Brainscape's Knowledge GenomeTM


Top Flashcards (Certified)
All Flashcards

CISSP-27thMarch > Day-5-27th march@Legal > Flashcards

Day-5-27th march@Legal Flashcards

1
Q

In US three types of common LAW

A

> Criminal
Civil (Tort)
Administrative

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

criminal law

A

> crimes committed against society
beyond reasonable doubt
felony serious crime , normally in jail for more than 1 year
misdemeanor less serious crime , jail inprisonment for less than 1 year

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

civil law

A

> Against individual or company that can create injury, loss ,damage, death > based upon the preponderance of evidence

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Criminal vs Civil

A

> both have punishment
civil has compensatory
criminal has deterrence
civil has statutory damages

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

According to federal sentencing guideline

A

Sr corp officer are responsible personally if their org fails to comply with applicable laws .

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Administrative laws are regulatory laws

A

enforced by Govt agencies , penalty financial or imprisonment

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

risk appetite vs risk tolerance

A

Risk appetite: amount and type of risk that an organization is willing to pursue or retain
Risk tolerance: organization’s or stakeholder’s readiness to bear the risk after risk treatment in order to achieve its objectives

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Intellectual Property organizations

A

USPTO ,WIPO, WCO,WTO,TRIP

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

PRIVACY AND DATA PROTECTION LAWS PRINCIPALS

A

> must be collected fairly and lawfully
must only be used for the purposes for which it was collected
must be accurate and kept upto date
must be accessible to individuals who request a report on personal informations about themselves
individuals have the right to correct if there is any error
personal data cant be disclosed to other org
trnamission of personal data to locations is prohibited where equivalent security is not ensured

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

us federal privacy act 1974

A

Personal informations stored by federal agencies cant disclose to any others

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

HIPAA

A

privacy standards for PI health informations

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Hitech vs HIPAA

A

However, there is a difference between HIPAA and HITECH with regards to patients´ rights.

Prior to HITECH, patients were unable to find out who their ePHI had been disclosed to (both authorized and unauthorized where known). In 2011, the Department of Health & Human Services published a HITECH-required Rule that allows patients to request access reports. These reports explain to patients who accessed and viewed their ePHI and under what authority.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

HITRUST and HIPAA

A

hipaa is a framework or compliance law, hitrust is a company which help companies to achieve this law.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

GLBP

A

PII stored in Financial origanization

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

PCI DSS Principles

A 
Credit CARD industry
>build and maintain a secure network
>protect cardholder data
>maintain vulnerability management program
>implement strong access control
>regularly monitor and test network
>maintain an information security policy
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Computer Fraud and abuse act -crime

A

f federal -govt cmputers, f financial informations f foriegn relationship informations

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

electronic communications and privacy act

A

unauthorized monitring or evesdropping wiretapping

>can access email but not voice email

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

us computer security act

A

special security for compuers holding sensitive informations

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

us federal sentencing guideline

A

due care violations for organizations

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

us economic espionage act

A

patent trade secret protection

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

us child pornography act

A

distribution of child pornography

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

us patriot act

A

> wiretap is allowed > voice email access is allowed > mobile tap is allowed

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

pen device

A

to collect outgoing number list from a phone number

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

trap device

A

to collect incoming numbers

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
SOX
financial audit of public companies
26
safe harbor
agreement between us department of commerce and EU, t handle private data of EU citizens moving from EU to US
27
evidence
>real evidence : from witness five sense > direct evidence : tangible objects from actual crime >documentary evidence : computer generated, computer stored , log files etc > demonstrative evidence from expert opinion hearsay rule
28
hearsay documents
business records not directly related to crime
29
entrapment or enticement
entrapment : someone commits a crime without having any intention, entricement : someone provoked to commit a crime . its legal
30
chain of custody
provides accountability and protection for evidence throughout its entire life cycle
31
evidence life cycle
``` >collection and identification > analysis > storage preservation transportation >presentation in court >return to victim ```
32
subopena
order to an individual to submit evidence t court
33
search warrant criminal case / writ of possession civil case
by court to police to search and seize specific evidence ,
34
US federal sentencing guideline -due care failure
``` The 1991 U.S. Federal Sentencing Guidelines apply to the following white collar crimes that take place within an organization: Antitrust Federal securities Mail and wire fraud Bribery Contracts Money laundering ```
35
Wassenaar Arrangement
Established to contribute to regional and international security and stability by promoting transparency and greater responsibility in transfers of conventional arms and dual-use goods and technologies, thus preventing destabilizing accumulations.
36
CSO role
The role of the chief security officer (CSO) should be self-governing and independent of all the other departments in the organization. The CSO should report to the chief information officer (CIO), chief technology officer (CTO), or chief executive officer (CEO) only to gain management approval for security implementation and to provide feedback on the security process compliance. In an organization, an Information Technology security function should be led by a Chief Security Officer. The information technology function is responsible for carrying out infrastructure implementation based on directives issued by the CSO. The security responsibilities of a CSO include not only the information technology function, but extend to all the departments of the organization. The CSO might conduct a periodic meeting with managers from different departments of the organization and make them aware of the security initiatives flowing in a top-down approach from the senior managemen
37
NCSC
The National Computer Security Center (NCSC) is a centralized agency that evaluates computer security products and provides technical support to government offices and private firms.
38
hipaa
HIPAA is enforced by Office of Civil Rights (OCR) of the Department of Health and Human Services (HHS).
39
Operate and Maintain
Ensure that all baselines are met. Complete internal and external audits. Complete tasks outlined in the blueprints. Manage service level agreements as outlined in the blueprints
40
exigent circumstances
when evidence might be destroyed
41
IAB considered unethical behaviors
Seeking to gain unauthorized access to the resources of the Internet Destroying the integrity of computer-based information Disrupting the intended use of the Internet Wasting resources, including people, capacity, and computers, through such actions Compromising the privacy of users Being negligent in the conduct of Internet experiments
42
data haven
A data haven either has no laws or poorly enforced laws for information protection.
43
Admin LAw vs Regulatory Law
Administrative law is often called regulatory law. This type of law includes considered standards of performance or conduct expected by government agencies from companies, industries, and certain officials
44
Which things are covered under trade secret
Trade secrets consist of information and can include a formula, pattern, compilation, program, device, method, technique or process. To meet the most common definition of a trade secret, it must be used in business, and give an opportunity to obtain an economic advantage over competitors who do not know or use it.
45
3 types of security controls
b. physical controls c. technical controls d. administrative controls
46
incident response steps
1. Detection 2. Response 3. Reporting 4. Recovery 5. Remediation and review rca works here
47
process guide
SDLCP-(Info Assurance Is Out Dated) 1. Initiate 2. Aquire 3. Implemet 4. Operations 5. Disposal S-SDLCP (Re Do Damn Test Right) 1. Req Gather 2. Design 3. Develop 4. Test 5. Release CMMI (I Really Defend My Opinion) 1. Initial 2. Repeatable 3. Defined 4. Managed 5. Optimized BCP (IIPRCTM)....Sorry not so fun ;) 1. Initiation 2. BIA (Impact) 3. Preventative 4. Recovery 5. Continuity 6. Test 7. Manage/Maintain
48
Which phase of the security management life cycle are you engaged if you are completing audits to ensure that your security settings meet baselines? Other activities might include completing tasks in blueprints, managed slas outlined in blueprints, doing audits to ensure baselines.
Operate and Maintain
49
Which phase of the security management life cycle are you engaged if you are reviewing the audit results to assess if your organization's security baselines are maintained? other activities in this phase include review logs, audit results, metrics, and slas. assess accomplishments, complete steering committees, Develop improvement steps for integration into the plan and organize phase.
Monitor and Evaluate
50
data aggregator
a company that compiles, stores, and sells personal information
51
You are implementing asset identification and change control blueprints. In which phase of the security management life cycle are you engaged?
implement
52
The Basel II Accord
The Basel II Accord is built on three main pillars: minimum capital requirements, supervision, and market discipline. These pillars apply to financial institutions.
53
BCP steps police bia koreche preventive recovery hisebe akta contigency plan dar koriyeche , test ar maintain korte hobe
1. Develop the continuity planning policy statement. 2. Conduct the BIA. 3. Identify preventative controls. 4. Develop recovery strategies. 5. Develop the contingency plan. 6. Test the plan, and conduct training and exercises. 7. Maintain the plan.
54
HIPAA gap analysis
HIPAA gap analysis applies to transactions, security, and privacy and does not address either accountability or availability.
55
Reverse engineering
Reverse engineering, in computer programming, is a technique used to analyze software in order to identify and understand the parts it is composed of
56
bcp should be maintained
``` Infrastructure changes Environment changes Organizational changes Hardware, software, and application changes Personnel changes ```
57
Which organization developed P3P
World Wide Web Consortium (W3C)
58
privacy notice how to send
A privacy notice should be provided via a posted copy, a printed copy at the first service delivery, and a printed copy available upon request by a covered entity to the patient.
59
covered entities
Covered entities are defined in the HIPAA rules as (1) health plans, (2) health care clearinghouses, and (3) health care providers who electronically transmit any health information
60
delayed loss risk
that happens after a tangible resource is taken out

CISSP-27thMarch (7 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2025 Bold Learning Solutions. Terms and Conditions