Brainscape's Knowledge GenomeTM


Top Flashcards (Certified)
All Flashcards

Sunflower Notes > Domain 1 - Security and Risk Managment > Flashcards

Domain 1 - Security and Risk Managment Flashcards

1
Q

What is CIA?

A

Confidentiality
Integrity
Availability

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Opposite of CIA

A

DAD

Disclosure
Alteration
Destruction

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Confidentiality

A

Prevent unauthorized disclosure, need to know, and least privilege.

Assurance that information is not disclosed to unauthorized programs, users, processes, encryption, logical and physical access control,

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Integrity

A
  • No unauthorized modifications,

- consistent data, protecting data or a resource from being altered in an unauthorized fashion

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Availability

Think of…

FART

A

FART

  • Fault tolerance
  • Accessible
  • Reliable
  • Timely

Recovery procedures WHEN NEEDED

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What is required for Accountability?

A

IAAA

Identification
Authentication
Accountability
Authorization

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Privacy

A

level of confidentiality and privacy protections

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What is the goal of risk management?

A

Get risk to acceptable /tolerable level.

Not possible to get rid of all risk`

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What are Baselines?

A

Minimum standards

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What is ISO 27005?

A

Risk Management Framework

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What are the responsibilities of the Information Security Officer (ISO) ?

A

Written Products – ensure they are done

CIRT – implement and operate Security

Awareness – provide leadership

Communicate – risk to higher management

Report to as high a level as possible Security is everyone’s responsibility

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What are the characteristics of a Control Frameworks?

A

Consistent – approach & application

Measurable – way to determine progress

Standardized – all the same Comprehension – examine everything

Modular – to help in review and adaptive. Layered, abstraction

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What is Due Care?

A

Taking action and doing what is reasonable that a Prudent man would do in the same situation.

Taking the necessary steps required as countermeasures, Controls (safeguards).

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What is Due Diligence?

A

Doing the necessary research. Means that the company properly investigated all of its possibly weaknesses and vulnerabilities.

AKA understanding the threats

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Intellectual Property Laws

Think of a computer, a PC
PCTT

A

Patent
Copyright
Trade Secret
Trademarks

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Define Patent

A

Grants ownership of an invention and provides enforcement for owner to exclude others from practicing the invention. After 20 years the idea is open source of application

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Define Copyright

A

Protects the expression of ideas but not necessarily the idea itself ex. Poem, song @70 years after author dies

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Define Trade Secret

A

Something that is propriety to a company and important for its survival and profitability (like formula of Coke or Pepsi)

DON’T REGISTER – no application

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Define Trademarks

A

Words, names, product shape, symbol, color or a combination used to identify products and distinguish them from competitor products (McDonald’s M) @10 years

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Sarbanes Oxley, Section 302

A

The essence of Section 302 of the Sarbanes-Oxley Act states that the CEO and CFO are directly reponsible for the accuracy, documentation and submission of all financial reports as well as the internal control structure to the SEC.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Sarbanes Oxley, Section 404

Picture a big Ox in front of a bank vault protecting the money (financial reporting)

A

Mandates that all publicly-traded companies must establish internal controls and procedures for financial reporting and must document, test and maintain those controls and procedures to ensure their effectiveness.

The purpose of SOX is to reduce the possibilities of corporate fraud by increasing the stringency of procedures and requirements for financial reporting.

logical controls over accounting files; good auditing and information security

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

What are the Corporate Officers’ liability under Sarbanes Oxley (SOX)?

A

Executives are now held liable if the organization they represent is not compliant with the law. Negligence occurs if there is a failure to implement

Negligence occurs if there is a failure to implement recommended precautions, if there is no contingency/disaster recovery plan, failure to conduct appropriate background checks, failure to institute appropriate information security measures, failure to follow policy or local laws and regulations.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

What is COSO?

“CRC IM”

A

Framework to work with Sarbanes-Oxley 404 compliance (internal controls to financial reporting).

European laws: TREADWAY COMMISSION

Need for information security to protect the individual. Privacy is the keyword here! Only use information of individuals for what it was gathered for

COSO helps a company define organizational risks at a business level.

CRC IM

Control environment— Management’s philosophy and operating style; the company culture as it pertains to ethics and fraud

Risk assessment— Establishment of risk objectives; the ability to manage internal and external change

Control activities—Policies, procedures, and practices put in place to mitigate risk

Information and communication—A structure that ensures that the right people get the right information at the right time

Monitoring—Detecting and responding to control deficiencies

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

ITSEC

A

The Information Technology Security Evaluation Criteria

The European version of TCSEC

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
COBIT
Control Objectives for Information and Related Technologies Examines the effectiveness, efficiency, confidentiality, integrity, availability, compliance, and reliability of high level control objectives. Having controls, GRC heavy auditing, metrics, regulated industry
26
Incident
An event that has potential to do harm
27
Breach
Incident that results in disclosure or potential disclosure of data
28
Data Disclosure
Unauthorized acquisition of personal information
29
Event
Threat events are accidental and intentional exploitations of Vulnerabilities.
30
ITAR
International Traffic in Arms Regulations Defense goods, arms export control act
31
FERPA
Family Educational Rights and Privacy Act
32
Graham, Leach, Bliley (GLBA) Think of a leach sucking on a credit card
Credit related Personally identifiable information (PII)
33
ECS
Electronic Communication Service (Europe) Notice of breaches
34
Fourth Amendment
The basis for privacy rights is the Fourth Amendment to the Constitution. Prevents unauthorized search and seizure
35
1974 US Privacy Act Think of... Privacy=Protect -->Personal
Protection of PII on federal databases
36
1980 Organization for Economic Cooperation and Development (OECD)
Provides for data collection, specifications, safeguards A global organization that provides guidelines to various countries on collecting, handling, and protecting personal data
37
US Computer Fraud and Abuse Act
Trafficking in computer passwords or information that causes a loss of $1,000 or more or could impair medical treatment. A Federal crime to access a protected computer without proper authorization
38
Electronic Communications Privacy Act
Prohibits eavesdropping or interception w/o distinguishing private/public
39
Communications Assistance for Law Enforcement Act (CALEA) of 1994
Amended the Electronic Communications Privacy Act of 1986. CALEA requires all communications carriers to make wiretaps possible for law enforcement with an appropriate court order, regardless of the technology in use.
40
1987 US Computer Security Act
Security training, develop a security plan, and identify sensitive systems on govt. agencies To improve the security and privacy of sensitive information in federal computer systems and to establish a minimum acceptable security practices for such systems
41
US Economic and Protection of Propriety Information Act
Industrial and corporate espionage
42
Health Insurance and Portability Accountability Act (HIPPA)
Provides data privacy and security provisions for safeguarding medical information
43
Health Information Technology for Economic and Clinical Health Act of 2009 (HITECH)
Congress amended HIPAA by passing this Act. This law updated many of HIPAA’s privacy and security requirements. One of the changes is a change in the way the law treats business associates (BAs), organizations who handle PHI on behalf of a HIPAA covered entity. Any relationship between a covered entity and a BA must be governed by a written contract known as a business associate agreement (BAA). Under the new regulation, BAs are directly subject to HIPAA and HIPAA enforcement actions in the same manner as a covered entity. HITECH also introduced new data breach notification requirements
44
ISC2 Code of Ethics
Protect society, the commonwealth, and the infrastructure. Act honorably, honestly, justly, responsibly, and legally. Provide diligent and competent service to principals. Advance and protect the profession.
45
Internet Advisory Board (IAB) Ethics and Internet (RFC 1087)
Don’t compromise the privacy of users. Access to and use of Internet is a privilege and should be treated as such It is defined as unacceptable and unethical if you, for example, gain unauthorized access to resources on the internet, destroy integrity, waste resources or compromise privacy.
46
Business Continuity plans development (BCP)
BCP Steps: 1. Project Initiation (Develop policy and management approval) 2. BIA 3. Recovery Strategy 4. Plan design and development 5. Implementation 6. Testing 7. Continual maintenance Defining the continuity strategy Computing strategy to preserve the elements of HW/SW/ communication lines/data/application - Facilities: use of main buildings or any remote facilities People: operators, management, technical support persons Supplies and equipment: paper, forms HVAC Documenting the continuity strategy
47
What is the Goal of a Business Impact Assessment (BIA)?
Goal: to create a document to be used to help understand what impact a disruptive event would have on the business.
48
What are the key steps in a BIA? "My Science Resume is Wonderful''! SCI | CV | RAD ``` SCI = Science CV = Curriculum Vitae = Resume RAD = is slang for Wonderful ``` Think of a teenager with long hair from California who is in school in a Science classroom looking at a microscope and holding in his hand is his CV (Resume) and he is shouting "Dude! My Science Resume is RAD, it's Wonderful"!
Select individuals to interview for Data-gathering Create Data-gathering techniques (qualitative and quantitative analysis) Identify Company's Critical Business Functions and Resources Calculate how long these functions can survive without these resources ( Maximum Tolerable Downtime - MTD) Vulnerability Assessment Risk Assessment Analyze the compiled information Documentation and Recommendation
49
BIA Step 1 - Gathering assessment material
Org charts to determine functional relationships Examine business success factors
50
BIA Step 2 - Vulnerability assessment
Identify Critical IT resources out of critical processes, Identify disruption impacts and Maximum, Tolerable Downtime (MTD) Loss Quantitative (revenue, expenses for repair) or Qualitative (competitive edge, public embarrassment). Presented as low, high, medium. Develop recovery procedures
51
BIA Step 3 - Analyze the compiled information
Document the process Identify interdependabilit Determine acceptable interruption periods
52
BIA Step 4 - Documentation and Recommendation
Provide Documentation and Recommendation to managment
53
In a BIA, the RTO
The Recovery Time Objective (RTO) must be less than the Maximum Tolerable Downtime
54
What are some Administrative Management Controls?
``` M of N Control Least privilege Two-man control Dual control Rotation of duties Mandatory vacations Need to know Employee Agreements - NDA, no compete, acceptable use ```
55
Who are the greatest threat to security?
Employees, staff members pose more threat than external actors, loss of money stolen equipment, loss of time work hours, loss of reputation declining trusts and loss of resources, bandwidth theft, due diligence Voluntary & involuntary ------------------Exit interview!!!
56
Who are Third Party Controls geared towards?
- Vendors - Consultants - Contractors Properly supervised, rights based on policy
57
Threat
Damage
58
Vulnerability
Weakness, flaw or lack of a countermeasure Weakness to a threat vector (never does anything)
59
Likelihood
chance it will happen
60
Residual Risk
amount of risk left over after countermeasures have been put in place You can never completely eliminate risk
61
How is Risk determined?
Risk is determined as a byproduct of likelihood and impact . Organizations own the risk
62
What is ITIL?
Best practices for IT core operational processes, not for audit - Service - Change - Release - Configuration Strong end to end customer focus/expertise About services and service strategy Risk
63
What is the goal of Risk Management?
Determine impact of the threat and risk of threat occurring. The primary goal of risk management is to reduce risk to an acceptable level.
64
What are the steps in conducting a Risk Management Analysis?
Step 1 – Prepare for Assessment (purpose, scope, etc.) Step 2 – Conduct Assessment - ID threat sources and events - ID vulnerabilities and predisposing conditions - Determine likelihood of occurrence - Determine magnitude of impact - Determine risk Step 3 – Communicate Risk/results Step 4 – Maintain Assessment/regularly
65
What are the different types of Risk?
``` Inherent Control Detection Residual Business Overall ```
66
Inherent Risk
chance of making an error with no controls in place
67
Control Risk
chance that controls in place will prevent, detect or control errors
68
Detection Risk
chance that auditors won’t find an error
69
Residual Risk
risk remaining after control in place
70
Business Risk
concerns about effects of unforeseen circumstances
71
Overall Risk
combination of all risks aka Audit risk
72
Preliminary Security Examination (PSE)
Helps to gather the elements that you will need when the actual Risk Analysis takes place.
73
Risk Analysis steps?
Identify assets, identify threats, and calculate risk.
74
ISO 27005
deals with risk
75
Four Major Risk Assessment Steps
Prepare, Perform, Communicate, Maintain
76
What are the steps in a Qualitative Risk Assessment?
Approval – Form Team – Analyze Data – Calculate Risk – Countermeasure Recommendations Note: Remember Hybrid Risk Assessment which is a combination of a Qualitative and Quantitative Risk Assessment
77
Hybrid Risk Assessment
A combination of a Qualitative and Quantitative Risk Assessment
78
Quantitative Risk Analysis
Deals with numbers and values which is conducted after a Qualitative Risk Analysis.
79
SLE (single Loss Expectancy)
= Asset Value * Exposure factor (% loss of asset)
80
ALE (Annual loss expectancy)
= SLE * ARO (Annualized Rate of occurrence)
81
What are some Risk responses after a Quantitative Risk Analysis has been performed?
Accept Mitigate (Reduce) Assign or Transfer Avoid
82
Risk: Mitigation
Reduce by implementing controls calculate costs
83
Risk: Assign/Transfer
Insure the risk to transfer it
84
Risk: Avoidance
Stop the business activity that is causing the risk because you don't want to accept the risk
85
Risk: Loss
Probability x Cost
86
Residual Risk
Where cost of applying extra countermeasures is more than the estimated loss resulting from a threat or vulnerability (C > L). Legally the remaining residual risk is not counted when deciding whether a company is liable.
87
Controls Gap
The amount of risk that is reduced by implementing safeguards
88
How to calculate Residual Risk?
Total risk – controls gap = residual risk
89
RTO (Recovery Time Objective) Time=Quickly Objective=Target
How quickly you need to have that application’s information available after downtime has occurred The recovery time objective (RTO) is the maximum tolerable length of time that a computer, system, network, or application can be down after a failure or disaster occurs. RTO, or Recovery Time Objective, is the target time you set for the recovery of your IT and business activities after a disaster has struck. The goal here is to calculate how quickly you need to recover, which can then dictate the type or preparations you need to implement and the overall budget you should assign to business continuity.
90
RPO (Recovery Point Objective)
Point in time that application data must be recovered to resume business functions; AMOUNT OF DATA YOUR WILLING TO LOSE
91
MTD (Maximum Tolerable Downtime)
Maximum delay a business can be down and still remain viable MTD minutes to hours: critical MTD 24 hours: urgent MTD 72 hours: important MTD 7 days: normal MTD 30 days non-essential PLAN Accept Build Risk Team Review Once in 100 years = ARO of 0.01
92
Define SLE
The dollar value lost when an asset is successfully attacked
93
What are consequences of an Impact?
Life, dollars, prestige, market share
94
Risk: Acceptance
live with it and pay the cost Accept the consequences of the risk
95
Risk Framework Countermeasures
- Accountability - Auditability - Source trusted and known - Cost-effectiveness - Security - Protection for CIA of assets - Other issues created? If it leaves residual data from its function
96
How do you determine if a company shall proceed with a Control for Risk mitigation?
Primary Controls (Types) – (control cost should be less than the value of the asset being protected)
97
Administrative/Managerial Policy Controls
Preventive | Detective
98
Administrative: Preventive Control
hiring policies, screening security awareness (also called soft-measures!)
99
Administrative: Detective
screening behavior, job rotation, review of audit records
100
Technical (aka Logical) :Preventive
protocols, encryption, biometrics smartcards, routers, firewalls
101
Technical (Logical): Detective
IDS and automatic generated violation reports, audit logs, CCTV(never preventative)
102
Physical: Preventive
fences, guards, locks
103
Physical: Detective
motion detectors, thermal detectors video cameras
104
What is the primary objective of implementing Controls?
To reduce the effects of security threats and vulnerabilities to a tolerable level
105
Another definition of Risk Analysis
Process that analyses threat scenarios and produces a representation of the estimated Potential loss
106
Access Control: Directive
Specify rules of behavio
107
Access Control: Deterrent
Discourage people, change my mind
108
Access Control: Preventative
Prevent incident or breach
109
Access Control: Compensating
Sub for loss of primary control
110
Access Control: Detective
Signal warning, investigate
111
Access Control: Corrective
Mitigate damage, restore control
112
Access Control: Recovery
Restore to normal after incident
113
Preventive: Accuracy
Data checks, validity checks
114
Preventive: Security
Labels, traffic padding, encryption
115
Preventive: Consistency
DBMS, Data dictionary
116
Detective: Accuracy
Cyclic Redundancy
117
Detective: Security
IDS, audit trails
118
Detective: Consistency
Comparison tools
119
Corrective: Accuracy
Checkpoint, backups
120
Corrective: Security
Emergency response
121
Corrective:Consistency
Database controls
122
What is Penetration Testing?
Testing a networks defenses by using the same techniques as external intruders
123
Penetration Testing: Scanning and Probing
Scanning - port scanners Demon Dialing - war dialing for modems Sniffing – capture data packets Dumpster Diving – searching paper disposal areas Social Engineering – most common, get information by asking
124
Blue team
Had knowledge of the organization, can be done frequent and least expensive
125
Red team
Is external and stealthy
126
White box
Ethical hacker knows what to look for, see code as a developer
127
Grey Box
Partial knowledge of the system, see code, act as a user
128
Black box
Ethical hacker not knowing what to find No prior knowledge
129
What are the 4 Stages of Penetration Testing?
Panning, discovery, attack, reporting
130
In Penetration Testing, what are some examples of vulnerabilities exploited?
Kernel flaws, Buffer overflows, Symbolic links, File descriptor attack
131
Footprinting
External information gathering information gathering - port scans, vulnerability mapping, exploitation, report scanning tools are used in penetration tests
132
Fingerprinting
Information gathering on the operating systems and web applications that are running on a target host.
133
Penetration Testing strategies
External, internal, blind, double-blind
134
Penetration Testing Strategies
Zero, partial, full knowledge tests
135
Pen Test Methodology
- Recon/discover - Enumeration - vulnerability analysis - execution/exploitation - Document Findings/reporting - SPELL OUT AND DEFINE!!!!
136
What is the Deming Cycle?
Plan – ID opportunity & plan for change Do – implement change on small scale Check – use data to analyze results of change Act – if change successful, implement wider scale, if fails begin cycle again
137
Employee Administrative Controls
Individuals must be qualified with the appropriate level of training. - Develop job descriptions - Contact references - Screen/investigate background - Develop confidentiality agreements - Determine policy on vendor, contractor, consultant, and temporary staff access DUE DILIGENCE
138
Software Licenses: Public domain
Available for anyone to use
139
Software Licenses: Open source
Source code made available with a license in which the copyright holder provides the rights to study, change, and distribute the software to anyone
140
Software Licenses: Freeware
Proprietary software that is available for use at no monetary cost. May be used without payment but may usually not be modified, re-distributed or reverse-engineered without the author's permission
141
What is Assurance as it relates to Security?
Degree of confidence in satisfaction of security requirements Assurance = other word for security THINK OUTSIDE AUDIT
142
What is Security Awareness?
Technical training to react to situations, best practices for Security and network personnel; Employees, need to understand policies then use presentations and posters etc. to get them aware Formal security awareness training – exact prep on how to do things
143
What is Wire Tapping?
Eavesdropping on communication -only legal with prior consent or warrant
144
What is Data Diddling?
Act of modifying information, programs, or documents to commit fraud, tampers with INPUT data
145
What does Privacy Laws stipulate?
Data collected must be collected fairly and lawfully and used only for the purpose it was collected
146
Water holing
Create a bunch of websites with similar names
147
Work Function (factor)
The difficulty of obtaining the clear text from the cipher text as measured by cost/time
148
Fair Cryptosystems
In this escrow approach, the secret keys used in a communication are divided into two or more pieces, each of which is given to an independent third party. When the government obtains legal authority to access a particular key, it provides evidence of the court order to each of the third parties and then reassembles the secret key.
149
What is an SLA
Agreement between IT service provider and customer, document service levels, divorce; how to dissolve relationship
150
SLR (requirements)
Requirements for a service from client viewpoint
151
Service level report
Insight into a service providers ability to deliver the agreed upon service quality Legislative
152
What is FISMA?
Regarding Federal Agencies Phase 1 categorizing, selecting minimum controls, assessment Phase 2: create national network of secures services to assess

Sunflower Notes (8 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2025 Bold Learning Solutions. Terms and Conditions