtual storage
Combines RAM and secondary storage so the system seems to have a larger bank of memory.
A deadlock situation
Occurs when two processes are trying to access the same resource at the same time.
How complex are security mechanisms?
Security mechanisms can focus on different issues, work at different layers,
and vary in complexity.The more complex a security mechanism is, the less amount of assurance it can usually provide.
TCB
Not all system components fall under the trusted computing base (TCB), which includes only those system components that enforce the security policy directly and protect the system. These components are within the security perimeter.
Components that make up the TCB
Hardware, software, and firmware that
provide some type of security protection.
Security perimeter
An imaginary boundary that has trusted components within it (those that make up the TCB) and untrusted components outside it.
The reference monitor concept
An abstract machine that ensures all subjects have the necessary access rights before accessing objects. Therefore, it mediates all accesses to objects by subjects.
The security kernel
The mechanism that actually enforces the rules of the reference monitor concept.
Requirements of the security kernel
- must isolate processes carrying out the reference monitor concept
- must be tamperproof
- must be invoked for each access attempt
- must be small enough to be properly tested.
Security domain
All the objects available to a subject.
Processes need to be isolated. How can this be accomplished?
Can be done through segmented memory
addressing, encapsulation of objects, time multiplexing of shared resources,
naming distinctions, and virtual mapping.
The level of security a system provides depends upon ___________.
how well it enforces the security policy.
A multilevel security system
processes data at different classifications (security levels), and users with different clearances (security levels) can use the system.
Why should processes be assigned least privilege?
so they have just enough system
privileges to fulfill their tasks and no more.
Layering
Some systems provide security at different layers of their architectures, which
is called layering. This separates the processes and provides more protection
for them individually.
Data hiding
occurs when processes work at different layers and have layers of access control between them. Processes need to know how to communicate only with each other’s interfaces.
A security model
maps the abstract goals of a security policy to computer system terms and concepts. It gives the security policy structure and provides a framework for the system.
A closed system
Often proprietary to the manufacturer or vendor, whereas the open system allows for more interoperability.
The Bell-LaPadula model
Deals only with confidentiality
Has a simple security rule, which means a subject cannot read data from a higher level (no read up).
The *-property rule means a subject cannot write to an object at a lower level (no write down).
The strong star property rule dictates that a subject can read and write to objects at
its own security level.
used mainly in military systems.
A state machine model
deals with the different states a system can enter. If a system starts in a secure state, all state transitions take place securely, and the system shuts down and fails securely, the system will never end up in an insecure state.
A lattice model
provides an upper bound and a lower bound of authorized access for subjects.
Information flow security model
does not permit data to flow to an object
in an insecure manner.
dedicated security mode
only deals with one level of data classification, and all users must have this level of clearance to be able to use the system.
Biba model
- Deals only with integrity
- does not let subjects write to objects at a higher integrity level (no write up), and it does not let subjects read data at a lower integrity level (no read down).
- used in the commercial sector
Clark-Wilson model
- Deals only with integrity
- dictates that subjects can only access objects through applications. This model also illustrates how to provide functionality for separation of duties and requires auditing tasks within software.
- used in the commercial sector.
Compartmented and multilevel security modes
enable the system to process
data classified at different classification levels.
Trust
means that a system uses all of its protection mechanisms properly to process sensitive data for many types of users.
Assurance
the level of confidence you have in this trust and that the protection mechanisms behave properly in all circumstances predictably.
The Orange Book
also called Trusted Computer System Evaluation Criteria (TCSEC), was developed to evaluate systems built to be used mainly by the military. Its use was expanded to evaluate other types of products.
Orange Book, D classification
means a system provides minimal
protection and is used for systems that were evaluated but failed to meet
the criteria of higher divisions.
Orange Book, the C division
deals with discretionary protection
Orange Book, B division
deals with mandatory protection (security labels).
Orange Book, A classification
means the system’s design and level of
protection are verifiable and provide the highest level of assurance and trust.
Orange Book, C2
Requires object reuse protection and auditing.
Orange Book, B1
first rating that requires security labels.
Orange Book, B2
requires security labels for all subjects and devices, the existence of a trusted path, routine covert channel analysis, and the provision of separate administrator functionality.
ITSEC
evaluates the assurance and functionality of a system’s protection mechanisms separately, whereas TCSEC combines the two into one rating.
Common Criteria
Developed to provide globally recognized
evaluation criteria and is in use today. It combines sections of TCSEC,
ITSEC, CTCPEC, and the Federal Criteria.
Common Criteria uses protection profiles and ratings from ___________.
EAL1 to EAL7.
Certification
the technical evaluation of a system or product and its security components. Accreditation is management’s formal approval and acceptance of the security provided by a system.
A covert channel
An unintended communication path that transfers data in a way that violates the security policy.
Two types of covert channels
timing and storage covert channels
Covert timing channel
enables a process to relay information to another process by modulating its use of system resources.
What does a covert storage channel enable?
a process to write data to a storage medium
so another process can read it.
A maintenance hook
Developed to let a programmer into the application quickly for maintenance. This should be removed before the application goes into production or it can cause a serious security risk.
An execution domain
Where instructions are executed by the CPU. The operating system’s instructions are executed in a privileged mode, and
applications’ instructions are executed in user mode.
Process isolation
ensures that multiple processes can run concurrently and the processes will not interfere with each other or affect each other’s memory segments.
The only processes that need complete system privileges are located where?
in the system’s kernel.
TOC/TOU
stands for time-of-check/time-of-use. This is a class of asynchronous attacks.
What goal of integrity does the Biba model addresses?
the first goal of integrity, which is to prevent unauthorized users from making modifications.
What goal of integrity does the Clark-Wilson model address?
all three integrity goals: prevent unauthorized users from making modifications, prevent authorized users from making improper modifications, and maintain internal and external consistency.
How can users access and manipulate objects in the Clark-Wilson model?
users can only access and manipulate objects through programs. It uses access triple, which is subject-program-object.
What is usually the first line of defense against environmental risks
and unpredictable human behavior?
Physical security
Crime Prevention Through Environmental Design (CPTED)
combines the physical environment and sociology issues that surround it to reduce crime rates and the fear of crime.
How to determine if security controls are cost-effective?
The value of property within the facility and the value of the facility itself need to be ascertained to determine the proper budget for physical security
Automated environmental controls
help minimize the resulting damage and
speed the recovery process. Manual controls can be time-consuming and errorprone, and require constant attention.
What need to be evaluated for
their protective characteristics, their utility, and their costs and benefits?
Construction materials and structure composition
When looking at locations for a facility, consider ___________.
local crime, natural disaster possibilities, and distance to hospitals, police and fire stations, airports, and railroads.
Characteristics of a good HVAC system
should maintain the appropriate temperature and humidity levels and provide closed-loop recirculating air-conditioning and positive pressurization and ventilation.
High humidity can cause ________
corrosion
low humidity can cause ________
static electricity.
Administrative controls
drills and exercises of emergency procedures, simulation testing, documentation, inspections and reports, prescreening of employees, post-employment procedures, delegation of responsibility and rotation of duties, and security-awareness training.
Proximity identification devices can be __________
User-activated (action needs to be
taken by a user) or system sensing (no action needs to be taken by the user).
A transponder
is a proximity identification device that does not require action by the user. The reader transmits signals to the device, and the device responds with an access code.
Problem with interior partitions
If interior partitions do not go all the way up to the true ceiling, an intruder
can remove a ceiling tile and climb over the partition into a critical portion of
the facility.
Intrusion detection devices
Include motion detectors, CCTVs, vibration
sensors, and electromechanical devices.
Drawbacks of Intrusion detection devices
can be penetrated, are expensive to install and monitor, require human response, and are subject to false alarms.
Benefit of CCTV
enables one person to monitor a large area, but should be coupled with alerting functions to ensure proper response.
A cipher lock
uses a keypad and is programmable.
Media should be protected from _________
destruction, modification, theft,
unauthorized copying, and disclosure.
Security concerns with floors, ceilings, and walls
need to be able to hold the necessary load and provide the required fire rating.
Water, steam, and gas lines need to have _________
shutoff valves and positive drains
substance flows out instead of in
The threats to physical security
interruption of services, theft, physical
damage, unauthorized disclosure, and loss of system integrity.
The primary power source
is what is used in day-to-day operations, and the alternate power source is a backup in case the primary source fails.
Power companies usually plan and implement brownouts when ____________
they are experiencing high demand.
Power noise
A disturbance of power and can be caused by electromagnetic interference (EMI) or radio frequency interference (RFI).
EMI can be caused by ____________
lightning, motors, and the current difference between wires.
RFI can be caused by ___________
electrical system mechanisms, fluorescent lighting, and electrical cables.
Power transient noise
disturbance imposed on a power line that causes electrical interference.
Power regulators
condition the line to keep voltage steady and clean.
UPS factors that should be reviewed
the size of the electrical load the UPS
can support, the speed with which it can assume the load when the primary
source fails, and the amount of time it can support the load.
Shielded lines
protect from electrical and magnetic induction, which causes interference to the power voltage.
Perimeter protection
used to deter trespassing and to enable people to enter a facility through a few controlled entrances.
Smoke detectors should be located ________
on and above suspended ceilings, below
raised floors, and in air ducts to provide maximum fire detection.
What interferes with the
chemical reaction of a fire?
Gases, like Halon, FM-200, and other Halon substitutes
The HVAC system should be turned off ___________
before activation of a fire suppressant
to ensure it stays in the needed area and that smoke is not distributed to
different areas of the facility.
Portable fire extinguishers should be located ___________
within 50 feet of electrical
equipment and should be inspected quarterly.
Is Halon still available?
No, because it depletes the ozone. FM-200 or other similar substances are used instead of halon.
Drawbacks of Proximity systems
require human response, can cause false alarms, and
depend on a constant power supply, so these protection systems should be
backed up by other types of security systems.
Dry pipe systems
reduce the accidental discharge of water because the water does not enter the pipes until an automatic fire sensor indicates there is an actual fire.
In locations with freezing temperatures where broken pipes cause problems, dry pipes should be used.
preaction pipe
delays water release
When can Dual-homed firewalls be compromised
if the operating system does not
have packet forwarding or routing disabled.
protocol
A set of rules that dictates how computers communicate over networks.
