Domain 1: Security and Risk Management Flashcards
Patent
Patents legally secure protection for inventions. Patents must be unique ideas that provide useful processes to complete a task.
Reduction Analysis
A reduction analysis supports threat modeling by identifying elements common to underlying threats.
Also called decomposition
Breaks threat modeling into 5 separate concepts:
Trust Boundaries
Dataflow paths
Input points
Privileged Operations
Details about security stance and approach.
If password attacks are a threat common to several applications, but each of those applications relies on Microsoft Active Directory for authentication and authorization, then Microsoft Active Directory need only be evaluated once for password attacks (not for each application).
Risk
The possibility or likelihood that a vulnerability will be exploited.
Risk = Threat x Vulnerability x Impact
OR
Risk = Threat x Vulnerability
DREAD rating system
Risk rating system
The DREAD rating system is designed to provide a flexible rating solution that is based on the answers to five main questions about each threat:
Damage potential
Reproducibility
Exploitability
Affected users
Discoverability
SLE
Single loss expectancy
ALE
Annual Loss Expectancy
SLE x ARO. Or ( EF x AV) x ARO
Annualized loss expectancy (ALE) measures exactly a one-year financial loss an asset may suffer from a specifically identified threat.
ARO
Annualized rate of occurence
EF (think quantitaive risk analysis)
Exposure Factor
Threat Modeling
Threat modeling is the security process wherein potential threats to assets are identified and analyzed. Goal is to proactively model attacks to identify weak spots and opportunites for control improvement
Threat Hunting
Threat hunting refers to a technique used in security operations in which production environments are actively scrutinized by an experienced analyst for threats and indicators of compromise.
Due Care
Due care is best defined as taking and making decisions that a reasonable and competent person would make.
Due Diligence
Puts governance structures in place to protect an organizations interests.
- Things done in advance.
- Generally strategic, not tactical.
Non repudiation
Non-repudiation in digital security refers to ensuring that an authentication event is genuine or provides proof of data’s origin and integrity.
Risk mitigation
Risk mitigation is when the risk is reduced to an acceptable level aligned with the organization’s risk appetite. It is never possible to eliminate all risk.
Risk analysis
Synonymous with Risk Assessment. Systematic process of identifying, analyzing, and evaluating potential threats and vulnerabilities that could impact an organization’s information assets.
What does a Trademark protect?
Brand Identity - i.e. logo, slogan, catchphase, etc
What is Governance?
Governance is the process in which senior management directs an organization to meet its objectives.
Governance must involve oversight to ensure that the goals set by senior management have been met. When performing security governance, IT managers need to keep security objectives in alignment with business objectives.
VAST
Threat Modeling framework:
Visual, Agile, and Simple Threat
VAST uses Agile programming concepts to conduct threat modeling.
Due care
Due Care is acting in a way that a reasonable and competent person would act in a given scenario. Exercising due care can help reduce an organization’s liability in the event of a security breach. A lack of due care can be described as negligence.
-Things done in the moment.
-Generally tactical, not strategic.
Ultimately, who is accountable for the security of a company or organization?
Senior management
Procedure
Procedures usually detail a step-by-step process to accomplish the desired results.
Guideline
Guidelines offer suggestions no how to execute policy, standards, or procedures. Provide recommendations but are not required.
NOT the same as best practices.
Baseline
Define minimum level of security that every system throughout the organization must meet.
Baseline is more operationally focused form of a standard.
All systems not complying w/baseline must be taken off line.
Usually system specific.
Inherent Risk
Level of default, natural, or native risk in an environment/system/product.
