Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

- > Domain 1: Security and Risk Management > Flashcards

Domain 1: Security and Risk Management Flashcards

1
Q

What is the CIA Triad?

A

Confidentiality, Integrity and Availability

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What is the principle of ‘confidentiality’?

A

It is about protecting secrecy of data, objects, or resources by preventing unauthorised access to data. Prevent unauthorised disclosure, need to know, and least privilege, assurance that information is not disclosed to unauthorised programs, users, processes, encryption, logical and physical access control.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What is the principle of ‘integrity’?

A

Protecting the reliability and correctness of data. Examples include access controls, IDS/IPS, and hashing.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What is the principle of ‘availability’?

A

Providing authorised subjects timely and uninterrupted access to objects. This means access to data is reliable, timely, accessible, fault tolerant, and has recovery procedures in place. Examples include, monitoring network traffic.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What is an ‘object’?

A

Passive element, such as files, computers, network connections, and applications

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What is a ‘subject’?

A

Active element in a security relationship, such as users, programs and computers.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What is defense in depth?

A

Use of multiple controls in a series to protect an asset

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What is abstraction?

A

Where details of something is hidden. Security controls can be applied to the entire group (thus hiding the details)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What is ‘IAAA’?

A

Identification, Authentication, Authorisation, and Auditing

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What is ‘Authentication’?

A

Proving one’s identity. Process of verifying or testing that the claimed identity is valid. Examples include providing a correct password, or other correct information.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What is ‘Authorisation’?

A

About defining the permissions (e.g. grant or deny) of a resource and object access for a specific identity. It involves evaluating an access control matrix that compares the subject, the object, and the intended activity.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What is ‘Auditing’?

A

Process of recording log files to check for compliance and violations in order to hold subjects accountable for their actions. Ensures that a subject’s actions are non-repudiation.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What is ‘layering’?

A

Use of multiple controls in a series. Also known as Defense in Depth. Serial configurations (controls in a row) are very narrow but very deep, alternatively parallel configurations are very broad, but lack depth.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What is ‘data hiding’?

A

Preventing data from being discovered or accessed by a subject positioning the data in a logical storage compartment that is not accessible or seen by the subject. Such as polyinstantiaton.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What is the weakest element in any security solution?

A

Humans

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What role does job descriptions play when hiring new staff?

A

Ensure job descriptions consider separation of duties to separate key functions to limit ability for one employee to circumvent key security controls. Further, ensure a classification for the job.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What is ‘job rotation’?

A

Rotating employees among multiple job positions. This is the best way to investigate an employee’s daily business activity to uncover any potential fraud that may be taking place.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Strategic Plan

A

Long term plan defining organisation’s security purpose. Aligns the plan with the organisations goals, mission, objectives. This is a 5 year plan with annual reviews

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Tactical Plan

A

Mid term plan developed to provide more details on accomplishing the goals set forth in the strategic plan or can be crafted ad hoc based upon unpredictable events. This lasts a year

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Operational Plan

A

Short term (for a month or quarter) highly detailed plan. Purpose to retain compliance with tactical plans. The plans may include: resource allotments, budgetary requirements.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Data Classification Process

A

Identify the custodian, specify evaluation criteria, document any exceptions, select security controls for each level, specify the procedures for declassifying, and create enterprise wide awareness program

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Levels of Government/military classification

A

Top Secret, Secret, Confidential, Sensitive but Unclassified, Unclassified

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Levels of Corporate classifications

A

Confidential, Private, Sensitive, Public

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Due care

A

Using responsible care to protect the interests of an organisation. Company must do all that it could have reasonably done to try and prevent a security breach /compromise/disaster, and take the necessary steps required as countermeasures/controls (safeguards).

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

Due diligence

A

Practicing activities that maintain due care effort. Company properly investigated all of its possible weaknesses and vulnerabilities AKA understanding the threats.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

Information security program

A

Designing and implementing security practices to protect critical business process and assets.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

Types of policies

A

Corporate policy, security policy, system specific policy and issue specific policy

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

Dual control

A

Where two people must simultaneously authorise an action, such as use of two keys. This is similar to M of N control

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

What is the order of security documents in an organisation?

A

Policies –> Standards/Baseline –> Guidelines –> Procedures

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

What is a security policy?

A

Document that defines the scope of security needed by the organisation at a high level. Discusses the assets that require protection, and assigns roles and responsibilities.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

What is a ‘standard document’?

A

Mandatory document that provides compulsory requirements for systems to enable consistent use

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

Guidelines

A

Not mandatory, suggestive in nature actions to guide users

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

Procedure documents

A

For example, these are Standard Operating Procedures that provide step by step instructions on a given topic

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

Baselines

A

Mandatory minimum acceptable security configuration for a system or process, e.g. performing hardening, has a standard image

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

Risk

A

Possibility or likelihood of a threat exploiting a vulnerability to cause harm. Calculated as Risk = Threat x Vulnerability

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

Threat

A

Potential cause of an unwanted incident, which may result in harm to a system or organisation. Threats exploit vulnerabilities.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

Vulnerability

A

Weakness in a system that allows a threat source to compromise its security

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

Exposure

A

Being susceptible to asset loss because of a threat

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

Safeguards

A

Security control to reduce/remove a vulnerability. Can be a technical, physical or administrative control

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
40
Q

Attack

A

Exploitation of a vulnerability by a threat agent

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
41
Q

Breach

A

Intentional or unintentional release of private data to an untrusted environment.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
42
Q

Threat agent

A

Entity that takes advantage of a vulnerability

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
43
Q

What is ‘DAD’?

A

Negative to CIA, this is the

  1. Disclosure
  2. Alteration
  3. Destruction
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
44
Q

Privacy

A

Maintaining the confidentiality of data

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
45
Q

ISO 27005

A

Risk management framework

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
46
Q

Risk management approach

A

It is not possible to get rid of all risk, therefore, aim is to bring risk to an acceptable/tolerable level

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
47
Q

Responsibilities of the Information Security Officer

A
  • Written products - ensure they are done
  • Cyber Incident Response Team - implement and operate
  • Security awareness - provide leadership
  • Communicate - risk to higher management
  • Report to as high a level as possible
  • Security is everyone’s responsibility
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
48
Q

Control Frameworks

A

Ensure control frameworks are:

  1. Consistent - approach and application
  2. Measurable - way to determine progress
  3. Standardised - all the same
  4. Comprehension - examine everything
  5. Modular - to help in review and adaptive. Layered, abstraction.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
49
Q

Patent

A

Grants ownership of an invention and provides enforcement for owner to exclude others from practicing the invention. After 20 years the idea is open source of application.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
50
Q

Copyright

A

Protects the expression of ideas but not necessarily the idea itself. For example, poem or song. Expires 70 years after author dies.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
51
Q

Trade secret

A

Something that is proprietary to a company and important for its survival and profitability (like formula of Coke or Pepsi). This is NOT registered

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
52
Q

Trademarks

A

Words, name, product shape, symbol, color or a combination used to identify products and distinguish them from competitor products. For example, McDonald’s ‘M’. Expires in 10 years

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
53
Q

Wassenaar Agreement (WA) AKA International Traffic in Arms Regulations

A

Agreement which implemented controls on the export of cryptographic systems.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
54
Q

SOX

A

Sarbanes Oxley. Protects shareholders and the general public from accounting errors and fraudulent practices in enterprises, and to improve the accuracy of corporate disclosures.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
55
Q

Section 302 SOX

A

CEO’s and CFO’s can be sent to jail when the information they sign is incorrect. CEO must sign

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
56
Q

Section 404 SOX

A

This is about internal controls assessment: describing logical controls over accounting files, good auditing and information security.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
57
Q

Legal Liability for Executives

A

Executives are now held liable if the organisation they represent is not compliant with the law

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
58
Q

Negligence

A

It is a breach of duty of care. This occurs if there is a failure to implement recommended precautions, if there is no contingency/disaster recovery plan, failure to conduct appropriate background checks, failure to institute appropriate information security measures, failure to follow policy or local laws and regulations.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
59
Q

COSO

A

Internal control system/framework to work with Sarbanes Oxley 404 compliance. Developed a model for evaluating internal controls. This model has been adopted as the generally accepted framework for internal control and is widely recognised as the definitive standard against which organisations measure the effectiveness of their systems of internal control.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
60
Q

COBIT

A

IT governance and management framework created by ISACA.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
61
Q

Incident

A

An event that has the potential to do harm

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
62
Q

Data disclosure

A

Unauthorised acquisition of personal information

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
63
Q

Event

A

Threat events are accidental and intentional exploitations of vulnerabilities

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
64
Q

Fourth Amendment

A

Basis for privacy rights in fourth amendment to the constitution

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
65
Q

1974 US Privacy Act

A

Protection of PII on federal databases

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
66
Q

1980 OECD Privacy Guidelines

A

Established the first internationally agreed upon privacy principles.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
67
Q

1986 US Computer Fraud and Abuses Act

A

Protects computers used by the Government or in interstate commerce from a variety of abuses.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
68
Q

1986 Electronic Communications Privacy Act

A

Makes it a crime to invade the privacy of an individual

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
69
Q

Health Information Technology for Economic and Clinical Health Act of 2009 (HITECH)

A

Amended version of HIPAA. The HITECH Act encouraged healthcare providers to adopt electronic health records and improved privacy and security protections for healthcare data. Federal law requires notification of individuals when a HIPAA-covered entity breaches their protected health information.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
70
Q

Digital Millennium Copyright Act

A

Prohibits the circumvention of copy protection mechanisms placed in digital media and limits the liability of ISP’s for the activities of their users. ISP’s are no longer liable for the transitory activities of the user.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
71
Q

Economic Espionage Act 1996

A

Provides penalties for individuals found guilty of the theft of trade secrets. Harsher penalties apply when the individual knows that the information will benefit a foreign government.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
72
Q

GDPR

A

General Data Protection Regulation governs the use and exchange of personal information.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
73
Q

ISC2 Code of Ethics Cannons

A

ISC has established four key cannon/principles

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
74
Q

ISC Cannon 1

A

Protect society, the commonwealth, and the infrastructure

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
75
Q

ISC Cannon 2

A

Act honorably, honestly, justly, responsibly, and legally

76
Q

ISC Cannon 3

A

Provide diligent and competent service to principals

77
Q

ISC Cannon 4

A

Advance and protect the profession

78
Q

Ethics and Internet RFC 1087

A

Don’t compromise the privacy of users. Access to and use of Internet is a privilege and should be treated as such. It is defined as unacceptable and unethical if you, for example, gain unauthorised access to resources on the internet, destroy integrity, waste resources or compromise privacy

79
Q

BC Plan Development Process

A

Based on the ISC2 BCP Process:

  1. Project scope and planning
  2. BIA
  3. Continuity Planning
  4. Approval and Implementation
80
Q

Business Impact Assessment

A

Goal is to create a document to be used to help understand what impact a disruptive event would have on the business.

81
Q

BIA: 1. Project Scope and Planning

A
  1. Business organisation analysis: analyse organisation, including teams
  2. BCP Team Selection: make sure to include senior executives
  3. Resource Requirements: who do you need?
  4. Legal and Regulatory Requirements
82
Q

BIA: 2. Business Impact Assessment

A
  1. Identify priorities: valuation of assets, including MTD and RTO for each business function
  2. Identify risks for those assets, such as natural, man made and perform a likelihood assessment
83
Q

BIA: 3. Continuity Planning

A

Determine appropriate responses: such as risk reduction/mitigation, assign/transfer, risk acceptance, and risk rejection

84
Q

BIA: 4. Approval and Implementation

A
  1. Get approval from CEO
  2. Plan Training
  3. Plan implementation
85
Q

Seperation of Duties

A

Assigns parts of tasks to different individuals thus no single person has total control of the system’s security mechanisms; forces collision.

86
Q

M of N Control

A

Requires that a minimum number of agents (M) out of the total number of agents (N) work together to perform high-security tasks. So, implementing three of eight controls would require three people out of the eight with the assigned work task of key escrow recovery agent to work together to pull a single key out of the key escrow database.

87
Q

Least privilege

A

A system’s user should have the lowest level of rights and privileges necessary to perform their work and should only have them for the shortest time. Three types exist: Read only, read/write, and access/change.

88
Q

Two man control

A

Two persons review and approve the work of each other, for very sensitive operations

89
Q

Dual control

A

Two persons are needed to complete a task

90
Q

Rotation of duties

A

Limiting the amount of time a person is assigned to perform a security related task before being moved to different task to prevent fraud; forces collusion

91
Q

Mandatory vacations

A

Prevent fraud and allowing investigations, one week minimum; kill processes

92
Q

Need to know

A

The subject is given only the amount of information required to perform an assigned task, business justification

93
Q

Agreement Examples

A

NDA, non compete, and acceptable use

94
Q

Explain risk of employees in managing security

A

Staff members pose more threat than external actors. Loss of money, stolen equipment, loss of time work hours, loss of reputation, declining trusts and loss of resources, bandwidth theft, due diligence.

95
Q

Controls during Voluntary and Involuntary Leave

A

Ensure you perform exit interview

96
Q

Third Party Controls

A

Vendors, consultants, and contractors. Make sure they are properly supervised, with their rights based on policy.

97
Q

Likelihood

A

Chance it will happen

98
Q

Residual Risk

A

Amount of risk left over. Organisations own the risk, and risk is determined as a byproduct of likelihood and impact. Further, the cost of applying extra countermeasures is more than the estimated loss resulting from a threat or vulnerability (C > L). Legally the remaining residual risk is not counted when deciding whether a company is liable.

99
Q

ITIL

A

Best practices for IT core operational processes, not for audit. This includes Service, change, release, and configuration, Strong end-to-end customer focus/expertise. Focused on services and service strategy.

100
Q

Goal of Risk Management

A

Goal is to determine impact of threat and risk of threat occuring, then reduce risk to an acceptable level.

101
Q

Step 1: Categorise

A

Categorise the information system and the information processed, stored, and transmitted by that system based on an impact analysis.

102
Q

Step 2: Risk Management

A

Conduct Assessment:

  • ID threat sources and events
  • ID vulnerabilities and predisposing conditions
  • Determine likelihood of occurrence
  • Determine magnitude of impact
  • Determine risk
103
Q

Step 3: Implement

A

Implement the security controls and describe how the controls are employed within the information system and its environment of operation

104
Q

Step 4: Assess

A

Assess the security controls using appropriate assessment procedures to determine the extent to which the controls are implemented correctly, operating as intended, and producing the desired outcome with respect to meeting the security requirements for the system.

105
Q

Inherent: Types of Risk

A

Chance of making an error with no controls in place

106
Q

Control: Types of Risk

A

Chance that controls in place will not prevent, detect or control errors

107
Q

Detection: Types of Risk

A

Chance that auditors won’t find an error

108
Q

Business: Types of Risk

A

Concerns about effects of unforseen circumstances

109
Q

Overall: Types of Risk

A

Combination of all risks aka Audit Risk

110
Q

Preliminary Security Assessment (PSE)

A

Helps to gather the elements that you will need when the actual Risk Analysis takes place.

111
Q

Risk Assessment Steps

A
  1. Prepare
  2. Perform
  3. Communicate
  4. Maintain
112
Q

Qualitative Risk Management Process

A
  1. Approval
  2. Form Team
  3. Analyse Data
  4. Calculate Risk
  5. Countermeasure Recommendations
113
Q

Quantitative Risk Analysis

A

Uses quantitative values to calculate risk

114
Q

Single Loss Expectancy (SLE)

A

Asset Value * Exposure Factor (% loss of asset). It is the dollar value lost when an asset is successfully attacked.

115
Q

Annual Loss Expectancy (ALE)

A

SLE * ARO

116
Q

Annualised Rate of Occurance (ARO)

A

Number of times an event occurs in a year

117
Q

How to address risk

A
  1. Accept: live with it and pay the cost
  2. Mitigate: Reduce by implementing controls by calculating costs
  3. Assign/Transfer: insure the risk to transfer it. Passing it to another entity.
  4. Avoid: stop business activity
118
Q

Loss Formula

A

Loss = probablity * cost

119
Q

Controls Gap

A

Is the amount of risk that is reduced by implementing safeguards. A formula for residual risk is as follows: Total Risk - Controls Gap = Residual Risk

120
Q

RTO

A

Recovery Time Objective: How quickly you need to have that application’s information available after downtime has occurred.

121
Q

RPO

A

Recovery Point Objective: Point in time that application data must be recovered to resume business functions. Amount of data you are willing to lose. For example, you may be willing to loose one day of data.

122
Q

MTD

A 
Maximum Tolerable Downtime: Maximum Delay a business can be down and still remain viable. 
MTD: minutes to hours = critical
MTD: 24 hours = urgent
MTD 72 hours = important
MTD 7 days = normal
MTD 30 days = non-essential
123
Q

Exposure Factor

A

How much of an asset is exposed to loss, expressed as a percentage (0 to 100%).

124
Q

Factors that effect impact

A

Human life, dollars, prestige, market share

125
Q

Risk Framework Countermeasures

A
  • Accountability
  • Auditability
  • Source trusted and known
  • Cost effectiveness
  • Security
  • Protection for CIA of assets
  • Other issues created?
126
Q

Primary Controls (types)

A

Control costs should be less than the value of the asset being protected

127
Q

Administrative/Managerial/Policy

A

Preventive: hiring policies, screening security awareness (also called soft measures)
Detective: screening behaviour, job rotation, review of audit records

128
Q

Technical (aka Logical)

A
  • Preventive: protocols, encryption, biometrics, smartcards, routers, firewalls
  • Detective: IDS and automatic generated violation reports, audit logs, CCTV (never preventative)
  • Preventive: fences, guards, locks
  • Detective: motion detectors, thermal detectors, video detectors
129
Q

Physical Controls

A

Things you can see and touch, such as fences, doors and lock, windows

130
Q

Prime Objective

A

Reduce effects of security threats and vulnerabilities to a tolerable level

131
Q

Risk analysis

A

Process that analyses threat scenarios and produce a representation of the estimated potential loss

132
Q

Main categories of access control

A

7 Types of controls

133
Q

Directive control

A

Specify rules of behaviour

134
Q

Deterrent

A

Discourage people, change my mind

135
Q

Preventative

A

Prevent incident or breach

136
Q

Compensating

A

Substitute for loss of primary controls

137
Q

Detective control

A

Signal warning, investigate

138
Q

Corrective

A

Mitigate damage, restore control. For example, correct a system by deleting its virus.

139
Q

Recovery

A

Restore to normal after incident

140
Q

Preventive Controls

A
  1. Accuracy: data checks, validity checks
  2. Security: labels, traffic padding, encryption
  3. Consistency: DBMW, data dictionary
141
Q

Detective controls

A
  1. Accuracy: cyclic redundancy
  2. Security: IDS, audit trails
  3. Consistency: comparison tools
142
Q

Corrective controls

A
  1. Accuracy: checkpoint backups
  2. Security: emergency response
  3. Consistency: database controls
143
Q

Functional order in which controls should be used

A
  1. Deterrence
  2. Denial
  3. Detection
  4. Delay
144
Q

Penetration Testing

A

Testing a network’s defenses by using the same technique as external intruders

145
Q

Scanning and probing

A

Port scanners (such as nmap)

146
Q

Sniffing

A

Capturing data packets

147
Q

Demon Dialing

A

War dialing for modems

148
Q

Dumpster diving

A

Searching paper disposal areas

149
Q

Social engineering

A

Most common, get information by asking

150
Q

Types of Penetration Testing

A

Blue Team: Had knowledge of the organisation, can be done frequent and least expensive
Red Team: is external and stealthy

151
Q

White Box Testing

A

Ethical hacker knows what to look for, see code as a developer

152
Q

Grey Box Testing

A

Partial knowledge of the system, see code, act as a user

153
Q

Black Box

A

Hacker does not know what to find

154
Q

4 Stages of Pen Testing

A
  1. Planning
  2. Discovery: recon/discover, and enumeration
  3. Attack: Vulnerability analysis, and execution/exploitation
  4. Reporting: document findings/reporting
155
Q

Vulnerabilities exploited

A

Kernal flaws, buffer overflows, symbolic links, file descriptor attacks

156
Q

Other Model

A

Footprint network (information gathering) port scans, vulnerability mapping, exploitation, report scanning, tools are used in penetration tests

157
Q

Flaw hypotheses methodology

A

Operating system penetration testing

158
Q

Penetration testing strategy

A

External, internal, blind, double blind.

Categories: zero, partial, full knowledge tests

159
Q

Deming Cycle

A
  1. Plan: ID opportunity and plan for change
  2. Do: implement change on small scale
  3. Check: Use data to analyse results of change
  4. Act: If change successful, implement wider scale, if fails begin, cycle again
160
Q

Identification of threat

A

Individuals must be qualified with the appropriate level of training. This includes:

  • Developing job descriptions
  • Contact references
  • Screen/investigate background
  • Develop confidentiality agreements
  • Determine policy on vendor, contractor, consultant and temporary staff access
161
Q

Software Licenses

A
  1. Public Domain; available for anyone to use
  2. Open Source: source code made available with a license in which the copyright holder provide the rights to study, change, and distribute the software to anyone
  3. Freeware: proprietary software that is available for use at no monetary cost. May be used without payment but may usually not be modified, re-distributed or reverse-engineered without the author’s permission.
162
Q

Assurance

A

Degree of confidence in satisfaction of security requirements. Is another word for security

163
Q

Successful Requirements Gathering

A

Don’t assume what client wants, involve users early, define and agree on scope.

164
Q

Security awareness

A

Technical training to react to situations, best practices for security and network personnel. Employees need to understand policies.

Formal security awareness training provides exact prep on how to do things.

165
Q

Wire Tapping

A

Eavesdropping on communication - only legal with prior consent or warrant

166
Q

Data Diddling

A

Act of modifying information, progrms, or documents to commit fraud, tampers with INPUT data

167
Q

Privacy Laws

A

Data collected must be collected fairly and lawfully and used only for the purpose for the purpose it was collected

168
Q

Water holing

A

Create a bunch of websites with similar names

169
Q

Work function (factor)

A

The difficulty of obtaining the clear text from the cipher text as measured by cost/time

170
Q

Fair Cryptosystms

A

In this escrow approach, the secret keys used in a communication are divided into two or more pieces, each of which is given to an independent third party. When the government obtains legal authority to access a particular key, it provides evidence of the court order to each of the third parties and then reasembles the secret key.

171
Q

SLA

A

Agreement between IT service provider and customer, document service levels, divorce: how to dissolve relationship

172
Q

SLR (requirement)

A

Requirements for a service from client viewpoint

173
Q

Service Level Report

A

Insight into a service providers ability to deliver the agreed upon service quality

174
Q

FISMA (federal agencies)

A

The Federal Information Security Management Act (FISMA), passed in 2002, requires that federal agencies implement an information security program that covers the agency’s operations. FISMA also requires that government agencies include the activities of contractors in their security management programs.

175
Q

Two phases of FISMA

A

Phase 1: categorising, selecting minimum controls, assessment
Phase 2: create national network of secure services to assess

176
Q

ISO/IEC 27799

A

Known as the health informatics, and its purpose is to provide guidance to health organisations and other holders of personal health information on how to protect such information via implementation of ISO/IEC 27002.

177
Q

Process improvement models

A
  1. Six Sigma: Business management strategy that can be used to carry out process improvement
  2. CMMI: organisational development for process improvement developed by Carnegie Mellon
178
Q

Emergency procedures (BCP)

A

Are carried out to protect human life, and then other procedures need to be executed to reduce the damage from other threats.

179
Q

Prudent Rule Man/Reasonable Person Test

A

The prudent man rule requires that senior executives take personal responsibility for ensuring the due care that ordinary, prudent individuals would exercise in the same situation. The rule originally applied to financial matters, but the Federal Sentencing Guidelines applied them to information security matters in 1991.

180
Q

Gramm-Leach-Bliley Act of 1999 (GLBA)

A

Requires financial institutions to provide written privacy policies to all their customers.

181
Q

STRIDE

A 
Threat modelling technique. 
S: Spoofing
T: Tampering
R: Repudiation
I: Information disclosure
D: Denial of access
E: Elevation of privilege
182
Q

Reduction Analysis

A

Threat modelling diagramming where a greater understanding of the logic of the product as well as its interactions with external elements.

183
Q

Communications Assistance for Law Enforcement Act (CALEA) 1994

A

Requires all carriers to make wiretaps possible for law enforcement with an appropriate court order, regardless of the technology in use.

184
Q

Step 5: Authorise (risk management framework)

A

Authorise information system operation based on a determination of the risk to organisational operations and assets, individuals, other organisations, and the country resulting from the operation of the information system and the decision that this risk is acceptable.

185
Q

Step 6: Monitor (risk management framework)

A

Monitor the security controls in the information system on an ongoing basis including assessing control effectiveness, documenting changes to the system or its environment of operation, conducting security impact analyses of the associated changes, and reporting the security state of the system to designated organisational officials.

- (8 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions