Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CISSP Vorbereitung > Domain 1 Security and Risk Management > Flashcards

Domain 1 Security and Risk Management Flashcards

1
Q

Vulnerability

A

A vulnerability is a weakness in a system that can be exploited, such as software bugs, hardware flaws, or procedural gaps.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Threat

A

A threat is a potential danger that exploits a vulnerability, while a
threat agent is the entity that actually exploits the vulnerability.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Risk

A

Risk is the probability of a threat exploiting a vulnerability and the
impact it would have on the business.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

exposure

A

An exposure is when an organization is open to potential losses due to vulnerabilities.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Control or Countermeasures

A

Controls or countermeasures are action taken to mitigate risks, such as firewalls, password management, and security training.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Name the three Control Types

A

● Administrative: Management-oriented like security policies, risk
management, and training.
● Technical: Hardware or software like firewalls, Intrusion Detection
System(IDS), encryption, and authentication mechanisms.
● Physical: Protect facilities and resources with measures like locks,
security guards, and CCTV.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Defense in Depth

A

Layered security approach to reduce the success of attacks.
- Multilayered defenses increase the difficulty for attackers to access
critical assets.
- Layers include various physical and technical controls based on asset sensitivity.
- Security Layers: Network Layer Security, Platform Layer Security, Application Layer Security, Data Layer Security, Response Layer Mechanism

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Control Functionalities
Preventive

A

Avoid incidents (e.g., policies, hiring practices, encryption).

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Control Functionalities
Detective

A

Identify incidents or intruders (e.g., auditing logs).

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Control Functionalities
Corrective

A

Fix issues after an incident (e.g., reloading computer images).

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Control Functionalities
Deterrent

A

Discourage potential attacks (e.g., visible CCTV).

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Control Functionalities
Recovery

A

Return to normal operations (e.g., data backup systems).

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Control Functionalities
Compensating

A

Alternative measures when primary control isn’t feasible (e.g., fence instead of security guards).

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Name three of the Frameworks that describes Security Controls Development in their Framwork.

A

Frameworks like COBIT 5, NIST SP 800-53, and COSO aim to provide
business frameworks and sets of controls for IT management, US federal systems, and internal corporate controls, respectively.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Name three of the Frameworks that describes Process Management Development in their Framwork.

A

Frameworks such as ITIL, Six Sigma, and CMMI offer processes for IT
service management, business management strategies, and organizational development for process improvement.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Name three of the Frameworks that describes Enterprise Architecture Development in their Framwork.

A

Organizations can follow ad hoc approaches or defined security
architectures, with frameworks like Zachman, TOGAF, DoDAF, MODAF, and SABSA providing guidelines for enterprise architectures.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What steps involves Security Program Development?

A

Involves planning and organizing, implementing, operating, maintaining, monitoring, and evaluating. It’s supported by management and involves continuous improvement.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What are Intrusion Detection Systems (IDS)?

A

Intrusion Detection Systems (IDS) can alert companies to breaches but may not always identify the attacker.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Name the Law for Import/Export Legal Requirements

A

Organizations must comply with different countries’ import and export laws, like the Wassenaar Arrangement, which controls the export of dual-use goods and technologies.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Name six types of Legal Systems (Law system)

A

Civil (Code) Law System: Rule-based, used in continental Europe.
Common Law System: Precedent-based, developed in England.
Customary Law System: Based on regional traditions and customs.
Religious Law System: Based on religious texts and beliefs.
Mixed Law System: Combination of different legal systems.
Data Protection Regulations

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Describe the Intellectual Property (IP) Law

A

Protect a company’s or individual’s creations from unauthorized use or duplication.
Companies must take reasonable steps to safeguard their Intellectual property (IP) and demonstrate due care.
Failure to protect IP adequately may lead to losing legal protection or cases such as wrongful termination suits.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

What is Software Piracy?

A

Occurs when software is used or duplicated without authorization.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Name for typical Personally Identifiable Information (PII)

A

PII is data that can uniquely identify an individual. It’s essential to protect PII due to its use in identity theft and other crimes. Definitions of PII vary across jurisdictions and are based on risk assessments.
Typical PII includes full name, national ID numbers, IP addresses, and credit card numbers.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Privacy Laws

A

Privacy laws have been enacted globally in response to the need for PII protection.
Examples include the U.S. Federal Privacy Act of 1974, The Gramm-
Leach-Bliley Act, and HIPAA.
Canada and New Zealand have enacted horizontal privacy laws,
addressing privacy across all sectors.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

Federal Privacy Act of 1974

A

Restricts government data collection and sharing of individual records.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

Federal Information Security Management Act of 2002

A

Requires federal agencies to implement security programs for their information systems.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

Department of Veterans Affairs Information Security Protection Act

A

Enforces additional controls and reporting for the Veterans Administration (VA) after a data breach.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

Health Insurance Portability and Accountability Act (HIPAA)

A

Sets standards for handling personal medical information.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

Health Information Technology for Economic and Clinical Health
(HITECH) Act

A

Directs Health and Human Services (HHS) to publish annual guidance
on data protection controls.
Compliance with these controls exempts organizations from reporting breaches, while non-compliance requires reporting within 60 days.
Strengthens enforcement of HIPAA rules.

30
Q

USA PATRIOT Act

A

Expands law enforcement powers for surveillance and intelligence gathering.

31
Q

Gramm-Leach-Bliley Act (GLBA)

A

Mandates financial institutions to protect customers’ personal information.

32
Q

Prescreening Personnel

A

Organizations must follow legal limitations when conducting background checks on potential employees.

33
Q

Personal Privacy Protection

A

Users are encouraged to use encryption, firewalls, and antivirus software, and to shred personal documents to protect their privacy.

34
Q

Economic Espionage Act of 1996

A

Provides structure for investigating corporate espionage.
Protects corporate IP from unauthorized exposure or theft.

35
Q

State Laws

A

Most U.S. states have laws mandating disclosure of data breaches
involving PII.
Definitions of PII and conditions for notification vary, complicating
compliance.

36
Q

Who should create Security policies?

A

Senior management or a designated body should create an overarching security policy, defining the scope and enforcement of security within the organization and addressing legal compliance.

37
Q

Definiton of Standard

A

Standards are mandatory rules that ensure uniformity in technology usage and behavior within an organization.

38
Q

Definiton of Baselines

A

Baselines are reference points establishing a minimum level of protection, which can be used to measure future changes.

39
Q

Definiton of Guidelines

A

Guidelines offer recommendations for actions when no specific standard applies, providing flexibility for unforeseen circumstances.

40
Q

Definiton of Procedures

A

Procedures are detailed instructions for achieving goals, such as
configuring systems or handling sensitive materials.

41
Q

Definiton of Implementation

A

To be effective, security policies and their supportive documents must be actively implemented and enforced, with employees made aware of expectations and consequences for noncompliance. This shows due care and prevents potential liability.

42
Q

Definiton of Risk Management

A

Involves identifying and assessing risk, reducing it to an acceptable level, and maintaining that level.
Encompasses a variety of risks, not only IT-related but also business
decisions like acquisitions and product line expansions.

43
Q

Definiton of Hollistic Risk Management

A

Often misunderstood and not sufficiently prioritized by those inside and outside the security profession.
Should be viewed as a business issue, with a focus on how risks
impact the bottom line.
Requires understanding of the context in which risk exists and a
holistic approach across all organizational tiers.

44
Q

Name the three NIST SP 800-39 RISK MANAGEMENT TIERS

A

Organizational Tier: Focuses on the business as a whole, setting risk
tolerance and framing the risk management approach.
Business Process Tier: Deals with risks to major organizational
functions and information flows.
Information Systems Tier: Focuses on information system-related
risks within the context of the broader organizational risk management

45
Q

THE RISK MANAGEMENT PROCESS (NIST SP 800-39)

A

Frame Risk: Defines the context, assumptions, constraints, priorities, and risk tolerance.
Assess Risk: Identification of threats, vulnerabilities, and potential
impacts.
Respond to Risk: Allocating resources to prioritize and implement
controls based on the risk assessment.
Monitor Risk: Ongoing monitoring to adapt to changes and ensure
control effectiveness.

46
Q

THREAT MODELING METHODOLOGIES
Attack Trees

A

Visualize multiple paths to achieve a malicious objective.
Multiple conditions (leaf nodes) lead to a single goal (root node).
Helps to identify various ways an attacker can accomplish each
objective.

47
Q

THREAT MODELING METHODOLOGIES
Reduction Analysis

A

Attack trees require significant resources; reduction analysis helps
manage
Aims to reduce the number of attacks to consider by finding
commonalities.
Identifies the most effective mitigation techniques by applying controls closer to the root node.
Controls or countermeasures are implemented to mitigate identified attacks.

48
Q

SUPPLY CHAIN RISK MANAGEMENT

A

Organizations often overlook supply chain risks, which can be exploited by attackers.
A supply chain includes all suppliers of products and services to a
company.
Different suppliers have different security perspectives and threat
models.

49
Q

Name three commonly accepted Risk Management Frameworks

A

NIST RMF (SP 800-37r1): Used by U.S. federal agencies; focuses on the
life-cycle of information systems and their certification and accreditation.
ISO 31000:2018: Focuses on managing uncertainty and its effects,
both negative and positive , across various aspects of an organization.
ISACA Risk IT: Bridges the gap between generic frameworks and ITcentricones; integrates well with COBIT.

50
Q

Disaster Recovery (DR)

A

DR focuses on minimizing the effects of a disaster and resuming
operations quickly.
-DR is IT-focused and implemented during emergency mode.

51
Q

Business Continuity Planning (BCP)

A

BCP deals with longer-term outages, keeping business going after a
disaster.
BCP includes moving to alternative environments, managing
communication, and maintaining operations.

52
Q

Standard for Disaster Recovery and Buisness Continuity Planning

A

The National Institute of Standards and Technology (NIST) and ISO
provide guidelines for BCP and BCM.
NIST SP 800-34, ISO/IEC 27031, ISO 22301, and other industry
guidelines offer frameworks for continuity planning.

53
Q

Business Continuity Management (BCM)

A

BCM is the holistic process that integrates DR and BCP.
It aims to maintain business operations under various conditions,
focusing on resilience and effective response.

54
Q

Key Components in BCM

A

Availability, integrity, and confidentiality must be maintained even after a disaster.
Plans must integrate security to protect against increased vulnerability post-disaster.

55
Q

Business Impact Analysis (BIA)

A

BIA identifies critical functions, resources, and the Maximum Tolerable Downtime (MTD) for each.
It assesses the potential impact of disruptions on business functions.
The BIA process includes interviews, data collection, risk assessment,
and establishing criticality levels.

56
Q

Risk Assessment in BCP

A

Risk assessment evaluates the potential impact and likelihood of threats.
It considers both qualitative and quantitative impacts on the business.

57
Q

PERSONNEL SECURITY

A

People are crucial to a company’s success but can also be the weakest link in security.
Security issues often arise from personnel mistakes, lack of training,
or intentional acts like fraud.
Preventive measures can reduce risks, such as hiring qualified
individuals, performing a background check, and implementing strict access controls.
Separation of duties, split knowledge, dual control, and rotation of
duties are key strategies to prevent fraud and misuse of resources.

58
Q

Due Care

A

behavioral expectations that organizations must adhere to.
e.g.
-following standards to mitigate Risks
-fix vulnerabilities

59
Q

Due Diligence

A

research necessary to make good, informed decisions
e.g.
-doing background checks on employees
-Risk assessment of physical security systems
-Testing of backup services

60
Q

Liability

A

legal responsibility for damage caused by an individual or buisness entity
e.g.
Organization must protect themselves from liability with creating policies and procedures.
Everybody must be aware of the policies & procedures

61
Q

Name the Fromular for Risk

A

Risk = Threat * Vulnerability
e.g.
Burning Company = Fire * no Fireeraser

62
Q

Risk Management Principles (Types)

A

Avoidance = too high risk and we dont start it
Mitigation = pay amount of Money to mitigate and reduce the risk
Acceptance = accept the Risk
Transfer = transfer the risk to someone else

63
Q

Name the Formular to calculate Single Lost Expectancy (SLE)

A

SLE = Asset Value * Exposure Factor

64
Q

Name the Formular to calculate Anual rate Accurancy (ARO)

A

ARO = x/n
x= how many times the event happen
n= amount of years

65
Q

Name the Formular to calculate Anual Lost Expectancy (ALE)

A

ALE = SLE * ARO

66
Q

Calculate SLE, ARO and ALE for example:
Asset Value = 100.000
Exposure Factor = 30%
amount of times that this dmg accure per year = 2

A

SLE = 100.000* 0,3 = 300.000
ARO = 2/1 = 2
ALE = 300.000 * 2 = 600.000

67
Q

Risk Analysis Quantitative vs Qualitative

A

Quantitative = A mathematical estimate based on the historical occurences of an incident
Qualitative = A best-guess estimate based on the judgement and experience of analysts

68
Q

PCI-DSS

A

PCI-DSS requires firewalls, encryption, antivirus software, physical restrictions, regular testing, and more to protect cardholder data.

69
Q

Fuzz-Testing

A

Fuzz-testing applications load tons of random input into fields.
e.g.
the name, address, phone number and so on.

70
Q

Acceptable Use Policy (AUP)

A

An AUP states practice users must agree to access the organization’s network or internet. For best security, all users must accept the AUP.

CISSP Vorbereitung (2 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions