Domain 1 - Chapter 1 - Security Governance Through Principles & Policies Flashcards
What are the primary goals and objectives of a security infrastructure?
Confidentiality, integrity, and availability.
What is confidentiality?
Protection of the secrecy of data, objects, or resources.
What are the concepts, conditions, and aspects of confidentiality?
Sensitivity, discretion, criticality, concealment, secrecy, privacy, seclusion, & isolation.
What is integrity?
Protecting the reliability and correctness of data.
Prevents unauthorized alterations of data.
What is integrity is dependent on?
Confidentiality and access control
What are the concepts, conditions, and aspects of integrity?
Accuracy, truthfulness, validity, accountability, responsibility, completeness, & comprehensiveness.
What is availability?
Principles that authorized subjects are granted timely and uninterrupted access to objects.
What is availability is dependent on?
Integrity and confidentiality
What are the concepts, conditions, and aspects of availability?
Usability, accessibility, timeliness.
What is the opposite of the CIA Triad?
DAD
Disclosure, alteration, & destruction
DAD triad represents the failures of security protections in the CIA Triade.
Overprotecting confidentiality can result in?
Restriction of availability
Overprotecting integrity can result in?
Restriction of availability
Overproviding in availability can result in?
Loss of confidentiality and integrity
What is the core security mechanisms for all security environments?
IAAAA
Identification - Claiming to be an identity when attempting access to a secured area or system
Authentication - Proving that you are that claimed identity
Authorization - Defining permissions of a resource and object access
Auditing - Recording log events and activities related to systems and objects
Accounting - Reviewing log files to check for compliance and violations.
What are four types of protection mechanisms?
Defense in depth
Abstraction
Data Hiding
Encryption
What is security governance?
Collection of practices related to supporting, evaluating, defining, and directing the security elements of a organization.
Who is responsible for security management?
Upper Management
What is the length of time for a strategic plan?
Long-term plan that is fairly stable. ~5 years
What is the length of time for a tactical plan?
Mid-term plan developed to provide more details on a accomplishing the goals set forth in the strategic plan. ~1 year
What is the length of time for an operational plan?
Short-term plan that is highly detailed based on strategic and tactical plans. ~Monthly or Quarterly
Security governance should address ______ ?
every aspect of an organization, including the organizational processes of acquisitions, divestitures, and governance committees.
What processes should be considered when evaluating a third party security integration?
On-site assessment
Document Exchange Review
Process/Policy Review
Third-Party Review
What is a security role?
The part an individual plays in the overall scheme of security implementations and administration within an organization.
List common security roles present in a typical secured environment?
Senior Manager -
Security Professional -
Asset Owner -
Custodian -
User -
What is COBIT?
Control Objectives for Information and Related Technology (COBIT). A documented set of best IT security practices crafted by the Information Systems Audit and Control Association (ISACA).
COBIT is based on how many key principles?
Six
List the six principles that COBIT it based on?
Provide Stakeholder Value Holistic Approach Dynamic Governance System Governance Distinct from Management Tailored to Enterprise Needs End-to-End Governance System
List common frameworks for security?
NIST 800-53 Security and Privacy Controls for Information Systems and Organizations
The Center for Internet Security
NIST Risk Management Framework (RMF)
NIST Cybersecurity Framework (CSF)
International Organization for Standardization (ISO)
Information Technology Infrastructure Library (ITIL)
What is due care?
Continued application of security structure onto the IT infrastructure of an organization.
What is due diligence?
Establishing a plan, policy, and the processes to protect the interests of an organization.
What is a security policy?
A document that defines the scope of security needed by the organization and discusses the assets that require protection.
What is a baseline?
Minimum level of security that every system throughout the organization must meet.
What are guidelines as it relates to policy?
Guidelines offer recommendations on how standards and baselines are implemented and serves as an operational guide for both security professionals and users.
What is threat modeling?
Security process where potential threats are identified, categorized, and analyzed. Threat modeling identifies the potential harm, the probability of occurrence, the priority of concern, and the means to eradicate or reduce the threat.
List common threat model guides.
Microsoft STRIDE
PASTA
VAST
Microsoft threat model?
STRIDE Spoofing Tampering Repudiation Information Disclosure Denial of Service (DoS) Elevation of privilege
Seven-stage Threat Model?
Risk centric model
PASTA - seven-stage threat model designed to be a risk-centric approach.
Stage I - Definition of the Objectives (DO) for the Analysis (ADA)
Stage II - Definition of Technical Scope (DTS)
Stage III - Application Decomposition and Analysis (ADA)
Stage IV - Threat Analysis (AT)
Stage V - Weakness and Vulnerability Analysis (WVA)
Stage VI - Attack Modeling & Simulation (AMS)
Stage VII - Risk Analysis & Management (RAM)
Threat Model - Agile
VAST
Visual
Agile
Simple Threat
Technique used to rank or rate threats?
DREAD Damage Potential Reproducibility Exploitability Affected Users Discoverability
Explain how identification works
Process by which a subject professes an identity and accountability and accountability is initiated.
What is a security boundary?
The line of intersection between any two areas, subnets, or environments that have different security requirements or needs.
What is a business case?
A documented agreement or stated position in order to define a need to make a decision or take some form of action.
Security management planning steps…
Strategic
Tactical
Operational
What are the elements of a formalized security policy structure?
Security Policy Standards Baselines Guidelines Procedures
