Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CISSP 8 Domains 2020 > D1: Security & Risk Management > Flashcards

D1: Security & Risk Management Flashcards

D1 from example test simulators keywords

1
Q

NDA

A

Non Disclosure Agreement; restricts dissemination of information; Compelling parties to not reveal information to others; Keeping secrets;

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

NCA

A

Non Compete Agreement; relates to employment with competition; Work restrictions; Agreement not to enter into or start a similar line of work in competition against another party;

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

AUP

A

Authorized Use Policy; warns employees about proper use of organizational assets; Allows for firing employee for misuse;

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Exit Interview

A

Useful for discovering serious problems that might not be otherwise disclosed;

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Education

A

Providing fundamental knowledge & definitions

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Training

A

Providing tactical knowledge necessary for a job or task

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Awareness

A

Imparting sensitivity or importance to a topic/issue to all personnel

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Indoctrination

A

Incorporating an individual or group into the culture of the larger organization

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

CEO

A

Chief Executive Officer; Responsible for overall organization and its mission

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

CIO

A

Chief Information Officer; Responsible for aligning information & technical strategies; Most senior official in an organization responsible for IT & Systems that support enterprise; Senior Technology official;

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

CPO

A

Chief Policy Officer: Responsible for ensuring that there is compliance with org and regulatory privacy rules

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

CISO

A

Chief Information Security Officer; Responsible for monitoring & analyzing risk information associate with data protection

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

CSO

A

Chief Security Officer; Responsible for physical & Technical security of orgs assets; Responsible for development, oversight, mitigation, & other risk strategies; Senior most security official;

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

CTO

A

Chief Technology Officer; Chooses technology & scientific items; Executive person tasked with identifying useful technology, IT strategies, & partnerships;

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

ISSO

A

Information Systems Security Officer; Organizational role charged with developing, implementing, testing, & reviewing IT security;

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Risk Management Categorize

A

Related to assigning a security role to an IT system

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Risk Management Select

A

Identifies the appropriate measures needed to reduce risk satisfactorily

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Risk Management Implement

A

Regards enacting the selected security controls

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Risk Management Assess

A

Involves an independent assessor to test the controls

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Risk Management Authorize

A

Take the risk assessment and make a risk determination

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Risk Management Monitor

A

Relates to ongoing review & updating of controls and security status

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Opportunity Cost

A

Next best use for funds

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Depreciated Cost

A

Reflects wear, tear, and evaluation over time

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Replacement Cost

A

current expenditure to gain an identical item

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

Purchase Cost

A

Original cost

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

Code of Regulations

A

Administrative law is published here

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

Constitution

A

Provides for information about interpretation of laws

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

NIST

A

National Institute of Standards & Technology; Publishes Special Publications, but NO laws; Publishes recommendations and standards, many related to IT security; Government standards body;

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

United States Code

A

Laws enacted by Congress published here

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

Accept Risk

A

Accept with knowledge of risk.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

Avoid Risk

A

Change course or cancelling a project.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

Deter Risk

A

Pursue the threat actor.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

Mitigate Risk

A

Addressing risk and its factors. Try to reduce/prevent risk.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

Transfer Risk

A

Assign risk to another party, insurance.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

Ignore Risk

A

Move ahead without knowledge of the risk. NEVER an appropriate response.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

Copyright

A

Legal right for creator of original work

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

Trademark

A

Recognized signs or expressions to identify product or service;

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

Patent

A

Intellectual property rights to a product/process for a limited period of time; protect innovative product/process; Exclusive rights to product/process;

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

Trade Secret

A

Formula, process, or design that is generally not known by others and has a viable commercial use; Guarded info not disclosed to the world;

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
40
Q

DRM

A

Digital Rights Management; Systematized access control for digital media; Encrypted PDFs; Access control technology for restricting the use of propriety hardware & copyrighted works;

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
41
Q

Wassenaar

A

Covers conventional arms sales and controls.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
42
Q

Economic Espionage Act

A

Criminalized stealing trade secrets

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
43
Q

GDRP

A

General Data Protection Regulation; European law endorsed by the US that handles privacy issues; Enforced by Department of Commerce; International data privacy regulation;

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
44
Q

FISMA

A

Federal Information Security Management Act; Handles risk management in the US government; US requirements for data security within federal orgs; Requires each federal agency to develop, document, & implement an agency wide pgm to provide info sec; Uses RMF

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
45
Q

PCI

A

Payment Card Industry; Self-regulation for banking cards

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
46
Q

Data Owner

A

Party that collects & is responsible for the information

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
47
Q

Data Subject

A

The person/thing referred to by data;

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
48
Q

Data Processor

A

Group/organization responsible for manipulation & computations with the data w/in their systems;

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
49
Q

Data Custodian

A

Manages the information systems that perform processing; has physical control & server control; Facilitates use;

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
50
Q

ISO 27000

A

Information system management system standards are a flexible set of standards and practices to manage security risks in an org.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
51
Q

NIST RMF

A

National Institute of Science & Technology Risk Management Framework; Government created set of guides to manage and control risk

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
52
Q

COSO

A

Committee of Sponsoring Organizations is an initiative to combat organizational fraud; Preventing fraud and abuse; dedicated to guiding managers & government w/ regard to ethics, controls, & risk mgmt.;

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
53
Q

COBIT

A

Control Objectives for Information and Related Technologies; is a best practice security framework from ISACA

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
54
Q

AGILE

A

Software development methodology; Emphasize customer involvement & simple deliverables. Expects continual refinement of requirements, capabilities, & features through dev process;

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
55
Q

Directive Security Control

A

Rules promulgated by management; EX] Policy, NDA, Exit Signs, Need to know policy;

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
56
Q

Deterrent Security Control

A

Affect threat agents; EX] Guards, cameras, Logon banner with warning;

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
57
Q

Preventative Security Control

A

stop an active attack; EX] Walls, fence, Biometric doorway control;

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
58
Q

Compensating Security Control

A

take over for another function/measure while a threat is active; EX] RAID array;

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
59
Q

Detective Security Control

A

only identify and do not stop threats; EX} motion detector, dogs, logs & audits;

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
60
Q

Corrective Security Control

A

implements after a threat has manifested; EX] IPS, Fire Suppression;

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
61
Q

Recovery Security Control

A

Restores operations to way they were; EX: Backups, DRP, cloud-based backup;

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
62
Q

STRIDE Threat Modeling

A

Created by Microsoft; Spoofing, Tampering, Repudiation, Information Disclosure, DOS, Elevation of Privilege; Initially created as part of the process of Threat Modeling;

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
63
Q

VAST Threat Modeling

A

Visual Agile & Simple Threat modeling; promotes its use across the entire infrastructure & the SDLC

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
64
Q

ISA

A

Interconnection Service Agreement; Defines VPNs; Agreed-upon measures, settings & protocols taken by two orgs to facilitate communication;

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
65
Q

OLA

A

Operating Level Agreement

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
66
Q

MOU

A

Memorandum of Understanding; Provides refinement of duties and responsibilities; Provides terms & details necessary for two parties to work together;

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
67
Q

MOA

A

Memorandum of Agreement; Achieving consensus toward a common goal; Document describing cooperative work to be taken together by two parties toward an objective;

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
68
Q

SLA

A

Service Level Agreement; Contractual guarantee of performance; A promise; An agreement on the characteristics of quality and performance between two parties;

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
69
Q

MSA

A

Master Services Agreement

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
70
Q

MTD

A

Maximum Tolerable Downtime; Beginning of a disaster; Estimated time until catastrophic damage to an org has occurred;

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
71
Q

MTBF

A

Mean Time Between Failures; The average failure rate; Estimation as to how often serious errors occur, typically measured in thousands of hours; Predicted elapsed time between failures of a mechanical or electronic system; Hardware reliability;

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
72
Q

MTTR

A

Mean Time to Recovery (Repair); how long a system can take to recovery from a failure; Time needed to fix something; Standard recovery statistic indicating swiftness of DRP responses; Restoration average; Timely time it will take to regain functionality;

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
73
Q

MTPD

A

Maximum Tolerable Period of Disruption; Identifies the point at which services must be restored or irrevocably damage the business;

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
74
Q

RPO

A

Recovery Point Objective; What data must be available upon restoration & defines acceptable loss; Maximum # of transactions lost; # of transactions or quality of data that can be acceptably lost; Targeted maximum loss quantity;

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
75
Q

RTO

A

Recovery Time Objective; When data must be available; Maximum amount of time lost; Maximum amount of time allowed for an outage;

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
76
Q

MITM

A

Man-in-the-Middle; An attacker insinuates itself between client and server, observing or modifying communications; Intercepting and changing;

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
77
Q

GDRP Lawful

A

Data must be legal to possess;

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
78
Q

GDRP Purpose

A

Must have purpose for possessing the information;

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
79
Q

GDRP Minimal

A

Data can only be retained as long as necessary;

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
80
Q

GDRP Accuracy

A

Data must be as accurate as possible;

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
81
Q

GDRP Storage Limitation

A

Only the information necessary for its purposes should be retained;

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
82
Q

GDRP Integrity & Confidentiality

A

Must take measures to ensure integrity & confidentiality;

83
Q

PCI DSS

A

Payment Card Industry Data Security Standard; Credit Card industry established to ensure regulated control & consumer confidence;

84
Q

WIPO

A

World Intellectual Property Organization; Promote the protection of intellectual property; United Nations agency that overseas international trademarks & patents;

85
Q

GLBA

A

Gramm-Leach-Biley Financial Services Modernization Act; Involves privacy concerns with financial institutions; Requires financial orgs to protect customer data and to disclose how this is done; Provide each consumer with a privacy notice at time of consumer relation started; Financial Rules overhaul;

86
Q

SOX

A

Sarbanes-Oxley; Financial accountability; Implements criminal penalties for incorrect reporting of losses or liabilities; Requirements for US companies & mgmt. to provide accurate information;

87
Q

COPPA

A

Federal Children’s Online Privacy Protection Act. Applies to collection of info/accounts for children < 13yo; AKA: CaliOPPA

88
Q

HIPAA

A

Health Insurance Portability & Accountability Act; Medical security; Requires proper encryption of data transmission & storage as well as secure disposal; US law designed to protect the privacy of patient information;

89
Q

PII

A

Personally Identifiable Information; EX] DL#, SSN, Credit Card #; Unique identifier; data or pieces of data used to uniquely correspond to or identify one individual and requires special handling;

90
Q

PHI

A

Personal Health Information; Info within an EMR; Sensitive info regarding health of individual;

91
Q

PIPEDA

A

Personal Information Protection & Electronic Documents Act; Canadian law involving privacy; Canadian PII;

92
Q

Baselines

A

Required minimum levels of protection and performance that must be met

93
Q

Guidelines

A

Recommended settings or levels and are considered optional

94
Q

Standards

A

Security practices based on industry or governmental documents. Mandates steps to follow

95
Q

Procedures

A

Step-By-Step instructions. Repeatable, Detailed.

96
Q

Policies

A

High level written

97
Q

NIST SP 800-30

A

9 steps: System characterization, threat identification, vulnerability identification, control analysis, likelihood determination, impact analysis, risk determination, recommend controls, & results documentation;

98
Q

Due Care

A

Requires an organization to act and enforce security mechanisms put into place; Being careful; Legal standard

99
Q

Due Diligence

A

Demonstrating that the organization is following its own policies; verifying work, researching, being forewarned & prepared;

100
Q

Prudent Man

A

Relates to taking appropriate responsibility for actions; Test for activies in the protection of assets, considered what a careful & responsible person would de;

101
Q

Preponderance of Guilt

A

In civil litigation it is only necessary for a preponderance of guilt to be believed;

102
Q

Compliance

A

Adherence to external mandates

103
Q

Audits

A

Tools, processes, & activities used to preform compliance reviews;

104
Q

Virus

A

Attaches itself to programs in order to replicate; Most common; Copies itself; Requires interaction from user;

105
Q

Backdoor

A

Privileged access to software or a system;

106
Q

Worm

A

Replicates independently to infect systems; Fastest; Attacks the OS; No user interaction is needed;

107
Q

Trojan Horse

A

Appears to provide a valid service hiding its malicious nature; Commonly downloaded; Introduced to system by misdirection or trust

108
Q

Logic Bomb

A

Set to happen based on certain events; Typically date & time; Launches malicious activity when predetermined conditions are met/triggered;

109
Q

Spyware/Adware

A

Secretly installed; Collects info about user; plays, displays, or downloads w/o consent; designed to spy on system activity;

110
Q

Rootkit

A

Capable of hiding user files and processes; Maliciously disguises or blocks observation of malware;

111
Q

Polymorphic

A

Constantly re-factoring code to evade detection by signatures

112
Q

Macro

A

Capable of attacking multiple operating systems

113
Q

Bipartile

A

A multimodal virus that may infect boot sectors and executable files

114
Q

Boot Sector

A

Attacks an operating system prior to the kernel being loaded

115
Q

Risk Formula

A

Risk = Threat * Vulnerability; sometimes risk = threat * value * vulnerability

116
Q

RMF Authorize

A

Based upon a determination of risk by independent parties

117
Q

Dynamic Policy

A

Is one that can be implemented and changed from a central location as needed;

118
Q

1st Amendment

A

Freedom of speech

119
Q

4th Amendment

A

Search & seizures

120
Q

Accountability

A

Holding individuals responsible for their actions

121
Q

Availability

A

refers to providing data when and where a user requires access

122
Q

Non-Repudiation

A

refers to the characteristic of data where the user cannot deny they performed their actions on the data;

123
Q

Authenticity

A

Data which can be described as not corrupted, or genuine;

124
Q

CSS / XSS

A

Cross Site Scripting; Users inserting JavaScript into a URL or blog page to force unwanted actions by other users; Sends unwanted code to clients; Web Application attack; Malicious user using script input to steal info from other users;

125
Q

Session Hijacking

A

Allowing another user to login and then seizing control;

126
Q

SQL Injection

A

Using web front end to implement database actions on the backend; Insertion of DB commands by client that cause unwanted server actions.

127
Q

Privilege Escalation

A

The surfing of authority in order to gain additional access;

128
Q

CSRF / XSRF

A

Cross-Site Request Forgery; Devising a webpage that bounces commands often unwary client to an unsecured site to force a transaction; Attack wherein a message is spoofed from a user to a trusted site; Web application attack; Iframes & server flaws that allow illicit fake message to be processed;

129
Q

Buffer Overflow

A

The insertion of assembler-level commands into the input data stream by exploiting a boundary error; Corrupting the memory of a host by causing lg amount of data to be inserted in the stack/heap; lg amt data cause other instructions to be overwritten; Cause DoS or take over completely.

130
Q

What do Privacy Laws protect

A

Customers data, Employees data, & Employee rights

131
Q

What is the purpose of a BIA

A

Determine the impact to business operations of disruptions

132
Q

Countermeasures

A

Reactive controls to mitigate or correct an incident

133
Q

Safeguards

A

Proactive controls to mitigate or correct an incident

134
Q

Responses

A

Actions after an incident has occurred

135
Q

Exposures

A

How vulnerable are systems to threats

136
Q

Qualitative Assessments

A

Use non-numerical levels or categories, and Expert or best judgement

137
Q

Quantitative Assessments

A

Use consistent numerical values, Financial performance measurements

138
Q

DRP

A

Disaster Recovery Plan; An immediate plan to cope with disasters & problems; aid in recovery from short-term issues

139
Q

Change Management Policy

A

Dictates how and when changes are made to a system; enforces accountability and create an audit trail of modifications;

140
Q

AIC

A

Another way of saying CIA; Availability, Integrity, and Confidentiality; Primary security goals; Having a system that is able to be accessed, accurate with its info and maintain proper access controls;

141
Q

ARO

A

Annualized Rate of Occurrence; frequency in which an attack occur; Number of attacks per year; Total # of expected successful attacks on an annual basis;

142
Q

EMI

A

Electromagnetic Interference; Threat to copper-based media

143
Q

ESP

A

Encapsulating Security Payload; Protocol to encrypt IPsec payloads

144
Q

EF

A

Exposure Factor; Percentage of an asset lost from a single attack; Indicates value loss from one attack; Assessed damage level;

145
Q

SPIM

A

Spam over Internet Messaging; Unwanted messages; Chat messages delivered as a hoax to induce purchase;

146
Q

SPIT

A

Spam over Internet Telephony; Use of SMS to deliver unwanted messages;

147
Q

Pivot

A

Gaining control of one application or host in order to manipulate a secondary target; Staging a new attack;

148
Q

MITM

A

Man in the Middle; Between Client and Server; An attack wherein a node listens to and takes over a conversation by insinuating itself into the stream of communication;

149
Q

BO

A

Buffer Overflow; The insertion of malicious computer instructions into the RAM of a host to accomplish a DoS or injecting shellcode;

150
Q

Brute Force

A

Discovers a has or encrypted secret by attempting all combinations and permutations; Always works if time is not a factor;

151
Q

ALE

A

Annualized Loss Expectancy: SLE * ARO; hint: SLEAROoooo -> Drunk at a bar with ALE; Total annual damage;

152
Q

APT

A

Advanced Persistence Threat; Highly target threat; Full featured exploit designed to attack specific target, commonly assembled by teams of attackers to achieve a particular goal;

153
Q

BIA

A

Business Impact Analysis: Impact estimate; Prerequisite for disaster recovery and continuity planning to identify potential losses;

154
Q

BPA

A

Business Partners Agreement: Outlines the goals and responsibilities between entities pursuing a common work product; Cooperation and partnership;

155
Q

CERT

A

Computer Emergency Response Team; IT First responders; A multi-discipline group designated to handle IT incidents;

156
Q

CIRT

A

Computer Incident Response Team: A group that investigates & resolves IT security problems; Handles breaches;

157
Q

DBA

A

Database Administrator; Creates & maintains large data repositories; Personnel capable of managing automated and large information repositories;

158
Q

DDoS

A

Distributed Denial of Service; Attack methodology involves a multitude of remotely controlled devices focusing upon a single target; Mass attack; Attacker leverages thousands/millions of zombies/bots to degrade a victim;

159
Q

DEP

A

Data Execution Prevention; Stops buffer overflows; An operating system memory management technique that prevents user data from overlapping into computer instructions;

160
Q

DoS

A

Denial of Service; Stopping operation; A one on one attack that causes access or utility to cease; Singular attackers seeks to make a resource unavailable;

161
Q

MSP

A

Managed Service Provider; Handle specific applications of IT; Specialty provider of IT services management contracted by a client;

162
Q

POODLE

A

Padding Oracle on Downgrade Legacy Encryption; An attack technique that could support confidentiality in SSL connection; Decryption threat;

163
Q

RAT

A

Remote Access Trojan; Backdoor placement; Software that implements illicit remote control software;

164
Q

ROI

A

Return on Investment; Cost divided by expense; Primary metric to be used when evaluating whether something is worth the time, effort, or cost;

165
Q

RMF

A

Risk Management Framework; NIST created framework; Paradigm that was promulgated by the US government;

166
Q

SCAP

A

Security Content Automation Protocol; Security Automation; Framework promoted by US govt to create open standards for automation of information assurance;

167
Q

SEH

A

Structured Exception Handler; Memory Corruption; facility within windows that identifies memory corruption and contingencies;

168
Q

SLE

A

Single Loss Expectancy; Damage from one incident; The value of an asset multiplied by the exposure factor (EF); One time cost;

169
Q

AV

A

Asset Value; Cost of an asset; The value of an asset or its repair cost as measured in risk formulas;

170
Q

BSI

A

British Standards Institute; Engineering Standards; US engineering groups that defines various terms and standards;

171
Q

CBK

A

Common Body of Knowledge; ISC2 goals; Collection of topics related to information security professionals;

172
Q

CC

A

Common Criteria; Framework in which computer system users can specify their security functional & assurance requirements (SFRs & SARs respectively) in a security target (ST) & may be taken from Protection Profiles (PPs);

173
Q

CSF

A

Critical Success Factor; Important results; Necessary for an organization or project to achieve its mission;

174
Q

CVE

A

Common Vulnerabilities & Exposures; List of software flaws that is published by Mitre to act as a dictionary of known issues; Vulnerability list;

175
Q

DoDAF

A

Department of Defense Architecture Framework; Overview & details aimed to specific stakeholders; Provides visualization infrastructure for specific stakeholders concerns through viewpoints organized by various views;

176
Q

DPA

A

Data Protection Act; Provision about the processing of personal data; UK law that complements the GDRP;

177
Q

GDRP

A

General Data Protection Regulation; European Union’s;

178
Q

DSS

A

Decision Support Systems; Planning and organizational tool;

179
Q

EULA

A

End-user Licensing Agreement; Terms of use; type of software agreement;

180
Q

FIPS

A

Federal Information Processing Standard; Federal requirements; Openly announced standards developed by the US Govt for use in computer systems or network;

181
Q

HSPD

A

Homeland Security Presidential Directive; Presidential commands; issues by presidents involving foreign, military, & domestic policies;

182
Q

IA

A

Information Assurance; Securing computers & other information; The orgs function associated with assessing & managing risk so as to reduce it to an acceptable level;

183
Q

IAB

A

Internet Architecture Board; Architectural oversight of IEFT; seeks to improve the Internet by providing high quality technical documents & guidance in the way the internet is used and managed;

184
Q

IAM

A

Information Assurance Management; In charge of IT; Management personnel associated with defense of IT resources;

185
Q

IAM

A

Identity & Access Management; Granting or blocking access; An organizational function associated with creating & managing digital identities;

186
Q

IAT

A

Information Assurance Technical; Hands on IT security; Technical person associated with the defense of IT resources;

187
Q

IEC

A

International Electrotechnical Commission; Electrical & electronic standards; Covers vast range of technologies from power generation, transmission, & distribution to home appliance and office equipment;

188
Q

IP

A

Intellectual Property; Proprietary stuff; Plans, designs, creative works of human thought that have value;

189
Q

ISMS

A

Information Security Management Systems; Standards body; Cohesive set of policies, plans, & procedures for an org;

190
Q

ITIL

A

Information Technology Infrastructure Library; Linking business & technology; groups of practices for IT service mgmt. that focuses on creating synergy between IT services & business requirements;

191
Q

ITSEC

A

Information Technology Security Evaluation Criteria; Security evaluation; Organized set of criteria for evaluating computer security within products & systems;

192
Q

IV&V

A

Independent Verification & Validation; Objective assurance; Ensuring a product, service, or system meets specified requirements and designs;

193
Q

KEDB

A

Known-Error Database; Compendium of problems with solutions; Collection of problems that are successfully diagnosed & which either a work around or a perm solution has been determined;

194
Q

KMS

A

Key Management Server; Licensing; Provide software activation through a central system to handle compliance;

195
Q

MDC

A

Modification Detection Codes; Hashing; Mathematical algorithm designed to create message digest that can be used to indicate when a message has been altered;

196
Q

OEM

A

Original Equipment Manufacturer; An org/company that manufactures parts & components that may be marketed by other companies; “Third-party products”;

197
Q

PDCA

A

Plan-Do-Check-Act; Continuous improvement; Iterative four step management system designed to facilitate control & improvement;

198
Q

PP

A

Protection Profile; Certifification document; Element of the CC that specifies evaluation criteria to validate the security claims of a product;

199
Q

SABSA

A

Sherwood Applied Business Security Architecture: Security framework; Methodology for enterprise architecture & management of security services;

200
Q

TCSEC

A

Trusted Computer System Evaluation Criteria; Standard IT security verification; US DoD standard for assessing the effectiveness of computer security;

201
Q

TOC/TOU

A

Time of check/Time of use; Problem with race condition vulnerability; Problematic time period of time between the time at which a resource is set or known and the time at which it is ultimately used;

202
Q

TOE

A

Target of Evaluation; Item being inspected; System or application that is being subjected to detailed examination & analysis for security features;

203
Q

TOGAF

A

The Open Group Architecture Framework; Enterprise architecture for design, planning, implementing, & governing IT; Four level framework for modeling the business, application, data, & technology;

CISSP 8 Domains 2020 (2 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions