Domain 1 Flashcards
ISC2 Code of Ethics
PAPA
Protect society, the commonwealth,
and the infrastructure
Act honorably, honestly, justly,
responsibly, and legally
Provide diligent and competent
service to principals
Advance and protect the profession
Types of Security Planning
Strategic. Long term, stable plan that should include a risk assessment. (5-yr horizon, annual updates)
Tactical. Midterm plan developed to provide more details on goals of the strategic plan. (usually ~1 year)
Operational. Short term, highly detailed plan based on the strategic and tactical plans. (monthly, quarterly)
Primary Risk Management Framework
NIST 800-37 RMF
Other RMFs
OCTAVE
operationally critical threat, asset, and
vulnerability evaluation
FAIR
Factor Analysis of Information Risk
TARA
Threat Agent Risk Assessment
6 Steps of NIST 800-37 RMF
P CSIAAM Prepare to execute the RMF 1. Categorize information systems 2. Select security controls 3. Implement security controls 4. Assess the security controls 5. Authorize the system 6. Monitor security controls
Types of Risk
Residual - (AFTER)The risk that remains even with all conceivable safeguards in place.
Inherent - (BEFORE)Newly identified risk not yet addressed with risk management strategies.
Total - (WITHOUT)The amount of risk an organization would face if no safeguards were implemented.
Risk Formula
Threat * Vulnerability
Types of Risk Analysis
Quantitative - Assigns a dollar value to evaluate effectiveness of countermeasures
Qualitative - Uses a scoring system to rank threats and effectiveness of countermeasures
Delphi Technique - An anonymous feedback-and-response process used to arrive at a consensus.
Risk Analysis Steps
The six major steps in quantitative risk analysis
1. Inventory assets and assign a value (asset value, or AV).
2. Identify threats. Research each asset and produce a list of all
possible threats of each asset. (and calculate EF and SLE)
3. Perform a threat analysis to calculate the likelihood of each threat
being realized within a single year. (the ARO)
4. Estimate the potential loss by calculating the annualized loss
expectancy (ALE).
5. Research countermeasures for each threat, and then calculate the
changes to ARO and ALE based on an applied countermeasure.
6. Perform a cost/benefit analysis of each countermeasure for each
threat for each asset.
Loss Potential
What would be lost if the threat agent is
successful in exploiting a vulnerability.
Delayed loss
This is the amount of loss that can occur
over time.
Quantitative Formula Terms
exposure factor (EF) single loss expectancy (SLE) annualized rate of occurrence (ARO) annualized loss expectancy (ALE) Safeguard evaluation
Controls Gap
The amount of risk reduced by
implementing safeguards
total risk - controls gap = residual risk
Supply Chain Evaluation
On Site Assessment. Visit organization, interview personnel, and observe their operating habits.
Document Exchange and Review. Investigate dataset and doc exchange, review processes
Process/Policy Review. Request copies of their security policies, processes, or procedures.
Third party Audit. Having an independent auditor provide an unbiased review of an entity’s security infrastructure
Threat Modeling Focuses on 3 Approaches
Focused on Assets. Uses asset valuation results to identify threats to the valuable assets.
Focused on Attackers. Identify potential attackers and identify threats based on the attacker’s goals.
Focused on Software. Considers potential threats against the software the org develops.
Threat Modeling STRIDE
Microsoft
Spoofing Tampering Repudiation Information disclosure Denial of service Elevation of privilege
