CyberFrameworks

Question 1

COBIT

Answer 1

is a documented set of best IT security practices crafted by
the Information Systems Audit and Control Association (ISACA). It prescribes goals and requirements for security controls and encourages the mapping of IT security ideals to business objectives.

Question 2

COBIT (6 principles)

Answer 2

■ Provide Stakeholder Value
■ Holistic Approach
■ Dynamic Governance System
■ Governance Distinct from Management
■ Tailored to Enterprise Needs
■ End-to-End Governance System

Question 3

NIST 800-53 Rev. 5

Answer 3

U.S. government–sourced general recommendations for organizational security.

Question 4

Center for Internet Security (CIS)

Answer 4

provides OS, application, and hardware security configuration guides

Question 5

NIST Risk Management Framework (RMF)

Answer 5

establishes mandatory requirements for federal agencies. The
RMF has six phases: Categorize, Select, Implement, Assess, Authorize, and Monitor

Question 6

NIST Cybersecurity Framework (CSF)

Answer 6

is designed for critical infrastructure and commercial organizations, and consists of five functions:
Identify,
Protect,
Detect,
Respond,
Recover.
It is a prescription of operational activities that are to
be performed on an ongoing basis for the support and improvement of security over time

Question 7

ISO 27000

Answer 7

an international standard that can be the basis of implementing organizational security and related management practices

Question 8

Information Technology Infrastructure Library (ITIL)

Answer 8

rafted by the British government, is a set of recommended best practices for optimization of IT services to support business growth, transformation, and change. ITIL focuses
on understanding how IT and security need to be integrated with and aligned to the
objectives of an organization. ITIL and operational processes and is often used as a
starting point for the crafting of a customized IT security solution within an established
infrastructure

Question 9

threat modeling framework

Answer 9

assets/attackers/software, STRIDE, PASTA, VAST, diagramming, reduction/decomposing, and DREAD.

Question 10

STRIDE

Answer 10

Spoofing
Tampering
Repudiation
Information Disclosure
Denial of Service
Elevation of Privilege

Question 11

PASTA

Answer 11

Process for Attack Simulation and Threat Analysis .

. PASTA is a risk-centric approach that aims at selecting or developing
countermeasures in relation

Question 12

VAST

Answer 12

Visual, Agile, and Simple Threat.

is a threat modeling concept that integrates
threat and risk management into an Agile programming environment on a scalable basis