Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CISSP 2021 > Domain 1 - Chapter 2 - Personnel Security and Risk Management Concepts > Flashcards

Domain 1 - Chapter 2 - Personnel Security and Risk Management Concepts Flashcards

1
Q

What is the weakest element in any security solution?

A

Human

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What are job responsibilities?

A

Specific work tasks an employee is required to perform on a regular basis.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What is the removal of an employee’s identity from an Identity and Access Management system (IAM) system.

A

Offboarding

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

_______exists when several entities or organizations are involved in a project.

A

Multiparty risk

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What is a VMS?

A

Vendor Management System
A software solution that assists with the management and procurement of staffing services, hardware, software, and other needed products and services.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What is compliance?

A

The act of conforming to or adhering to rules, policies, regulations, standards, or requirements.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What is the detailed process of identifying factors that could damage or disclose assets, evaluating those factors in light of asset value and countermeasure cost, and implementing cost-effective solutions for mitigating or reducing risk.

A

Risk management

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What is risk assessment/risk analysis?

A

The examination of an environment for risks, evaluating each threat event as to its likelihood of occurring and the severity of the damager it would cause if it did occur.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What is risk response?

A

Involves evaluating countermeasures, safeguards, and security controls using a cost/benefit analysis;

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What is meat by risk awareness?

A

An effort to increase the knowledge of risk within an organization.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What is an asset?

A

Anything used in a business process or task.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What is asset valuation

A

Value assigned to an asset based on a number of factors to include importance to the organization, used in critical process, actual costs, and nonmonetary expenses/costs.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What is a threat?

A

Any potential occurrence that may cause an undesirable or unwanted outcome for an organization or for a specific asset is a threat.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What is a threat agent/actors?

A

Person or entity that intentionally exploit vulnerabilities.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What is a threat event?

A

Accidental occurrences and intentional exploitations of vulnerabilities. - Earthquakes, fires, human error, ….

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What is a vulnerabiity?

A

A weakness in asset or of the absence or the weakness of a safeguard or countermeasure. - loophole, flaw, oversight, error, limitation…

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What is exposure?

A

Being susceptible to asset loss because or a threat.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What is a risk?

A

The possibility or likelihood that a threat will exploit a vulnerability to cause harm to an asset and the severity of damage that could result.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Risk formula

A

risk = threat * vulnerability

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What is a safeguard?

A

Anything that removes or reduces a vulnerability or protects against one or more specific threats.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

What is an attack?

A

The intentional attempted exploitation of a vulnerability by a threat agent to cause damage, loss, or disclosure of assets.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

What is a breach?

A

Breach = Intrusion = Penetration

Occurrence of a security mechanism being bypassed or thwarted by a threat agent.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Threats exploit _____.

A

vulnerabilities

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Who is primarily responsible for risk management?

A

Upper Management

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

Identify two risk assessment types?

A

Quantitative and Qualitative

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

What are the six major elements of quantitative risk analysis?

A

Assign asset value (AV)
Calculate exposure factor (EF)
Calculate single loss expectancy (SLE)
Assess the annualized rate of occurrence (ARO)
Derive the annualized loss expectancy (ALE)
Perform cost/benefit analysis of countermeasures

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

What is Exposure Factor (EF)?

A

The percentage of loss that an organization would experience if a specific asset were violated by a realized risk.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

What is a Single Loss Expectancy (SLE)?

A

The potential loss associated with a single realized threat against a specific asset.

SLE = asset value (AV) * exposure factor (EF)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

What is a Single Loss Expectancy (SLE)?

A

The potential loss associated with a single realized threat against a specific asset.

SLE = asset value (AV) * exposure factor (EF)
SLE = AV * EF
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

Annualized Rate of Occurence

A

The expected frequency with which a specific threat or risk will occur within a SINGLE YEAR.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

Annualized loss Expectancy

A

The possible yearly loss of all instances of a specific realize threat against a specific asset.

ALE = single loss expectancy (SLE) * annualized rate of occurrence 
ALE = SLE * ARO
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

What is risk appetitie?

A

The total amount of risk that an organization willing to shoulder in aggregate across all assets.

33
Q

What is risk capacity?

A

The level of risk an organization is able to shoulder.

34
Q

What is risk tolerance?

A

The amount or the level of risk an organization will accept per individual asset-threat pair.

35
Q

What is risk limit?

A

The maximum level of risk above the risk target that will be tolerated before further risk management actions are taken.

36
Q

Risk responses?

A 
Risk Mitigation
Risk Assignment
Risk Deterrence 
Risk Avoidance 
Risk Acceptance
Risk Rejection
37
Q

Risk mitigation

A

Implementation of safeguards, security controls, and countermeasures to reduce and/or eliminate vulnerabilities or block threats.

Encryption; firewalls;

38
Q

Risk Assignment

A

The placement of the responsibility of loss due to a risk onto another entity or organization.

39
Q

Risk Detterence

A

The process of implementing deterrents to would-be violators or security and policy.

40
Q

Risk Avoidance

A

The process of selecting alternate options or activities that have less associated risk than the default, common, expedient, or cheap option.

41
Q

Risk Acceptance

A

The result after a cost/benefit analysis shows countermeasure costs would outweigh the possible cost of loss due to a risk. Management has agreed to accept the consequences and the loss if the risk is realized.

42
Q

Risk Rejection

A

Ignoring a risk can be considered negligence in court

43
Q

What are inherent risks?

A

Initial risk

44
Q

What are residual risks?

A

The risk that management has chose to accept rather than mitigate.

45
Q

What are total risk(s)?

A

The amount of risk an organization would face if no safeguards were implemented.

Total risk = threats * vulnerabilities * asset value

46
Q

What is the control gap?

A

The difference between total risk and residual risk; the amount of risk that is reduced by implementing safeguards.

Total risk - controls gap = residual risk

47
Q

What is ACS?

A

Annualized Cost of the Safeguard

48
Q

What is the cost/benefit calculation?

A

ALE pre-safeguard - ALE post safe-guard - annual cost of safeguard = value of the safeguard for the company.

(ALE1 - ALE2) - ACS

If the result is negative, the safeguard is not a financially responsible choice.

49
Q

Are policies and procedures defined by an organization’s security policy and other regulations or requirements….

A

Administrative controls

50
Q

The hardware or software mechanisms used to manage access and provide protection for IT resources and systems.

A

Technical/logical controls

51
Q

Protection to the facility and real-world objects.

A

Physical controls

52
Q

What are preventative controls?

A

Controls deployed to thwart or stop unwanted or unauthorized activity from occurring.
fence, locks, authentication, access control vestibules, alarm systems, encryption, auditing

53
Q

What are deterrent controls?

A

Deployed to discourage security policy violations.

policies, security awareness training, badges,

54
Q

What are detective controls?

A

Deployed to discover or detect unwanted or unauthorized activity.
security guards, CCTV, motion detectors, audit trails, IDS’s

55
Q

What are compensating controls?

A

Deployed to provide various options to other existing controls to aid in enforcement and support of security policies.

56
Q

What are corrective controls?

A

Modifies the environment to return systems to normal after an unwanted or unauthorized activity has occured

57
Q

What are recovery controls?

A

An extension of corrective controls but have more advanced or complex abilities. Attempts to repair or restore resources, functions, and capabilities after a security policy violation.

58
Q

What are directive controls?

A

Deployed to direct, confine, or control the actions of subjects to force or encourage compliance with security policies.

59
Q

What is a SCA?

A

Security Control Assessment

60
Q

What is a Security Control Assessment (SCA)?

A

The formal evaluation of a security infrastructure’s individual mechanisms against a baseline or reliability expectation.

61
Q

Goals of a SCA?

A

To ensure the effectiveness of the security mechanisms, evaluate the quality and thoroughness of the risk management processes of the organization, and produce a report of the relative strengths and weaknesses of the deployed security infrastructure.

62
Q

Security controls should provide benefits that can be ______and _____.

A

monitored; measured

63
Q

What is risk reporting?

A

A key task to perform at the conclusion of a risk analysis.

64
Q

What is a risk register/risk log?

A

A document that inventories all the identified risk to an organization or system or within an individual projects.

65
Q

What is an ERM?

A

Enterprise Risk Management program

An ERM assesses the key indicators and activities of a mature, sustainable, and repeatable risk management process.

66
Q

____ established the Risk Management Framework and the Cybersecurity Framework

A

NIST

67
Q

What is a risk framework?

A

A guideline for how risk is to be assessed, resolved, and monitored.

68
Q

Cybersecurity Framework is designed for ______?

A

Critical infrastructure and Commercial organizations

69
Q

CSF is based on framework core that consists of what five functions?

A 
Identify
Protect
Detect
Respond
Recover
70
Q

Risk Management Framework is designed for ____ ?

A

Federal Agencies

71
Q

List the six (seven) cyclical RMF phases?

A 
Prepare - 
Categorize
Implement
Assess
Authorize
Authorize
Monitor
72
Q

List social engineering types?

A 
Authority 
Intimidation 
Consensus
Scarcity
Familiarity
Trust 
Urgency
73
Q

What is whaling?

A

A form of spear phishing that targets specific high-value individuals (by title, by industry, from media coverage…) C-level executives

74
Q

What is smishing?

A

Spam over instant messaging

75
Q

What is vishing?

A

Voice-based phishing

76
Q

What is typo-squatting?

A

The practice of traffic redirected to a alternate website based on a mistyped character e.g. Googlee

77
Q

What is the Delphi technique?

A

An anonymous feedback and response process used to arrive at a consensus.

78
Q

NIST SP 800-37 Rev 2

A

RMF

79
Q

What is RMM?

A

Risk Maturity Model
A means to assess the key indicators and activities of a mature, sustainable, and repeatable risk management process.

Ad hoc - Chaotic starting point

Preliminary - Loose attempts at following risk management processes, but each dept may perform risk assessment uniquely

Defined - A common or standardized risk framework is adopted organization-wide

Integrated - Risk management operation are integrated into business processes, metrics are used to gather effectiveness data, and risk is considered an element in business strategy decisions.

Optimized - Focuses on achieving objectives rather than reacting

CISSP 2021 (6 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions