Domain 1 - Security and Risk Management Flashcards
Confidentiality
Access controls help ensure that only authorized subjects can access objects.
Integrity
Ensures that data or system configurations are not modified without authorization
Availability
Authorized requests for objects must be granted to subjects within a reasonable amount of time.
Code of Ethics
PAPA
Protect society, the commonwealth, and the infrastructure.
Act honorably, honestly, justly, responsibly, and legally.
Provide diligent and competent service to principals.
Advance and protect the profession
Security Policy development
Acceptable Use Policy
Assigns roles and responsibilities
Security Baselines
Define “minimum levels”
Security Guidelines
Offer recommendations
Security Procedures
Detailed step-by-step
Risk Categories
Group of potential causes of risk.
Damage - Results in the physical loss of an assess or the inability to access the asset.
Disclosure - Disclose critical information regardless of how or where it was disclosed.
Losses - Might be permanent or temporary including altered data or inaccessible data.
Risk Factors
Something that increase risk or susceptibility.
Physical damage - Natural disaster, power loss, or vandalism.
Malfunctions - Failure of systems, networks, or peripherals.
Attacks - Purposeful acts whether from the inside or outside, such as unauthorized disclosure.
Human errors - Usually considered accidental incidents, whereas attacks are purposeful incidents.
Application errors - Failures of the application including the operating system.
Security Planning
Strategic - long term ~5 year
Tactical - midterm plan ~1 year
Operations - shorter (highly detailed) month to month or quarterly.
Response to risk
Risk acceptance - Do nothing, accept the risk and potential loss if threat occurs.
Risk mitigation - You do this by implementing a countermeasure and accepting the residual risk.
Risk Assignment - Transfer risk to 3rd party.
Risk Avoidance - When costs of mitigating or accepting are higher than benefits of service
Risk Deterrence - Implementing deterrents to would-be violators of security behavior.
Risk rejection - UNACCETABLE possible response to risk is to reject of ignore risk.
Risk management Frameworks
Primary risk management framework
NIST 800-37 rev 2
7 Steps of NIST 800-37 rev 2
PCSIAAM
People Can See I am Always Monitoring
- Prepare - to execute the RMF
- Categorize - information systems
- Select - security controls
- Implement - security controls
- Assess - the security controls
- Authorize - the system (ATO)
- Monitor - security controls
When legal issues are involved.
contact an attorney
Types of Risks
Residual - risk that remain after all safeguards - After
Inherent - risk that exists without controls (newly identified) - Before
Total - amount of risk an organization would face if no safeguards were implemented - Without
Total Risk Formula
threats * vulnerabilities * asset value = total risk
Risk formula
threat * vulnerability = risk
Risk analysis - Quantitative
Quantitative - dollar value to evaluate effectiveness of countermeasures. OBJECTIVE
- Assign asset value (AV)
- Calculate exposure factor (EF)
- Calculate single loss expectancy (SLE)
- Assess the annualized rate of occurrence (ARO)
- Derive the annualized loss expectancy (ALE)
- Perform cost/benefit analysis of countermeasures
- Inventory assets and assign a value (AV)
- Identify threats. Research each asset and produce a list of all possible threats to each assets. (EF and SLE)
- Perform a threat analysis to calculate the likelihood of each threat being realized within a single year. (ARO)
- Estimate the potential loss by calculating the annualized loss expectancy (ALE).
- Research countermeasures for each threat, and then calculate the changes to ARO and ALE based on an applied countermeasure.
- Perform a cost/benefit analysis of each countermeasure for each threat for each asset.
Risk analysis - Qualititative
Uses a scoring system to rank threats and effectiveness of countermeasures. SUBJECTIVE
Delphi Technique
An anonymous feed-back and response process used to arrive at a consensus.
Loss potential
What would be lost if the threat agent is successful in exploiting a vulnerability.
Delayed loss
This is the amount of loss that can occur over time.
Threat agent
are what causes the threat by exploiting vulnerabilities
Formula terms
exposure factor (EF) % of loss that an organization would experience if a specific asses were violated by a realized risk.
single loss expectancy (SLE)
Represents the cost associated with a single realized risk against a specific assets
annualized rate of occurrence (ARO) - The expected frequency with which a specific threat or risk will occur with a single year.
annualized loss expectancy (ALE)
Safeguard evaluation -
SLE Formula
AV * EF = SLE
