Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

My CISSP > Domain 1 > Flashcards

Domain 1 Flashcards

Study

1
Q

A logical structure used to document and organize processes?

A

Framework

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Framework for designing, establishing, implementing, maintaining, and monitoring an information security program.

A

ISMS (Information Security Management System)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Internationally recognized Information Security Framework

A

ISO 27000

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Payment card system information security contractually enforced framework

A

PCI DSS (Payment Card Industry Data Security)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

This type of metric is intended to help an organization compare themselves to peers

A

Benchmark

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

<p>Publisher of the SP800 series.</p>

A

<p>NIST</p>

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

This program is the U.S government repository of publicly available security guidance.

A

NCP (National Checklist Program)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

This U.S framework is voluntary guidance, based on existing standards, guidelines, and practices, for critical infrastructure organizations to better manage and reduce cybersecurity risk

A

NIST Cybersecurity Framework

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

The U.S government repository of standards-based vulnerability management data.

A

NVD (National Vulnerability Database)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Principle that focuses on protection from unintentional accidental, or inadvertent change.

A

Integrity.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Process of tracing actions to their source.

A

Accountability.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Principle that only authorized subjects have access.

A

Confidentiality

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Positive identification of a person or a system.

A

Authentication.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Process used to develop confidence that security measures are working as intended.

A

Assurance.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Principal that relates to operations and accessibility.

A

Availability.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Granting users and systems a predetermined level of access

A

Authorization.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Confidence that the system will act in a correct and predictable manner in every situation.

A

Trustworthy Computing.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Logging of access and use of information resources.

A

Accounting.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Expanded view of information security to include external relationships and global threats.

A

Cybersecurity.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

The standard of care that a prudent person would have exercised under the same or similar conditions:
- Actions taken by an organization to protect its stakeholders, investors, employees, and customers from harm.

A

Due Care.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Is an investigation of a business or person generally before entering into a contract:
- Is is the care and caution a reasonable person would take.

A

Due Diligence.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Is the potential liability incurred by a company whose computer systems are compromised and becomes the source of harm.

A

Downstream Liability.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

The board or a board committee duties include:

A
  • Promoting effective governance.
  • Determining organizational risk tolerance.
  • Contributing to and authorizing strategic plans.
  • Allocating funds.
  • Approving policies and significant projects.
  • Ensuring appropriate monitoring.
  • Ensure compliance with laws, regulations and contracts.
  • Reviewing audit and examination results.
  • Honoring the legal constructs of due diligence and due care.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Executive management is responsible for:

A
  • Strategic Alignment.
  • Risk Management.
  • Value delivery.
  • Performance measurements.
  • Resource management.
  • Processes assurance.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

Corporate Governance.

A

Is the system by which organizations are directed and controlled.
Governance structures are principles identify the distribution of rights and responsibilities.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

Governance Outcomes.

A
  • Strategic Alignment.
  • Risk Management.
  • Value Delivery.
  • Resource Management.
  • Performance Measurements.
  • Process Integration.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

Strategic Alignment.

A

Aligning departmental strategies with business strategy to support organizational goals.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

Risk Management.

A

Mitigate risk to acceptable level.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

Value Delivery.

A

Optimize investments in support of business objectives.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

Resource Management.

A

Efficient and effective use of resources.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

Performance Measurements

A

Monitoring and reporting on achievements.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

Processes Integration.

A

Achieve operational synergies and efficiencies.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

Information Security Management (ISM) personnel.

A

Generally have the authority to interpret strategic direction and are held accountable for the success of failure of their area.
ISM personnel should report as high as possible to maintain visibility, limit distortion, and minimize conflict of interest.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

Related infosec or ISM organizational roles, include:

A
  • Chief Risk Officer (CRO)
  • Chief Information Security Officer (CISO)
  • Information Security Officer (ISO)
  • Information Assurance Officer (IAO) or manager (IAM)
  • Privacy Officer
  • Compliance Officer.
  • Physical Security Officer.
  • Internal Audit.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

Information Security Management include:

A
  • Being a subject matter expert and security champion.
  • Managing the information security program.
  • Communicating with executive management.
  • Coordinating the budget for information security activities.
  • Ensuring the development and upkeep of governance documents.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

Functional Roles.

A

Functional roles are tactical and relate to specific data-sets, information systems, assets, or processes.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

Information Owner.

A

Owners are members of management responsible for protection of a subset of information.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

Custodians.

A

Custodians are responsible for implementing, managing, and monitoring the protection mechanisms.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

Data Users.

A

Users are expected to follow operational security procedures.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
40
Q

Jurisdiction.

A

Is the power or right of a legal or political agency to exercise its authority over a person, subject matter, or territory. Jurisdiction considerations include:

  • Privacy and security regulations (or lack of).
  • Access of local governments to stored or transmitted data.
  • Attitudes toward “foreigners”
  • Law Enforcement.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
41
Q

GLBA

A

The Safeguards Rule requires financial institutions to have measures in place to keep customer information secure. In addition to developing their own safeguards, companies covered by the safeguards rules are responsible for taking steps to ensure that their affiliates and service providers safeguards customer information in their care.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
42
Q

HIPPA | HITECH

A

The Security Rule requires covered entities implement appropriate administrative, physical and technical safeguards to ensure the confidentiality, integrity, and security of electronic protected health information in their care and shared with business partners.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
43
Q

FISMA

A

FISMA requires federal agencies to implement a program to provide security for their information and information systems including those provided by or managed by another agency.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
44
Q

Data Protection Directive / GDPR (EU)

A

Data protection for all individuals within the European Union. EU Data Protection Directive (EU DPD) and it’s successor the GDPR (General Data Protection Regulations) is based upon the Organization for Economic Cooperation and Development (OECD) Privacy Principles.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
45
Q

Cookie Law.

A

Web cookies inform and consent requirements.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
46
Q

PCI DSS

A

Payment Card Industry Data Security Standard (PCI DSS) is a contractual obligation between merchants and the the payment card brands.

  • The PCI DSS framework includes stipulations regarding storage, transmissions, and processing of payment card data.
  • Six core principles require technical and operational security controls, testing, requirements, and attestation process.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
47
Q

Board of Directors

A

Group ultimately responsible for the actions of the organization from a fiduciary perspective.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
48
Q

Users

A

Group responsible for interacting with information systems in accordance with organizational policies and standards.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
49
Q

Privacy

A

<p>Privacy is the right of an individual to control the use of their personal information.</p>

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
50
Q

Information Security.

A

Information Security is the process by which we safeguard information and systems and ensure confidential, integrity, and availability.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
51
Q

Data Compilation

A

Collection of data for “later use” to be determined.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
52
Q

Data Warehousing

A

Data Warehousing combines data from multiple sources into a large database with the purpose of extensive retrieval and trend analysis

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
53
Q

Data Mining

A

Process of analyzing data with tools that look for trends, correlations, or anomalies resulting in metadata.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
54
Q

Aggregation

A

individual pieces of data are combined to create a bigger picture that may have greater sensitivity thank individual parts.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
55
Q

Inference

A

Ability to derive information that is not explicitly available.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
56
Q

Family Education Rights and Privacy Act (FERPA)

A

<p>Student educational records.</p>

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
57
Q

<p>Federal Privacy Act (U.S.)</p>

A

<p>Data Collected by the Government.</p>

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
58
Q

<p>Children's Online Privacy Protection Act (COPPA)</p>

A

Citizen data privacy protection.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
59
Q

Privacy Statement

A
  • Clearly state what information may be collected, how the information will be used, who the information may be shared with and why, how a third-party may use the information, and how to opt out.
  • Codify the organization’s commitment to data quality and to data security.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
60
Q

Computer Crime

A

Computer Crime is a term broadly applied when a computer is used in the act of computing a crime. Computer crimes are often divided into two categories:

  • Computer as the target of a crime.
  • Computer as a tool (weapon) used to commit a crime.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
61
Q

Computer Fraud and Abuse Act

A

Unauthorized access to federal government, financial institution system, or any system used for interstate or foreign commerce.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
62
Q

National Information Infrastructure Protection Act of 1996

A

Primary federal anti-hacking statute.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
63
Q

Wiretap Act

A

Unauthorized interception of digital communications.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
64
Q

Electronic Communications Privacy Act

A

Unauthorized access or damage to electronic messages in storage.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
65
Q

Cybercrime

A

Is a broad term given to criminal activity that involves the Internet, a computer system, a computer network, or technology.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
66
Q

Cyber Threat Actors

A
  • Hackers / Script Kiddies.
  • Organized Crime.
  • Hacktivist .
  • Nation-State founded.
  • Insiders.
  • Competitors.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
67
Q

Data Breach Disclosure &amp; notification

A

An incident that is classified as a confirmed or high probability breach may trigger disclosure and notification requirements.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
68
Q

Intellectual Property

A

Intellectual Property (IP) describes a wide variety of property created by musicians, authors, artists, designers, and inventors.

  • Intellectual property can be used in commerce or can be artistic or literary works.
  • Intellectual property laws protect use and misuse including compensation.
  • Intellectual Property law includes patents, trademarks, copyrights, trade secrets and software licensing.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
69
Q

Patents

A

Patents are designed to protect an invention.

  • The invention must be novel, not obvious, and provide some utility.
  • A patentable invention must be something that can be produced.
  • A patent is good for 20 years.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
70
Q

Trademarks

A

A trademark is intended to protect recognizable names, icons, shape, color, sound, or any combination used to represent a brand, product, service, or company.
- Law creates exclusive rights.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
71
Q

Copyrights

A

A copyright covers the expression of an idea rather than the idea itself (which is protected by the patent).

  • The intent is not protect artistic property such as a writing, recording, or a computer program.
  • The protections are intended to allow the creator to benefit from being credited for the work and to control the distribution, duplication, and use of the work.
  • A trademark or service mark can be renewed every 10 years.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
72
Q

Trade Secrets

A

Trade Secrets refer to proprietary business and technical information, processes, designs, or practices that are confidential and critical to a business.
- Trade Secrets don’t require any registration.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
73
Q

Software Piracy

A

It is defined as the “unauthorized copying or distribution of copyrighted software”.

  • Piracy includes copying, downloading, sharing, selling, or installing, or installing multiple copies onto personal or work computers.
  • The Digital Millennium Copyright Act (DMCA) makes it illegal to create products that circumvent copyright protections such as a license key.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
74
Q

End-user license agreement (EULA)

A

Legally enforceable software use agreement.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
75
Q

Which statement best describes the concept of privacy?

A

The right of an individual to control the use of their personal information.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
76
Q

Hacktivist

A

The primary motivation of this threat actor us making a political statement.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
77
Q

The 4 canons of the ISC2 Code of Ethics

A
  • Protect society, the common good, necessary public trust and confidence, and the infrastructure.
  • Act honorably, honestly, justly, responsibly, and legally.
  • Provide diligent and competent service to principles.
  • Advance and protect the profession.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
78
Q

Policies

A

Policies are high-level statements (governance communications) intended to communicate rules and expectations and to provide direction.

  • Standards, baselines, guidelines, and procedures support the implementation of a policy.
  • Policies must be approved by executive management.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
79
Q

Information Security Policy

A

The Information Security policies codify the high-level requirements for protection information and information assets and ensuring Confidentiality, Integrity, and Availability.

  • Written information security policies may be a regulatory or contractual compliance requirement.
  • Each aspect of the information security program should have a corresponding policy documents.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
80
Q

Policy Attributes.

A
  • Endorsed
  • Relevant
  • Realistic
  • Attainable
  • Adaptable
  • Enforceable
  • Inclusive
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
81
Q

Policy Life-cycle.

A
  • Plan
  • Write
  • Approved
  • Publish (Communicate, Disseminate, Educate)
  • Adopt (Implement, Monitor, Enforce)
  • Review (Solicit Feedback, Reauthorize or Retire)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
82
Q

Standards

A

Standards serve as specifications for the implementation of policy and dictate MANDATORY requirements.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
83
Q

Baselines

A

Baselines are aggregate of standards for a specific category or grouping such as a platform, device type, ownership, or location.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
84
Q

Guidelines

A

Guidelines help people understand and conform to a standard. Guidelines are customized to the intended audience and are NOT mandatory

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
85
Q

Procedures

A 
Procedures are instructions for how a policy, standard, baseline, or guideline is carried out in a given situation. Procedures focus on discrete actions or steps, with a specific starting and ending point.
Four commonly used formats:
- Simple
- Hierarchy
- Graphic
- Flowchart.
86
Q

NIST Special Publication Series #

A

SP-800

87
Q

Business Continuity

A

Business continuity is the ability for a business to operate in adverse conditions.

  • Business continuity may be a contractual obligation.
  • Business continuity may be a regulatory requirement.
88
Q

Business Continuity Planning.

A

The objective of business continuity planning is to prepare for continued operation of ESSENTIAL functions and services during disruption of normal operating conditions. To support this objective:

  • Threat scenarios are evaluated.
  • Essential services and processes are identified.
  • Response, recovery, and contingency plans are developed
  • Strategies, plans, and procedures are tested.
89
Q

BCP governance responsibilities include:

A
  • Board of Directors (or equivalent) approval of Business Continuity policies.
  • Board of Directors (or equivalent) oversight of BCP strategies, plans and testing.
  • Management oversight of BCP preparedness including external parties.
90
Q

Business Continuity Planning Phases

A
  • Project initiation and assignments.
  • Business Impact Analysis
  • Threat Analysis
  • Strategy Development
  • Plan Development
  • Execution / Procurement
  • Training
  • Testing
  • Auditing
  • Monitoring
  • Maintenance Review &amp; Update.
91
Q

Business Continuity Planning Resources

A
  • ISO 22301:2012

- SP 800-34 R1

92
Q

Continuity of Operations Plan (COOP)

A

Business unit plan and procedures for operational activities.

93
Q

Crisis Communication Plan (CCP)

A

Plan and procedures for internal and external communications.

94
Q

Disaster Recovery Plan (DRP)

A

<p>Plan and procedures for recovering technology and facilities.</p>

95
Q

Occupancy Emergency Plan (OEP)

A

Plan and procedures for minimizing loss of life and property.

96
Q

Cyber Incident Response Plan (CIRP)

A

Plan and procedures for mitigating a cyber attack

97
Q

Federal emergency management Angency (FEMA)

A

U.S Federal Agency responsible for responding to and coordinating the response to a disaster that has occurred in the USA

98
Q

Objective of Business Impact Analysis (BIA)

A

The Objective of Business Impact Analysis (BIA) is to identify the impact of a disruption on mission-essential services, systems, and infrastructure.

99
Q

A Business Impact Analysis (BIA) is used by management to:

A
  • Understand organizational continuity requirements.
  • Make investment decisions.
  • Guide the development of incidents response, disaster recovery, and business contingency (continuity) plans
100
Q

Maximum Tolerable Downtime (MTD) or Maximum Tolerable Outage (MTO)

A

Maximum time a process/service can be unavailable without causing significant harm to the business.

101
Q

Recovery Time Objective (RTO)

A

Amount of time allocated for system recovery. Must be less than the maximum amount of time a system resource can be unavailable before there is an unacceptable impact on other system resources or business processes.

102
Q

Recovery Point Objective (RPO)

A

Acceptable data loss. The point in time prior to a disruption or system outage that data can be recovered.

103
Q

Business Impact Analysis (BIA) Process

A
  • Identify Essential Services &amp; Dependencies.
  • Determine Maximum Tolerable Downtime (MTD).
  • Determine Recovery Point Objective (RPO).
  • Identify Infrastructure and Dependencies.
  • Determine Current RTO &amp; RPO.
  • Gap Analysis.
  • Report to Management.
104
Q

Background Check

A

A Background Check is an investigative report. It may include criminal, financial, credit and/or education history, workers compensation claims, and public records.

  • The depth and breath of a background check should specifically be related to job roles and responsibilities and level of access.
  • The applicant has a right to privacy. Consent should always be requested.
105
Q

On-boarding

A

Onbarding is the process of integrating a new employee with a company and culture as well as getting the tools and information they need to be successful.
- User orientation is the initial task on completing paperwork.

106
Q

User Provisioning

A

User Provisioning is the process of creating user accounts and credentials, assigning access rights and permissions.

107
Q

Confidentiality / Non-dis closure Agreement (NDA)

A

Protects Data from unauthorized disclosure:

  • Establish data ownership
  • Protect information from disclosure.
  • Prevent forfeiture of patent rights
  • Define handling standards including disposal.
108
Q

Acceptable Use Policy (AUP) Agreement

A

Sets forth proper use if information systems, handling standards, monitoring and privacy expectations.

  • An AUP should be written in languages that can be easily and unequivocally understood.
  • By signing the associated agreement, the user acknowledges, understands, and agrees to the stated rules.
109
Q

Acceptable Use Policy (AUP) Elements

A
  • Data Classifications and handling standards
  • Login requirements including password standards and use of tokens an/or biometrics
  • Procurement, installation, and licensing
  • Written and verbal communication use and limitations (including personal email)
  • Use, activity, and engagement (including social media)
  • Use, configuration, activity, and device protection

Use, configuration, activity, and physical security

Instructions on how to spot and report suspicius activity.

110
Q

Job Rotation

A

Rotating assignments (fraud deterrent and detection)

111
Q

Mandatory Vacation

A

Require employees to take a set amount of vacation time (fraud deterrent and detection)

112
Q

Separation of Duties

A

Breaking a process into tasks so tat no one subject is in complete control.
(fraud prevention/deterrent - would require collusion)

113
Q

Dual Control

A

Requiring to never leave confidential data (paper, monitor, whiteboard) unattended or within view of unauthorized personnel.

114
Q

Termination

A

Termination ends employment. How termination is handled depends upon the specific circumstances (friendly/unfriendly) and transition arrangements that have been made with the employee.

  • Tasks include recovering physical and access control assets, deleting or disabling local an remote access, deleting or disabling user accounts and access permissions, archiving documents and email, and reassigning file folder permissions.
  • All these tasks should be documented.
115
Q

Off-boarding

A

Off-boarding is the process for transitioning employees out of an organization. Tasks include:
- Documenting separation details
Tasks and responsibilities prior to departure
- Knowledge transfer
- Exit Interview.

116
Q

Adherence to the (ISC)2 Code of Ethics is a condition of certification. This group males the final decision on ethics violations and decertification.

A

(ISC)2 Boards of Directors

117
Q

This group is responsible for determining maximum tolerable downtime (MTD).

A

Business Unit

118
Q

This agreement generally includes a no expectation of privacy and electronic monitoring clauses.

A

Acceptable Use Policy Agreement.

119
Q

Three factors should inform information security decisions:

A
  • Strategic aliment with the organizatnio’s objectives.
  • Legal, regulatory, or contractual requirements.
  • Level of risk
120
Q

Threat

A

Potential danger.

121
Q

Threat Agent

A

Individual or group that can manifest a threat.

122
Q

Threat event

A

Specific instance of a threat

123
Q

Vulnerability

A

Weakness.

124
Q

Exploit

A

When a threat agent successfully takes advantage of a vulnerability.

125
Q

Impact

A

Magnitude of harm caused by a threat source.

126
Q

Likelihood (of occurrence)

A

A weighted factor that a given threat agent is capable of exploiting a giving vulnerability.

127
Q

Risk

A

Risk is the measurement of likelihood and impact of a threat event. Risk is inherently neither good nor bad.

128
Q

Risk appetite

A

Risk appetite is the level of risk that an entity will accept in pursuit of its mission and objectives.

  • Risk appetite can vary by category of risk
  • Risk Tolerance is acceptable variation in outcomes related to specific performance measures.
129
Q

Managing Risk

A

Managing Risk implies that the level of risk is understood, and is either accepted or being actively controlled (treated) and in either case, monitored.

130
Q

Information Security Risk Management Framework

A

Information Security Risk Management Framework should complement the organization’s risk management framework and be in conformance with regulatory requirements.

131
Q

Risk Assessment

A

A Risk Assessment is used to identify the level of risk:

  • Risk is assessed by evaluating, and the impact if the circumstance or event occurs.
  • The target of a risk assessment can be internal systems/process or external supply chain.
  • The target of a risk assessment can be internal system/process or external supply chain relationships.
132
Q

Risk Treatment

A

Risk Treatment is how an organization responds to identified risks - generally defined as actions taken to either accepted the level of risk or mitigate the impact of the undesirable or unfavorable outcome and-or enhance the likelihood of a positive outcome.

  • Inherent risk is the level of risk before treatment.
  • Residual risk is the level of risk after treatment.
133
Q

Ignore Risk

A

Act if the risk doesn’t exist.

134
Q

Avoid Risk

A

Eliminate the cause or terminate the associated activity.

135
Q

Mitigate Risk

A

Reduce the impact or likelihood by implementing controls or safeguards.

136
Q

Deter Risk

A

Discourage the threat action or adversary from taking action.

137
Q

Share Risk

A

Spread the risk among multiple parties.

138
Q

Transfer Risk

A

Assign the risk to another party via insurance or contractual agreement (subject to legal and regulatory constraints)

139
Q

Accept Risk

A

Acknowledge the risk and monitor it.

140
Q

Risk Monitoring

A

The objective of Risk Monitoring is to track known risks, evaluate treatment effectiveness, identify new risks, and schedule ongoing assessments.

141
Q

Risk Register

A

A Risk Register is a tool used to document organization risks and ancillary details such as owner, treatment, measures, and monitoring tasks.

142
Q

Risk Assessment

A

A Risk Assessment is used to identify the level of risk./
- Determining the scope and scheduling of risk assessments is a risk management function; however, it is common for this process to be managed by the audit department.

143
Q

Risk Assessment Approaches

A
  • Qualitative Risk Assessment.
  • Quantitative Risk Assessment.
  • Semi-Qualitative Risk Assessment.
144
Q

Qualitative Risk Assessment

A

Qualitative Risk Assessment use descriptive terminology such as high, medium, and low or normal, elevated, and severe.

145
Q

Quantitative Risk Assessment

A

Quantitative Risk Assessment assign a numeric and monetary values to all elements of the assessment.

146
Q

Semi-Qualitative Risk Assessment.

A

Semi-Qualitative Risk Assessments assign a numeric weighted scale to the descriptive values (e.g. high=5, medium=3, low=1) and incorporates deterministic formulas.

147
Q

Qualitative Methodologies

A
  • NIST SP 800-30
  • Facilitated Risk Analysis Process (FRAP)
  • The Operationally Critical Threat, Asset, and Vulnerability Evaluation (OCTAVE)
148
Q

NIST SP 800-30

A

Federal Government Standard

- Used extensively in the private sector.

149
Q

Facilitated Risk Analysis Process (FRAP)

A

Used to analyze one system at a time

- Stresses screening activities

150
Q

The Operationally Critical Threat, Asset, and Vulnerability Evaluation (OCTAVE)

A

Can be used to large scopes

  • Facilitated workshops involving business process teams
  • Developed at the Carnigie Mellon University Software Engineering Institute (CM SEI)
151
Q

ISO/27005

A

Supports the requirements of an ISO 27000 information security management system
- Does not specify a specific methodology but does detail a structured sequence of iterative processes.

152
Q

Quantitative risk assessment elements include:

A
  • Asset value (AV) expressed in $
  • Exposure factor (EF) expressed as a %
  • Single Loss expectancy (SLE) expressed in $
  • Annualized rate of occurrence (ARO) expressed as a #
  • Annualized loss expectancy (ALE) expressed in $
  • Cost/Benefit analysis (CBA) expressed in $
153
Q

Single Loss expectancy (SLE) Formula

A

SLE ($) = AV($) x EF(%)

154
Q

Annualized loss expectancy (ALE)

A

ALE($) = SLE($) x ARO (#)

155
Q

Residual Risk

A

Level of Risk after Controls are applied

156
Q

Control

A

A control (sometimes called the countermeasure or safeguard) is a tactic, mechanism, or strategy that accomplished one or more of the following:

  • Reduces or eliminates a vulnerability
  • Reduces or eliminates the likelihood that a threat agent will be able to exploit a vulnerability
  • Reduces or eliminates the impact of an exploit
157
Q

Types of Controls

A
  • Deterrent
  • Preventive
  • Detective
  • Corrective
  • Compensating
158
Q

Deterrent Controls

A

Deterrent Controls discourage a threat agent from acting.

159
Q

Preventive Controls

A

Preventive controls stop a threat agent from being successful.

160
Q

Detective Controls

A

Detective controls identify and report a threat agent, action, or incident.

161
Q

Corrective Controls

A

Corrective controls minimize the impact of a threat agent, or modify or fix a situation (recovery)

162
Q

Compensating

A

Compensating controls are alternate controls designed to accomplish the intent of the original controls as closely as possible, when the originally designed controls cannot be used due to limitations of the environment or financial constraints.

163
Q

Administrative Controls

A

Controls relating to oversight, laws, rules, regulations, and policies.
-Policies, procedures, training, audits, compliance reporting

164
Q

Physical Controls

A

Controls that can have a material structure (seen, heard, touched).
- gate, alarm, guard, barricade, door, lock, CCTV, ID card.

165
Q

Technical (Logical) Controls

A

Controls provided through the use of technology and/or a digital device.
- Encryption, ACLs, firewall rules, anti-virus software, bio-metric authentication.

166
Q

Threat Modeling Categorization Models

A
  • Attacker- Centric.
  • Architecture-Centric
  • Asset Centric.
167
Q

Attacker-Centric Threat Modeling

A

Attacket-Centric threat models start with identifying an attacker and the evaluate the attacket’s goals and potential techniques.

168
Q

Architecture-Centric Threat Modeling

A

Architecture-Centric threat models focus on system design and potential attacks against each component.

169
Q

Asset-Centric Threat Modeling

A

Asset-Centric Threat Modeling threat models begin by identifying asset value and motivation of threat agents.

170
Q

Motivation

A

Motivation is the driving force behind any attack

171
Q

Attack WorkFactor

A

Workfactor is the time, effort, and resources needed for an attacker to successfully achieve their objective.

172
Q

Threat Intelligence

A

Threat Intelligence is evidence-based knowledge about an emerging threat that can be used to inform control decisions. The true value of threat intelligence is in its application.

173
Q

Open Source threat intelligence (OSINT)

A

Open Source threat intelligence (OSINT) is a term used to refer to the data collected from publicly available sources to be used in an intelligence context.

174
Q

ISACs

A

Information Sharing and Analysis Centers (ISACs) collect, analyze and disseminate actionable sector specific threat information to their members and provide members with tools to mitigate risks and enhance resiliency.

175
Q

Threat Detection

A

Threat detection is the process of identifying artifacts (e.g. virus signatures, IP address, malicious URL, command and control connection, file changes, unexpected activity, behavioral anomalies) that are indicative of an attack (IOA) or an active exploit (IOC).

176
Q

Indicator of an Attack (IOA)

A

Indicator of an Attack (IOA) is a proactive early warning sign that an attack may be imminent or already underway underway.

177
Q

Indicator of Compromise (IOC)

A

Indicator of Compromise (IOC) is a reactive substantive or corroborating evidence that a system or network has been exploited.

178
Q

Resiliency

A

Resiliency is the capability to continue operating even when there has been a fault, incident, or abnormal operating conditions.

179
Q

Targeted Attack

A

Attacker Chooses a target for a specific objective

180
Q

Opportunistic Attack

A

Attacker takes advantage of a vulnerable target (not previously known to them)

181
Q

Amplification

A

Attacker uses an amplification factor to multiply its power.

182
Q

Priviledge Escalation

A

Attacker focuses on obtaining elevated access to resources that are normally protected from an application or user.

183
Q

Advanced Persistent Threat (APT)

A

A sophisticated attack in which an attacker gains access to a network and stays there undetected for a long period of time.

184
Q

Zero-day

A

A threat that is exploited and was unknown before it was detected.

185
Q

Primary Attack Vectors

A
  • Digital Infrastructure.
  • Human
  • Physical Infrastructure.
186
Q

Digital Infrastructure Attack Categories

A
  • Spoofing
  • Poisoning
  • Hijacking
  • Denial of Service (DOS)
  • Code.
187
Q

Spoofing

A

Impersonation an address, system or person.

- Enables an attacker to act as the trusted source and redirect/manipulate actions

188
Q

Poisoning

A

Manipulating trusted source of data (e.g. DNS)

- Enables an attacker to act as the trusted source and redirect/manipulate actions.

189
Q

Hijacking

A

Intercepting communication between two systems

- Enables an attacker to eavesdrop, capture, manipulate, and or reuse data packets

190
Q

Denial of Service (DOS)

A

Overwhelming communication between two systems

- Enables an attacker to take control

191
Q

Code / Firmware

A

Exploiting weaknesses in a server or client side code, applications or hardware.
- Enables an attacker to take control.

192
Q

Supply Chain

A

A supply chain is a ecosystem of organizations, process, people and resources involved in providing a product or service.

  • The supply chain represents the steps it takes to get the product or service to the consumer.
  • The supply chain includes outsourced operations.
  • The supply chain includes external providers.
193
Q

Insourcing

A

Insourcing is when functions are performed by internal personnel

194
Q

Outsourcing

A

Outsourcing is when functions are performed by third parties.

195
Q

Supply Chain Risk Management (SCRM)

A

Supply Chain Risk Management (SCRM) is the implementation of strategies to manage uncertainty, identify vulnerabilities, and ensure continuity.

196
Q

SSAE18

A

Statement on Standards for Attestation Agreements #18 (SSAE18) Service Organization Control (SOC) Reports are internal control report on the services provided by a service organization.

197
Q

NIST SETA Model

A
  • Security Education (Long term)
  • Training (Intermediate)
  • Awareness (Short-term)
198
Q

Employee Awareness Programs

A

Employee Awareness Programs should include:

  • On-boarding (initial and at 3 months) which includes polices, best practices, social engineering, duress, and reporting suspicious activity.
  • Annual compliance and ‘hot topic’ training (instructor-led, recorded, online)
  • Ongoing Awareness program.
  • As needed, situational awareness communications.
199
Q

Social Engineering

A

Social Engineering (SE) describes a class of techniques used to manipulate people by deception, into divulging information or performing an action.

200
Q

Social Engineering Principles

A
  • Authority
  • Intimidation
  • Consensus / Social Proof
  • Scarcity
  • Urgency
  • Familiarity / liking
  • Trust
201
Q

Phishing

A

Pretexting using email.

202
Q

Spear Phishing

A

Targeted version of phishing.

203
Q

Whale

A

High profile phishing target

204
Q

Vishing

A

Pretexting using voice (phone)

205
Q

Hoax

A

Warning f a non-existent threat or offer-designed to defraud.

206
Q

Watering Hole

A

Compromising a website or social media application frequented by the target.

207
Q

Social Engineering - Physical Presence

A
  • Impersonation.
  • Shoulder Surfing.
  • Piggybacking | Tailgating.
  • Dumpster Diving.
208
Q

Impersonation

A

Impersonation a “trusted” source in order to gain access.

209
Q

Shoulder Surfing

A

Covert Observation.

210
Q

Piggybacking | Tailgating

A

When an unauthorized person enters a checkpoint close behind, or in concert with authorized personnel.

211
Q

Dumpster Diving

A

Rummaging through trash and recycling in search of information.

212
Q

Social Engineering Defense Controls

A

User education, including general awareness and understanding of the importance of following security procedures and reporting suspicious activity. Supported by:

  • Published policies and procedures (caller/visitor identification, document disposal)
  • Technical Controls ( SPAM and content filtering)
  • Physical Controls (surveillance, mantraps, anti-skimming).

My CISSP (6 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2025 Bold Learning Solutions. Terms and Conditions