Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CISSP > Domain 1: Security and Risk Management > Flashcards

Domain 1: Security and Risk Management Flashcards

1
Q

CIA Triad

A

Confidentiality, Integrity, Availability

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Ex: Violation of Confidentiality

A

capturing network traffic, stealing password files, social engineering, port scanning, shoulder surfing, sniffing…

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Sensitivity

A

quality of info, which could cause harm or damage if disclosed

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Discretion

A

act or decision where an operator can influence of control disclosure to minimize damage

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Criticality

A

level to which info is mission critical

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Concealment

A

act of hiding or preventing disclosure

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Seclusion

A

Storing info in an out of the way location

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Ex: Violation of Integrity

A

Accidental deletion of files, entering invalid data, including errors in commands…

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Availability

A

Authorized subjects are granted timely and uninterrupted access to objects

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Ex: Violations of Availability

A

Accidental deletion of files, over utilization of HW/SW, underallocating resources…

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

AAA Services

A

Identification, Authentication, Authorization, Auditing, Accounting

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Identification

A

who you are

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Authentication

A

you are who you say you are

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Authorization

A

allows and denials of resource and object access for who you are

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Auditing

A

recording of events

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Accounting/Accountability

A

holding subjects accountable for their actions

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Nonrepudiation

A

ensures that the subject of an activity or event cannot deny that the event occurred, possible through AAA services

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Layering

A

Defense in Depth, Delay an intruder

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Abstraction

A

Similar elements are put into groups, classes, or roles and assigned security controls as a collective

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Data Hiding

A

positioning data in a logical storage compartment not seen by subjects (think classification levels)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Encryption

A

art and science of hiding the meaning or intent of a communication from unintended recepients

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Security Governance

A

Collection of practices related to supporting, defining, and directing the security efforts of an org

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

The best key plan is useless without ________

A

approval by senior mgmt

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Security Plan Timeline

A

Strategic (5 year - risk assessment, stable, security purpose), Tactical (1 year - midterm, schedules tasks, project plans, hiring plans, budget plans), Operational (Months -short term, highly detailed, training plans, system deployment plans)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

Importance of CM

A

Change can introduce new loopholes, overlaps, and oversights that lead to new vulnerabilities

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

Goal of CM

A

ensure that change does not lead to reduces security, backups and rollbacks

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

Data Classification

A

data is protected based on its need for secrecy, sensitivity, or confidentiality

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

Primary Objective of Data Classification

A

formalize and stratify the process of securing data based on assigned labels of importance and sensitivity

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

7 steps to implement a classification scheme

A
  1. Identify the custodian and define responsibilities
  2. Specify the evaluation criteria of how the info will be classified and labeled
  3. Classify and label each resource
  4. Document any exceptions to the classification policy
  5. Select the security controls
  6. Specify the procedures for declassifying resources
  7. Create an enterprise-wide awareness program
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

Levels of Government Classification

A

Top Secret, Secret, Confidential, Sensitive but Unclass, Unclassified

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

Commercial Classification Levels

A

Confidential/Proprietary, Private, Sensitive, Public

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

Senior Manager

A

ultimately responsible for security maintained

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

Security Professional

A

experienced network, systems, and security engineer who is responsible for following the directives mandated by senior mgmt (functional responsibility)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

Data Owner

A

responsible for the classifying of info

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

Data Custodian

A

responsible for the tasks of implementing the prescribed protection defined by the security policy and senior management

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

User

A

person who has access to the system

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

Auditor

A

responsible for reviewing and verifying that the security policy is properly implemented

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

COBIT & COSO

A

goals for meeting security - COBIT is IT, COSO is org

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

Due Care

A

using reasonable care to protect the interests of the org

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
40
Q

Due Diligence

A

Practicing the activities that maintain due care

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
41
Q

Security Policy

A

document that defines the scope of security needed by and org and discusses assets that need protection. Assigns responsibilities, defines roles, specify audit requirements, defines acceptable risk levels

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
42
Q

3 Categories of Security Policies

A

Regulatory (industry and legal standards), Advisory (acceptable use policy) and Informative (support, background)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
43
Q

Standards

A

define requirements for homogeneous use of hw, sw, tech, and security controls. Tactical docs that defines steps to accomplish goals defined by the security policy

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
44
Q

Baseline

A

minimum level of security that every system must meet

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
45
Q

Guidelines

A

recommendation on how standards and baselines are implemented

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
46
Q

Procedures

A

step by step how to

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
47
Q

Relationship of Policy Components

A

(Inverted Triangle) Procedures -> Guidelines -> Standards -> Policies

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
48
Q

3 Approaches to ID Threats

A

Focus on Assets, Focus on Attackers, Focus on Software

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
49
Q

STRIDE

A

Threat Categorization Scheme - Spoofing, Tampering, Repudiation, Information Disclosure, DoS, Elevation of Privileges

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
50
Q

Reduction Analysis

A

decomposing the application, system or environment

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
51
Q

5 key concepts of decomposition

A

Trust Boundaries, Data Flow Paths, Input Points, Privileged Operations, Details about Security Stance and Approach

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
52
Q

DREAD

A

Threat Ranking - Damage Potential, Reproducibility, Exploitability, Affected Users, Discoverability

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
53
Q

Acquisition Assessment

A

On-Site Assessment, Document Exchange and Review, Process/Policy Review

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
54
Q

Protection Mechanisms

A

Layering, Abstraction, Data Hiding, Encryption

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
55
Q

Applying Threat Modeling

A

Identifying threats
Determining potential attacks
Performing reduction analysis
Prioritization and response

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
56
Q

Separation of Duties

A

work tasks are divided among several individual administrators

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
57
Q

Collusion

A

occurrence of negative activity undertaken by two or more people

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
58
Q

Job Responsibilities

A

Specific work tasks an employee is required to perform on a job

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
59
Q

Job Rotation

A

rotating employees among multiple positions to provide knowledge redundancy and reduce the risk of fraud, misuse of info, data modification, etc.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
60
Q

NDA

A

Nondisclosure agreement used to protect the confidential information within an organization from being disclosed by a former employee

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
61
Q

NCA

A

Noncompete Agreement prevents employees with secrets from working in a competing org

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
62
Q

6 parts of employee termination policy

A

Return of assets, remove or disable the employees network user account, notify HR to issue final paycheck, arrange for security to escort out, inform security personnel at entrance points that employee does not reenter unescorted

63
Q

SLA

A

Service Level Agreement

64
Q

Compliance

A

the act of conforming to or adhering to rules, policies, regulation, standards, or requirements

65
Q

Third-party Governance

A

security oversight on third parties that your org relies on

66
Q

Risk

A

the possibility that something could happen to damage, destroy, or disclose data or other resources

67
Q

The primary goal of risk management is __________

A

to reduce risk to an acceptable level

68
Q

Risk Analysis

A

The process by which the goals of risk management are achieved

69
Q

Asset

A

anything within an environment that should be protected

70
Q

Asset Valuation

A

dollar value assigned to an asset

71
Q

Threats

A

Any potential occurrence that may cause an undesirable or unwanted outcome

72
Q

Vulnerability

A

The weakness in an asset or the absence or weakness of a safeguard or countermeasure

73
Q

Exposure

A

being susceptibility to asset loss because of a threat

74
Q

Risk = A x B

A

Threat X Vulnerability

75
Q

Safeguard

A

countermeasure, anything that removes or reduces a vulnerability or protects against one of more specific threats

76
Q

Attack

A

exploitation of a vulnerability by a threat agent (intentional attempt)

77
Q

Breach

A

occurrence of a security measure being bypassed or thwarted by a threat agent

78
Q

Elements of Risk

A

THREATS exploit VULNERABILITIES which results in EXPOSURE which is RISK which is mitigated by SAFEGUARDS which protect ASSETS which are endangered by THREATS

79
Q

Risk management/analysis is primarily an exercise for _______

A

upper management

80
Q

Six Major Elements of Quantitative Risk Analysis

A

Assign Asset Value, Calculate Exposure Factor, Calculate SLE, Assess ARO, Derive ALE, Perform cost/benefit analysis of countermeasures

81
Q

EF

A

Exposure Factor - loss potential %

82
Q

SLE

A

Single Loss Expectancy = AV * EF

83
Q

ARO

A

Annualized Rate of Occurrence is the expected frequency with which a threat or risk will occur in a single year

84
Q

ALE

A

Annualized Loss Expectancy = SLE * ARO

85
Q

Cost/Benefit Analysis steps

A

Pre-countermeasure ALE, Post-countermeasure ALE, Annual Cost of safeguard

86
Q

Delphi Technique

A

anonymous feedback and response process used to enable a group to reach an anonymous consensus

87
Q

4 Possible Risk Responses

A

Reduce/Mitigate, Assign/Transfer, Accept, Reject/Ignore

88
Q

Risk Mitigation or Reduction

A

implementing safeguards and countermeasures to reduce threats

89
Q

Risk Assignment

A

Insurance

90
Q

Residual Risk

A

Risk remaining once countermeasures are implemented

91
Q

Total Risk = _______

A

Threats * Vulnerabilities * AV (Not multiplications)

92
Q

Difference between total risk and residual risk

A

Controls gap - amount of risk reduced by implementing safeguards

93
Q

3 Categories of Security Control Implementation

A

Physical, Logical/Technical, Administrative

94
Q

Technical Controls

A

involves hw or sw mechanisms used to manage access and provide protection

95
Q

Administrative Controls

A

policies and procedures

96
Q

Physical Controls

A

Controls you can physically touch

97
Q

Control Types (7)

A

Deterrent - convinces user to not taking actions Preventative - blocks user from taking action
Detective - post action, discover activity
Compensating- aid in enforcement
Corrective - modifies environment to return to normal
Recovery - extension of corrective, more advanced
Directive - direct, control, or confine the actions of subjects to force or encourage compliance

98
Q

A prerequisite to security training is ______

A

Awareness

99
Q

Training vs Education

A

education is more detailed and provides more than users needs to know for their jobs

100
Q

BCP

A

Business Continuity Planning involves assessing the risks to organizational processes and creating policies, plans, and procedures to minimize the impact those risks might have on the organization if they were to occur

101
Q

The top priority of BCP and DRP is always __________

A

people

102
Q

The overall goal of BCP is ____________________

A

to provide a quick, calm, and efficient response in the event of an emergency

103
Q

4 main steps of the BCP process

A

Project Scope and Planning
Business Impact Analysis
Continuity Planning
Approval and implementation

104
Q

Project Scope and Planning Requirements

A

■ Business Org Analysis
■ BCP Team Creation
■ Resource Assessment
■ Legal and regulatory analysis

105
Q

Business Org Analysis

A

identify all departments and individuals who have a stake in the BCP

106
Q

BCP Team Selection

A

Reps from core service departments, reps from key support departments, IT reps, security reps, legal reps, senior management reps

107
Q

Three Phases of BCP

A

BCP Development, BCP Testing, Training, and Maintenance, and BCP Implementation

108
Q

The most significant resources consumed by the BCP plan are ________

A

people

109
Q

BIA

A

Business Impact Analysis - identifies the resources that are critical to an organization’s ongoing viability and the threats posed to those resources, assess likelihood and impact of those threats being realized

110
Q

5 Steps of BIA

A
  1. Identify Priorities
  2. Identify Risks
  3. Likelihood Assessment
  4. Impact Assessment
  5. Resource Prioritization
111
Q

Identify Priorities

A

1st step of BIA, determine most essential activities to day to day operations

112
Q

MTD/MTO

A

Maximum Tolerable Downtime, Maximum Tolerable Outage - maximum length of time a business function can be inoperable without causing harm to the business

113
Q

RTO

A

Recovery Time Objective - amount of time in which you think you can feasibly recover the function in the event of a disruption

114
Q

Goal of BCP is to ensure that RTO is _____ than your MTD

A

less

115
Q

Sources for Likelihood Assessment

A

NOAA, FEMA, USGS

116
Q

Categories of Law

A

Criminal, civil, adminstrative

117
Q

CCCA of 1984

A

Comprehensive Crime Control Act, exclusively cover computer crimes that crossed state boundaries to
avoid infringing on states’ rights and treading on thin constitutional ice

118
Q

CFAA of 1986

A

Computer Fraud and Abuse Act - changes to cover all federal interest computers

119
Q

1994 CFAA Amendments (4)

A

■ Outlawed the creation of any type of malicious code that might cause damage
■ Modified the CFAA to cover any computer used in interstate commerce
■ Allowed for the imprisonment of offenders, regardless of whether they actually intended to cause damage
■ Provided legal authority for the victims of computer crime to pursue civil action

120
Q

CSA of 1987

A

Computer Security Act, mandated baseline security requirements for all federal agencies, gave NIST responsibility for developing standards

121
Q

Following the CSA, the NSA retained authority over __________ and NIST gained responsibility for _________

A

NSA retained authority over classified systems, NIST gained responsibility for securing all other federal govt systems

122
Q

Three Major provisions of Federal Sentencing Guidelines

A

Prudent Man Rule (hold senior executives responsible), Minimize punishment by showing due care and due diligence, Three burdens of proof (legalize recognized obligation, failure to comply with standards, and relationship between act of negligence and damages)

123
Q

National Information Infrastructure Protection Act of 1996

A

Amendments to CFAA, covers international commerce, covers national infrastructure, treats damage causing act as felony

124
Q

Law Timeline

A 
1984 - CCCA
1986 - CFAA
1987 - CSA
1991 - Federal Sentencing Guidelines
1994 - CFAA Amendments
1995 - Paperwork Reduction Act
1996 - National Info Infrastructure Protection Act
2000 - GISRA
2002 - FISMA
125
Q

Paperwork Reduction Act

A

agencies must obtain OMB approval before requesting info from the public

126
Q

GISRA

A

Government Information Security Reform Act of 2000 amended Paperwork Reduction Act to implement additional information security policies and procedures

127
Q

FISMA

A

Federal Information Security Management Act, requires that federal agencies implement an information security program that covers the agency’s operations

128
Q

The most valuable asset of most organizations is their __________

A

Intellectual Property

129
Q

Copyright Law

A

guarantees the creators of “original works of authorship” protection again the unauthorized duplication of their work

130
Q

The precedent for copyrighting computer software puts software under the scope of _______

A

literary works

131
Q

Copyright law as it pertains to computer software protections ___________

A

the actual source code - the Expression inherent in the computer software

132
Q

Copyright law: Works by one or more authors are protected until __ years after ____________

A

70 years after the death of the last surviving author

133
Q

Works for hire and anonymous works are provided protection for ________

A

95 years from the date of the first publication or 120 years from the date of creation, whichever is shorter

134
Q

Trademarks

A

Protect words, slogans, and logos sued to identify a company and its products or services

135
Q

Patents

A

protect the intellectual property rights of inventors, 20 years of exclusive rights then public

136
Q

Trade Secrets

A

Not time limit, IP that is critical to business, best wya to protect computer software

137
Q

Licensing types

A

Contractual (written contract), shrink-wrap, Click-through, Cloud services

138
Q

4th Amendment

A

protection of privacy

139
Q

Privacy Act of 1974

A

limits federal governments ability to disclose and retain private information

140
Q

ECPA of 1986

A

Electronic Communications Privacy Act of 1986 makes it a crime to invade the electronic privacy of an individual

141
Q

CALEA of 1994

A

Communications Assistance for Law Enforcement Act amended ECPA and requires all communication carries to make wiretaps possible for law enforcement with an appropriate court order

142
Q

Economic and Protection of Proprietary Information Act of 1996

A

extends definition of property to include proprietary economic information (expands definition of theft)

143
Q

HIPAA

A

Health Insurance Portability and Accountability Act - privacy and security regulations requires strict security for medical information

144
Q

HITECH

A

Health Information Technology for Economic and Clinical Health Act, update to HIPAA, data break notification law

145
Q

COPPA

A

Children’s Online Privacy Protection Act - state information collected, parents can review and collected information, verifiable consent for under age 13

146
Q

Gramm-Leach-Biley Act

A

types of info which can be exchanged by banks

147
Q

USA PATRIOT Act

A

Uniting and Strengthening America by Providing Appropriate Tools Required to Intercept and Obstruct Terrorism

148
Q

FERPA

A

Family Educational Right and Privacy Act - affects any education institution that accepts any federal funding

149
Q

Identify Theft and Assumption Deterrent Act

A

made identify theft a crime

150
Q

ITIL

A

IT service mgmt

151
Q

OCTAVE

A

self directed risk assessment

152
Q

ISO 27001

A

intro on the control for ISMS

153
Q

ISO 27002

A

the how to implement security controls for ISMS

CISSP (9 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions