COMPARING SECURITY ROLES AND SECURITY CONTROLS Flashcards
What is a security Control?
Something designed to give a system or data asset the properties of Confidentiality, Integrity, Availability, and Non-repudiation
What is a technical Control?
Control, implemented as a system (hardware,software,firmware)
What is an Operational Control?
Implemented by people rather than systems (security Guards, training)
What is a Managerial Control?
Gives oversight of information System (risk ID tool)
Security Control Categories?
Technical, Managerial, Operational
Security Control Function Types?
Preventative, Detective, Corrective, Physical, Deterrent, Compensating
Preventative Control Function?
Acts to eliminate or reduce likelihood of attack
Detective Control Function
Does not prevent or Deter, but will ID/record any attempt intrustion
Corrective Control Function
Acts to eliminate or reduce the impact of an intrusion
Physical Control Function
Deter/Detect Physical access (Alarms/locks cameras)
Deterrent Control Function
May not prevent access, but discourages it
Compensating Control Function
Substitute for principal control
What is A Cybersecurity Framework?
A list of activities and objectives undertaken to mitigate risks
What is NIST (CSF)?
National Institute of Standards and Technology : Focuses solely on IT security
What Does ISO 27k Focus on?
Personal Data and Privacy
What does ISO 31k Focus on?
Overall framework for enterprise risk management (ERM)
What Is the Cloud Security Alliance? (CSA)
Organization that produces various resources to assist cloud service providers (CSP) in setting up and delivering secure cloud platforms.
What is the statements on Standards for Attestation Engagements (SSAE) Service organization Control (SOC)
SSAE is audit specifications developed by the American Institute of certified Public Accountants
SSAE SOC2 vs SOC3
SOC2 is detailed;DnD
SOC3 is Unclassified
What is the Center for internet Security (CIS)
the 20 CIS
Controls.” The CIS-RAM (Risk Assessment Method) can be used to perform an overall
evaluation of security posture
Open Web Application Security Project (OWASP)
community that publishes several secure application development resources,
Sarbanes-Oxley Act (SOX)
mandates the implementation of risk assessments, internal controls, and
audit procedures.
he Computer Security Act (1987)
equires federal agencies to
develop security policies for computer systems that process confidential information
General Data Protection
Regulation (GDPR)
personal data cannot be collected, processed, or
retained without the individual’s informed consent
