Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

PCS CISSP MM, EC, Thor series > Domain 1 - Security and Risk Management COPY > Flashcards

Domain 1 - Security and Risk Management COPY Flashcards

1
Q

what is CIA

A

confidentiality
integrity
availability

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

what are we protecting when we are talking about integrity

A

ensuring there is no unauthorized modifications to the data or systems (no data has been altered)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

what are we protecting when we are talking about availability

A

authorized persons have access to the data or system at a reasonable amount of time

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

what are we protecting with confidentiality

A

only authorized persons or systems have access to the data when they need it

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

tools that are used to ensure confidentiality

A
  1. encryption for data at rest (example AES256)
  2. secure transport protocols (SSL, TLS, IPSEC)
  3. best security practice for data in use ( clean desk, no shoulder surfing, screen view protector, pc locking policy,
  4. strong passwords, multi-factor authentication, masking data entry, access controls, need-to-know, least privilege
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

threats to confidentiality

A
  1. attacks on encryption (cryptanalyst)
  2. social engineering
  3. key loggers (software/hardware), cameras, steganography
  4. IOT (internet of things) the numbers of these items pose a threat. less secure, most are not updated, can be used as backdoors to other systems
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

what software/tools can we use to ensure integrity

A
  1. cryptography (again)
  2. check sums (this could be CRC)
  3. message digest (hash) this could be MD5, SHA1 or SHA2
  4. digital signatures
  5. access control
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

examples of threats to integrity

A
  1. alteration of our data
  2. code injection
  3. attacks on your encryption (cryptanalysis)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

tools used to ensure availability

A
  1. IPS/IDS
  2. Patch management
  3. redundancy (multiple power supplies/UPS’s/generators), disks (raid), traffic paths(network design), HVAC, staff, HA and more
  4. SLA’s - how much uptime do we want (what is that cost?)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

threats to availability

A
  1. malicious attacks (DDOS, physical, system compromise, staff)
  2. application failures (errors in the code)
  3. component failure (hardware)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

what does IAAA stand for

A

identification
authentication
authorization
accountability (monitoring/logging)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

what is Identification

A

you name, username, serial number, id number, employee number
“I am XXXX”

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

what is authentication

A

proving you are who you say you are (always should be multifactor)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

what is Type 1 authentication

A

something you know -Type 1 Authentication: (passwords, pass phrase, PIN, etc.)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

what is type 2 authentication

A

something you have -Type 2 Authentication: (ID, passport, smart card, token, cookies on PC, one time password (OTP) etc. )

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

what is type 3 authentication

A

something you are - Type 3 Authentication: (biometrics) fingerprint, iris scan, facial geometry, etc)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

what is the opposite of CIA

A

Disclosure - (confidentiality)
destruction - (availability)
alteration - (integrity)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

formula for risk

A

risk = threat X vulnerability
Sometimes an added variable of impact is added
Risk = threat x vulnerability x impact

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

if there is a vulnerability but no threat towards that vulnerability, is there risk?

A

no

if there is not threat towards the vulnerability there is not current risk

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

what is authorization?

A
  1. what you are allowed to access

2. access control models ( DAC, MAC, RBAC(role based access), RUBAC(rule based access))

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

what is the last A in IAAA

A

accountability -

  1. auditing(logs)
  2. prove who/what a given action was performed by (non-repudiation)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

explain least privilege

A
  1. give users/system exactly the access they need, no more
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

explain need to know

A
  1. you are generally given more access than you need(in a need to know environment) but if you do not have a need then you should not be accessing that data.
    example: doctors, they need to have access to all patients but if they are not their patients the do not have the need to access their data
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

what is non-repudiation and what two functions are used to provide it

A
  • can not deny having performed a certain action
  • authentication
  • integrity
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

what is a subject

A

(active) most often a user but can be a system. subjects manipulate objects

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

what is an object

A
  1. (passive) object is manipulated by subjects
  2. any passive data (both physical paper and data)
  3. a program can be both object and subject depending on if its accessing data or something is accessing it
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

what is governance not (security governance)

A
  • how an organization is managed

* actions and controls placed on those charged with managing a business entity

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

what is security governance

A
  1. how security is managed through policies, roles, processes used to make security decisions.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

In this list there are 6 truths about organizational security goals. name as many as you can

A

• security must align with the organization goals, not dominate or drive them
• security is optional, its a support function
security and the budget that funds it, can be done away with at any time (probably not wise but it can be)
• security practitioners must align with organizational goals
• implemented correctly, it helps keep cost down
• the security program must serve the organization properly

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

what is a governance committee

A

a formal decision making body within the organization

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

list the need to know C-level (senior leadership) - ultimately liable.

A
  1. CEO - chief executive officer
  2. COO - chief operations officer
  3. CIO - chief information officer
  4. CTO - chief technology officer
  5. CSO - chief security officer
  6. CISO - chief information security officer
    7 CFO - chief financial officer
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

what does pci-dss stand for and what is it

A

payment card industry data security standard..

its a standard but IS required if you want to handle credit cards or debits cards

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

what is COBIT and what to remember about it

A
  • framework created by ISACA for IT management and governance
  • has 5 principals
  • business framework for governance and management of enterprise IT
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

what is the goal behind COSO

A
  • auditing controls framework
  • designed to prevent fraud reporting of financial activities
  • provides guiding principles for internal controls over the entire enterprise
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

what is ITIL

A
  • is a framework (best practices) for IT service management for (ITSM)
  • ITIL v4, essentially it’s a best practice for service management (IT)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

what does ITSM stand for and what is it

A

Information Technology service management..
• improving business performance through better IT deliver.
• making IT better for
••• business operations
••• Employees
••• customers

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

Define ITSM

A
  • information technology service management
  • the craft of implementing, managing, and delivering and improving IT services
  • focuses on aligning IT processes and services with the business objectives to help an organization grow
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

quickly define the FRAP methodology

A
  • focus is on IT security threats
  • qualitative risk management
  • focus only on systems that really need assessing, reducing cost and time needed
  • the author felt that trying to use mathematical formulas to figure risk was too complicated
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

what is ISO/IEC 27001?

A

this international standard provides requirements for establishing, implementing, maintaining and improving an Information Security management System (ISMS)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
40
Q

what does ISO/IEC 27002 accomplish

A

it is to be used as a reference for determining and implementing controls for information security risk treatment in a information security management system (ISMS) based on ISO/IEC 27001

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
41
Q

what does ISO/IEC 27004 accomplish

A

intended to assist organizations to evaluate the performance and effectiveness of and ISMS (information, security management system).
* monitor
* measurement
* analysis
* evaluation
based from ISO 27001

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
42
Q

what does ISO/IEC 27005 provide

A

guidelines for information security risk management in an organization.
• its just guidelines, it is up to the organization to define their approach to risk management

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
43
Q

what does IS/IEC 27799 provid

A

standard that provides guidance to healthcare organizations and other custodians of protected health information (PHI) on how to best protect confidentiality, integrity and availability of that information

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
44
Q

a couple of facts about criminal law

A
  • society is the victim
  • proof must be beyond a reasonable doubt
  • incarceration, death, financial fines
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
45
Q

facts about civil law

A
  • another name is tort law
  • individuals, groups and organizations are the victims
  • proof must be “the majority of proof”
  • financial fines to compensate the victim(s)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
46
Q

facts about administrative law

A
  • regulatory law

* enacted by government agencies (FDA laws, HIPAA, FAA laws etc.)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
47
Q

facts about private regulations

A

• compliance is required by contract (example: PCI-DSS)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
48
Q

facts about customary laws

A
  • mostly handles personal conduct and patterns of behavior

* traditions and customs of the area or region

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
49
Q

facts about religious law

A
  • pretty much what it sounds like
  • religious beliefs in that area or country
  • often include their code of ethics and morality
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
50
Q

who is ultimately liable?

A
  • senior leadership

* this does not mean you are not liable if you did something wrong (depends on due care)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
51
Q

what is due care

A
  • actions/behaviors
  • prudent person rule
  • what would a prudent(reasonable) person would do in this/that situation
  • implementing/applying proper policies, procedures, processes etc.
  • examples: changing systems settings (crypt algorithms, key size, protocols), employee training and awareness about security and their responsibility, disabling employee access when needed.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
52
Q

what is due diligence

A
  • researching
  • preparation
  • leg work
  • knowledge and understanding
  • making sure the right things are done correctly (research, investigation)
  • anything done before decisions are made
  • example: knowledge of laws, regulations, industry standards, knowledge of best practices
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
53
Q

explain negligence

A
  • opposite of due care

* if your systems are compromised and you did nothing to prevent it, you are likely negligent or gross negligent

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
54
Q

explain real evidence

A

• tangible and physical objects (hard disks, usb drives) (but not the data))

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
55
Q

what does evidence have to be in order to be considered in court

A
  • relevant
  • material
  • complete
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
56
Q

direct evidence is

A
  • testimony from first hand witness

* what they experiences with their 5 senses

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
57
Q

what is circumstantial evidence

A

• evidence to support circumstances or other evidence

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
58
Q

explain hearsay evidence

A
  • mostly what it sounds like - not first hand knowledge

* computer generated records

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
59
Q

what type of evidence are logs and documents from the system

A

secondary evidence

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
60
Q

the integrity of evidence is mandatory, what are a few things done during forensics

A
  • disks are hashed (cd, hard drive, sd card, blue ray etc.)
  • make a copy using a write blocker to prevent changes to drive - hash again to make sure there was no change
  • all investigation is done on the copy
  • hash the copy when done to prove no changes were made
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
61
Q

evidence chain of custody

A
  • who obtained the evidence and secured it
  • where and when it was obtained
  • who had control or possession of the evidence
  • secure storage in a monitored vault is common
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
62
Q

reasonable searches - a few details

A
  • the fourth amendment protects citizens from unreasonable search and seizure by the government
  • in all cases the court will decide if the evidence was obtained legally
  • exigent circumstances
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
63
Q

when does exigent circumstances apply

A
  • if there is an immediate threat to human life

* or if evidence is about to be destroyed

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
64
Q

define entrapement

A
  • illegal and unethical

* when someone is persuaded to commit a crime that they did not intend to and charged for that crime

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
65
Q

define enticement

A
  • legal and ethical
  • making committing a crime more enticing - the person has broken the law or at least decided to do so
  • an example would be honeypots
  • check with legal before department before using honeypots - they pose both legal and practical risks
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
66
Q

what does copyright cover

A

books, art, music, software

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
67
Q

how long does a copyright last

A
  • 70 years after creator’s death

* 95 years after creation by a corporation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
68
Q

what is the exceptions to copyright law

A
  • first sale

* fair use

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
69
Q

what do trademarks cover

A

• brand names, logos, slogans(must be registered)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
70
Q

how long do trademarks last

A
  • valid for 10 years

* can be renewed indefinitely

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
71
Q

what do patents cover

A
  • inventions

* cryptographic algorithms can be patented

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
72
Q

how long do patents last

A

• 20 years

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
73
Q

what is the criteria for a patent

  1. profitable
  2. novel
  3. previously unknown
  4. nonobvious
  5. music\books\art
  6. useful
A
  1. novel (new idea no one has had before)
  2. useful (can be used and is useful to others)
  3. nonobvious (inventive work involved)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
74
Q

trade secret attributes

A
  • you keep your secret recipe secret (KFC)
  • if discovered, anyone can use it
  • there is no protection
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
75
Q

what are some attacks on a copyright

A
  • piracy (software piracy is the most common)

* copyright infringement (use of someone else’s copyrighted material, often songs and images)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
76
Q

what are some attacks on trademarks

A

• counterfeiting (fake Rolexes, Prada, Nike) either using the real name or something similar

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
77
Q

what are some attacks on patents

A

• patent infringement - using someone else’s patent in your product without permission

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
78
Q

what are some attacks on tradesecrets

A

• there is no law that protect trade secrets but you also cant break the law to discover it.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
79
Q

what is cybersquating

A

• buying a URL that you know someone else will need for the soul purpose of selling at a profit

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
80
Q

what is typo squatting

A

• buying URL that are very close the the real thing (this can be illegal in some circumstances)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
81
Q

what does HIPAA stand for

A

• Health Insurance Portability and Accountability Act

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
82
Q

what is the core protection of HIPAA

A

• Strict privacy and security rules on handling PHI (protected health information)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
83
Q

what does PHI stand for

A

• protected health information

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
84
Q

what does SOX stand for, what was it and when was it created

A
  • Sarbanes-Oxley Act
  • created 2002
  • created to prevent a repeat of accounting scandals in the 1990s
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
85
Q

what sector is Gramm-Leach-Briley act (GLBA) aimed at

A
  • applies to financial institutions

* drive by the federal financial instutution

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
86
Q

what did the patriot act do

when was it

A
  • expand law enforcement electronic monitoring capabilities
  • allows search and seizure without immediate disclosure
  • 2001
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
87
Q

what does PCI-DSS stand for

A

• Payment Card Industry Data Security Standard

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
88
Q

is PCI-DSS a law

A

• no, its a standard enforced by the payment card industry

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
89
Q

what do PCI-DSS standards apply to and what is its purpose

A
  • credit cards
  • debit cards
  • requires merchants and anyone dealing with credit cards and debit cards to meet a minimum set of security requirements
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
90
Q

what does GDPR stand for and when was it enacted

A

• General data protection regulations
• enacted in 2016
° enforced in 2018

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
91
Q

what region does GDPR apply to

A

• anyone living in the European Union

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
92
Q
  1. does GDPR (general protection privacy act) apply to anyone outside the EU
  2. how about EU citizens living outside the EU
A
  • no

* it does not apply to EU citizens living outside the EU

93
Q

what are possible fines if you break GDPR rules

A

• 20 million euro or 4% of annual revenue

94
Q

list GDRP personal data types

A

name(even common), email address, living address, unsubscribe confirmation URLs that contain email and/or names, IP address etc.

95
Q

according to GDPR what is required to use personal data and what are the limitations

A
  • the individual has to give expressed consent to user the personal data and only the person data that the consent was given for
  • the individual has the right to opt out
  • no other personal data is legal to process, unless there is a legal reason to do so
  • even after consent is given, the identity has to be anonymized
96
Q

according to GDPR what are the only reasons that personal data would be allowed to be unmasked

A
  • national security
  • military
  • police
  • or the justice system
97
Q

In GDPR - - what is right to access

A

• article 15, you have the right to request a copy of your personal data or request a electronic copy and it must be provided

98
Q

GDPR what is right to erasure

A

• you have the right to request to be forgotten (all personal data about you must be destroyed), except for laws and regulatory reasons like credit cards etc.

99
Q

GDPR breach notification is what

A

• users and data controllers must be notified of data breaches within 72 hours

100
Q

in the US, are you required to report a data breach if your data was encrypted

A

• no

101
Q

from a company perspective, what are some thoughts when dealing with GDPR and personal data

A
  • care must be taken to ensure personal data security
  • only store personal data that is absolutely necessary - if its not needed, do not store it, you are not legally allowed to do so
  • of you are data processing and monitoring information in the EU you must appoint a data protection officer
102
Q

what are some legacy laws between the EU and US

A
  • EU data protection directive (predecessor to GDPR)
  • EU-US safe harbor
  • Privacy Shield
103
Q

is it legal to transport data outside the EU

A

• only if the county has equal to or greater privacy protection as GDPR
• the US does not
Note: there are agreements/ requirements to allow data to and from the US (safe harbor act is an example)

104
Q

what laws dealing with privacy did the European court of justice declare invalid

A
  • EU-US safe harbor in 2015

* Privacy shield in 2020

105
Q

Wassenaar Arrangement attributes

A
  • 41 members
  • was originally for conventional arms
  • “dual-use” good and technologies was added (cryptography is part of that)
  • import and export restriction on cryptographic algorithms
  • Iran, Iraq, China, Russia have restrictions on how strong the encryption is allowed in their country (they don’t want it to be too hard to spy on their citizens)
106
Q

which is not mandatory

  1. policies
  2. standards
  3. guidelines
  4. procedures
  5. baselines (benchmarks)
A
  1. guidelines
107
Q

which are mandatory

  1. policies
  2. standards
  3. guidelines
  4. procedures
  5. baselines (benchmarks)
A
  1. policies
  2. standards
  3. procedures
  4. baselines
108
Q

define policies

A
  • mandatory
  • high level - none specific (broad umbrella)
  • strategic
  • why and what we are doing (not how)
  • can contain “patches, updates, strong encryption”
  • not specific to OS, encryption type or vendor technology
109
Q

define standards

A
  • standards set a describes a specific use of technology ( all laptops will be windows 10 64bit , 8 gigs of memory 1TB hard drive etc.)
  • tactical
  • formalization of regulatory or compliance
  • laws and regulations from outside the organization
  • mandatory
  • A perfect example is when a standard sets a mandatory requirement, such as that encryptions must be applied to all email communications.
110
Q

define guidelines

A

• recommendations, discretionary
—- suggestions on how you would do things
• non-mandatory
• do not confuse guidelines with best practices. they are not the same

111
Q

define procedures

A
  • mandatory
  • very detailed step by step approach on how to implement a security practice
  • most specific
  • they will contain “ OS type, encryption type, vendor technology”
112
Q

define baseline

A
  • mandatory
  • benchmarks for server hardening, apps, network
  • minimum requirements
  • stronger can be implemented if needed but these are minimum requirements
113
Q

users often pose the largest security risk. what are some ways to minimize

A
  • awareness training - change users behavior
  • training - provide users with a skillsets
  • hiring practices - background checks, check references, degrees, employment, criminal and maybe credit history.
  • employee termination practices - coach and train employees before firing them (they get warnings)
  • •• proper termination process, all access is properly shut down at the right time
114
Q

what should you do to ensure you are protected when dealing with vendors, consultants etc.

A
  • vendors, consultants and contractor security should be trained on processes for handling data.
  • their systems need to secure enough for our policies and procedures
115
Q

what are the 3 access control categories

A
  • administrative
  • technical
  • physical
116
Q

what are the 6 access control categories

A
  1. preventative
  2. detective
  3. corrective
  4. recover
  5. deterrent
  6. compensating
117
Q

define administrative access controls

A
  • policies and procedures defined by organization security policy to implement and enforce overall access control.
  • (personnel and business practices)
  • •• examples: policies and procedures, background checks, hiring practices, data classification, vacation history, reviews, security training awareness
118
Q

define technical access control

A
  • hardware/software/ that manages access control to systems and resources
  • firewalls, routers, encryption, protocols, smart cards, ACLs, passwords, constrained interfaces
119
Q

define physical access control

A
  • barriers deployed to prevent direct contact with systems or facilities.
  • •• examples: locks, fences, guards, dogs, gates, bollards,
120
Q

define preventive access control

A
  • stops unwanted or unauthorized activity from happening, prevents actions from happening
  • ••• examples: fences, least privilege, security policies, security awareness training, drug testing, IPS, firewalls, encryption, data classification, strong authentication, biometric access, mantraps
121
Q

define detective access control

A
  • controls that detect during or after unauthorized activities
  • •• examples: IDS, CCTV, alarms, anti-virus, security guards, mandatory vacations, honey pots, audit trails, incident investigation, security guards
122
Q

define corrective controls

A
  • any measures taken to repair damage or restore resources and capabilities to prior state
  • •• examples: patching a system, updating an outdated antivirus, quarantine a virus, terminating a process, rebooting a system, business continuity plan, applying a fix, restoring from backup
123
Q

define recovery access control

A
  • deployed to repair or restore resources. can repair damage as well as stop further damage
  • •• examples: DR environment, backups, HA environment, fault tolerant drive systems, server clustering, database shadowing.
124
Q

define deterrent access controls

A
  • deployed to discourage the violation of security policies - deter an attack
  • •• examples: locks, fences, security badges, security guards, mantraps, cameras, trespass or intrusion alarms, separation of duties, encryption, auditing, firewalls, awareness training, dogs
125
Q

define compensating access controls

A
  • provide various options to other existing controls, to aid the enforcement and support of a security policy.
  • •• examples: security policies, personnel supervision, monitoring, work task procedures
126
Q

what is the formula for risk

A
  • risk = threat X vulnerability
  • impact can be added
  • risk = threat X vulnerability X impact (how bad is it)
127
Q

what are the 4 steps to risk management lifecycle that Thor teaches

A 
• Risk identification 
• risk assessment (analysis)
• risk response/mitigation
• risk and control monitoring 
       its an iterative process
128
Q

what is an asset

A

• anything of value to the company

129
Q

what is a vulnerability

A

• a weakness, the absence of a safeguard

130
Q

what is a threat

A
  • an incident that could negatively effect the organization

* Any natural or man-made circumstance that could harm an organizational asset

131
Q

what is a threat agent

A

• the entity which carries out the attack

132
Q

what is an exploit

A

• an instance of compromise

133
Q

what is a risk

A
  • the probability of a threat materializing

* the probability of exposure or loss resulting from a cyber attack or data breach on your organization

134
Q

what are controls

A

• physical, administrative, technical protections (including safeguards and countermeasures)

135
Q

two types of risk assessments

A
  • qualitative

* quantitative

136
Q

what is qualitative risk assessment

A
  • how likely is it to happen
  • how bad is it if it happens
  • some guess work, estimations based off feel - very subjective
  • a pretty quick process
137
Q

what is quantitative risk analysis

A
  • this is dealing with dollars. what is the actual cost
  • dealing with actual value of the asset
  • based on facts
  • labor intensive
  • objective
138
Q

what is asset value

A

• the value of the asset

139
Q

what does EF stand for and what is it

A
  • exposure factor

* percentage of asset lost due to an incident

140
Q

what is SLE and how do you figure it

A

• single loss expectancy
• SLE = (AV X EF)
single loss expectancy = asset value X exposure factor

141
Q

what is ARO and how do you figure it

A
  • annual rate of occurrence

* how often will this loss happen per year (usually shown as a percentage)

142
Q

what is ALE and how to figure it

A

• Annualized loss expectancy
• yearly cost due to a risk
• ALE = SLE X ARO
annualized loss expectancy = single loss expectancy X annual rate of occurrence

143
Q

what is TCO and how is it figured

A
  • total cost of ownership
  • the total cost of a mitigating safeguard. (upfront cost plus the annual cost of maintenance) this includes staff hours, vendor maintenance fees, software subscriptions, etc.
144
Q

what are the 4 types of risk response and some details if needed

A
  • accept risk - we know the risk but the cost to mitigate is more costly than the risk
  • mitigate the risk (reduction)
  • avoid - decide to no longer do that activity because mitigation is too expensive
  • transfer - insurance or 3rd party support (msp etc.)
145
Q
  • can you mitigate all risk?

* what is residual?

A
  • no

* residual risk is what is left after you mitigate the risk to an acceptable level

146
Q

what is risk avoidance

A
  • we choose not to do the action to avoid the risk

* ••• example: maybe there is a risk to loss of data on stolen laptops. to avoid that risk, you don’t deploy laptops.

147
Q

what is risk rejection

A
  • you know the risk is there and you do nothing

* we never do this, its not an acceptable answer

148
Q

what is transfer of risk

A
  • handing the risk off to a willing 3rd party
  • think insurance
  • possibly any 3rd party vendor if you are choosing them to transfer risk (order fulfillment, payroll services, customer service, managed service provider)
149
Q

what is secondary risk

A

• mitigating one risk, may open up another risk

150
Q

according to nist 800-39 what does the risk management process include

A
  • Framing risk
  • assessing risk
  • responding to risk
  • monitoring risk
151
Q

according to nist 800-39 what are the 3 tiers that risk assessments can be conducted

A
  • organization
  • missions/business processes
  • information systems
  • ••• process should start at the top, go down the stack then the inter tier and and intra tier feedback loop goes back to the top.
152
Q

according to nist 800-39 why should all 3 tiers in the risk assessment be considered

A

• traditionally risk assessment is focused at the information system tier. many risks can be missed by not looking at organization and mission tiers.

153
Q

what is nist 800-30

A

• guide to conducting risk assessments

154
Q

what is nist 800-37

A

• RMF (risk management framework for Information Systems and Organizations)

155
Q

according to NIST 800-37 what are the 7 risk management framework steps

A
  • Prepare - to execute RMF
  • Categorize - the systems and information
  • select - initial set of controls
  • implement - the controls and document
  • assess - are controls implemented correctly and working
  • authorize - sign off by senior management or data owner
  • monitor - continue to monitor controls, conduct risk assessments and impact analysis
156
Q

what are the NIST cybersecurity framework core funcitons

A
  • Identify
  • protect
  • detect
  • respond
  • monitor
157
Q

what falls in the Identify function in the NIST cybersecurity framework

A
  • asset management
  • governance
  • risk assessment
  • supply chain risk management
158
Q

what falls in the protect function in the NIST cybersecurity framework

A
  • awareness training
  • data security
  • Identity management and access control
  • maintenance
159
Q

what falls in the detect function in the NIST cybersecurity framework

A
  • anomalies and events
  • security monitoring
  • detection process
160
Q

what falls in the respond function in the NIST cybersecurity framework

A
  • response planning
  • communications
  • mitigation
  • improvements
  • analysis
161
Q

what falls in the recover function of the NIST cybersecurity framework

A
  • recovery planning
  • improvements
  • communications
162
Q

what is KGI

A
  • key goal indicators

* KGI are lagging indicators, the function is to confirm whether or not a business goal has been reached.

163
Q

what is KPI

A
  • key performance indicators

* are used to show how the organization is performing based on the goals set by leadership.

164
Q

what is KRI

A
  • key risk indicators
  • measures the organizations risk and how its risk profile changes
  • metrics that demonstrate the risks that an organization is facing or how risky and activity is
  • metrics used by organizations to provide an early signal of increasing risk exposures in various areas
165
Q

what is a risk register

A
  • an information repository an organization creates to document the risks they face and the responses the are taking to address the risks.
  • at a minimum each risk documented should contain a description of each risk, the likelihood and impact from a cost standpoint.
  • each risk should be ranked in priority relevant to other risks, the response for each risk and how owns it.
166
Q

what is C&C

A

• command and control, when talking about botnets and malware

167
Q

what protocols do botnets often use

A

• IRC, HTTP, HTTPS

168
Q

what are the 4 types of fishing and the media/target they us

A
  • phishing - social engineering, small attacks or mass emails, not specific target
  • spear phishing - targeted phishing at a specific person. still using social engineering but there has been information gathered on a person or group
  • whale phishing - spear phishing targeted at senior leadership
  • vishing - attacks over voice. automated calls “your taxes are due” “your account is locked, enter your PII to prevent this”
169
Q

what is the purpose of the business continuity plan

A

• to respond to disruptions, activate recovery teams, handle tactical disaster status communication, assess damage caused by disruption

170
Q

what does BCP stand for

A

• business continuity plan

171
Q

define BCP

A
  • a document that outlines how a business will continue to operate during an unplanned disruption in service
  • isthe process of ensuring the continuous operation of your business before, during, and after a disaster event
172
Q

what are the important NIST publications for security and risk management

A
  • NIST 800-30 - guide for conducting risk assessments
  • NIST 800- 39 Managing Information Security Risk
  • NIST 800-34 Contingency Planning Guide for Federal Information Systems
  • NIST 800-53
173
Q

what is the focus of continuity planning and what section of the company does it normally apply to

A

• Continuity Planning normally applies to the mission/business itself; it concerns the ability to continue critical functions and process during and after an emergency event.

174
Q

what is the focus of contingency planning and what section of the company does it normally apply to

A

• contingency planning applies to information systems, and provides the steps needed to recover the operations for all or part of designated information systems

175
Q

define cyber incident response planning

A

• a plan that normally focuses on detection, response and recovery to a computer security incident or event

176
Q

define (BCP)

A
  • business continuity plan focuses on sustaining the organizations mission/business processes during and after a disruption
  • BCP can be scoped for a single business unit or the entire organization
  • BCP may be used as a long-term recovery in conjunction with the COOP
  • ••• an example: how do deal with payroll processes during a disruption
177
Q

what does COOP stand for

A

• continuity of operations

178
Q

what is the function of COOP

A
  • focuses on restoring an organizations missions essential functions (MEF) at an alternate site and performing those functions for 30 days before returning to normal operations
  • may also be activated with BCP, ISCP or DRP
179
Q

what is the function of the crisis communication plan

A
  • documents standard procedures for internal and external communications in the event of a disruption
  • provides various formats
  • often defines specific people as the “only” authority to answer questions from or providing information to the public
  • should be communicated to COOP and BCP planners
180
Q

what does CIPP stand for

A

• critical infrastructure protection plan (CIPP)

181
Q

what is the function of CIP (critical infrastructure protection plan)

A
  • critical infrastructure and key resources (CIKR)
  • components of the national infrastructure that are deemed so vital that their loss would have debilitation effect of the safety, security, economy, and/or health of the Unites States.
182
Q

what is Cyber Incident Response plan

A
  • establishes procedures to address cyber attack’s against an organization’s information system.
  • this plan may be an appendix in the BCP
  • this may activate a ISCP or DRP
183
Q

what does DRP stand for

A

• disaster recovery plan

184
Q

what is the function of the DRP

A
  • DRP is a information system-focused plan designed to restore operability of the target system, applications, or computer facility infrastructure at an alternate site after an emergency
  • DRP only address information system disruptions the require relocation
  • DRP may support BCP or COOP
185
Q

what does ISCP stand for

A
  • information system contingency plan
  • provides procedures for the assessment and recovery of a system following a system disruption
  • differs from the DRP in the fact that the plan focuses on recovery and is not specific to site (primary or failover site)
  • can work in conjunction with coop, drp and bcp
186
Q

what does OEP stand for

A

• occupant emergency plan

187
Q

what is the OPE (occupancy emergency plan) focus on

A
  • people are most important
  • first response procedures for occupants of a facility in the event of a threat or incident to the health and safety of personnel, the environment, or property.
  • physical threat
  • fire, bomb threat, chemical release, domestic violence in the work place, or medical emergency
  • initiated preceding a COOP or DRP activation
188
Q

what is the BIA pupose

A

• to correlate the system with the critical mission/business processes and services provided, and based on that information, characterize the consequences of a disruption.

189
Q

what plans should the BIA be incorporated into

A
  • BCP
  • DRP
  • COOP
190
Q

3 stages typically involved with BIA

A
  1. determine mission/business process and recovery criticality
  2. Identify resource requirements - what resources are needed to resume mission critical processes
  3. Identify recovery priorities for system recourses - prioritize the mission critical processes
191
Q

what is MTD

A
  • Maximum Tolerable Downtime
  • the total amount of time the system owner/authorizing official is willing to accept for a mission process outage or disruption.
192
Q

what is RTO

A
  • Recovery time Objective
  • the amount of time to restore the system (hardware)
  • RTO and WRT must not exceed MTD
193
Q

what two formulas should be equal to or less than MTD

A

• RTO and WRT

194
Q

what is WRT

A

• Work Recovery Time (software)

195
Q

what is MTBF

A
  • Mean Time Between Failures

* •••• example: average time that drives fails is 5 years. MTBF is 5 years

196
Q

what is MTTR

A

• Mean Time To Repair – how long it takes to recovery the failed system

197
Q

what is MOR

A

• Minimum Operating Requirements - the minimum requirements for critical systems to function

198
Q

what will suffer if you have too much confidentiality

A

• availability

199
Q

what will suffer if you have too much integrity

A

• availability

200
Q

what will suffer if you have to much availability

A

• confidentiality and integrity

201
Q

what is IT security’s main purposes

A
  • to support the business mission statement
  • support business goals
  • we are not the most important department but we span all departments
  • we are security leaders and business leaders
202
Q

should senior management be part of the BCP and DROP process

A
  • yes, they need to be involved and committed
  • ultimately they are liable
  • they must show due care and due diligence
  • be careful during the process, most departments feel they are the most important therefore their systems should be take priority
203
Q

what is the ISC2 ethics mnemonic

A
  • PAPA
  • Protect
  • Act
  • Provide
  • Advance
204
Q

what is type 1 authentication

A

• something you know — password, pass, phrase, PIN, etc.

205
Q

what is type 2 authentication

A

• something you have – ID, passport, smart card, token, cookies on PC, one time password(OTP) etc.

206
Q

what is type 3 authentication

A

• something you are – (biometrics) fingerprint, iris scan, facial geometry, your gait (walking pattern)

207
Q

what is the subject of ISO 27799

A

• Directives on how to protect PHI

208
Q

what is the subject of ISO 27005

A

• standards based approach to risk management

209
Q

explain Sabsa

A
  • layers and framework create and define a top down architecture for every requirement, control and process available in COBIT
  • model and methodology for developing a risk-driven enterprise information security architecture and service management, to support critical business processes
210
Q

explain TOGAF framework

A

• TOGAF is useful for defining the architecture goals, benefits and vision, and setting up and implementing projects to reach those goals.

211
Q

types of evidence

A
  • Demonstrative evidence
  • Documentary evidence
  • Real evidence
  • Testimonial evidence
212
Q

what is corroborative evidence

A

is supporting evidence used to help prove an idea or point. It cannot stand on its own but is used as a supplementary tool to help prove a primary
piece of evidence.

213
Q

what is secondary evidence

A

• is not viewed as reliable and strong in proving innocence or guilt (or liability in civil cases). Oral evidence, such as a witness’s testimony, and copies of original documents are placed in this category.
• Logs and documents from the systems are considered secondary
evidence.

214
Q

corrective access control is what

A

Corrective controls include any measures taken to repair damage or restore resources and capabilities to their prior state following an unauthorized or unwanted activity. Examples of technical corrective controls include patching a system, quarantining a virus, terminating a process, or rebooting a system

215
Q

Which of these is automatically granted, you do NOT have to apply for it?

  1. patent
  2. trademark
  3. copyright
  4. legal immunity
A
  1. copyright
216
Q

We are considering how we should protect our intellectual property. Which of these do you need to apply for to be protected? (Select all that apply).

  1. patent
  2. trademark
  3. trade secret
  4. copyright
A
  1. patent

2. trademarks

217
Q

Which of these would be a type of corrective access control?

  1. encryption
  2. backups
  3. patches
  4. IDS
A
  1. patches
218
Q

Jane is working on strengthening our preventative controls. What could she look at to do that?

  1. patches
  2. IDS
  3. drug tests
  4. backup
A
  1. drug test
219
Q

Healthcare insurers, providers and clearing house agencies must comply with HIPAA (Health Insurance Portability and Accountability Act) if they operate in the United States. Which of these are rules they MUST follow? (Select all that apply).

  1. privacy
  2. disclosure rule
  3. encryption rule
  4. breach notification
  5. security rule
A
  1. privacy rule
  2. breach notification rule
  3. security rule

Explanation
Puts strict privacy and security rules on how Protected Health Information (PHI) is handled by health insurers, providers and clearing house agencies (Claims). Health Insurance Portability and Accountability Act (HIPAA) has 3 rules – Privacy rule, Security rule and Breach Notification rule. The rules mandate Administrative, Physical and Technical safeguards. Security Breach Notification Laws. NOT Federal, 48 states have individual laws, know the one for your state (none in Alabama and South Dakota). They normally require organizations to inform anyone who had their PII compromised. Many have an encryption clause. Lost encrypted data may not require disclosure.

220
Q

If we are wanting to implement a governance standard and control framework focused on IT service management, which of these should we implement?

coso
frap
cobit
ITIL

A

ITIL

Explanation
ITIL (Information Technology Infrastructure Library) focuses on ITSM (IT Service Management).
221
Q

One of our senior VPs calls you up to explain a term he heard at a conference. He heard about cybersquatting and wants to know more. Which of these is TRUE about it?

never profitable
potentially illegal
always illegal
legal

A

legal

Explanation
Cybersquatting – Buying an URL you know someone else will need (To sell at huge profit – not illegal).

222
Q

Which type of companies are subject to the Sarbanes-Oxley act (SOX)?

  1. startup companies
  2. healthcare companies
  3. private companies
  4. publicly traded companies
A
  1. publicly traded companies

Explanation
Sarbanes-Oxley Act of 2002 (SOX): Directly related to the accounting scandals in the late 90’s. Regulatory compliance mandated standards for financial reporting of publicly traded companies. Intentional violations can result in criminal penalties.

223
Q 
Jane is looking at the CIA triad and working on mitigating our availability vulnerabilities. Select all the threats against our availability:
software coding errors  
code injections
keyloggers
hardware failure
ddos
A

software coding errors (meaning fault error. something failing to a halt) “I did not read this correctly the first time”
hardware failure
DDOS

Explanation
Common attacks on our availability includes Distributed Denial Of Service (DDOS) attacks, hardware failures, software failures. Keyloggers are normally attacks on our confidentiality and code injections are attacks on our integrity.

224
Q

The US HIPAA (Health Insurance Portability and Accountability Act) laws have 3 core rules. Which of these is NOT one of them?

encryption rule
breach notification rule
security rule
privacy rule

A

encryption rule

Explanation
HIPAA (Health Insurance Portability and Accountability Act) has 3 rules – Privacy rule, Security rule and Breach Notification rule. The rules mandate administrative, physical and technical safeguards. Risk Analysis is required.

225
Q

What could be a security concern we would need to address in a procurement situation?

  1. who gets the IT infrastructure
  2. all of these
  3. how do we ensure their security stands are high enough
  4. security is part of the SLA
A
  1. security is part of the SLA (read this question wrong. this is buying from a 3rd party not buying a business)

Explanation
Procurement: When we buy products or services from a 3rd party, security part of the SLA.

226
Q

You hear that senior management is looking at the ISO 27005 standard, and a colleague asks you, “What is that focused on?”

  1. PHI
  2. risk management
  3. HIPAA
  4. ITSM
A
  1. risk management

Explanation
ISO 27005: Standards based approach to Risk Management.

227
Q

What would be one of the security concerns we would need to address in a divestiture?

  1. who gets the IT infrastructure
  2. all of these
  3. security is part of the SLA
  4. how do we ensure their security standards are high enough
A
  1. who gets the IT infrastructure

Explanation
Divestitures: Your organization is being split up. How do you ensure no data crosses boundaries it shouldn’t? Who gets the IT Infrastructure?

228
Q

With the CIA triad in mind, if we have too much confidentiality which other control will suffer the MOST?

  1. authentication
  2. integrity
  3. availability
  4. accountability
A
  1. availability

Explanation
Finding the right mix of Confidentiality, Integrity and Availability is a balancing act. This is really the cornerstone of IT Security – finding the RIGHT mix for your organization. Too much Confidentiality and the Availability can suffer.

PCS CISSP MM, EC, Thor series (13 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions