Domain 1: Security and Risk Management Flashcards
Audit/Auditing
The tools, processes, and activities used to perform compliance reviews.
Availability
Ensuring timely and reliable access to and use of information by authorized users
Usability, Accessibility, Timeliness
sy. 7
Business Continuity(BC)
Actions, processes, and tools for ensuring an organization can continue critical operations during a contingency.
the Business …Continues
Business impact analysis(BIA)
An analysis that identifies the resources that are critical to an organization’s ongoing viability and the threats posed to those resources. It also
assesses the likelihood that each threat will actually occur and the impact those occurrences
will have on the business. Aka business impact analysis (BIA).
Compliance
Adherence to a mandate; both the actions demonstrating adherence and the tools, processes, and documentation that are used in adherence.
Confidentiality
Preserving authorized restrictions on information access and disclosure, including means for protecting personal privacy and proprietary information.
sy. 5
What is meant to be secret, stays secret
Data subject
The individual human related to a set of personal data.
The subject of the data
Disaster recovery(DR)
Those tasks and activities required to bring an organization back from contingency operations and reinstate regular operations.
Due care
A legal concept pertaining to the duty owed by a provider to a customer.
practicing the individual activities that maintain the due diligence effort.
Due diligence
Actions taken by a vendor to demonstrate/provide due care.
establishing a plan, policy, and process to protect the interests of an organization.
Governance
The process of how an organization is managed; usually includes all aspects of how decisions are made for that organization, such as policies, roles. and procedures the organization uses to make those decisions.
Governance committee
A formal body of personnel who determine how decisions will be made within the organization and the entity that can approve changes and exceptions to current relevant governance.
Guidelines
Suggested practices and expectations of activity to best accomplish tasks and attain goals.
Integrity
Guarding against improper information modification or destruction and includes ensuring information non-repudiation and authenticity.
Reliability and correctness
sy. 5
Intellectual Property
Intangible assets (notably, includes software and data).
Maximum allowable downtime(MAD)
The measure of how long an organization can survive an interruption of critical functions. [also known as maximum tolerable downtime(MTD)]
our maximum allowable destruction
Personally Identifiable information (PII)
Any data about a human being that could be used to identify that person.
Policy
Documents published and promulgated by senior management dictating and describing the organization’s strategic goals.
Less Granular, Intention towards security
Privacy
The right of human individual to control the distribution of information about themselves.
Procedures
Explicit, repeatable activities to accomplish a specific task. Procedures can address one-time or infrequent actions or common, regular occurrences.
Recovery time objective (RTO)
The target time set for recovering from any interruption
Residual Risk
The risk remaining after security controls have been put in place as a means of risk mitigation.
Risk that remains
Risk
The possibility of damage or harm and the likelihood that damage or harm will be realized.
Risk Acceptance
Determining that the potential benefits of a business function outweigh the possible risk impact/likelihood and performing that business function with no other action.
Risk avoidance
Determining that the impact and/or likelihood of a specific risk is too great to be offset by the potential benefits and not performing a certain business function because of that determination.
Avoid risk by NOT doing it, it’s not worth
Risk mitigation
Putting security controls in place to attenuate the possible impact or likelihood, or both, of a specific risk.
Risk transference
Paying an external party to accept the financial impact of a given risk.
Security control framework
A notional construct outlining the organization’s approach to security, including a list of specific security processes, procedures. and solutions used by the organization.
Security solution and management method connected.
Security governance
The entirety of the policies, roles. and processes the organization uses to make security decisions in an organization.
Standards
Specific mandates explicitly stating expectations of performance or conformance.
Sensitivity
refers to the quality of information, which could cause harm or damage if disclosed.
sy. 5
Discretion
is the act of decision where an operator can influence or control disclosure in order to minimize harm or damage.
sy. 5
Criticality
the level to which information is mission critical is its measure of criticality.
sy. 5
Concealment
the act of hiding or preventing disclosure.
sy. 5
Secrecy
the act of keeping something a secret or preventing the disclosure of information.
sy. 5
Privacy
refers to keeping information confidential that is personally identifiable or that might cause harm, embarrassment, or disgrace to some if revealed.
sy. 5
Seclusion
involves storing something in an out-of-the-way location, likely with strict access control.
sy. 5
Isolation
keeping something separated from others
sy. 5
DAD Triad
Disclosure, Alteration, and Destruction
sy. 8
Authenticity
Security concept that data is authentic or genuine and originates from its alleged source
sy. 8
Nonrepudiation
ensures that the subject of an activity or who cause an event cannot deny that the event occurred.
sy. 8
Identification
a subject must perform identification to start the process of auth, authz, and accountability
sy. 9
Authorization
ensures that the requested activity or access to an object is possible given the rights and privileges assigned to the authenticated identity.
sy. 10
Defense in depth
Layering, mulitple controls in a series.
sy. 11
Abstraction
for efficiency, similar elements are put into groups, classes, or roles that are assigned security controls, restrictions, or permissions as a collective.
Object Oriented programming
Sy. 12
Data hiding
preventing data from being discovered or access by a subject by positioning the data in a logical storage compartment that is not accessible or seen by the subject.
Can’t see or access the data - Steganography
sy. 12
Security Boundary
the line of intersection between any two areas, subnets, or environments that have different security needs or requirements.
Policy should state where one controls ends and another begins
sy. 13
Third-Party Governance
the system of external entity oversight that may be mandated by law, regulation, industry standards, contractual obligation, or licensing requirements.
Verify compliance, know an org’s requirements to fulfill
Documentation review
process of reading the exchanged materials and verifying them against standards and expectations.
sy. 15
Security management planning ensures proper creation, implementation, and enforcement of a ______
Security policy
sy. 17
A _____ ____ is usually documented argument or state position in order to define a need to make a decision to take some form of action.
Business case
Sy. 17
The best security plan is useless without one key factor _____.
Senior management approval, understanding the risks, exposures for which security policy is deployed.
sy. 18
Developing a security policy is evidence of ____ and ____.
Due Diligence and Due Care, without either senior management can be held liable for negligence and accountable for asset and financial loss.
sy. 18
