Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CISSP - Terms > Domain 1: Security and Risk Management > Flashcards

Domain 1: Security and Risk Management Flashcards

1
Q

Audit/Auditing

A

The tools, processes, and activities used to perform compliance reviews.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Availability

A

Ensuring timely and reliable access to and use of information by authorized users.

Usability, Accessibility, Timeliness
sy. 7

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Business Continuity(BC)

A

Actions, processes, and tools for ensuring an organization can continue critical operations during a contingency.

the Business …Continues

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Business impact analysis(BIA)

A

An analysis that identifies the resources that are critical to an organization’s ongoing viability and the threats posed to those resources. It also
assesses the likelihood that each threat will actually occur and the impact those occurrences
will have on the business. Aka business impact analysis (BIA).

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Compliance

A

Adherence to a mandate; both the actions demonstrating adherence and the tools, processes, and documentation that are used in adherence.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Confidentiality

A

Preserving authorized restrictions on information access and disclosure, including means for protecting personal privacy and proprietary information.
sy. 5

What is meant to be secret, stays secret

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Data subject

A

The individual human related to a set of personal data.

The subject of the data

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Disaster recovery(DR)

A

Those tasks and activities required to bring an organization back from contingency operations and reinstate regular operations.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Due care

A

A legal concept pertaining to the duty owed by a provider to a customer.

practicing the individual activities that maintain the due diligence effort.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Due diligence

A

Actions taken by a vendor to demonstrate/provide due care.

establishing a plan, policy, and process to protect the interests of an organization.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Governance

A

The process of how an organization is managed; usually includes all aspects of how decisions are made for that organization, such as policies, roles. and procedures the organization uses to make those decisions.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Governance committee

A

A formal body of personnel who determine how decisions will be made within the organization and the entity that can approve changes and exceptions to current relevant governance.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Guidelines

A

Suggested practices and expectations of activity to best accomplish tasks and attain goals.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Integrity

A

Guarding against improper information modification or destruction and includes ensuring information non-repudiation and authenticity.

Reliability and correctness
sy. 5

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Intellectual Property

A

Intangible assets (notably, includes software and data).

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Maximum allowable downtime(MAD)

A

The measure of how long an organization can survive an interruption of critical functions. [also known as maximum tolerable downtime(MTD)]

our maximum allowable destruction

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Personally Identifiable information (PII)

A

Any data about a human being that could be used to identify that person.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Policy

A

Documents published and promulgated by senior management dictating and describing the organization’s strategic goals.

Less Granular, Intention towards security

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Privacy

A

The right of human individual to control the distribution of information about themselves.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Procedures

A

Explicit, repeatable activities to accomplish a specific task. Procedures can address one-time or infrequent actions or common, regular occurrences.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Recovery time objective (RTO)

A

The target time set for recovering from any interruption

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Residual Risk

A

The risk remaining after security controls have been put in place as a means of risk mitigation.

Risk that remains

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Risk

A

The possibility of damage or harm and the likelihood that damage or harm will be realized.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Risk Acceptance

A

Determining that the potential benefits of a business function outweigh the possible risk impact/likelihood and performing that business function with no other action.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

Risk avoidance

A

Determining that the impact and/or likelihood of a specific risk is too great to be offset by the potential benefits and not performing a certain business function because of that determination.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

Risk mitigation

A

Putting security controls in place to attenuate the possible impact or likelihood, or both, of a specific risk.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

Risk transference

A

Paying an external party to accept the financial impact of a given risk.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

Security control framework

A

A notional construct outlining the organization’s approach to security, including a list of specific security processes, procedures. and solutions used by the organization.

Security solution and management method connected.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

Security governance

A

The entirety of the policies, roles. and processes the organization uses to make security decisions in an organization.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

Standards

A

Specific mandates explicitly stating expectations of performance or conformance.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

Sensitivity

A

refers to the quality of information, which could cause harm or damage if disclosed.
sy. 5

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

Discretion

A

is the act of decision where an operator can influence or control disclosure in order to minimize harm or damage.
sy. 5

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

Criticality

A

the level to which information is mission critical is its measure of criticality.
sy. 5

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

Concealment

A

the act of hiding or preventing disclosure.
sy. 5

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

Secrecy

A

the act of keeping something a secret or preventing the disclosure of information.
sy. 5

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

Privacy

A

refers to keeping information confidential that is personally identifiable or that might cause harm, embarrassment, or disgrace to some if revealed.
sy. 5

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

Seclusion

A

involves storing something in an out-of-the-way location, likely with strict access control.
sy. 5

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

Isolation

A

keeping something separated from others
sy. 5

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

DAD Triad

A

Disclosure, Alteration, and Destruction

sy. 8

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
40
Q

Authenticity

A

Security concept that data is authentic or genuine and originates from its alleged source
sy. 8

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
41
Q

Nonrepudiation

A

ensures that the subject of an activity or who cause an event cannot deny that the event occurred.

sy. 8

42
Q

Identification

A

a subject must perform identification to start the process of auth, authz, and accountability
sy. 9

43
Q

Authorization

A

ensures that the requested activity or access to an object is possible given the rights and privileges assigned to the authenticated identity.

sy. 10

44
Q

Defense in depth

A

Layering, mulitple controls in a series.
sy. 11

45
Q

Abstraction

A

for efficiency, similar elements are put into groups, classes, or roles that are assigned security controls, restrictions, or permissions as a collective.

Object Oriented programming
Sy. 12

46
Q

Data hiding

A

preventing data from being discovered or access by a subject by positioning the data in a logical storage compartment that is not accessible or seen by the subject.

Can’t see or access the data - Steganography
sy. 12

47
Q

Security Boundary

A

the line of intersection between any two areas, subnets, or environments that have different security needs or requirements.

Policy should state where one controls ends and another begins
sy. 13

48
Q

Third-Party Governance

A

the system of external entity oversight that may be mandated by law, regulation, industry standards, contractual obligation, or licensing requirements.

Verify compliance, know an org’s requirements to fulfill

49
Q

Documentation review

A

process of reading the exchanged materials and verifying them against standards and expectations.

sy. 15

50
Q

Security management planning ensures proper creation, implementation, and enforcement of a ______

A

Security policy

sy. 17

51
Q

A _____ ____ is usually documented argument or state position in order to define a need to make a decision to take some form of action.

A

Business case

Sy. 17

52
Q

The best security plan is useless without one key factor _____.

A

Senior management approval, understanding the risks, exposures for which security policy is deployed.

sy. 18

53
Q

Developing a security policy is evidence of ____ and ____.

A

Due Diligence and Due Care, without either senior management can be held liable for negligence and accountable for asset and financial loss.

sy. 18

54
Q

Strategic Plan

A

Long-term plan that is fairly stable

sy. 18

55
Q

Tactical Plan

A

midterm plan developed to provide more details on accomplishing the goals set forth in the strategic plan.

sy. 18

56
Q

Operational Plan

A

short-term, highly detailed plan based on the strategic and tactical plans.

sy. 19

57
Q

Service Level requirement (SLR)

A

a statement of the expectations of service and performance from the product or service of a vendor.
sy. 20

58
Q

Asset Owner

A

the person how is responsible for classifying information for placement and protection within the security solution.
sy. 21

59
Q

Data custodian

A

the user who is responsible for the tasks of implementing the prescribed protections defined by the security policy and senior management.
sy. 21

Custodians clean Data and secure locks

60
Q

Control Objectives for Information and Related Technologies (COBIT)

A

Documented set of best IT security practices crafted by the Information Systems Audit and Control Association (ISACA).
Sy. 22
Controls orbit our technologies

61
Q

NIST 800-53 v5

A

Security and Privacy Controls for Information Systems and Organizations.
Government sourced general recommendations for security.
Sy. 22

62
Q

NIST Risk Management Framework (RMF)

and it’s 5 functions

A

U.S. government guide for establishing and maintaining security crafted by the National Institute of Standards and Technology (NIST) that
establishes mandatory requirements for federal agencies. Aka NIST Risk Management
Framework (RMF).

Identify, Protect, Detect, Respond, and Recover

63
Q

NIST Cybersecurity Framework (CSF)

+ Five Stages

A

U.S. government guides for establishing and maintaining
security crafted by National Institute of Standards and Technology (NIST), which is designed for
critical infrastructure and commercial organizations. Aka NIST Cybersecurity Framework (CSF).
Identify, Protect, Detect, Respond, and Recover.

64
Q

International Organization for Standardization (ISO)/ International Electrotechnical Commission(IEC) 27000

A

International standard that can be the basis of implementing organizational security and related management practices.

65
Q

Operational Security

A

The continued maintenance of due care and due diligence

66
Q

Standards

A

Compulsory requirements for the homogenous use of hardware, software, technology, and security controls.

Standards a REQUIRED to be followed for use

67
Q

Baseline

A

Minimum level of security that every system throughout the organization must meet.

sy 25

68
Q

Guideline

A

Recommendations on how standards and baselines are implemented and serves as an operational guide for security professionals and users.

sy 25

69
Q

Procedures

A

detailed, step by step hot to document that describes the exact actions necessary to implement a specific security control, mechanism, or solution.

sy 25

70
Q

Threat Modeling

A

Security Process where potential threats are identified, categorized, and analyzed. Priority can be determined in which defenses to build controls around.

71
Q

Reduction Analysis

A

gain a greater understanding of the logic of the product, its internal components, as well as its interactions with external elements.

72
Q

Steps of Decomposition Process

A

Trust boundaries, where levels of security changes
dataflow paths, movement of data between locations
input points, where external input is received
Privileged operations, any activity that requires greater privileges, making changes to security or system changes.
Details of security stance, mapping to security policy and assumptions

73
Q

Supply Chain Risk Management

A

ensures that all vendors or links in the supply chain are reliable, trustworthy, reputable organizations that disclose their practices and security requirements.

74
Q

Risk Management

A

detail process of identifying factors that could damage or disclose assets, evaluating those factors in light of asset value and countermeasure cost, and implementing cost effective solutions for minimizing risk.

75
Q

Risk assessment/analysis

A

examination of an environment for risks, evaluating each threat event as its likelihood of occurring and the severity of the damage it would cause if it did occur.

76
Q

Risk Response

A

evaluating countermeasures, safegaurds, and security controls using cost benefit analysis; adjusting findings based on the conditions, concerns, priorities, and resources and providing proposal of response options.

How we evaluate and respond to risk

77
Q

Single-loss expectancy (SLE)

A

percentage of loss that an organization would experience if a specific asset were violated by a realized risk.

SLE = Asset Value * Exposure Factor

78
Q

Exposure factor

A

the percentage of loss that an organization would experience if a specific asset were violated by a realized risk

Loss Potential

the factor of something being exposed! How much loss

79
Q

Annualized Rate of Occurrence

A

expected frequency with which a specific threat or risk will occur

80
Q

Annualized Loss Expectancy

A

the possible yearly loss of all instances of a specific realized threat against a specific asset.

ALE = ARO * SLE (ale is arousal)

81
Q

Administrative controls

A

are the policies and procedures defined by an organization’s security policy and other regulations or requirements.

managerial/procedural/management controls

82
Q

Logical controls

A

involves the hardware or software mechanisms used to manage access and provide protection for IT resources and systems.

Technical controls

83
Q

Security Control Assessment (SCA)

A

the formal evaluation of a security infrastructure’s individual mechanisms against a baseline or reliability expectation

84
Q

Risk register

A

a document that inventories all the identified risks to an organization or system or within an individual project.

85
Q

Typo Squating

A

trying to redirect traffic when a user mistypes the domain name or ip address of an intended resources.

86
Q

Five stages of business impact analysis

A

Identification of Priorities, Risk identification, likelihood assessment, impact analysis, and resource prioritization

How would I evaluate Impact? Find the prorities, determine the risks, how likely would those risks happens, what would be the impact of those risks, and how would you prioritize resources to combat it.

87
Q

Civil Law

A

Designed to provide for an orderly society and govern matters that are not crimes but require an impartial arbiter

88
Q

Administrative law

A

Executive orders, policies, procedures, and regulations that govern the daily operations of the executive branch agency

89
Q

Computer Fraud and abuse act

A

first major legislation of computer cyber-specific crime
Built as part of the Comprehensive Crime Control Act of 1984

Doesn’t say Cyber, must be old

90
Q

Comprehension Crime Control Act

A

covered computer crimes that crossed state boundaries to avoid infringing on states’ rights and treading constitutional thin ice

Basic unauthorized access, using computers for fraud, damaging federal computer systems,

91
Q

National Information Infrastructure Protection Act of 1996

A

a set of amendments to the Computer fraud and abuse act that computer use to international and commercial use, and Industrial infrastructure (gas, trains, electric grids)

Key word: Infrastructure

92
Q

Digital Millennium Copywright Act (DMCA)

A

prohibition of attempts to circumvent copywrite protection mechanisms placed on a protected work by the copywrite holder.

World Intellectual Property Organization

ISPs are not liable for the traffic done by a user

93
Q

Trade secrets

A

intellectual property that if disclosed would cause significant damage

coca-cola recipe

94
Q

Electronic communications privacy act of 1986

A

makes it a crime to invade the electronic privacy of an individual

95
Q

Communication assistance for law enforcement act 1994

A

Amended Electronics communications privacy act to make wiretapping for law enforcement with an appropriate court order

96
Q

Economic Espionage Act of 1996

A

Extends the definition of property to include proprietary economic information so that the theft of this information can be considered industrial of corporate espionage.

97
Q

Health Insurance Portability and Accountability Act of 1996

A

Clearly defines the rights of individuals who are the subject of medical records and organizations that maintain such records to disclose these rights.

98
Q

ISO 27001

A

Establishes the guidelines for implementing an information security
management system (ISMS). It is the foundation of numerous other ISO standards, many
of which are within the ISO 27000 family group. It prescribes that management perform a
systematized evaluation of an organization’s assets and threats (i.e., risk assessment), then
design and implement a security response strategy to address the identified risks and adopt
an ongoing management, oversight, and governance process to maintain and improve the
security infrastructure over time.

99
Q

ISO 27002

A

Prescribes best practices for the implementation and use of security controls
within each of the 14 control groups from ISO 27001. ISO 27002 is effectively an extension
of ISO 27001.

100
Q

ISO 27701

A

An extension of ISO 27001 that focuses on privacy. It describes how to establish and maintain a privacy information management system (PIMS). It includes guidance on
implementing compliance with a range of privacy regulations, including General Data Protection Regulation (GDPR).

101
Q

ISO 31000

A

A family of standards and guidelines for implementing a risk management–
based security program

CISSP - Terms (8 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions