Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CISSP > Domain 1: Security and Risk Management > Flashcards

Domain 1: Security and Risk Management Flashcards

1
Q

CIA

A

Confidentiality, Integrity and Availability

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

States of Data

A

At rest
In process
In transit

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Password Masking CIA principle

A

Condifentiality

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Data in transit basic protection

A

TSL or SSL

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Confidentiality overt and covert techniques

A

Cryptography
Masking
Steganograhy

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Protection against system or software modification

A

Integrity

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Methods to ensure integrity

A 
CRC
Checksum
Message Digest
Hashes
MAC
Input Validation!!!
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Availability description

A

Provide timely access to a resource

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Availability metrics

A

Tolerance for losses: MTD/RTO/RPO
Lega: SLA
Life expectancy: MTBF/MTTR

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

MTBF

A

Mean Time Between Failure: the expected lifespan of the device

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

MTTR

A

Mean Time To Repair: how much time will be required to restore de component to functionality

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

RPO

A

Recovery Point Objective: how much data can be lost after a restoration

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

MTD

A

Maximum Tolerance Downtime: how long can the component/system can be down before our lose is unacceptable.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

SLA

A

Service Legal Agreement

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

IAAA

A

Identification
Authentication
Authorization
Accountability

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

FAR

A

False Accept Rate

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

FRR

A

False Reject Rate

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Access Control Models

A

DAC
MAC
RBAC
RuBAC

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

DAC

A

Discretionary Access Control: Zero knowledge

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

MAC

A

Mandatory Access Control: Labels

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

RBAC

A

Role Based Access Control

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

RuBAC

A

Rule Based Access Control

23
Q

CRUD operations

A

Create
Read
Update
Delete

24
Q

Accountability requirements

A

Time
Action
Subject
Object

25
Q

Tenets or secure architecture and design (16)

A
  1. How much security is enough?
  2. Defense in depth
  3. Fail-safe
  4. Economy of Mechanism (the K.I.S.S principle)
  5. Completeness of Design
  6. Least Common Mechanism
  7. Open Design
  8. Consider the Weakest Link
  9. Redundancy
  10. Psychological acceptability
  11. Separation of Duties (SOD)
  12. Mandatory Vacations
  13. Job Rotation
  14. Least privilege
  15. Need to know
  16. Dual Control
26
Q

Risk

A

Likelihood that a threat will exploit a vulnerability in an asset

27
Q

Threat (amenaza)

A

Has the potential to harm an asset

28
Q

Vulnerability

A

A weakness; lack of a safeward

29
Q

Exploit

A

Instance of compromise

30
Q

Security Controls

A

Protective mechanisms to secure vulnerabilities
Safeguards: Proactive (Deters and/or Prevents)
Countermesures: Reactive (Detects and/or Corrects)

31
Q

Secondary Risk

A

Risk event that comes as a result of another risk response

32
Q

Residual Risk

A

The amount of risk left over after a risk response.

Total Risk * Control GAP

33
Q

Fallback Plan

A

Plan B

34
Q

Workarround

A

Unplanned response

35
Q

Asset

A

Something that has value and we need to protect

36
Q

Total Risk

A

Amount of risk without implementing mitigation.

Threats * Vulnerabilities * Asset Value

37
Q

Risk assessment

A

Identify an valuate assets; identify threats and vulnerabilities

38
Q

Risk analisys

A

Value of potential risks

39
Q

Risk mitigation

A

Respond to risk

40
Q

Risk monitoring

A

Risk 4 ever

41
Q

Risk Management (AAMM)

A

Assessment
Analisys
Mitigation
Monitoring

42
Q

Risk assessment methodologies

A

OCTAVE
FRAP
NIST 800-30

43
Q

NIST 800-30 9 steps

A
  1. System characterization
  2. Threat identification
  3. Vulnerability identification
  4. Control analisys
  5. Likelihood determination
  6. Impact analysis
  7. Risk determination
  8. Control recommendations
  9. Results documentations
44
Q

Risk analysis types

A

Qualitative: Nature. (High, Medium, Low). Objective opinions.
Quantitative: Determine money value. More expertise and time

45
Q

Delphi Technique

A

Qualitative risk analysis technique

46
Q

AV

A

Asset Value: Money

47
Q

EF

A

Exposure Factor: Percentage of loss expected when an event happends

48
Q

SLE

A

Single Loss Expectancy: Cost of a single occurrence of a threat instance. AV * AF

49
Q

ARO

A

Annual Rate of Occurrence: How often the threat is expected to materialize

50
Q

ALE

A

Annual Loss Expectancy: Cost per year as a result of a threat. SLE * ARO

51
Q

TCO

A

Total Cost of Ownership: total cost of implementing safeguards and maintenance.

52
Q

ROI

A

Return On Investment: Money saved implementing a safeguard. ALE_before - ALE_after - TCO

53
Q

Risk mitigation strategies

A

Reduce: final step is Avoid (eliminate)
Accept: Cost of mitigation > Asset Value. Final step is Reject (not studying the risk)[3 monkeys]
Transfer: Insurance or SLA

CISSP (8 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions