Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CISSP > Domain 1 > Flashcards

Domain 1 Flashcards

1
Q

DAD

A

(disclosure alteration and destruction)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Confidentiality

A

prevent unauthorized disclosure, need to know, and least privilege. assurance that information is not disclosed to unauthorized programs, users, processes, encryption, logical and physical access control,

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Integrity

A

no unauthorized modifications, consistent data, protecting data or a resource from being altered in an unauthorized fashion

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Availability

A

reliable and timely, accessible, fault tolerance and recovery procedures, WHEN NEEDED

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

IAAA

A

Requirements for accountability
Identification - user claims identity, used for user access control
Authentication - testing of evidence of users identity
Accountability - determine actions to an individual person
Authorization - rights and permissions granted

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Privacy

A

level of confidentiality and privacy protections

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Risk

A

Not possible to get rid of all risk.
Get risk to acceptable/tolerable level Baselines – minimum standards
ISO 27005 – risk management framework Budget – if not constrained go for the $$$

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Responsibilities of the ISO

A

Written Products – ensure they are done CIRT – implement and operate
Security Awareness – provide leadership Communicate – risk to higher management Report to as high a level as possible Security is everyone’s responsibility

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Control Frameworks

A 
Consistent – approach & application
Measurable – way to determine progress
Standardized – all the same
Comprehension – examine everything
Modular – to help in review and adaptive. Layered, abstraction
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Due Care

A

Which means when a company did all that it could have reasonably done to try and prevent security breach / compromise / disaster, and took the necessary steps required as countermeasures / controls (safeguards). The benefit of “due care” can be seen as the difference between the damage with or without “due care” safeguards in place. AKA doing something about the threats, Failing to perform periodic security audits can result in the perception that due care is not being maintained

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Due Diligence

A

means that the company properly investigated all of its possibly weaknesses and vulnerabilities AKA understanding the threats

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Patent

A

grants ownership of an invention and provides enforcement for owner to exclude others from practicing the invention. After 20 years the idea is open source of application

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Copyright

A

protects the expression of ideas but not necessarily the idea itself ex. Poem, song @70 years after author dies

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Trade Secret

A

something that is propriety to a company and important for its survival and profitability (like formula of Coke or Pepsi) DON’T REGISTER – no application

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Trademarks

A

words, names, product shape, symbol, color or a combination used to identify products and distinguish them from competitor products (McDonald’s M) @10 years

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Wassenaar Arrangement (WA)

A

Dual use goods & trade, International cryptographic agreement, prevent destabilizing

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Computer Crimes

A

loss, image, penalties

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Regulations

A

SOX, Sarbanes Oxley, 2002 after ENRON and World Online debacle Independent review by external accountants.
Section 302: CEO’s CFO’s can be sent to jail when information they sign is incorrect. CEO SIGN
Section 404 is the about internal controls assessment: describing logical controls over accounting files; good auditing and information security.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Corporate Officer Liability (SOX)

A

Executives are now held liable if the organization they represent is not compliant with the law.
Negligence occurs if there is a failure to implement recommended precautions, if there is no contingency/disaster recovery plan, failure to conduct appropriate background checks, failure to institute appropriate information security measures, failure to follow policy or local laws and regulations.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

COSO

A

framework to work with Sarbanes-Oxley 404 compliance European laws: TREADWAY COMMISSION
Need for information security to protect the individual.
Privacy is the keyword here! Only use information of individuals for what it was gathered for
(remember ITSEC, the European version of TCSEC that came from the USA/Orange Book, come together in Common Criteria, but there still is some overlap)
• strong in anti-spam and legitimate marketing
• Directs public directories to be subjected to tight controls • Takes an OPT-IN approach to unsolicited commercial
electronic communications
• User may refuse cookies to be stored and user must be
provided with information
• Member states in the EU can make own laws e.g. retention of data

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

COBIT

A

examines the effectiveness, efficiency, confidentiality, integrity, availability, compliance, and reliability of high level control objectives. Having controls, GRC heavy auditing, metrics, regulated industry

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Incident

A

an event that has potential to do harm

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Breach

A

incident that results in disclosure or potential disclosure of data

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Data Disclosure

A

unauthorized acquisition of personal information

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

Event

A

Threat events are accidental and intentional exploitations of vulnerabilities.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

ITAR, 1976.

A

Defense goods, arms export control act FERPA– Education

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

GLBA

A

Graham, Leach, Bliley; credit related PII (21)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

ECS

A

Electronic Communication Service (Europe); notice of breaches

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

Fourth Amendment

A

basis for privacy rights is the Fourth Amendment to the Constitution.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

1974 US Privacy Act

A

Protection of PII on federal databases

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

1980 Organization for Economic Cooperation and Development (OECD)

A

Provides for data collection, specifications, safeguards

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

1986 (amended in 1996) US Computer Fraud and Abuse Act

A

Trafficking in computer passwords or information that causes a loss of $1,000 or more or could impair medical treatment.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

1986 Electronic Communications Privacy Act

A

Prohibits eavesdropping or interception w/o distinguishing private/public

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

Communications Assistance for Law Enforcement Act (CALEA) of 1994

A

amended the Electronic Communications Privacy Act of 1986. CALEA requires all communications carriers to make wiretaps possible for law enforcement with an appropriate court order, regardless of the technology in use

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

1987 US Computer Security Act

A

Security training, develop a security plan, and identify sensitive systems on govt. agencies.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

1991 US Federal Sentencing Guidelines

A

Responsibility on senior management with fines up to $290 million. Invoke prudent man rule. Address both individuals and organizations

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

1996 US Economic and Protection of Propriety Information Act

A

industrial and corporate espionage

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

1996 Health Insurance and Portability Accountability Act (HIPPA) – amended

A

Amended

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

1996 US National Information Infrastructure Protection

Act

A

Encourage other countries to adopt similar framework.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
40
Q

Health Information Technology for Economic and Clinical Health Act of 2009 (HITECH)

A

Congress amended HIPAA by passing this Act. This law updated many of HIPAA’s privacy and security requirements. One of the changes is a change in the way the law treats business associates (BAs), organizations who handle PHI on behalf of a HIPAA covered entity. Any relationship between a covered entity and a BA must be governed by a written contract known as a business associate agreement (BAA). Under the new regulation, BAs are directly subject to HIPAA and HIPAA enforcement actions in the same manner as a covered entity. HITECH also introduced new data breach notification requirements

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
41
Q

Ethics

A

Just because something is legal doesn’t make it right.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
42
Q

ISC2 Code of Ethics Canons

A

Protect society, the commonwealth, and the infrastructure.

  • Act honorably, honestly, justly, responsibly, and legally.
  • Provide diligent and competent service to principals.
  • Advance and protect the profession.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
43
Q

(IAB)

A

Internet Advisory Board

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
44
Q

Ethics and Internet (RFC 1087)

A

Don’t compromise the privacy of users. Access to and use of Internet is a privilege and should be treated as such
It is defined as unacceptable and unethical if you, for example, gain unauthorized access to resources on the internet, destroy integrity, waste resources or compromise privacy.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
45
Q

Business Continuity plans development

A

Defining the continuity strategy
- Computing strategy to preserve the elements of HW/SW/
communication lines/data/application
- Facilities: use of main buildings or any remote facilities
People: operators, management, technical support persons Supplies and equipment: paper, forms HVAC
Documenting the continuity strategy

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
46
Q

BIA

A

Goal: to create a document to be used to help understand what impact a disruptive event would have on the business

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
47
Q

Gathering assessment material

A

Org charts to determine functional relationships

- Examine business success factors

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
48
Q

Vulnerability assessment

A

Identify Critical IT resources out of critical processes, Identify disruption impacts and Maximum, Tolerable Downtime (MTD)

  • Loss Quantitative (revenue, expenses for repair) or Qualitative (competitive edge, public embarrassment). Presented as low, high, medium.
  • Develop recovery procedures
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
49
Q

Analyze the compiled information

A

Document the process Identify inter- dependability

  • Determine acceptable interruption periods
  • Documentation and Recommendation
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
50
Q

RTO

A

MTD

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
51
Q

Separation of duties

A

assigns parts of tasks to different individuals thus no single person has total control of the
system’s security mechanisms; prevent collusion

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
52
Q

M of N Control

A

requires that a minimum number of agents (M) out of the total number of agents (N) work together to perform high-security tasks. So, implementing three of eight controls would require three people out of the eight with the assigned work task of key escrow recovery agent to work together to pull a single key out of the key escrow database

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
53
Q

Least privilege

A

a system’s user should have the lowest level of rights and privileges necessary to perform their work and should only have them for the shortest time. Three types:
Read only, Read/write and Access/change

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
54
Q

Two-man control

A

two persons review and approve the work of each other, for very sensitive operations

55
Q

Dual Control

A

two persons are needed to complete a task

56
Q

Rotation of Duties

A

limiting the amount of time a person is assigned to perform a security related task before being moved to different task to prevent fraud; reduce collusion

57
Q

Mandatory vacations

A

prevent fraud and allowing investigations, one week minimum; kill processes

58
Q

Need to Know

A

the subject is only given the amount of information required to perform an assigned task, business justification

59
Q

Agreements

A

NDA, no compete, acceptable use

60
Q

Employment

A

staff members pose more threat than external actors, loss of money stolen equipment, loss of time work hours, loss of reputation declining trusts and loss of resources, bandwidth theft, due diligence
Voluntary & involuntary ——————Exit interview!!!

61
Q

Third Party Controls

A

Vendors
- Consultants
- Contractors
Properly supervised, rights based on policy

62
Q

Threat

A

damage

63
Q

Vulnerability

A

weakness to threat vector (never does anything)

64
Q

Likelihood

A

chance that it will happen

65
Q

Impact

A

overall effects

66
Q

Residual Risk

A

amount of leftover
Organizations own the risk
Risk is determined as a byproduct of likelihood and impact

67
Q

ITIL

A

best practices for IT core operational processes, not for audit
- Service
- Change
- Release
- Configuration
Strong end to end customer focus/expertise About services and service strategy

68
Q

Risk Management (GOAL)

A

Determine impact of the threat and risk of threat occurring The primary goal of risk management is to reduce risk to an acceptable level.
Step 1 – Prepare for Assessment (purpose, scope, etc.)
Step 2 – Conduct Assessment
- ID threat sources and events
- ID vulnerabilities and predisposing conditions
- Determine likelihood of occurrence
- Determine magnitude of impact
- Determine risk
Step 3 – Communicate Risk/results
Step 4 – Maintain Assessment/regularly

69
Q

Types of Risk

A

Inherent chance of making an error with no controls in place Control chance that controls in place will prevent, detect or control errors
Detection chance that auditors won’t find an error
Residual risk remaining after control in place
Business concerns about effects of unforeseen circumstances
Overall combination of all risks aka Audit risk

70
Q

Preliminary Security Examination (PSE

A

Helps to gather the elements that you will need when the actual Risk Analysis takes place.

71
Q

ANALYSIS

A

Steps: Identify assets, identify threats, and calculate risk.

72
Q

ISO 27005

A

deals with risk

73
Q

Risk Assessment Steps

A

Four major steps in Risk assessment? Prepare, Perform, Communicate, Maintain

74
Q

Qualitative

A 
Approval –
Form Team –
Analyze Data –
Calculate Risk –
Countermeasure Recommendations -
REMEMBER HYBRID!
75
Q

Quantitative Risk Analysis

A

Quantitative VALUES!!
- SLE (single Loss Expectancy) = Asset Value * Exposure
factor (% loss of asset)
- ALE (Annual loss expectancy) = SLE * ARO
(Annualized Rate of occurrence)
Accept, mitigate(reduce by implementing controls calculate costs-), Assign (insure the risk to transfer it), Avoid (stop business activity) Loss= probability * cost

76
Q

Residual risk

A

where cost of applying extra countermeasures is more than the estimated loss resulting from a threat or vulnerability (C > L). Legally the remaining residual risk is not counted when deciding whether a company is liable.

77
Q

Controls gap

A

is the amount of risk that is reduced by implementing safeguards. A formula for residual risk is as follows: total risk – controls gap = residual risk

78
Q

RTO

A

how quickly you need to have that application’s information available after downtime has occurred

79
Q

RPO

A

Recovery Point Objective: Point in time that application data must be recovered to resume business functions; AMOUNT OF DATA YOUR WILLING TO LOSE

80
Q

MTD

A

Maximum Tolerable Downtime: Maximum delay a business can be down and still remain viable
MTD minutes to hours: critical MTD 24 hours: urgent
MTD 72 hours: important MTD 7 days: normal
MTD 30 days non-essential

81
Q

PLAN

A

Accept
Build Risk Team
Review

82
Q

Once in 100 years =

A

ARO of 0.01

83
Q

SLE is also

A

the dollar value lost when an asset is successfully attacked

84
Q

Exposure Factor ranges from

A

0 to 1

85
Q

ALE

A

is the annual % of the asset lost when attacked

86
Q

Determination of Impact

A

Life, dollars, prestige, market share

87
Q

Risk Avoidance

A

discontinue activity because you don’t want to accept risk

88
Q

Risk Transfer

A

passing on the risk to another entity

89
Q

Risk Mitigation

A

elimination or decrease in level of risk

90
Q

Risk Acceptance

A

live with it and pay the cost

91
Q

Background checks

A

mitigation, acceptance, avoidance

92
Q

Risk Framework Countermeasures

A 
Accountability
- Auditability
- Source trusted and known
- Cost-effectiveness
- Security
- Protection for CIA of assets
- Other issues created?
If it leaves residual data from its function
93
Q

Primary Controls (Types)

A

(control cost should be less than the value of the asset being protected)

94
Q

Administrative/Managerial Policy

A

Preventive: hiring policies, screening security awareness (also called soft-measures!)
- Detective: screening behavior, job rotation, review of audit records

95
Q

Technical (aka Logical)

A

Preventive: protocols, encryption, biometrics smartcards, routers, firewalls
- Detective: IDS and automatic generated violation reports, audit logs, CCTV(never preventative)
- Preventive: fences, guards, locks
- Detective: motion detectors, thermal detectors video
cameras

96
Q

Physical (Domain 5) – see and touch

A

Fences, door, lock, windows etc.

97
Q

Prime objective

A

is to reduce the effects of security threats and vulnerabilities to a tolerable level

98
Q

Risk analysis

A

process that analyses threat scenarios and produces a representation of the estimated Potential loss

99
Q

Main Categories of Access Control (67)

A

Directive: specify rules of behavior

  • Deterrent: discourage people, change my mind
  • Preventative: prevent incident or breach
  • Compensating: sub for loss of primary controls
  • Detective: signal warning, investigate
  • Corrective: mitigate damage, restore control
  • Recovery: restore to normal after incident
100
Q

Functional order in which controls should be used

A

Deterrence, Denial, Detection, Delay

101
Q

Testing a networks defenses by using the same techniques as external intruders means using

A

Scanning and Probing – port scanners
• Demon Dialing – war dialing for modems
• Sniffing – capture data packets
• Dumpster Diving – searching paper disposal areas
• Social Engineering – most common, get information by
asking

102
Q

Blue team

A

had knowledge of the organization, can be done frequent and least expensive

103
Q

Red team

A

is external and stealthy

104
Q

White Box

A

ethical hacker knows what to look for, see code as a developer

105
Q

Grey Box

A

partial knowledge of the system, see code, act as a user

106
Q

Black Box

A

ethical hacker not knowing what to find

107
Q

4 Stages

A

planning, discovery, attack, reporting

108
Q

vulnerabilities exploited

A

kernel flaws, buffer overflows, symbolic links, file descriptor attacks

109
Q

other PT model

A

footprint network (information gathering) port scans, vulnerability mapping, exploitation, report scanning tools are used in penetration tests

110
Q

flaw hypotheses methodology =

A

operation system penetration testing

111
Q

IF there is an Egregious hole

A

Tell them now !

112
Q

Strategies

A

External, internal, blind, double-blind

113
Q

Categories

A

zero, partial, full knowledge tests

114
Q

Plan

A

ID opportunity & plan for change

115
Q

Do

A

implement change on a small scale

116
Q

Check

A

use data to analyze results of change

117
Q

Act

A

if change successful, implement wider scale, if fails begin cycle again

118
Q

Identification of Threat

Individuals must be qualified with the appropriate level of training.

A 
Develop job descriptions
- Contact references
- Screen/investigate background
- Develop confidentiality agreements
- Determine policy on vendor, contractor, consultant, and
temporary staff access
DUE DILIGENCE
119
Q

Public domain

A

available for anyone to use

120
Q

Open source

A

source code made available with a license in which the copyright holder provides the rights to study, change, and distribute the software to anyone

121
Q

Freeware

A

source code made available with a license in which the copyright holder provides the rights to study, change, and distribute the software to anyone

122
Q

Assurance

A

Degree of confidence in satisfaction of security requirements Assurance = other word for security
THINK OUTSIDE AUDIT

123
Q

Successful Requirements Gathering

A

Don’t assume what client wants Involve users early

Define and agree on scope MORE

124
Q

Security Awareness

A

Technical training to react to situations, best practices for Security and network personnel; Employees, need to understand policies then use presentations and posters etc. to get them aware
Formal security awareness training – exact prep on how to do things

125
Q

Wire tapping

A

eavesdropping on communication -only legal with prior consent or warrant

126
Q

Data Diddling

A

act of modifying information, programs, or documents to commit fraud, tampers with INPUT data

127
Q

Privacy Laws

A

data collected must be collected fairly and lawfully and used only for the purpose it was collected.

128
Q

Water holing

A

create a bunch of websites with similar names

129
Q

Work Function

A

the difficulty of obtaining the clear text from the cipher text as measured by cost/time

130
Q

Fair Cryptosystems

A

In this escrow approach, the secret keys used in a communication are divided into two or more pieces, each of which is given to an independent third party. When the government obtains legal authority to access a particular key, it provides evidence of the court order to each of the third parties and then reassembles the secret key.

131
Q

SLA

A

agreement between IT service provider and customer, document service levels, divorce; how to dissolve relationship

132
Q

SLR

A

requirements for a service from client viewpoint

133
Q

Service Level Report

A

insight into a service providers ability to deliver the agreed upon service quality

134
Q

FISMA(federal agencies)

A

Phase 1 categorizing, selecting minimum controls, assessment Phase 2: create national network of secures services to assess

CISSP (2 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions