Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

KM - Personal CISSP > Domain 1 -- Security and Risk Management > Flashcards

Domain 1 -- Security and Risk Management Flashcards

1
Q

What are the ways to achieve Availability?

A
  • RAID disks
  • Clustering
  • Load Balancing
  • Redundant Data and Power lines
  • Software and data backups
  • Disk shadowing
  • Co-location and off-site facilities
  • Rollback functions
  • Failover configurations
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What are the ways to achieve Integrity?

A
  • Hashing (data integrity)
  • Configuration management (system integrity)
  • Change Control (process integrity)
  • Access Control (Physical and technical)
  • Software digital signing
  • Transmission Cyclic Redundancy Check (CRC Functions)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What are ways to achieve Confidentiality?

A
  • Encryption for data at rest (whole disk or DB encryption)
  • Encryption for data in transit (IPSec, TLS, PPTP, SSH)
  • Access Control (physical and technical)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Definition of Vulnerability

A

A vulnerability is a weakness in a system that allows a threat source to compromise its security

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What is a threat?

A

A threat is any potential danger that is associated with the exploitation of a vulnerability.

The entity that takes advantage of a vulnerability is a threat agent

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What is a risk?

A

A risk is a likelihood of a thread source exploiting a vulnerabilty.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What is an exposure?

A

An exposure is an instance of being exposed to losses.

A vulnerability exposes an organization to possible losses

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What is a control?

A

A control is a countermeasure put in place to mitigate (reduce) the potential risk

Note: Control, Countermeasure and safeguard are interchangeable terms

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What is the relationship between Vulnerabilities, threats, risks, exposures and controls?

A

See Image

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What are the three types of Controls?

A
  • Administrative
  • Technical
  • Physical
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Give Examples of Physical Controls

A
  • Fence
  • Locked external doors
  • CCTV
  • Security Guard
  • Locked internal doors
  • Locked server room
  • Physically secured computers (cable locks)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What are examples of Technical Controls?

A
  • Firewalls
  • Intrusion Detection Systems
  • Intrusion Prevention systems
  • Antimalware
  • Access control
  • Encryption
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What are examples of administrative controls?

A
  • Security Documentation
  • Risk Management
  • Personnel security
  • Training
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What are the six different control functionalities?

A
  • Preventive
  • Detective
  • Corrective
  • Deterrent
  • Recovery
  • Compensating
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Give examples of Administrative Preventive Contols

A
  • Policies and procedures
  • Effective hiring practices
  • Pre-employment background checks
  • Controlled termination processes
  • Data Classification and labeling
  • Security awareness
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Give examples of Physical Preventive Controls

A
  • Badges and swipe cards
  • Guards, dogs
  • Fences, locks, mantraps
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Give examples of Techical Preventive Controls

A
  • Passwords, biometrics, smart cards
  • Encryption, secure protocols, call-back systems, database views, constrained user interfaces
  • Antimalware software, access control lists firewalls, intrusion prevention systems
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Is Security through Obscurity a good idea or a bad idea?

A

Bad idea

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What is a framework for developing a Security Program?

A

ISO/IEC 27000 Series

Examples:

  • ISO / IEC 27014 Information Security Governance
  • ISO / IEC 27031 Business Continuity
  • ISO / IEC 27035 Incident Management
  • ETC.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What are Standards for Enterprise Architecture Development?

A
  • Zachman Framework
  • TOGAF - The Open Group Arch Framework
  • DoDAF - Dept of Defense Arch Framework
  • MODAF - Arch frameword developed by British Ministry of Defence
  • SABSA Model - Model and methodology for the Dev of Security enterprise architectures
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

What are the Security Controls Development Frameworks?

A
  • COBIT 5 - Developed by the Information Systems Audit and Control Association (ISACA)
  • NIST SP 800-53 – Set of controls developed by NIST to protect Federal Systems
  • COSO Internal Control - Integrated Framework. Developed by the Committee of Sponsoring Organizations (COSO) of the Treadway Commision
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

What are the three key Process Management Development Frameworks?

A
  • ITIL - IT Service Management (started in UK)
  • Six Sigma
  • CMMI - Capability Maturity Model Integration (developed by Carnegie Mellon)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

What are the key things to remember about the Zachman Framework?

A
  • Interogatives / Perspectives
  • What / How / Where / Who / When / Why
  • Top to bottom Executives to Technicians
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

What are the key things to remember about TOGAF

A

Used to develop

  • Business Architecture
  • Data Architecture
  • Application architecture
  • Technology architecture
  • Architecture Development Model
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

What are the key things to remember regarding DoDAF and MODAF?

A
  • These are military architectural frameworks
  • These are designed to solve the problem of communicating information from a very large collection of agencies/stakeholders
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

What does SABSA stand for and why is it important?

A
  • SABSA stands for Sherwood Applied Business Security Archicture
  • Similar to Zachman framework for security architecture
  • What are you trying to do at this layer?
  • Why are you doing it?
  • How are you trying to do it?
  • Who is involved?
  • Where are you doing it?
  • When are you doing it?
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

What does ISMS stand for and what is a synonym for it?

A

ISMS stands for Information System Management System

An ISMS is the same as a Security Program

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

What does COBIT stand for and what are its five key principles?

A

COBIT – Controls Objectives for Information and related Technology

5 principles

  • Meeting stakeholders needs
  • Covering the enterprise end to end
  • Applying a single integrated framework
  • Enabling a holistic approach
  • Separating governance from management

Note – COBIT deals with all aspects of IT, not just security

Note – COBIT is used in the private sector, NIST SP 800-53 is used in gov

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

What does COSO stand for and what are its five control principles?

A

COSO stands for Committe of Sponsoring Organizations (COSO)

The COSO Internal Control – Integrated Framework is a set of internal corporate controls to help reduce the risk of financial fraud.

  1. Control Environment
  2. Risk Assessment
  3. Control Activities
  4. Information and Communication
  5. Monitoring Activities
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

What’s the difference between the COSO IC framework and COBIT?

A
  • The COSO Integrated Controls Framework is a model for corporate governance
  • COBIT is a model for IT governance
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

Which is more dangerous – a script kiddie or an Advanced Persistent Threat (APT)?

A

An Advanced persistent threat is more dangerous

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

What does GDPR stand for and what is its goal?

A

GDPR stands for General Data Protection Regulation

It is intended to protect personal data and privacy for EU citizens

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

What does the Wassenaar arrangement deal with and what is its goal

A

The Wassenaar arrangement implements export controls for Conventional Arms and Dual-use Goods and Technologies.

  • It is designed to prevent one country from building up too much military capability
  • Part of the Wassenaar arrangement deals with cryptography
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

What is the strongest form of intellectual property protection?

A

a patent

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

What’s the difference between the following?

  • Freeware
  • Shareware/Trial Software
  • Commercial Software
  • Academic software
A
  • Freeware - Free
  • Shareware/Trial Software - Free trial version
  • Commercial Software
  • Academic software - software used by academic institutions at a reduced cost
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

What does DMCA stand for and what is its intent?

A

DMCA stands for Digital Millennium Copyright Act.

It makes it illegal to circumvent copyright protection mechanisms

37
Q

What do policies need to be independent of?

A

Policies need to be independent of technologies and solutions.

Policies should outline goals and missions, but leave it up to the organization to decide how to accomplish them

38
Q

Name three types of policies

A
  • Regulatory
  • Advisory
  • Informative
39
Q

What is a baseline?

A

The term baseline refers to a point in time that is used as a comparison for future changes

40
Q

What is a Guideline?

A

Guidelines are recommended actions and operational guides to users, IT staff, operations staff, and others when a specific standards does not apply.

41
Q

What are procedures?

A

Procedures are detailed step-by-step tasks that should be performed to achieve a certain goal.

42
Q

What is Risk Management?

A

Risk Management (RM) is the process of identifying and assessing risk, reducing it to an acceptable level, and ensuring it remains at that level.

43
Q

What are the three tiers of Risk Management?

A
  1. Organizational Tier
  2. Business process Tier
  3. Information Systems Tier
44
Q

What does ISRM stand for?

A

Information Systems Risk Management

45
Q

What are the four components of the NIST SP 800-39 standard for Risk Management?

A
  1. Frame Risk
  2. Assess Risk
  3. Respond to Risk
  4. Monitor Risk
46
Q

What is Threat Modeling?

A

Threat Modeling is the process of describing feasible adverse effects on our assets caused by threat sources.

47
Q

What are three components of vulnerabilities in threat modeling?

A
  • Information
    • Data (at rest, in motion, in use)
  • Processes
  • People
48
Q

What are two common threat modeling methodologies?

A
  • Attack Trees - make a graph to show the threat
  • Reduction analysis
    • Reduce the number of attacks that must be considered
    • Reduce the threat posed by the attack
49
Q

What’s the difference between Risk Assessment and Risk Analysis?

A

For the CISSP exam. . .

Risk Assessment is the broader effort

Risk Analysis are the specific tasks performed in order to support the goal of risk assessment

50
Q

What are the four main goals of Risk Management?

A
  1. Identify assets and their value to the organization
  2. Determine the likelihood that a threat exploits a vulnerability
  3. Determine the business impact of these potential threats
  4. Provide economic balance between the impact of the threat and the cost of the countermeasure

At a high level Risk Analysis provides a cost/benefit comparison

51
Q

Should the risk assessment team only include specialists from IT and from Security?

A

No – It should include representatives from a broad cross section of the company

52
Q

What are four good questions to ask during a Risk Assessment?

A
  1. What event could occur (threat event)?
  2. What could b the potential impact (risk)?
  3. How often could it happen (frequency)?
  4. What level of confidence do we have in the answers to the first three questions (certainty)?
53
Q

What is the document that NIST developed for Conducting Risks Assessments?

A

NIST SP 800-30 Revision 1

54
Q

What does FRAP stand for and what should be remembered about it?

A

FRAP stands for Facilitated Risk Analysis Process

It is a qualitative methodology

It’s IT focused

55
Q

What does OCTAVE stand for and what is it used for?

A

OCTAVE stands for:
Operationally Critical Threat, Asset, and Vulnerability Evaluation

It’s a Risk Assessment Methodology.

IT focused

56
Q

How does the ISO 27005 Risk Assessment Methodology differ from other risk assessement methodologies?

A

Other methodologies are focused on IT and operations.

The ISO 27005 is focused not only on IT and operations, but on other softer issues as well, such as documentation and training

57
Q

What does FMEA stand for and what is it used for?

A

FMEA stands for

Failure Mode Effect Analysis

Figure out where things are most likely to break and then determine what to do about it.

It is a methodology used in product development

58
Q

What does CRAMM stand for and what is it used for?

A

Central Computing and Telecommunications Agency Risk Analysis and Management Method

Was created by the United Kingdom and now an automated tool sold by Siemens

59
Q

What’s the difference between a risk assessment and a risk analysis?

A

A risk assessment is used to gather the data

A risk analysis examines the gathered data to produce results that can be acted upon

60
Q

What are the two main risk analysis approaches?

A
  1. Quantitative
  2. Qualitative
61
Q

What’s the difference between a vulnerability assessment and a risk assessment?

A

A vulnerability assessment just identifies the vulnerabilities (holes)

A risk assessment calculates the probability of the vulnerabilities being exploited and the associated business impact

62
Q

What does SLE stand for and give an equation that uses it

A

SLE stands for Single Loss Expectancy

SLE = Asset Value x Exposure Factor (EF)

63
Q

What is the Exposure Factor (EF)?

A

The Exposure Factor represents the percentage of loss a realized threat could have on a certain asset.

If a data warehouse was valued at $150K and the EF was 25%, then the SLE would be ($150K x 25%) = $37.5K

64
Q

What does ALE stand for and how is it used?

A

ALE stands for Annual Loss Expectancy.

ALE = SLE x Annualized Rate of Occurrence (ARO)

ARO stands for Annual Rate of Occurence and it is the estimated frequency of a specific threat taking place within a 12-month timeframe

Key point – Never spend more per year than the ALE to protect something.

65
Q

What are the five expected results of a Quantitative Risk Analysis?

A
  1. Monitary value assigned to assets
  2. Comprehensive list of all significant threats
  3. Probability of the occurrence rate of each threat
  4. Loss potential the company can endure per threat in a 12-month time span
  5. Recommended controls
66
Q

What’s the quantitative equation for cost/benefit analysis in Risk Management

A

(ALE before implementing safeguard)

-

(ALE after implementing safeguard) -

-

(Annual cost of safeguard)

=Value of Safeguard to company

67
Q

A Business Impact Analysis (BIA) is a component of what Broader Effort?

A

Business Continuity Planning

68
Q

What is Residual Risk

A

Even after implementing a countermeasure, there is still some risk left over. Risk is never completely eliminated

69
Q

What are the four ways of dealing with risk?

A
  1. Transfer it
  2. Avoid it
  3. Reduce it
  4. Accept it
70
Q

What is Supply Chain Risk Management and what is the Target Example?

A

Some attackers will attack the supply chain of a company, rather than the company itself.

Target’s HVAC vendor was targeted and compromised.

From there, the attackers were able to target Point of Sale systems and get credit card info.

71
Q

What does RMF stand for?

A

Risk Management Framework

72
Q

List three Commonly accepted Risk Management Frameworks

A
  • NIST RMF (SP 800-37r1)
  • ISO 31000:2018
  • ISACA Risk IT
73
Q

What are the six steps in the NIST Risk Management Framework?

A
  1. Categorize information system
  2. Select Security Controls
  3. Implement Security Controls
  4. Assess security controls
  5. Authorize information system
  6. Monitor Security Controls
74
Q

What is the equation for Residual Risk?

A

(threats x vulnerability x asset value) x controls gap = residual risk

75
Q

What is the order of steps in the Capability Maturity Model Integration?

A
  1. Initial
  2. Repeatable
  3. Defined
  4. Quantitively Managed
  5. Optimizing
76
Q

What is the purpose of the Organization for Economic Cooperation and Development (OECD)?

A

Almost every country has its own rules pertaining to what constitutes private data and how it should be protected. As the information/digital age upon us, the different laws started to negatively affect international trade.

Thus, the OECD was born to develop guidelines so that data is protected and everyone follows one set of rules.

77
Q

Define the roles of the following committees:

  • Security policy committee
  • Audit committee
  • Risk Management Committee
  • Security Steering Committee
A
  • Security Policy Committe – chosen by senior management to produce security policies
  • Audit Committe – goal is to provide independenct and open communication among the board of directors, management, internal auditors and external auditors.

Reports its findings to the steering committee

  • Risk Management Committee – purpose is to understand the risks that an organization faces as a whole and work with senior management to reduce them to acceptable levels
  • Security Steering Committe - Responsible for making decisions on strategic and tactical issues within an organization
    • Should be made up of individuals throughout the org.
    • Responsible for Vision statement and Mission statement for CIA
    • Does not create the actual policies themselves
78
Q

What is the purpose of AS/NZS 4360?

A

AS/NZS 4360 takes a very broad approach to risk management. It can be used to understand a company’s financial, captial, human safety and business decision risks.

While it can be used to analyze security risks, it was not created for that purpose.

79
Q

What are the four ways of dealing with risk?

A
  • Risk Mitigation
  • Risk Transference
  • Risk Acceptance
  • Risk Avoidance
80
Q

Define the following:

  • ISO/IEC 27002
  • ISO/IEC 27003
  • ISO/IEC 27004
  • ISO/IEC 27005
A
  • ISO/IEC 27002 - Code of practice for information security management
  • ISO/IEC 27003 - Guideline for ISMS implementation
  • ISO/IEC 27004 - Guideline for information security management measurement and metrics framework
  • ISO/IEC 27005 - Guideline for information security risk management
81
Q

What are the 8 steps of a Business Impact Analysis (BIA)?

A
  1. Select individuals to interview for data gathering
  2. Create data gathering techniques (surveys,questionnaires, etc.)
  3. Identify the company’s critical business functions
  4. Identify the resources these functions depend on
  5. Calculate how long these functions can survive without these resources (maximum tolerable downtime)
  6. Identify vulnerabilities and threats to these functions
  7. Calculate the risk for each different business function
  8. Document findings and report to management
82
Q

What’s the best way to keep the BCP plan up to date?

A

Integrate the BCP with the Change Management process

83
Q

What does the ISO/IEC 27031 standard deal with?

A

ISO/IEC 27031 is a set of guidelines for information and communications technology readiness for business continuity. It is a component of the overall ISO/IEC 27000 series

84
Q

What are the key features of the Digital Millennium Copyright Act (DMCA)?

A

The DMCA is a US copyright law that criminalizes the production and dissemination of technology, devices or services that circumvent access control measures that are put into prlace to protect copyright material.

85
Q

What is the Internet Architecture Board and what role does it play?

A

The Internet Architecture Board (IAB) is the coordinating committee for Internet design, engineering and management. It is responsible for:

  • The architectural oversight of the Internet Engineering Task Force (IETF) activities
  • The Internet Standards Process oversight
  • Appeal and editor of Request for Comments
  • It issues ethics related statements concerning the use of the Internet
86
Q

What was the first international treaty seeking to address computer crimes by coordinating national laws and improving investigative techniques and international cooperation?

A

The Council of Europe Convention on Cybercrime

87
Q

What is the European Union Data Protection Directive?

A

The Data Protection Directive is a set of principles addressing using and transmitting information that is considered private.

All EU contries must comply

Any company that wants to do business in the EU must comply

88
Q

What is the purpose of the Safe Harbor requirements?

A

The Safe Harbor requirements were created to harmonize the data privacy practices of the US with the EU’s stricter privacy controls and to prevent accidental information disclosure and leaks.

US companies certify against the Safe Harbor rule base.

89
Q

How many sets of instructional books are included in ITIL and which is considered the core set?

A
  • ITIL consists of 5 sets of books.
  • The core fundamental approach of ITIL lies in the creation of a Service Strategy, which is focused on overall planning for intended IT Services.
  • Other components of ITIL:
    • Service Design
    • Service Transition Stage
    • Service Operation
    • Continual Service Improvement

KM - Personal CISSP (9 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions