Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CISSP > DOMAIN 1: Security and Risk Management > Flashcards

DOMAIN 1: Security and Risk Management Flashcards

1
Q

CIA Confidentiality

A

Protecting secrets (ex: military, pharmaceutical

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

CIA - Integrity

A

Protecting accuracy and authenticity (ex: banks, brokerage firms)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

CIA- Availability

A

Protecting stability and reliability . (ex: ISP, Telecomm)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

DAD

A
  • Disclosure, Alteration, and Destruction (NEGATIVE)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Information/data owners (Data Controllers)

ACCOUNTABLE for Assets

A

Business unit/division. Usually a person in the unit will be designated as the “owner”.

1) Must identify assets
2) Classify the assets
3) Determines access permissions for the assets

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Custodians (stewards) (RESPONSIBLE for assets)

A

They don’t own the data, but they have
maintenance responsibilities for the assets.
(IT, operations, helpdesk, etc.)
- Perform day-to-day tasks: ensure CIA, perform backups,
implements security controls, etc.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

System Owners

A

“Own” the equipment , systems, networks, etc.

(ex: IT department) Here, “own” means “responsible for”

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Auditors

A

Check for compliance . They bring an outside

scope or perspective. Can be internal or external auditors, but from a different department at least

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Users

A

They may take assets home, but they must keep

them secure! This is why we have to convince them to take security seriously

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Due Care

A

Setting best or reasonable practices as a
responsible individual/organization should. “Doing the right
thing” (Similar to “The Prudent Person Rule”)
- The company did all that it could have reasonably done to
prevent the breach: They did exercise due care

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Due Diligence

A

Providing a record or history of compliance and
enforcement . Providing evidence that you
are doing the right thing. (the proof of following the policy)
- Auditors care about BOTH due care AND due diligence

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Legal standards: PCI - DSS

A

Payment Card Industry - Data Security Standard
- Security standard requiring businesses that accept, process,
transmit, or store credit or
debit card information to implement certain
controls in order to reduce credit card fraud.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Sarbanes -Oxley Act (SOX)

A

Protects investors from fraudulent corporate
accounting activities (you can’t lie to your investors!)
- Section 302: CEO SIGN; CFO’s and CEO’s can go to jail if the info they sign is false
- Section 404: Internal controls assessment. Good auditing and security of accounting files

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Health Insurance Portability and Accountability Act (HIPAA)

A

Laws requiring the protection of: Personal Health Information (PHI)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Federal Information Systems Management Act (FISMA)

A

US law for government agencies to secure their IT environments .

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Legal systems: Common Law

A 
(US, Canada, UK, Australia, NZ, etc) Enforcement is based on
legal precedent. This includes:
1) Written law passed by legislators
2) Court decisions
3) Judges legal opinions (ex: judge says
"this is unconstitutional")
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Civil Law (Code Law)

A

(Europe, South America, etc.) Enforcement of the law is based on:
1) Written law
2) Abstract rules and concepts (ex:
democracy, property protection)
3) Academic writings on concepts of law by the
legal scholars

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Religious Law

A

(Vatican, Africa, Indonesia, Islamic law (Middle-East))
1) Religion is endorsed by the government
2) Perhaps with little or no separation between
religion and state

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Subdivisions of Common Law include:

Criminal Law

A

Punishing behavior harmful to society.

Punishments include: jail, death (capitol punishment), fines, losing certain rights as an individual

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Civil or Tort Law

A

(Law suits) Punishing wrongs against individuals or businesses
that result in harm . Punishments are usually
financial

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Administrative or Regulatory Law

A

Special rules that apply to particular industries.
Regulators check businesses to make sure they’re
compliant.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

USA branches of law:

A

Legislative : writes laws
Executive : enforces laws
Judicial : interprets laws

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Computer Crimes

A

For classification as a computer crime, computers:
1) Can be a tool of crime (ex: digital
manipulation)
2) Can be a target of crime (victim of digital
manipulation)
3) Can be incidental to the crime (not a tool or
target, but contains evidence) (Ex: logs on the router, or browser cache)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Intellectual property includes:

Patents (strongest)

A

Protections awarded by the government for useful, novel, and non-obvious inventions. US patents last for
20 years from the date of registration/filing of the
patent.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

Trademarks (must be registered)

A

Any symbol, word, name, colors, musical tunes, or design to identify a product or service . You have to use it in commerce, and continue to use it to claim it’s still yours. Otherwise, it doesn’t expire.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

Copyrights

A

Protections for creative expressions of ideas .
(books, movies, songs, software) US copyrights last for
70 years after the death of the author.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

Trade Secrets

A

Any information, device, method, technique, or process that derives economic value from not being
generally known, and is kept a secret. Must continue to protect it as a secret.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

IP software licensing: Public Domain

A

Available for anyone to use

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

Open Source

A

Source code available for free to study, modify, use, and distribute

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

Freeware (Shareware)

A

Proprietary software available for free, but there are some restrictions on modifications and redistribution

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

Site & Per-Seat licensing

A

Buy a license for entire org, or one license per-user or per- “seat”

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

DRM (Digital Rights Management)

A

Uses encryption to enforce copyright restrictions on digital media. This is done to protect Intellectual Property

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

Wassenaar Arrangement

A

An arms control treaty among 40 nations
(including the US) To control the export of weapons and controlled dual-use
technologies. (used by both commercial and military)
Ex: Strong encryption tools, such as LARGER KEY SIZES.
Controls key sizes larger than 56-bit (which means DES has now been de-controlled)

34
Q

7 European Union Privacy Directives

A

8 points (page 128) Study these!

  • Created by OECD: Organization for Economic Cooperation and Development
  • Remember the term EUROPEAN UNION PRINCIPALS
35
Q

General Data Protection Regulation (GDPR)

A
  • Added “Right to be Forgotten Principal”
  • If there is a security breach, you must inform the EU
    within 72 hours of the breach or be fined
  • Orgs in breach of GDPR can be fined up to 4% of annual global turnover, or €20 million, whichever is greater!
36
Q

(ISC)² code of ethics canons.

A

1) Protect Society (safety first!)
2) Act honorably and legally .
3) Provide diligent service to principals .
4) Advance and protect the profession .

37
Q

Security planning Top-down approach

A

Driven by management . You must start here

for security.

38
Q

Bottom-up approach

A

Driven by IT, admins, helpdesk, etc.

- Lack of enforcement & authority if you only use bottom-up - Lack of funding & resources

39
Q

Policies

A
  • First and highest level of documentation. Corporate “vision” statement reflecting management’s commitment to its goals
40
Q

What makes good, effective policy?

A
  • clear, concise, understandable (universal interpretation)
  • Relevant to the business. Current, and not obsolete
  • Enforceable (need management backing), and doable
  • Easily accessible by all employees
  • Applied fairly and consistently .
    (this applies to management too, unless the policy has exceptions)
  • Should be stable and enduring , with a long-term focus
  • Should have consequences if violated (give incentive to comply
41
Q

Procedures

A

Step by step required actions

42
Q

Standards

A

Hardware, software, documents to be

deployed universally throughout the organization. Use of specific technologies in a uniform way

43
Q

Baselines

A

Minimum levels of protection for

specific platforms or environments (minimum settings)

44
Q

Guidelines

A

Recommendations, suggestions,

best-practices , advice

45
Q

Employee candidate screening

A

Check credit history, do a background check

46
Q

Policies for new employees include

A

Non-disclosure agreements (NDAs)- Still binding, even after you leave the company)
Acceptable-Use policies
.(network, phones, supplies, building, kitchen, etc)

47
Q

Separation of Duties

A

To reduce fraud or conflict of interest

48
Q

User Access Reviews

A

Periodically review and recertify privileged users

49
Q

Need to Know

A

KNOWLEDGE needed to do the job

info, skills, training

50
Q

Least Privilege

A

MINIMUM PERMISSIONS needed to
do the job. (extension on need-to-know into the realm of permissions) (ex: 20 people need to know it, but only 3 people have permissions to update the information)
- contractors, vendors, and consultants must be bound by these rules too!

51
Q

Security Training

A
  • Structured training for all employees. Uses a classroom (or Webex), instructor, syllabus, start & end times, etc
52
Q

Security Awareness

A
  • Much less structured: posters, blurb in newsletter

( nagging ) - serves as a constant reminder

53
Q

Privacy

A

If businesses monitor, they must monitor in a
legal fashion , including:
1) Need to inform those being monitored
(policy, signed agreements)
2) Monitor fairly &
consistently .
(No unfair targeting of individuals without just cause)
3) Monitor activities that are work-related .

54
Q

Risk management

A

To reduce or mitigate the
threats.- This includes: Risk analysis, cost/benefit analysis, deploying countermeasures or safeguards, auditing, insurance, Business Continuity Planning (BCP - more on this later), awareness,
education, training, etc.

55
Q

ISO 27005

A
  • Standard risk management framework
56
Q

COSO - (Committee Of Sponsoring Organizations (of the Treadway Commission)):

A
  • Framework for internal controls
    .organizations can use to assess compliance and risk
  • works with SOX 404: joint initiative among accounting & auditing organizations to combat corporate fraud
57
Q

3 phases of Risk Management

A

1) Risk analysis & assessment . (Identify assets & the threats to
them)
2) Risk response - “solving” the threats
3) Evaluation and Assurance .
(Make sure solutions are still working via the use of tools like auditing, compliance monitoring, pen-tests, etc

58
Q

Risk analysis/assessment

A

To identify the assets & their threats

59
Q

Risk Assessment Process

A

1) Prepare for the assessment
2) Conduct the assessment (perform)
3) Communicate the results
4) Maintain the assessment
(update when needed)

60
Q

Terms: Asset

A

Something of value to the organization

people, data, systems, IP, etc.

61
Q

Threat

A

Something that could harm the asset

62
Q

Exposure

A

Actual or anticipated damage from a threat

63
Q

Vulnerability

A

Lack of or weakness in

a countermeasure that can be exploited

64
Q

Risk

A

The Impact & the likelihood of a threat

65
Q

) Second phase of risk management: Deciding how to deal with each risk (risk response):

A

Risk Avoidance . Removing the technology or activity to remove the risk
(ex: ban wifi) Coming up with ALTERNATIVES instead
Risk Transference . SHARING your risk with another entity
(ex: insurance, outsourcing)
Risk Mitigation . Deploying appropriate countermeasures.
Residual risk .is what smaller risk remains
after mitigation
- Controls Gap Amount of risk that is mitigated by implementing safeguards.
Total Risk - Controls Gap = Residual Risk
Risk Acceptance . Accepting the loss using no countermeasures

66
Q

Countermeasure selection decisions include:

A

1) Cost/benefit analysis Cost of countermeasure should be less than the
asset value
2) Accountability Who is in-charge of the safeguard?
3) Don’t rely on design secrecy Security through obscurity alone is not enough
4) Solutions are universally
applied
Especially for tools used in monitoring .
(fairly & consistently)
5) Defense in depth Multiple layers of protection, less reliance on just
one
6) Least common mechanism Don’t always place all solutions in one
location .
7) Acceptance by personnel Users struggle between security &
convenience .
8) Minimize human intervention For things that could be automated .
(ex: antivirus updates)
9) Avoid unintended
consequences
Activation of the safeguard should not accidentally
destroy the assets (ex: sprinkler system)

67
Q

Control TYPES Physical controls

A

ex: locks, fire sprinklers, etc.

(note: look for anti-shim and anti-bump technologies when buying padlocks!)

68
Q

Technical/logical controls

A

hardware & software , often controlling access

69
Q

hardware & software , often controlling access

A

policies, procedures, people-oriented controls

70
Q

Control CATEGORIES Directive

A 
Administrative controls focusing on the
 management aspects (ex: policies, procedures, management sign-off, etc.)
71
Q

Compensating

A

Alternatives when the best controls are not

available or feasible

72
Q

Deterrent

A

Controls focusing on consequences

73
Q

Preventative

A

To stop unwanted activity or behavior

74
Q

Detective

A

To identify and monitor

75
Q

Corrective

A

To mitigate an incident and reduce the damage

76
Q

Recovery

A

Controls focusing on restoration . (bit of overlap with corrective)

77
Q

Preventative + technical controls:

A

ex: firewall, encryption, IDS/IPS, biometric access systems

78
Q

Detective + administrative:

A

Background checks, log files, camera footage

79
Q

Corrective + physical:

A

ex: security guards, audible alarm, electrified fence, fire sprinklers

80
Q

Scoping

A

When creating a baseline, scoping is removing those

recommendations that do not apply to our environment. They are “outside the scope” of what we’re trying to achieve

CISSP (1 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions