CySA+ Study Notes 9 Flashcards
Real Evidence : consists of tangible objects that may be brought into a courtroom.
Order of Volatility : Network Traffic -> Memory Contents -> System and Process Data -> Files -> Logs -> Archived Records.
Live Analysis : retrieves volatile evidence.
Cellebrite is a popular mobile forensic tool.
info …
??? regulates handling of student educational records.
??? regulates financial institutions.
??? protects privacy of children under 13 years of age.
FERPA / GLBA / COPPA
Due Care : fulfilling legal responsibilities and professional best practices.
Due diligence : take reasonable measures to investigate security risks.
info …
??? use human driven processes to manage technology in a secure manner.
??? improve security of the risk management process itself.
??? remediate security issues that have already occurred.
??? implement incident response procedures.
??? use technology to achieve security control objectives.
Operational Controls / Managerial Controls / Corrective Controls / Responsive Controls / Technical Controls
COBIT : business focused control framework.
ISO 27001 : part of a series of business standards.
info …
??? business leaders w/overall responsibility for data they set policies and guidelines for their datasets.
??? handle day-to-day governance activities, they are delegated responsibility by data owners.
??? store and process info and are often IT staff members.
Data Owner / Data Steward / Data Custodians
??? data is only subject to laws of jurisdictions where its collected, stored or processed; storing data in multiple locations subjects it to multiple jurisdictions.
??? transforms PII into form where its no longer possible to tie to an individual person.
Data Sovereignty / Data Obfuscation
Tokenization : replaces sensitive fields w/a random identifier.
Masking : replaces sensitive info with blanks or for example X’s.
Pattern Matching : recognizes known patterns of sensitive info, like SSNs.
Watermarking : identifies sensitive info using electronic tags.
info …
IRM (Information Rights Management) : enforces data rights, provisions access, implements access control models.
DRM (Digital Rights Management) : provides owners of intellectual property w/technical means to prevent unauthorized use of their content through use of encryption technology.
IRM / DRM
??? external force jeopardizing information and systems.
??? weaknesses in security controls that a threat might exploit to undermine CIA.
??? combo of vuln. and corresponding threat.
Threat / Vuln. / Risk
