Domain 1 - Security and Risk Managment Flashcards
What is CIA?
Confidentiality
Integrity
Availability
Opposite of CIA
DAD
Disclosure
Alteration
Destruction
Confidentiality
Prevent unauthorized disclosure, need to know, and least privilege.
Assurance that information is not disclosed to unauthorized programs, users, processes, encryption, logical and physical access control,
Integrity
- No unauthorized modifications,
- consistent data, protecting data or a resource from being altered in an unauthorized fashion
Availability
Think of…
FART
FART
- Fault tolerance
- Accessible
- Reliable
- Timely
Recovery procedures WHEN NEEDED
What is required for Accountability?
IAAA
Identification
Authentication
Accountability
Authorization
Privacy
level of confidentiality and privacy protections
What is the goal of risk management?
Get risk to acceptable /tolerable level.
Not possible to get rid of all risk`
What are Baselines?
Minimum standards
What is ISO 27005?
Risk Management Framework
What are the responsibilities of the Information Security Officer (ISO) ?
Written Products – ensure they are done
CIRT – implement and operate Security
Awareness – provide leadership
Communicate – risk to higher management
Report to as high a level as possible Security is everyone’s responsibility
What are the characteristics of a Control Frameworks?
Consistent – approach & application
Measurable – way to determine progress
Standardized – all the same Comprehension – examine everything
Modular – to help in review and adaptive. Layered, abstraction
What is Due Care?
Taking action and doing what is reasonable that a Prudent man would do in the same situation.
Taking the necessary steps required as countermeasures, Controls (safeguards).
What is Due Diligence?
Doing the necessary research. Means that the company properly investigated all of its possibly weaknesses and vulnerabilities.
AKA understanding the threats
Intellectual Property Laws
Think of a computer, a PC
PCTT
Patent
Copyright
Trade Secret
Trademarks
Define Patent
Grants ownership of an invention and provides enforcement for owner to exclude others from practicing the invention. After 20 years the idea is open source of application
Define Copyright
Protects the expression of ideas but not necessarily the idea itself ex. Poem, song @70 years after author dies
Define Trade Secret
Something that is propriety to a company and important for its survival and profitability (like formula of Coke or Pepsi)
DON’T REGISTER – no application
Define Trademarks
Words, names, product shape, symbol, color or a combination used to identify products and distinguish them from competitor products (McDonald’s M) @10 years
Sarbanes Oxley, Section 302
The essence of Section 302 of the Sarbanes-Oxley Act states that the CEO and CFO are directly reponsible for the accuracy, documentation and submission of all financial reports as well as the internal control structure to the SEC.
Sarbanes Oxley, Section 404
Picture a big Ox in front of a bank vault protecting the money (financial reporting)
Mandates that all publicly-traded companies must establish internal controls and procedures for financial reporting and must document, test and maintain those controls and procedures to ensure their effectiveness.
The purpose of SOX is to reduce the possibilities of corporate fraud by increasing the stringency of procedures and requirements for financial reporting.
logical controls over accounting files; good auditing and information security
What are the Corporate Officers’ liability under Sarbanes Oxley (SOX)?
Executives are now held liable if the organization they represent is not compliant with the law. Negligence occurs if there is a failure to implement
Negligence occurs if there is a failure to implement recommended precautions, if there is no contingency/disaster recovery plan, failure to conduct appropriate background checks, failure to institute appropriate information security measures, failure to follow policy or local laws and regulations.
What is COSO?
“CRC IM”
Framework to work with Sarbanes-Oxley 404 compliance (internal controls to financial reporting).
European laws: TREADWAY COMMISSION
Need for information security to protect the individual. Privacy is the keyword here! Only use information of individuals for what it was gathered for
COSO helps a company define organizational risks at a business level.
CRC IM
Control environment— Management’s philosophy and operating style; the company culture as it pertains to ethics and fraud
Risk assessment— Establishment of risk objectives; the ability to manage internal and external change
Control activities—Policies, procedures, and practices put in place to mitigate risk
Information and communication—A structure that ensures that the right people get the right information at the right time
Monitoring—Detecting and responding to control deficiencies
ITSEC
The Information Technology Security Evaluation Criteria
The European version of TCSEC
COBIT
Control Objectives for Information and Related Technologies
Examines the effectiveness, efficiency, confidentiality, integrity, availability, compliance, and reliability of high level control objectives. Having controls, GRC heavy auditing, metrics, regulated industry
Incident
An event that has potential to do harm
Breach
Incident that results in disclosure or potential disclosure of data
Data Disclosure
Unauthorized acquisition of personal information
Event
Threat events are accidental and intentional exploitations of Vulnerabilities.
ITAR
International Traffic in Arms Regulations
Defense goods, arms export control act
FERPA
Family Educational Rights and Privacy Act
Graham, Leach, Bliley (GLBA)
Think of a leach sucking on a credit card
Credit related
Personally identifiable information (PII)
ECS
Electronic Communication Service (Europe)
Notice of breaches
Fourth Amendment
The basis for privacy rights is the Fourth Amendment to the Constitution.
Prevents unauthorized search and seizure
1974 US Privacy Act
Think of…
Privacy=Protect –>Personal
Protection of PII on federal databases
1980 Organization for Economic Cooperation and Development (OECD)
Provides for data collection, specifications, safeguards
A global organization that provides guidelines to various countries on collecting, handling, and protecting personal data
US Computer Fraud and Abuse Act
Trafficking in computer passwords or information that causes a loss of $1,000 or more or could impair medical treatment.
A Federal crime to access a protected computer without proper authorization
Electronic Communications Privacy Act
Prohibits eavesdropping or interception w/o distinguishing private/public
Communications Assistance for Law Enforcement Act (CALEA) of 1994
Amended the Electronic Communications Privacy Act of 1986.
CALEA requires all communications carriers to make wiretaps possible for law enforcement with an appropriate court order, regardless of the technology in use.
1987 US Computer Security Act
Security training, develop a security plan, and identify sensitive systems on govt. agencies
To improve the security and privacy of sensitive information in federal computer systems and to establish a minimum acceptable security practices for such systems
US Economic and Protection of Propriety Information Act
Industrial and corporate espionage
Health Insurance and Portability Accountability Act (HIPPA)
Provides data privacy and security provisions for safeguarding medical information
Health Information Technology for Economic and Clinical Health Act of 2009 (HITECH)
Congress amended HIPAA by passing this Act. This law updated many of HIPAA’s privacy and security requirements.
One of the changes is a change in the way the law treats business associates (BAs), organizations who handle PHI on behalf of a HIPAA covered entity.
Any relationship between a covered entity and a BA must be governed by a written contract known as a business associate agreement (BAA).
Under the new regulation, BAs are directly subject to HIPAA and HIPAA enforcement actions in the same manner as a covered entity.
HITECH also introduced new data breach notification requirements
ISC2 Code of Ethics
Protect society, the commonwealth, and the infrastructure.
Act honorably, honestly, justly, responsibly, and legally.
Provide diligent and competent service to principals.
Advance and protect the profession.
Internet Advisory Board (IAB) Ethics and Internet (RFC 1087)
Don’t compromise the privacy of users.
Access to and use of Internet is a privilege and should be treated as such
It is defined as unacceptable and unethical if you, for example, gain unauthorized access to resources on the internet, destroy integrity, waste resources or compromise privacy.
Business Continuity plans development (BCP)
BCP Steps:
- Project Initiation (Develop policy and management approval)
- BIA
- Recovery Strategy
- Plan design and development
- Implementation
- Testing
- Continual maintenance
Defining the continuity strategy
Computing strategy to preserve the elements of HW/SW/ communication lines/data/application -
Facilities: use of main buildings or any remote facilities
People: operators, management, technical support persons Supplies and equipment: paper, forms HVAC
Documenting the continuity strategy
What is the Goal of a Business Impact Assessment (BIA)?
Goal: to create a document to be used to help understand what impact a disruptive event would have on the business.
What are the key steps in a BIA?
“My Science Resume is Wonderful’’!
SCI | CV | RAD
SCI = Science CV = Curriculum Vitae = Resume RAD = is slang for Wonderful
Think of a teenager with long hair from California who is in school in a Science classroom looking at a microscope and holding in his hand is his CV (Resume) and he is shouting “Dude! My Science Resume is RAD, it’s Wonderful”!
Select individuals to interview for Data-gathering
Create Data-gathering techniques (qualitative and quantitative analysis)
Identify Company’s Critical Business Functions and Resources
Calculate how long these functions can survive without these resources ( Maximum Tolerable Downtime - MTD)
Vulnerability Assessment
Risk Assessment
Analyze the compiled information
Documentation and Recommendation
BIA Step 1 - Gathering assessment material
Org charts to determine functional relationships
Examine business success factors
BIA Step 2 - Vulnerability assessment
Identify Critical IT resources out of critical processes, Identify disruption impacts and Maximum, Tolerable Downtime (MTD)
Loss Quantitative (revenue, expenses for repair) or Qualitative (competitive edge, public embarrassment). Presented as low, high, medium.
Develop recovery procedures
BIA Step 3 - Analyze the compiled information
Document the process Identify interdependabilit
Determine acceptable interruption periods
BIA Step 4 - Documentation and Recommendation
Provide Documentation and Recommendation to managment
In a BIA, the RTO
The Recovery Time Objective (RTO) must be less than the Maximum Tolerable Downtime
What are some Administrative Management Controls?
M of N Control Least privilege Two-man control Dual control Rotation of duties Mandatory vacations Need to know Employee Agreements - NDA, no compete, acceptable use
Who are the greatest threat to security?
Employees, staff members pose more threat than external actors, loss of money stolen equipment, loss of time work hours, loss of reputation declining trusts and loss of resources, bandwidth theft, due diligence
Voluntary & involuntary ——————Exit interview!!!
Who are Third Party Controls geared towards?
- Vendors
- Consultants
- Contractors
Properly supervised, rights based on policy
Threat
Damage
Vulnerability
Weakness, flaw or lack of a countermeasure
Weakness to a threat vector (never does anything)
Likelihood
chance it will happen
Residual Risk
amount of risk left over after countermeasures have been put in place
You can never completely eliminate risk
