Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Fundamentals of Information Security > Compliance > Flashcards

Compliance Flashcards

1
Q

What is the definition of compliance?

A

Adherence to the rules and regulations that govern the information you handle and the industry within which you operate

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Does being in compliance mean your system is secure?

A

No. Compliance fills a business need rather than any technical security need.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What are the two types of compliance?

A

Regulatory
Industry

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Define regulatory compliance

A

Adherence to laws specific to the industry in which you’re operating; usually involves cyclical audits and assessments to ensure compliance

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Define industry compliance

A

Adherence to regulations that aren’t mandated by law but that can nevertheless have severe impacts upon your ability to conduct business
Example: PCI DSS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What are the three main types of controls for compliance?

A

Physical
Administrative
Technical

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What do physical controls in compliance do?

A

Mitigate risks to physical security
Deter unauthorized access
Examples: Fences, guards, cameras, locked doors

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

How do administrative controls help achieve compliance?

A

Mitigate risks by implementing certain processes and procedures
Must be documented to show that they are put in place and enforced

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Information security policy

A

To comply with this requirement, must put a policy in place and prove you have followed it
Examples: Emails, tickets from ticketing systems, files from investigations

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Define and describe technical controls for compliance please.

A

Manage risk using technical measures
Regulations will often mandate certain technical controls
Examples: firewalls, intrusion detection systems, access control lists

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Name the two levels of compliance controls, pertaining to importance

A

Key
Compensating

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Define and describe key controls in compliance. (4)

A

Primary controls used to manage risk in your environment
Provide a reasonable degree of assurance that risk will be mitigated
If control fails, it’s unlikely another control could take over for it
Failure of this control will affect an entire process

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Should you always test key controls as part of compliance and audit efforts?

A

Yes.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Define and describe compensating compliance controls.

A

Replace impractical or unfeasible key controls
Likely to have to explain to auditors how it will fulfill the intent and purpose of the key control it’s replacing

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What are the four steps to maintaining compliance?

A

Monitoring
Reviewing
Documenting
Reporting

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Describe monitoring as a step of maintaining compliance. (3)

A

See if the controls you have in place mitigate or reduce your risk
No news is good news
Check controls to make sure they are still effective as environment and technology changes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Describe reviewing as a step in maintaining compliance.

A

Periodically make sure your controls cover old and emergent risks appropriately
Determine whether you need to implement new controls or retire outdated controls

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Describe documenting as a step of maintaining compliance. (3)

A

Document results of review
Tracks changes to control’s environment
Helps to evaluate trends, possibly predict future control changes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Describe reporting as a step in maintaining compliance.

A

Report results of review and documentation to leadership
Keeps them in the loop and provides you with means of requesting staff and resources you may need

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Where are many of the US government’s standards in their information security laws from?

A

Standards that form the basis of US laws are often from the series of Special Publications of the US National Institute of Standards and Technology (NIST)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

What is FISMA?

A

Federal Information Security Management Act (2002)
Requirements involve risk-based approach–one that handles security by enumerating and compensating for specific risks
Once an org passes an audit, it receives an authority to operate (ATO)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Whom does FISMA apply to? (3)

A

US federal government agencies
State agencies that administer federal programs (eg, Medicare)
Private companies that support, sell to, or receive grant money from feds

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

What is FedRAMP?

A

Federal Risk and Authorization Management Program (2011)
Defines rules for government agencies contracting with cloud providers, including SaaS cloud tools
Certification has single ATO for all agencies

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

What is HIPAA?

A

Health Insurance Portability and Accountability Act (1996)
Protects rights and data of patients in the US
Applies generally to orgs involved in healthcare and health insurance

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

What is PHI and e-PHI?

A

Protected health information–any portion of a patient’s medical records or medical transactions

26
Q

What are some requirements of HIPAA? (4)

A

Requires to safeguard protected health information (PHI) and electronic PHI (e-PHI)
Ensure CIA of any information that you handle or store
Protect info from threats and unauthorized disclosures
Ensure workforce is compliant with these rules

27
Q

What is SOX?

A

Sarbanes-Oxley Act (2002)
Regulates financial data, operations, and assets for publicly held companies
Made in response to incidents of financial fraud, like Enron

28
Q

What are the requirements of SOX?

A

Has reqs on record-keeping, including integrity of records, retention periods for some information, and methods of storing electronic information.

29
Q

What law do information security professionals often used to develop and implement systems?

A

SOX

30
Q

What is GLBA?

A

Gramm-Leach-Bliley Act (1999)
Protects personally identifiable information (PII) and financial data of customers of financial institutions

31
Q

Broad strokes, what must one do to comply with GLBA? (3)

A

Secure pertinent records against unauthorized access
Track people’s access to these records
Notify customers when you share their information

32
Q

Do you have to have an information security plan in place and overarching IS program to handle security for org, according to GLBA?

A

Yes.

33
Q

What is CIPA?

A

Children’s Internet Protection Act (2000)
Requires schools to prevent children from accessing obscene or harmful content over Internet

34
Q

What are some requirements of CIPA?

A

Have policies and tech protection measures in place to filter or block the bad content
Monitor activities of minors and educate about proper online behavior

35
Q

What are the penalties for CIPA noncompliance?

A

No cheap internet. No jail or fines.

36
Q

What is COPPA?

A

Children’s Online Privacy Protection Act (1988)
No PII from kids under 13
Difficult to comply with

37
Q

What is FERPA?

A

Family Educational Rights and Privacy Act (1974)
Protects student records
Defines how institutions must handle student records

38
Q

When might you want to choose a more overarching framework?

A

When you have to comply with separate, unrelated regulations.

39
Q

What is ISO?

A

International Organization for Standardization

40
Q

What does ISO do?

A

Sets standards between nations

41
Q

What is GDPR?

A

General Data Protection Regulation (2018)
Covers data protection and privacy for all citizens of EU

42
Q

What document deals with international information security standards?

A

ISO 27000 series

43
Q

What does ISO 27k do?

A

Lays out best practices for managing risk, controls, privacy, technical issues, etc

44
Q

What is SP 800-37?

A

Special publication put out by NIST
Guide for Applying the Risk Management Framework for Federal Information Systems

45
Q

What is SP 800-53?

A

Special publication put out by NIST
Security and Privacy Controls for Federal Information Systems and Organizations

46
Q

What are the six steps in the risk management framework of SP 800-37?

A

Categorize
Select
Implement
Assess
Authorize
Monitor

47
Q

Describe the categorize step in SP 800-37.

A

Categorize based on what the system handles and impact of exposing or losing data

48
Q

Describe the select step in SP 800-37.

A

Pick controls based on system’s categorization and any extenuating circumstances

49
Q

Describe the implement step in SP 800-37.

A

Implement the controls selected and document the implementation

50
Q

Describe the assess step in SP 800-37.

A

Make sure controls are properly implemented and performing as expected.

51
Q

Describe the authorize step in SP 800-37.

A

Authorize or ban use of system based on risk it faces and controls implemented to mitigate risk

52
Q

Describe the monitor step in SP 800-37.

A

Monitor controls to ensure that they continue to appropriately mitigate risk

53
Q

Does SP 800-37 contain specific guidelines for selecting controls?

A

Yes.

54
Q

List cloud services in increasing order of control and responsibility.

A

Software as a service
Platform as a service
Infrastructure as a service

55
Q

Who owns the risk in cloud-based computing?

A

Cloud provider takes responsibility for the portions of the environment the users can’t control.

56
Q

What are the responsibilities for IaaS cloud providers?

A

Risk related to networks and servers on which the virtual infrastructure exists
ie, securing and maintaining hosts, storage arrays, networks

57
Q

What are the responsibilities for PaaS cloud providers?

A

Security of infrastructure, ie, patching operating system, configuring servers, backing up servers

58
Q

What are the responsibilities of SaaS cloud providers?

A

Basically everything, except perhaps the data put into the environment by the users themselves

59
Q

Do contracts generally state that you have a right to audit and assess the security of the cloud environment?

A

Yes, but it’s gotta be reasonable.

60
Q

Are risks higher in SaaS or IaaS?

A

SaaS, because you share a larger portion of the environment with other users. In IaaS, you are your data are more sharply divided from other users.

61
Q

Describe compliance with blockchain

A

Must understand it to regulate it, which not many lawmakers do
Requires consensus of 51% of participants, which is not unbeatable

62
Q

What is NIST?

A

National Institute of Standards and Technology

Fundamentals of Information Security (8 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions