Domain 1 - Security and Risk Management Flashcards
What is the NIST Risk Management Publication?
NIST 800-30
What is the ISO standard for risk management?
ISO 27005
What is water holing?
Creating a bunch of websites with similar names, or an attacker infecting websites that are frequented by members of the group being attacked
What is data diddling?
act of modifying info, programs or documents to commit fraud. tampering with input data
What is COSO?
develops guidelines for businesses to evaluate internal controls, risk management, and fraud deterrence. these are goals for the entire organization
What is COBIT?
Created by ISACA, COBIT allows practitioners to govern and manage IT holistically, bridging gap between business requirements, control needs and technical issues. TLDR - IT Governance
What is OCTAVE?
Self Directed Risk Management.
What is ISO 27799?
Directives on how to protect PHI (Protected Health Information)
What are the PCI-DSS principles?
- Build and Maintain a Secure Network and Systems
- Protect Account Data (stored data and cryptography of data in transit)
- Maintain a Vulnerability Management program
- Implement Strong Access Control Measures
- Regularly monitor and test networks
- Maintain an info sec policy
Which CSA Star Level requires 3rd party certification?
Star Level 2
Which CSA Star Level has continuous auditing?
Star Level 3
Which CSA Star Level(s) have continuous self assessment?
Star Level 1 Continuous and Star Level 2 Continuous
Which CSA Star Level is only self-assessment?
Star Level 1
What does the Computer Security Act (CSA) focus on?
Creating computer security plans and ensuring adequate training of system users and owners where the systems would hold sensitive information.
What is the purpose of CALEA?
This is a communication assistance law to aid lawful interception of communications
What is COPPA?
Children online privacy protection act. For those collecting information on those under 13 years of age. Restrictions against marking, must receive consent and display privacy policy.
What law protects against espionage?
The Economic Espionage Act (EEA) 1996.
Who are exempted from the DMCA?
nonprofit organisations such as libraries and schools
What are the requirements of FISMA?
- Deployment of risk assessments
- Development and maintenance of an information assurance program. with IT security architecture and framework
- Security training conduction
- Periodic testing and evaluation
- Security awareness programs
The following example would be what kind of security document:
“All users must choose a long passphrase that will be changed annually”
This would exist in a high level policy.
The following example would be what kind of security document:
“SoE must be Windows 11 and use AES 128bit key encryption”
This would exist in a standard.
The following example would be what kind of security document:
“Use AES for encryption”
This would be a baseline as it does not define what key length is required. Leaving it somewhat discretionary for users.
What is the NIST 800-53?
This is security and privacy controls for Information Systems and Organizations that provides detailed security controls for US FEDERAL systems. Rev 5 also provides privacy controls, supply chain and insider threat.
What is the NIST 800-37
This is the Risk Management Framework for Info Systems and Organizations
What are the steps in the NIST Cyber Security Framework?
- Identify
- Protect
- Detect
- Respond
- Recovery
What is another name of a bot?
Zombie
Who can complain about Canon I and II?
Any member of the general public may file a complaint for canon I or II
Who can complain about Canon III?
Any principal that has a employer/contractor relationship with the certificate holder
Who can complain about Canon IV?
any other profession and also subscribed to a code of ethics
What may be compromised if we over subscribe in confidentiality?
Availability may be impacted
What may happen if we overprotect integrity
Availability may be impacted as well.
What are the three types of plans that a security planning team develop?
- Strategic Plan (3-5 years)
- Tactical Plan (1 year plan)
- Operational Plain (updated frequently)
What types of entities does HIPAA regulate?
HIPAA regulates three types of entities—healthcare providers, health information clearinghouses, and health insurance plans—as well as the business associates of any of those covered entities.
What 3 rules does the HIPAA have?
- Privacy Rule
- Security Rule
- Breach notification rule
What are the controls of Crime Prevention Through Environmental Design (CPTED)?
- Natural access control
- Natural Surveillance
- Territorial Reinforcement
