Domain 1 Flashcards
Mindset of the CISSP Exam
1) Think like a CEO - an ethical CEO. answer is policies
2) Safety is the most important concept - no loss of data is worth risks loss of life - safety is always a good choice
3) Ethics are critical
- — protect society, the common good, necessary public trust and confidence and the infrastructure
- — act honorably, honestly, justly, responsibly, and legally
- — provide diligent and competent service to principals
- — advance and protect the profession
4) Business continuity: protect the organization
5) Increase profits by reducing the risk of financial loss
Information Security is:
The protection of information and information systems from unauthorized access, use, disclosure, disruption, modification, or destruction in order to provide confidentiality, integrity and availability (CIA triad)
Opposites:
Confidentiality – Disclosure
Integrity – Alteration
Availability – Destruction
____ provides a weak and unproven claim of identity
Identification - providing a username
____ serves as proof that a users identity claim was legitimate
authentication - password. The stronger the authentication it implies a higher integrity - e.g., multifactor authentication
Something you know
Something you have
Something you are
Someplace you are (such as GPS)
two or more of these is two factor or multifactor
____ proceeds after successful authentication and determines what an authenticated user can do
authorization - roles and access in a system. which users or group of users should have access to what group of information. Need to know.
____ details the interactions performed by individuals. Makes you responsible for your actions.
accountability / accounting - audit logs could be generated, which could be used to hold users accountable for their actions. However, this is not enough. Someone must actually review the logs and identify violations
____ is the confidentiality and protection of personally identifiable information
privacy
____ is acting as any reasonable person would
Due Care - important concept to the legal matter of negligence, and therein potential liability. Sometimes referred to as Prudent Man Rule
Base level of protection
____ are practices or processes that ensure the decided upon standard of care is maintained
Due Diligence - followed to ensure that an organization is exercising their duty of care
Access Control Measures: What are the major types of controls and how are they implemented?
Major types of controls:
- Preventive (the most important and cost-effective)
- Detective (assumes an attack has begun and detects after the attach occurs) - e.g., IDS, rotating duties, background check, cameras
- Corrective - reacts to an attack and takes corrective action for data recovery (run spyware and fix an issue)
- Deterrent - discourage security violations (beware of dog)
- Recovery - restores the operating state back to normal after an attack or system failure - mitigate more sever impacts compared to corrective. reimages a system to remove an infection
- Compensating - provides alternatives to other controls
Implemented Via:
- Administrative (directive):
---- Background checks
---- Policies and procedures
- Physical
---- locks
---- securing laptops
---- securing magnetic media
---- the protection of cable
Technical
---- Encryption
---- Smart Cards
Defense in depth is critical
Definition of risk and the formula is
Risk = threat x vulnerability
to mitigate risks we must understand both threats and vulnerabilities, as well as their interaction
Risk analysis is the application process of applying the risk formula
Must also:
- Understand threats and their motivations
- Understand particular vulnerabilities and the likelihood of exploitation
- Understand CIA impacts if exploited
- Understand controls that could limit impact or decrease likelihood
- Perform this calculation for each particular vulnerability on each system
- Aggregated the scores and determine overall risk
A ____ is anything that can cause harm to an information system or the potential for a threat-agent to cause harm by exploiting a particular vulnerability
Threat
- Threat-agents or threat-sources are what is behind a particular threat. They are organized crime and are considered as part of the “likelihood” component based on the motivation and capabilities of the threat source.
- understanding motivation and capabilities of threat sources is important.
A ____ is a weakness in a system that could potentially be exploited
Vulnerability
- Without an applicable vulnerability, threats cannot introduce risk
- There is no risk, even if there are numerous motivated threat agents, if there is no vulnerability.
A ____ is a vulnerability that is not publicly known and there is no patch that currently exists.
Zero-day vulnerability
____ is the process of a threat taking advantage of a vulnerability or the means by which a threat exercises a vulnerability.
Exploitation / exploit
- Actions triggered by the exploit are called the payload
- An attacker (threat agent or threat source) exploits a vulnerability.
____ is source or binary code that eases the ability for an attacker to exploit a vulnerability
Exploit code
The existence of publicly available exploit code is one item that can increase a vulnerability’s overall score
The ____ is what action the attacker wants to carry out as a result of the exploitation
Payload
- Actions triggered by the exploit are called the payload
In order to perform risk assessments, you must also understand the ___ and ____ of an attack.
Likelihood - how likely it is that the threat will exercise the vulnerability
Impact - what the outcome of successful exploitation would be
What are the two primary approaches to Risk Analysis?
Quantitative (tied to dollar amounts) and Qualitative risk analysis
Risk analysis is the application process of the risk formula (risk = threat x vulnerability)
What are some factors of Quantitative Risk Analysis
- More desirable and likely to sway stakeholders
- Tied to dollars - Attempts to provide a precise numerical value to risk statements but honest calculation can be cumbersome.
- Not as subjective
- Established practices and calculations
- Single Loss Expectancy (SLE) = AV x EF
- Annualized Rate of Occurrence (ARO) - (frequency of the threat occurrence per year
- Annualized Loss Expectancy (ALE) = SLE x ARO
- Total Cost of Ownership (TCO)
- Return on Investment (ROI)
- Cost/Benefit Analysis
What are the Quantitative Risk Analysis / Management Key Formulas?
- Asset Value (AV) = Value of the Asset
- Exposure Factor (EF) = % of asset value at risk due to a threat
- Annualized Rate of Occurrence (ARO) = Frequency of threat occurrence per year
- Single Loss Expectancy (SLE) = AV x EF
- Annualized Loss Expectancy (ALE) = SLE x ARO
What are some factors of Qualitative Risk Analysis
- Not as overly tied to dollar amounts associated with potential losses
- Easier to calculate
May not be considered as valuable because of the lack of explicit dollar amounts - Useful for prioritization of risks to be addressed
- Strong starting point
**Risk Matrix - Common approach for qualitative analysis. Plotting likelihood and impact associated with a threat vulnerability pair (high medium and low rankings)
____ means that the level of risk is unacceptable to the decision makers
Excessive Risk - does not necessarily mean a lot of risk, only past the acceptable levels
If risk exceeds acceptable levels, the org. must determine how to proceed and the response
How do you respond to excess risk?
1) Risk Mitigation - reduce the risk to an acceptable level by taking actions to decrease the risk
- — Most common approach to responding to excessive risk
- — Mitigation comes in many flavors:
- — threat-oriented - focused on reducing motivation of threat agents (increase fines)
- — Vulnerability oriented - reducing the vulnerabilities a threat can exploit (patching)
- — Impact oriented - reducing overall impact that an exploitation entails
- — Likelihood oriented - reducing the likelihood that the threat can exploit the vulnerability
- — Must identify current existing controls before identifying additional controls
2) Risk Avoidance - deciding not to move forward with a project that introduces a risk or decommissioning a system. (maybe deciding to do nothing or choose a different project).
3) Transferring Risk - aka risk sharing, involves a third party to help address the excess risk
- — e.g., insurance, outsourcing a risky system to a third party
4) Accepting Risk - there will always be residual risk and some risk ultimately needs to be accepted
Control Assessments are used to:
Determine both the cost of the control or countermeasure as well as efficacy of the control at reducing risk. Effectively, you must perform a cost benefit analysis to determine which countermeasures to employ or if they should be adopted at all.
Metrics to determine this are:
- — Total cost of ownership (TCO) - attempts to capture the true cost of adopting something beyond merely capital expense (includes run and resource cost)
- — Return on Investment (ROI) - attempts to determine how financially worthwhile something is based on how much money will be made (prevention of future losses) based on money spent.
First you must identify the current controls in place. Once you determine if those are not sufficient, you must identify countermeasures and controls. Then you perform a control assessment.
A ____ is used to determine providers / suppliers capabilities and allow for questions and tuning. This is made to gather information about the available providers of the item or service being procured
Request for Information (RFI) - used to also identify who will be included/excluded from a subsequent RFP/RFQ.
A ____ is to determine which providers will bid for a project and what it will look like.
Request for Proposal (RFP) - might include an RFI and RFQ as a part of it. will include who will bid, what their proposal looks like and commonly how much it will cost
A ____ is focused on determining the cost a supplier would charge
Request for Quote (RFQ) - can be included as part of RFP but can also be standalone but typically for less complex solutions.
A ____ is used when a business operates legally as a partnership
Business Partnership Agreement (BPA) - addresses things like ownership, profits/losses, partner contributions. A formal written BPA is not required, it could address things like ownership, profits/losses and contributions.
A ____ is used when two organizations interconnect information systems / networks
Memorandum of Understanding / Agreement (MOU / MOA) - goal is to establish basic roles, responsibilities and requirements for interconnection. It refers to the Interconnection Security agreements (ISA).
