Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CISSP > Domain 1 > Flashcards

Domain 1 Flashcards

1
Q

Which control functionality is Lighting out of 6 control functionalities?

A

Physical Deterrent

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Security Policy out of 6 control functionalities

A

Administrative Preventive

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Separation of duties out of 6 control functionalities

A

Administrative Preventive

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

job rotation out of 6 control functionalities

A

Administrative Detective

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Information Classification out of 6 control functionalities

A

Administrative Preventive

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Server images out of 6 control functionalities

A

Technical Corrective

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

ISO/IEC 27000 ISO/IEC 27001 ISO/IEC 27002 ISO/IEC 27003 ISO/IEC 27004 ISO/IEC 27005 ISO/IEC 27006 ISO/IEC 27007 ISO/IEC 27008 ISO/IEC 27011 ISO/IEC 27014 ISO/IEC 27015 ISO/IEC 27031 ISO/IEC 27032 ISO/IEC 27033 ISO/IEC 27034 ISO/IEC 27035 ISO/IEC 27037 ISO/IEC 27799

A 
Overview and vocabulary
ISMS requirements
Code of practice for information security management ISMS implementation
ISMS measurement
Risk management
Certification body requirements
ISMS auditing
Guidance for auditors
Telecommunications organizations
Information security governance
Financial sector
Business continuity
Cybersecurity
Network security
Application security
Incident management
Digital evidence collection and preservation
Health organizations
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Zachman Architecture Framework

A

The Zachman Framework is a two-dimensional model that uses six basic commu- nication interrogatives (What, How, Where, Who, When, and Why) intersecting with different perspectives (Executives, Business Managers, System Architects, Engineers, Technicians, and Enterprise-wide) to give a holistic understanding of the enterprise.
The goal of this framework is to be able to look at the same organization from different viewpoints.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

The Open Group Architecture Framework (TOGAF),

A 
TOGAF is a framework that can be used to develop the following architecture types:
  Business architecture
  Data architecture
  Applications architecture    
Technology architecture

create these individual architecture types through the use of its Architecture Development Method (ADM).

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

DoDAF

A

The focus of the architecture framework is on command, control, communications, computers, intel- ligence, surveillance, and reconnaissance systems and processes.

It is not only important that these different devices communicate using the same protocol types and interoper- able software components, but also that they use the same data elements.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

The Ministry of Defence Architecture Framework (MODAF)

A

The crux of the framework is to be able to get data in the right format to the right people as soon as possible.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

enterprise security architecture

A

subset of an enterprise architecture and defines the information security strategy that consists of layers of solutions, processes, and procedures.

It is a comprehensive and rigorous method for describing the structure and behavior of all the components that make up a holistic ISMS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

main reason to develop an enter- prise security architecture

A

to ensure that security efforts align with business practices in a standardized and cost-effective manner.

The architecture works at an abstraction level and provides a frame of reference. Besides security, this type of architecture allows organizations to better achieve interoperability, integration, ease of use, standardization, and governance.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Sherwood Applied Business Security Architecture (SABSA)

A

similar to the Zachman Framework.

Each layer of the framework decreases in abstraction and increases in detail so it builds upon the others and moves from policy to practical implementation of technology and solutions. The idea is to provide a chain of traceability through the contextual, conceptual, logical, physical, component, and operational levels.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Sherwood Applied Business Security Architecture (SABSA)

A

a framework and methodology for enterprise security architecture and service management.

Since it is a framework, this means it provides a structure for individual architectures to be built from. Since it is a methodology also, this means it provides the processes to follow to build and maintain this architecture. SABSA provides a life-cycle model so that the architecture can be constantly monitored and improved upon over time.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Strategic Alignment

A

Strategic alignment means the business drivers and the regu- latory and legal requirements are being met by the security enterprise architecture.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

difference between an ISMS and an enterprise security architecture

A

An ISMS outlines the controls that need to be put into place (risk management, vulnerability management, business continuity planning, data protection, auditing, configuration management, physical security, etc.) and provides direction on how those controls should be managed throughout their life cycle.

The enterprise security architecture illustrates how these components are to be integrated into the different layers of the current business environment. The security components of the ISMS have to be interwoven throughout the business environment and not siloed within individual company departments.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Business enablement

A

Security enables the company to move to this different working model by providing the necessary protection mechanisms.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Process Enhancement

A

organization that is serious about securing its environment will have to take a close look at many of the business processes that take place on an ongoing basis.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Process reengineering under Process Enablement

A

When you look at many business processes taking place in all types of organizations, you commonly find a duplication of efforts, manual steps that can be easily automated, or ways to streamline and reduce time and effort that are involved in certain tasks. This is commonly referred to as process reengineering.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Security effectiveness

A

Security effectiveness deals with metrics, meeting service level agreement (SLA) requirements, achieving return on investment (ROI), meeting set baselines, and providing management with a dashboard or balanced scorecard system.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Enterprise vs. System Architectures

A

An enterprise architecture addresses the structure of an organization. A system architecture addresses the structure of software and computing components.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Cobit

A
  1. Meeting stakeholder needs
  2. Covering the enterprise end to end
  3. Applying a single integrated framework 4. Enabling a holistic approach
  4. Separating governance from management
24
Q

Cobit

A

They ensure that we meet the second goal of covering the enterprise end to end by explicitly tying enterprise and IT goals in both the governance and management dimensions.

governance is a set of higher-level processes aimed at balancing the stakeholder value proposition, while management is the set of activities that achieve enterprise objectives.

A majority of the security compliance auditing practices used today in the industry are based off of COBIT.

25
Q

three control categories

A

For Commercial
- Administrative, Technical, Physical

For Government
- Management, Technical, operational

26
Q

COSO IC

A

17 internal control principles that are grouped into five internal control components.

  • Control environment
  • Risk Assessment
  • Control Activities
  • Information and Communication
  • Monitoring Activities

The COSO IC framework is a model for corporate governance, and COBIT is a model for IT governance.

SOX is based upon the COSO model, so for a corporation to be compliant with SOX, it has to follow the COSO model.

27
Q

ITIL

A

Although ITIL has a component that deals with security, its focus is more toward internal SLAs between the IT department and the “customers” it serves. The customers are usually internal departments.

28
Q

Life Cycle of security program

A
  1. Plan and organize
  2. Implement
  3. Operate and maintain
  4. Monitor and evaluate
29
Q

control objective vs blueprints vs. description vs. architecture vs. checklist

A

To tie these pieces together, you can think of the ISO/IEC 27000 that works mainly at the policy level as a description of the type of house you want to build (ranch style, five bedrooms, three baths). The security enterprise framework is the architecture layout of the house (foundation, walls, ceilings). The blueprints are the detailed descriptions of specific components of the house (window types, security system, electrical system, plumbing). The control objectives are the building specifications and codes that need to be met for safety (electrical grounding and wiring, construction material, insulation, and fire protection).

A building inspector will use his checklists (building codes) to ensure that you are building your house safely. Which is just like how an auditor will use his checklists (COBIT or NIST SP 800-53) to ensure that you are building and maintaining your security program securely.

30
Q

computer-assisted, targeted, incidental

A

a computer-targeted crime could not take place without a computer, whereas a computer-assisted crime could.

31
Q

Privacy Act of 1974

A

Government agencies can maintain this type of information only if it is necessary and relevant to accomplishing the agency’s purpose. The Privacy Act dictates that an agency cannot disclose this information without written permission from the individual.

32
Q

Federal Information Security Management Act (FISMA) of 2002

A

U.S. law that requires every federal agency to create, document, and implement an agency-wide secu- rity program to provide protection for the information and information systems that support the operations and assets of the agency, including those provided or managed by another agency, contractor, or other source

33
Q

HIPAA vs. HITECH vs. Omnibus Rule

A

HITECH added more technical requirements to hospitals and doctors who were using electronic health records. A section of HITECH also improved provisions of HIPAA.
This was when carriers began issuing business associate agreements with all their agents. HITECH had extended the Privacy and Security Rules of HIPAA to business associates: agents of carriers. It also imposed new requirements regarding breaches - covered entities are now obligated to report large data breaches to the government and the affected individuals.

HIPAA and HITECH were updated in 2013 when the Omnibus Rule was released. The greatest change was that the Security and Breach Notification Rules of HIPAA, as well as updates from HITECH, were now to be upheld by business associates.

Where previously, business associates were only obligated to their covered entity, now they were directly liable for any non-compliance and any fines associated with the non-compliance.

34
Q

REP (Reasonable expectation of privacy)

A

In the U.S. legal system, the REP standard is used when defining the scope of the privacy protections provided by the Fourth Amendment of the Constitution. If employees are not specifically informed that work-related monitoring is possible and/or probable, when the monitoring takes place, employees could claim that their privacy rights have been violated and launch a civil suit against your company.

35
Q

Comprehensive Crime Control Act (CCCA) of 1984

A

This law was carefully written to exclusively cover computer crimes that crossed state boundaries to avoid infringing on states’ rights and treading on thin constitutional ice.

Access classified information or financial information in a federal system without authorization or in excess of authorized privileges

36
Q

Computer Fraud and Abuse Act (CFAA) of 1986

A

Computer crime law enacted as part of the CCCA was amended by the more well-known Computer Fraud and Abuse Act (CFAA) in 1986.

Instead of merely covering federal computers that processed sensitive information, the act was changed to cover all “federal interest” computers. This widened the coverage of the act to include the following:
Any computer used exclusively by the U.S. government Any computer used exclusively by a financial institution

37
Q

Computer Fraud and Abuse Act (CFAA) of 1994

A

Outlawed the creation of any type of malicious code that might cause damage to a computer system
Modified the CFAA to cover any computer used in interstate commerce rather than just “federal interest” computer systems

38
Q

National Information Infrastructure Protection Act of 1996

A

In 1996, Congress passed yet another set of amendments to the Computer Fraud and Abuse Act designed to further extend the protection it provides.

Broadens CFAA to cover computer systems used in international commerce in addition to systems used in interstate commerce.

39
Q

Computer Security Act (CSA) of 1987

A

mandate baseline security requirements for all federal agencies.

To give the National Institute of Standards and Technology (NIST) responsibility for developing standards and guidelines for federal computer systems. For this purpose, NIST draws on the technical advice and assistance (including work products) of the National Security Agency where appropriate.

40
Q

NIST 800-39 vs. 800-37

A

https://www.threatconnect.com/blog/threat-intelligence-within-risk-management/

41
Q

delayed loss

A

Delayed loss is secondary in nature and takes place well
after a vulnerability is exploited. Delayed loss may include damage to the company’s reputation, loss of market share, accrued late penalties, civil suits, the delayed collection of funds from customers, resources required to reimage other compromised systems, and so forth.

42
Q

Facilitated Risk Analysis Process

A

The crux of this qualitative methodology is to focus only on the systems that really need assessing, to reduce costs and time obligations. It stresses prescreening activities so that the risk assessment steps are only carried out on the item(s) that needs it the most. FRAP is intended to be used to analyze one system, application, or business process at a time.

43
Q

kinds of risk assessment

A

NIST 800-30, FRAP, OCTAVE, AS/NZS 4360, FMEA, CRAM

44
Q

NIST 800-30

A

Prepare, conduct, communicate, maintain the risk.
is mainly focused on computer systems and IT security issues. It does not explicitly cover larger organizational threat types, as in succession planning, environmental issues, or how security risks associate to business risks. It is a methodology that focuses on the operational components of an enterprise, not necessarily the higher strategic level.

45
Q

OCTAVE

A

This places the people who work inside the organization in the power positions as being able to make the decisions regarding what is the best approach for evaluating the security of their organization. This relies on the idea that the people working in these environments best understand what is needed and what kind of risks they are facing.

46
Q

AS/NZS 4360

A

AS/NZS 4360 takes a much broader approach to risk management. This Australian and New Zealand methodology can be used to understand a company’s financial, capital, human safety, and business decisions risks. Although it can be used to analyze security risks, it was not created specifically for this purpose. This risk methodology is more focused on the health of a company from a business point of view, not security.

47
Q

FMEA

A

Failure Modes and Effect Analysis (FMEA) is a method for determining functions, identifying functional failures, and assessing the causes of failure and their failure effects through a structured process. FMEA is commonly used in product development and operational environments.
The application of this process to a chronic failure enables the determination of where exactly the failure is most likely to occur. Think of it as being able to look into the future and locate areas that have the potential for failure and then applying corrective measures to them before they do become actual liabilities.

48
Q

Fault Tree Analysis

A

While FMEA is most useful as a survey method to identify major failure modes in a given system, the method is not as useful in discovering complex failure modes that may be involved in multiple systems or subsystems. A fault tree analysis usually proves to be a more useful approach to identifying failures that can take place within more complex environments and systems

49
Q

CRAMM

A

CRAMM (Central Computing and Telecommunications Agency Risk Analysis and Management Method), which was created by the United Kingdom, and its automated tools are sold by Siemens. It works in three distinct stages: define objectives, assess risks, and identify countermeasures.

50
Q

Risk Assessment vs. Risk Analysis

A

A risk assessment is used to gather data. A risk analysis examines the gathered data to produce results that can be acted upon.

51
Q

Vulnerability Assessment vs. Risk Assessment

A

A vulnerability assessment just finds the vulnerabilities (the holes). A risk assessment calculates the probability of the vulnerabilities being exploited and the associated business impact.

52
Q

Quantitative vs Qualititative Analysis

A

Quantitative evaluation can be used for tangible assets (monetary values), and a qualitative assessment can be used for intangible assets (priority values).

53
Q

BCP vs. BCM

A

While the term “BCP” actually applies to a plan and “BCM” applies to the overall management of continuity, these terms are commonly used interchangeably.

54
Q

ISO and NIST performance metrics & measurement

A

ISO 27004, NIST 800-55 rev1

55
Q

RFC 1087

A

RFC 1087 is called “Ethics and the Internet.” This RFC outlines the concepts pertaining to what the IAB considers unethical and unacceptable behavior.

CISSP (2 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions