Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CISSP > Domain 1 > Flashcards

Domain 1 Flashcards

1
Q

What is the CIA Triad

A
  1. Confidentiality
  2. Integrity
  3. Availability
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Achieving CIA Best Practices

A
  1. Separation of Duties
  2. Mandatory Vacations
  3. Job Rotation
  4. Least Privilege
  5. Need-to-know
  6. Dual Control
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

BIA

A

Business Impact Analysis

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Define RTO

A

Planned recovery time. The amount of time allocated for a recovery plan to be executed

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

WRT

A

Work Recovery Time

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Define WRT

A

The time needed to test and make sure everything is ready to go into live production environment

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

SLO

A

Service Level Objective

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Define SLO

A

The level of Service a business needs to recover to in order to meet contractual requirements

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

RTO

A

Recovery Time Objective

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

COOP

A

Continuation of Operations

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Define COOP

A

Focuses on delivering “something”, even if not optimal, while recovering critical systems to nominal

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

MTD

A

Maximum Tolerable Downtime

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Define MTD

A

Amount of time we can be without a critical business function before business can no longer function from pain (pain of loss)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

MTO

A

Maximum Tolerable Outage

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Define MTO

A

The amount of time business can operate in recovery mode. May be limited by resources or constraint of inventory (example fuel in generators)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Steps of BIA

A
  1. Inventory and Define Assets (critical assets)
  2. Learn the business (understand what it does)
  3. Identify critical business functions
  4. Total list, critical and not of assets and their function
  5. Derive Plans - Create different plans for management to select from
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Risk Management Constraints

A

Time and budget

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Opposite of CIA Triad (DAD)

A

Disclosure, Alteration, Destruction

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Protection Mechanisms

A
  1. Layering (defense in Depth)
  2. Abstractions
  3. Encryption
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Security Control Categories

A
  1. Directive (administrative) -mandated requirements
  2. Deterrent - Reduces someone’s will to attack
  3. Preventative - Controls to prohibit activity
  4. Detective - Recognize hostile activity
  5. Corrective - Reacts to a situation to stop and restore 5. Recovery - restore operations to known good state
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Define Risk Management

A

Process of identifying, examining, measuring, mitigating, or transferring (sharing) risk

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Risk Terminology

A

Asset - Anything of value to a company
Vulnerability - a weakness; the absence of a safeguard
Threat - Things that could pose a risk to an asset
Threat agent - The entity which carries out attack
Exploit - An instance of compromise

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Popular Security Frameworks

A 
ISO 27001/27002
COBIT
ITIL
RMF
CSA STAR
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

ISO 27001

A

ISO 27001 is known as the information security management system (ISMS) and is a comprehensive, holistic view of security governance within and organization, mostly focused on policy

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

ISO 27002

A

ISO 27002 is a comprehensive list of security controls that can be applied to an organization; the organization uses ISO 27002 to select the controls appropriate to its own ISMS, which the organization designs according to ISO 27001

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

COBIT

A

The COBIT framework (currently COBIT 5) is designed as a way to manage and document enterprise IT and IT security functions for an organization. COBIT widely uses a governance and process perspective for resource management and is intended to address IT performance, security operations, risk management, and regulatory compliance.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

ITIL

A

“concentrates on how an organization’s IT environment should enhance and benefit its business goals. ITIL is also mapped to the ISO 20000 standard, perhaps the only non-ISO standard to have this distinction”

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

RMF

A

NIST, the U.S. National Institute of Standards and Technology, publishes two methods that work in concert (similar to how ISO 27001 and 27002 function);

Risk Management Framework (RMF), and the applicable list of security and privacy controls that goes along with it (respectively, these documents are Special Publications (SPs) 800-37 and 800-53).

Required to be followed by federal agencies in the United States,

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

CSA STAR

A

Cloud Security Alliance (CSA) publishes standards and tools for industry and practitioners, at no charge. The CSA also hosts the Security, Trust, and Assurance Registry (STAR), which is a voluntary list of all cloud service providers who comply with the STAR program framework and agree to publish documentation on the STAR website attesting to compliance

“STAR framework is a composite of various standards, regulations, and statutory requirements from around the world, covering a variety of IT security. Three tiers

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

Three Tiers of STAR Framework

A

Tier 1. Only requires vendor self-assessment, uses CAIQ

Tier 2. Assessment of the organization by an external auditor certified by CSA to perform CAIQ audits

Tier 3. will require continuous monitoring of the target organization by independent, certified entities

31
Q

Due Care

A

“a legal concept pertaining to the duty owed by a provider to a customer. In essence, a vendor has to engage in a reasonable manner so as not to endanger the customer: the vendor’s products/services should deliver what the customer expects, without putting the customer at risk of undue harm.”

32
Q

Due Diligence

A

“is any activity used to demonstrate or provide due care. Using the previous example, the car vendor might engage in due diligence activities such as quality control testing (sampling cars that come off the production line for construction/assembly defects), subjecting itself to external safety audit, prototype and regular safety testing”

33
Q

Samples of Types of Vulnerabilities

A
  1. Software
  2. Physical
  3. Personnel
34
Q

Two Risk Analysis Categories

A

Qualitative, Quantitative

35
Q

Define Qualitative

A

A subjective approach to risk analysis. The organization should opt for this method when the organization does not have a sufficient availability of time, budget, or personnel trained in risk analysis to put toward the effort.

36
Q

Define Quantitative

A

An objective approach to risk analysis; the quantitative method should produce objective, discrete numeric values. The organization should opt for this method when it has sufficient time, budget, and personnel trained in risk analysis to put toward the effort.

37
Q

General Risk Management Options

A

Avoidance, Acceptance, Mitigation, Transference

38
Q

Remaining risk after risk management efforts is called

A

Residual risk

39
Q

ALE

A

Annual Loss Expectancy
(ex. if ARO is 1000 and SLE is 5 then;
ALE = 1000*5; ALE = 5000)

40
Q

SLE

A

Single Loss Expectancy

ex. a single incident you expect $5 in loss

41
Q

ARO

A

Annual (annualized) Rate of Occurrence

42
Q

What is the loss expectancy model (equation)

A

ALE = ARO * SLE

43
Q

EF

A

Exposure Factor

44
Q

AV

A

Asset Value

45
Q

how is SLE calculated

A

SLE = AV * EF

46
Q

Define ARO

A

Number of times per year a given impact is expected expressed as a number.

(ex1. 1000 events in the course of a yr is 1000/1; is 1000)
(ex. once every 50 years is 1/50 so; ARO = .02)

47
Q

Define Defense in Depth (Layered Defense)

A

Using multiple types of security controls to prevent single failures, and improve likelihood to stop attacks

48
Q

SCA

A

Security Control Assessment

49
Q

Define SCA

A

“a plan and process for determining the proper function and management of controls is necessary and should be customized to the needs of the organization. This is very similar to an audit with specific focus on security controls and includes performance of those controls”

50
Q

Control Assessment Techniques

A

Vulnerability Assessment

Penetration Test

51
Q

What NIST Special Publication is 800-37

A

RMF (publication)

52
Q

S.T.R.I.D.E

A 
Spoofing
Tampering
Repudiation
Information Disclosure
Denial of Service
Escalation of Privilege's
53
Q

What are the Threat Modeling Concepts

A

STRIDE, DREAD, MART

54
Q

D.R.E.A.D.

A 
Damage
Reproducibility
Exploitability
Affected
Discoverability
55
Q

M.A.R.T.

A

Mitigate
Accept
Reject
Transfer

56
Q

SLA

A

Service Level Agreement

57
Q

GDPR

A

General Data Protection Regulation

58
Q

Define GDPR

A

European Union privacy protection Act

59
Q

Define HIPPA

A

American federal law that impacts medical privacy

60
Q

GLBA Graham-Leach-Bliley Act

A

US law that allows banks to merge with insurance providers for information

61
Q

Sarbanes-Oxley Act (SOX)

A

Law created to regulate fraud prevention and finances of publicly traded companies

62
Q

FISMA Federal Information Systems Management Act

A

Law applicable only to federal government to comply with NIST

63
Q

Computer Related Crimes

A 
Malware
Unauthorized Access
Ransomware
Theft
Illegal Use of Source (botnet, DDOS attacks)
Fraud
64
Q

Intangible Assets are called

A

Intellectual Property

65
Q

Modern Forms Of Licensing Include

A

Site Licensing
Per-seat Licensing
Shareware
Public Domain

66
Q

DRM

A

Digital Rights Management

67
Q

DRM Traits

A

Persistency, Dynamic policy control, Automatic expiration, continuous audit trail, interoperability

68
Q

Define Import/Export Controls

A

The controls to limit and monitor the Trans border passing of data, software and hardware. Protects US interest and intellectual property

69
Q

As of 2018, does US Adhere to GDPR

A

No

70
Q

Types of Laws

A 
Criminal, 
Civil, 
Administrative, 
comprehensive crime act (1984)
Computer Fraud and Abuse act (1986)
Computer Security Act (1987)
Gov information security reform act (2000)
Federal information security Management Act (2002)
71
Q

Types of Intellectual Property

A 
Copyright
Trademarks
Patents
Trade Secrets
Licensing
72
Q

6 steps of Risk Management Framework

A
  1. Categorize information systems
  2. Select security controls
  3. Implement security controls
  4. Assess controls
  5. Authorize system
  6. Monitor controls
73
Q

Risk Value Equation

A

Risk Value = Probability * Impact

74
Q

Security Governances

A 
ISO 27000 Series
COBIT 
COSO
OCTAVE
ITIL

CISSP (13 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions