Domain 1 Flashcards
Security and Risk Management (e.g., Security, Risk, Compliance, Law, Regulations, Business Continuity)
Confidentiality
Seeks to prevent the unauthorized disclosure of information: it keeps data secret
Integrity
Seeks to prevent unauthorized modification of information. In other words, integrity seeks to prevent unauthorized write access to data. Integrity also seeks to ensure data that is written in an authorized manner is complete and accurate.
Availability
Ensures that information is available when needed
Subject
An active entity on an information system
Object
A passive data file
Annualized Loss Expectancy
The cost of loss due to a risk over a year
Threat
A potentially negative occurrence
Vulnerability
A weakness in a system
Risk
A matched threat and vulnerability
Safeguard
A measure taken to reduce risk
Total Cost of Ownership
The cost of a safeguard
Return on Investment
Money saved by deploying a safeguard
Disclosure
Unauthorized release of information
Alteration
The unauthorized modification of data
Destruction
Making systems or data unavailable
Authentication
The act of proving an assertion, such as the identity of a computer system user.
Authorization
Actions you can perform on a system once you have been identified and authenticated
Accountability
Holds users accountable for their actions
Non-repudiation
A user cannot deny (repudiate) having performed a transaction.
Least privilege
Users should be granted the minimum amount of access (authorization) required to do their jobs, but no more.
Need to know
more granular than least privilege: the user must need to know that specific piece of information before accessing it.
Defense-in-Depth
Applies multiple safeguards (also called controls: measures taken to reduce risk) to protect an asset.
Due care
Doing what a reasonable person would do.
Due diligence
The management of due care.
Gross negligence
The opposite of due care. Doing what a unreasonable person would do.
Civil Law (Legal System)
The system of civil law leverages codified laws
or statutes to determine what is considered within the bounds of law.
Common Law
The legal system used in the United States, Canada, the United Kingdom, and most former British colonies, amongst others.
Religious Law
Religious doctrine or interpretation serves as a source of legal understanding and statutes.
Criminal Law
Pertains to those laws where the victim can be seen as society itself.
Civil Law
The victim will be an individual, group, organization.
Statutory
Statutory damages are those prescribed by law, which can be awarded to the victim even if the victim incurred no actual loss or injury
Compensatory
The purpose of compensatory damages is to provide the victim with a financial award in effort to compensate for the loss or injury incurred as a direct result of the wrongdoing.
Punitive
The intent of punitive damages is to punish an individual or organization. These damages are typically awarded to attempt to discourage a particularly egregious violation where the compensatory or statutory damages alone would not act as a
deterrent.
Administrative law or regulatory law
law enacted by government agencies. Think FCC Regulations, HIPAA Security mandates, FDA regulations and FAA regulations.
