Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CISSP 2021 > Domain 1 - Chapter 1 - Security Governance Through Principles & Policies > Flashcards

Domain 1 - Chapter 1 - Security Governance Through Principles & Policies Flashcards

1
Q

What are the primary goals and objectives of a security infrastructure?

A

Confidentiality, integrity, and availability.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What is confidentiality?

A

Protection of the secrecy of data, objects, or resources.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What are the concepts, conditions, and aspects of confidentiality?

A

Sensitivity, discretion, criticality, concealment, secrecy, privacy, seclusion, & isolation.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What is integrity?

A

Protecting the reliability and correctness of data.

Prevents unauthorized alterations of data.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What is integrity is dependent on?

A

Confidentiality and access control

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What are the concepts, conditions, and aspects of integrity?

A

Accuracy, truthfulness, validity, accountability, responsibility, completeness, & comprehensiveness.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What is availability?

A

Principles that authorized subjects are granted timely and uninterrupted access to objects.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What is availability is dependent on?

A

Integrity and confidentiality

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What are the concepts, conditions, and aspects of availability?

A

Usability, accessibility, timeliness.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What is the opposite of the CIA Triad?

A

DAD
Disclosure, alteration, & destruction
DAD triad represents the failures of security protections in the CIA Triade.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Overprotecting confidentiality can result in?

A

Restriction of availability

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Overprotecting integrity can result in?

A

Restriction of availability

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Overproviding in availability can result in?

A

Loss of confidentiality and integrity

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What is the core security mechanisms for all security environments?

A

IAAAA
Identification - Claiming to be an identity when attempting access to a secured area or system

Authentication - Proving that you are that claimed identity

Authorization - Defining permissions of a resource and object access

Auditing - Recording log events and activities related to systems and objects

Accounting - Reviewing log files to check for compliance and violations.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What are four types of protection mechanisms?

A

Defense in depth

Abstraction

Data Hiding

Encryption

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What is security governance?

A

Collection of practices related to supporting, evaluating, defining, and directing the security elements of a organization.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Who is responsible for security management?

A

Upper Management

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What is the length of time for a strategic plan?

A

Long-term plan that is fairly stable. ~5 years

19
Q

What is the length of time for a tactical plan?

A

Mid-term plan developed to provide more details on a accomplishing the goals set forth in the strategic plan. ~1 year

20
Q

What is the length of time for an operational plan?

A

Short-term plan that is highly detailed based on strategic and tactical plans. ~Monthly or Quarterly

21
Q

Security governance should address ______ ?

A

every aspect of an organization, including the organizational processes of acquisitions, divestitures, and governance committees.

22
Q

What processes should be considered when evaluating a third party security integration?

A

On-site assessment
Document Exchange Review
Process/Policy Review
Third-Party Review

23
Q

What is a security role?

A

The part an individual plays in the overall scheme of security implementations and administration within an organization.

24
Q

List common security roles present in a typical secured environment?

A

Senior Manager -

Security Professional -

Asset Owner -

Custodian -

User -

25
Q

What is COBIT?

A

Control Objectives for Information and Related Technology (COBIT). A documented set of best IT security practices crafted by the Information Systems Audit and Control Association (ISACA).

26
Q

COBIT is based on how many key principles?

A

Six

27
Q

List the six principles that COBIT it based on?

A 
Provide Stakeholder Value
Holistic Approach
Dynamic Governance System
Governance Distinct from Management 
Tailored to Enterprise Needs
End-to-End Governance System
28
Q

List common frameworks for security?

A

NIST 800-53 Security and Privacy Controls for Information Systems and Organizations

The Center for Internet Security

NIST Risk Management Framework (RMF)

NIST Cybersecurity Framework (CSF)

International Organization for Standardization (ISO)

Information Technology Infrastructure Library (ITIL)

29
Q

What is due care?

A

Continued application of security structure onto the IT infrastructure of an organization.

30
Q

What is due diligence?

A

Establishing a plan, policy, and the processes to protect the interests of an organization.

31
Q

What is a security policy?

A

A document that defines the scope of security needed by the organization and discusses the assets that require protection.

32
Q

What is a baseline?

A

Minimum level of security that every system throughout the organization must meet.

33
Q

What are guidelines as it relates to policy?

A

Guidelines offer recommendations on how standards and baselines are implemented and serves as an operational guide for both security professionals and users.

34
Q

What is threat modeling?

A

Security process where potential threats are identified, categorized, and analyzed. Threat modeling identifies the potential harm, the probability of occurrence, the priority of concern, and the means to eradicate or reduce the threat.

35
Q

List common threat model guides.

A

Microsoft STRIDE
PASTA
VAST

36
Q

Microsoft threat model?

A 
STRIDE
Spoofing 
Tampering
Repudiation
Information Disclosure
Denial of Service (DoS)
Elevation of privilege
37
Q

Seven-stage Threat Model?

Risk centric model

A

PASTA - seven-stage threat model designed to be a risk-centric approach.

Stage I - Definition of the Objectives (DO) for the Analysis (ADA)

Stage II - Definition of Technical Scope (DTS)

Stage III - Application Decomposition and Analysis (ADA)

Stage IV - Threat Analysis (AT)

Stage V - Weakness and Vulnerability Analysis (WVA)

Stage VI - Attack Modeling & Simulation (AMS)

Stage VII - Risk Analysis & Management (RAM)

38
Q

Threat Model - Agile

A

VAST
Visual
Agile
Simple Threat

39
Q

Technique used to rank or rate threats?

A 
DREAD
Damage Potential 
Reproducibility
Exploitability
Affected Users
Discoverability
40
Q

Explain how identification works

A

Process by which a subject professes an identity and accountability and accountability is initiated.

41
Q

What is a security boundary?

A

The line of intersection between any two areas, subnets, or environments that have different security requirements or needs.

42
Q

What is a business case?

A

A documented agreement or stated position in order to define a need to make a decision or take some form of action.

43
Q

Security management planning steps…

A

Strategic
Tactical
Operational

44
Q

What are the elements of a formalized security policy structure?

A 
Security Policy
Standards
Baselines
Guidelines
Procedures

CISSP 2021 (6 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions