Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CISSP > D1: Information Security Governance and Risk Management > Flashcards

D1: Information Security Governance and Risk Management Flashcards

0
Q

Integrity

A

Accuracy and reliability of the information and systems are provided and any unauthorized modification is prevented

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
1
Q

Availability

A

Reliable and timely access to data and resources is provided to authorized individuals

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Confidentiality

A

Necessary level of secrecy is enforced and unauthorized disclosure is prevented

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

List some controls for Availability

A
  • redundent array of inexpenisve disks (RAID)
  • clustering
  • load balancing
  • redundant data and pwoer lines
  • software and data backups
  • disk shadowing
  • co-locatio nand off-site facilities
  • roll-back functions
  • fail-over configurations
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Name some controls for Integrity

A
  • hashing (data integrity)
  • configuration management (system integrity)
  • Change control (process integrity)
  • access control (physical and technical integrity)
  • software digital signing
  • transmission CRC functions
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Name some controls for confidentiality

A
  • encryption for data at rest (whole disk, database encryption)
  • encryption for data in transit (IPSec, SSL, PPTP, SSH)
  • access controls (physical and technical)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

VULNERABILITY

A

Weakness or a lack of a countermeasure
i.e.: service running on a server; unpatched application or OS; unrestricted wireless access point; open port on firewall; lax physical security; unenforced password mgt. on severs/workstations

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

THREAT AGENT

A

Entity that can exploit a vulnerability
(i.e.: intruder acessing the network through a port on the FW; a process accessing data in a way that violates the security policy; a tornado wiping out a facility; employee making unintentional mistake)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

THREAT

A

The danger of a threat agent explotiing a vulnerability

(ssomeon or somethign will identify a specific vulnerability and use it against the company/individual.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

RISK

A

the probability of a threat agent exploiting a vulnerability and the associated impact.
(if FW has several ports open, higher likelilihood intruder will access; if uesrs not educated on processes/procedures there sa higher likelihood that an employee will destory data; IDS not implemented higher likelihood attack will go unnoticed

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

CONTROL

A

Safeguard that is put in place to reduce a risk; also called a countermeasure

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

EXPOSURE

A

Presence of a vulneraiblity which exposes the organization to a threat
(i.ee.: if PW mgt is lax, compony is exposed; does not have its wiring inspective; exposed to devastating fires)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

CONTROL

A

Countermeasure taht is put into place to mitigate (reduce) the potential risk

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What are the three main types of controls?

A

1 - Administrative Controls (soft controls)
2 - Technical Controls (aka logical controls)
3 - Physical Controls

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Describe administrative controls

A

Management oriented: i.e. security documentation; risk management; personnel security; training

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Describe technical controls

A

software/hardware components (i.e. FWs IDS, encryption, identification and authenticatin mechanisms)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Describe physical controls

A

items put into place to protect facility, personnel, resources (i.e. security guards, locks, fencing)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Name the different functionalities of the security controls

A 
1-prventative
2- detective
3- corrective
4- deterrent
5-recovery
6-compensating
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

DETERRENT CONTROL

A

Intended to discourage a potential attacker

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

PREVENTATIVE

A

Intended to avoid an incident from occurring

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

CORRECTIVE CONTROL

A

Fixes components or systems after an incident has occurred

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

RECOVERY CONTROL

A

Intended to bring the environment back to regular operations

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

DETECTIVE CONTROL

A

Helps identify an inciden’ts activities and potentially an intruder

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

COMPENSATING CONTROL

A

Controls that provide an alternative measure of control

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

What you can’t ____, you should be able to ___, and if you ____ something, it means you weren’t able to _____ it, and therefore you should take _____ ___ to make sure it is indeed ___ the next time around.

A

prevent; detect; detect; prevent; corrective action; prevented

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

Examples of Preventive Administrative Controls

A
  • policies and procedures
  • effective hiring practices
  • pre-employment background checks
  • cotnrolled termination processes
  • data classification and labeling
  • security awareness
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

Examples of Preventitive Physical controls

A

Badges, swipe cards
Guards, dogs
Fences, locks, mantraps

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

What is the bS7799 and its significance?

A

British Standard 7799, developed in 1995 by UK gvt. to outline how an information security management system (ISMS; aka security program) should be build and maintained. Was the basis of the ISO/IEC 2700 series

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

ISO

A

International Organization for Standardization

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

IEC

A

International Electrotechnical Commission

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

The objectives of security are to provide

A

Avilability, integrity, and confidentiality protection to data and resources

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

CoBIT

A

a framework of control objectives and allows for IT governence

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

ISO/IEC 27001

A

The standard for the establishment, implementation, control, and improvement of the information security management system

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

Enterprise architecture frameworks are used to:

A

develop architectures for specific stakeholders and present inforamiton in views

34
Q

ISMS

A

Informaiotn security management system is a coherent set of policies, processes, and systems to manage risks to inforamtion assets outlined in ISO/IEC 27001

35
Q

Enterprise security architecuture

A

A subset of business architecture and a way to describe current and future security processes, syttems, and subunits to ensure strategic alginment

36
Q

BLUEPRINTS

A

Functional definitions for the integration of technology into business processes

37
Q

Enterprise architure frameworks are used to build…

A

individual architectures that best map to individual organizationl needs and business drivers

38
Q

Zachman

A

an enterprise architecture framework

39
Q

SABSA

A

Security enterprise architecture framework

40
Q

COSO

A

A governance model used to help prevent fraud within a corporate environment

41
Q

ITIL

A

A set of best practices for IT service management

42
Q

Six Sigma

A

Used to identify defects in processes so that the processes can be improved upon

43
Q

CMMI

A

A maturity model that allows for processes to improve in an incremented and standard approach

44
Q

Security enterprise architecture should tie in (4):

A

1 - strategic alginment
2 - business enablement
3 - process enhancement
4 - security effectiveness

45
Q

What control categories does NIST 800-53 use?

A

1 - technical
2 - management
3 - operational

46
Q

OCTAVE

A

A team-oriented risk management methodology that employs workshops and is commonly used in the commercial sector

47
Q

Security management should work from - - -

A

the top down (from senior management down to the staff)

48
Q

Risk can be:

A

transferred, avoided, reduced, or accepted

49
Q

A x B x C = total risk

A

threats x vulnerability x asset value = total risk

50
Q

(threats x vulnerability x asset value) x __ = residual risk

A

threats x vulnerability x asset value ) x controls gap = residual risk

51
Q

State the main goals of risk analysis

A

1) identify assets and assign values to them
2) identify vulnerabilities and threats
3) quantify the impact of potential threats
4) proidde an economic balance between the impact of the risk and cost of the safegaurds

52
Q

FMEA

A

Failure Modes and Effect Analysis.
A method for determinign functions, identifying functional failures, and assessing the causes of failures and the failure effects through a structured process

53
Q

When would you use a fault tree analysis?

A

To detect failures that can take place within complex environments and systems

54
Q

Describe quantitative risk analysis

A

Attempts to assign monetary values to components within the analysis

55
Q

Is a purely quantitiative risk analysis possible?

A

No, becasue qualitative items cannot be quantified with precision

56
Q

Why is capturing the degree of uncertainty when carrying out a risk analysis important?

A

because it indicates the level of confidence the team and management should have in the resulting figures

57
Q

When should automated risk analysis tools be used?

A

to estimate future expected lossses and calculate the benefits of different security measures

58
Q

___ x ___ = annualized loss expectancy

A

single loss expectancy x frequency per year - annualized loss expectancy (SLE x ARO = ALE)

59
Q

Qualitative risk analysis uses _ and _ instead of numbers

A

judgement; intuition; numbers

60
Q

Qualitiative risk analysis involves people with….

A

the requisite experience and education evaluating threat scenarios and rating the probability, potential loss, and severity of each threat based on their perosnla experience

61
Q

DELPHI TECHNIQUE

A

A group decision method where each group member can communicate anonymously

62
Q

When choosing the right safeguard to reduce a specific risk, the _, _, and _ must be evaluated and a cost/benefit analysis performed.

A

cost; functionality; effectiveness

63
Q

SECURITY POLICY

A

A statement by managment dictating the role security plays in the organization

64
Q

PROCEDURES

A

detailed step-by-sepactions that should be followed to achieve a certain task

65
Q

STANDARDS

A

Documetns that outline rules that are compulsory in nature and support the organization’s security policies

66
Q

BASELINE

A

minimum level of security

67
Q

GUIDELINES

A

Recommendations and general approaches that provide advice and flexibility

68
Q

Job rotation is a _ _ control to detect fraud

A

detective administrative

69
Q

Mandatory vacations are a _ _ control type that can help detect _ activities.

A

detective administrative control type that can help detect fraudulent activities

70
Q

SEPARATION OF DUTIES

A

ensures no single person has total control over a critical activity or task.

71
Q

Separation of duties is a _ _ control

A

preventative adminsitrative

72
Q

Split knowledge an dual control are two aspects of _ _ _.

A

separation fo duties

73
Q

Who specifies the classification of data?

A

data owners

74
Q

Who implements and maintains controls to enforce the set classification levels?

A

Data custodians

75
Q

Security has functional requirements, which define the _ _ _ _ _ _ _ , and assurance requirements which establish _ _ _ _ _ _ _ .

A

functional requirements: define the expected behavior from a product or system
assurance requirements: establish confidence in the implemented products or systems overall

76
Q

Management must: (5)

A 
1 - define the scope and purpose of the security management
2 - provide support
3 - appoint a security team
4 -delegate responsibiilty
5 - review the team's findings
77
Q

Who should be included in the risk management team?

A

individuals from different departments within the organization; not just technical personnel

78
Q

SOCIAL ENGINEERING

A

A nontechnical attack carried out to manipulate a person into providing sensitive data to an unauthorized individual

79
Q

PII

A

Personal identification information is a collection of identity based data that can be used in identity theft an dfinancial raud, and thus must be highly protected

80
Q

SECURITY GOVERNANCE

A

A framework that provides oversight, accountability, and compliance

81
Q

ISO/IEC 27004 2009

A

AN INTERNATIONAL STANDARD FOR INFORMATION SECURITY MEAsurement management

82
Q

NIST-800-55

A

a standard for the performance measurementfor information security

CISSP (6 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions