Domain 1 – Security Management Practices Flashcards

Question

Identification of Risk

Answer 1

• Actual threat • Possible consequences • Probable frequency • Likely hood of event

Answer 2

• Identification of risks • Benefit - cost justification of counter measures

Answer 3

• Asset – Resource, product, data • Threat – Action with a negative impact • Vulnerability – Absence of control • Safeguard – Control or countermeasure

Answer 4

% of asset loss caused by threat

Answer 5

Single Loss Expectancy Expected financial loss for single event

Answer 6

Annualized Rate of Occurrence represents estimated frequency in which threat will occur within one year

Answer 7

Annualized Loss Expectancy Annually expected financial loss

Answer 8

• Risk analysis is more comprehensive than a Business Impact Analysis • Quantitative – assigns objective numerical values (dollars) • Qualitative – more intangible values (data) • Quantitative is a major project that requires a detailed process plan

Answer 9

Preliminary Security Examination • Often conducted prior to the quantitative analysis. • PSE helps gather elements that will be needed for actual RA

Answer 10

1) Estimate of potential loss 2) Analyze potential threats 3) Define the Annualized Loss Expectancy (ALE)

Answer 11

Warfare – technically oriented terrorism

Answer 12

Unauthorized system access

Answer 13

ineffective security results in data entry errors

Answer 14

Physical destruction, or vandalism

Answer 15

utility outage, natural disaster

Answer 16

Hardware failure, program errors

Answer 17

reduced productivity, delayed collections processing

Answer 18

• Valuation of Critical Assets • Detailed listing of significant threats • Each threats likelihood • Loss potential by threat • Recommended remedial safeguards

Answer 19

Risk Reduction - implementation of controls to alter risk position Risk Transference – get insurance, transfer cost of a loss to insurance Risk Acceptance – Accept the risk, absorb loss

Answer 20

• Scenario Oriented • List the threat and the frequency • Create exposure rating scale for each scenario • Scenario written that address each major threat • Scenario reviewed by business users for reality check • Risk Analysis team evaluates and recommends safeguards • Work through each finalized scenario • Submit findings to management

Answer 21

• Asset valuation necessary to perform cost/benefit analysis • Necessary for insurance • Supports safeguard choices

Answer 22

• Perform cost/benefit analysis • Costs of safeguards need to be considered including • Purchase, development and licensing costs • Installation costs • Disruption to production • Normal operating costs

Answer 23

ALE (PreControl) – ALE (PostControl) = Annualized value of the control

Answer 24

• The amount of manual intervention required to operate the safeguard • Should not be too difficult to operate

Answer 25

Safeguard must allow for auditability and accountability

Answer 26

• During and after the reset condition • No asset destruction during activation or reset • No covert channel access to or through the control during reset • No security loss after activation or reset • Defaults to a state that does not allow access until control are fully operational

Answer 27

Benefits of Awareness • Measurable reduction in unauthorized access attempts • Increase effectiveness of control • Help to avoid fraud and abuse Periodic awareness sessions for new employees and refresh other

Answer 28

• Live interactive presentations • CBTs • Publishing of posters and newsletters • Incentives and awards • Reminders, login banners

Answer 29

• Security training for Operators • Technical training • Infosec training • Manager training

Answer 30

Intended to discourage a potential attacker : fences lightning

Answer 31

Program made up of many components: logical administrative, and physical

Answer 32

British Standard 799 Was developed in 1995 defined how Information Security Management system should be built and maintained ant has two parts: Part1 outlines control objectives Part2 ISMS

Answer 33

standards that attempt to compartmentalize and modularize the necessary components of an ISMS, as shown here: • ISO/IEC 27000 Overview and vocabulary • ISO/IEC 27001 ISMS requirements • ISO/IEC 27002 Code of practice for information security management • ISO/IEC 27003 Guideline for ISMS implementation • ISO/IEC 27004 Guideline for information security management measurement and metrics framework • ISO/IEC 27005 Guideline for information security risk management • ISO/IEC 27006 Guidelines for bodies providing audit and certification of information security management systems • ISO/IEC 27011 Information security management guidelines for telecommunications organizations • ISO/IEC 27031 Guideline for information and communications technology readiness for business continuity • ISO/IEC 27033-1 Guideline for network security • ISO 27799 Guideline for information security management in health organizations

Answer 34

Plan- Do- Check- ACT Used in ISO/IEC 27000 series

Answer 35

Model for the development of enterprise architectures developed by John Zachman What,How,Where,When,Why Planner,Owner,Designer,Builder,Worker

Answer 36

Model and methodology for the development of enterprise architectures developed by The Open Group Used to develop the following architecture types: Business,Data,Applications,Technology.

Answer 37

Department of Defense architecture framework Focuses on: Command control,communications,computers,intelligence,surveillance and reconnaissance systems and processes.

Answer 38

British ministry of defense architecture framework Based upon DoDAF, get data in the right format,to the right people ASAP.

Answer 39

Sherwood Applied Business Security Architecture Similar to Zachman Framework(Enterprise Architecture), defines business requirements from security perspective . Each layer decries in abstraction: Contextual,Conceptual,Logical,Physical,Component,Operational. • What are you trying to do at this layer? The assets to be protected by your security architecture. • Why are you doing it? The motivation for wanting to apply security, expressed in the terms of this layer. • How are you trying to do it? The functions needed to achieve security at this layer. • Who is involved? The people and organizational aspects of security at this layer. • Where are you doing it? The locations where you apply your security, relevant to this layer. • When are you doing it? The time-related aspects of security relevant to this layer.

Answer 40

Control objectives for information and related technology set of control objectives for IT management developed by Information Systems Audit and Control Association (ISACA) and IT governance institute Security Controls development Plan and organize,Acquire and implement,Deliver and support, and monitor and evaluate IT products. Was derived from COSO -Controls to reduce risk of financial fraud Similar to NIST 800-53

Answer 41

Set of controls to protect U.S. federal systems developed by the National Institute of Standards and Technology (NIST) outlines controls that agencies need to put into place to be compliant with the Federal Information Security Management Act of 2002

Answer 42

Controls to reduce risk of financial fraud developed by Comittee of Sponsoring Organizations COSO 1985 Co

Answer 43

Six Sigma is a process improvement methodology. developed by Motorola It is the “new and improved” Total Quality Management (TQM) Is used to identify defects in processes so that the processes can be improved upon.

Answer 44

Capability Maturity Model Integration (CMMI) Process improvement model developed by Carnegie Mellon. CMMI is a maturity model that allows for processes to improve in an incremented and standard approach.

Answer 45

Architecture Development Method (ADM). This method is an iterative and cyclic process that allows requirements to be continuously reviewed and the individual architectures updated as needed. These different architectures can allow a technology architect to understand the enterprise from four different views (business, data, application, and technology) so she can ensure her team develops the necessary technology to work within the environment and all the components that make up that environment and meet business requirements.

Answer 46

Who the stakeholders? What information they need? MODAF:British ministry of defense architecture framework DODAF:Department of Defense architecture framework TOGAF:The Open Group architecture framework Zachman Framework 1980

Answer 47

Subset of enterprise architecture Strategy how to make up ISMS Make sure that security efforts aligned with practices in standardized cost effective manner.

Answer 48

Strategic alignment means the business drivers and the regulatory and legal requirements are being met by the security enterprise architecture. Security efforts must provide and support an environment that allows a company to not only survive, but thrive.

Answer 49

Information Technology Infrastructure Library is the de facto standard of best practices for IT service management.

Answer 50

Information risk management (IRM) is the process of identifying and assessing risk reducing it to an acceptable level implementing the right mechanisms to maintain that level.

Answer 51

Proper risk management requires a strong commitment from senior management, a documented process that supports the organization’s mission, an information risk management (IRM) policy, and a delegated IRM team. The IRM policy should address the following items: • The objectives of the IRM team • The level of risk the organization will accept and what is considered an acceptable level of risk Formal processes of risk identification • The connection between the IRM policy and the organization’s strategic planning processes • Responsibilities that fall under IRM and the roles to fulfill them • The mapping of risk to internal controls • The approach toward changing staff behaviors and resource allocation in response to risk analysis • The mapping of risks to performance targets and budgets • Key indicators to monitor the effectiveness of controls

Answer 52

The Risk Management Team The overall goal of the team is to ensure the company is protected in the most cost-effective manner. This goal can be accomplished only if the following components are in place: • An established risk acceptance level provided by senior management • Documented risk assessment processes and procedures • Procedures for identifying and mitigating risks • Appropriate resource and fund allocation from senior management • Security-awareness training for all staff members associated with information assets • The ability to establish improvement (or risk mitigation) teams in specific areas when necessary • The mapping of legal and regulation compliancy requirements to control and implement requirements • The development of metrics and performance indicators so as to measure and manage various types of risks • The ability to identify and assess new risks as the environment and company change • The integration of IRM and the organization’s change control process to ensure that changes do not introduce new vulnerabilities

Answer 53

NIST developed a risk methodology, which is published in their SP 800-30 document. This NIST methodology is named a “Risk Management Guide for Information Technology Systems” and is considered a U.S. federal government standard. It is specific to IT threats and how they relate to information security risks. It lays out the following steps: • System characterization • Threat identification • Vulnerability identification • Control analysis • Likelihood determination • Impact analysis • Risk determination • Control recommendations • Results documentation

Answer 54

Facilitated Risk Analysis Process. The crux of this qualitative methodology is to focus only on the systems that really need assessing to reduce costs and time obligations. It stresses prescreening activities so that the risk assessment steps are only carried out on the item(s) that needs it the most.

Answer 55

Another methodology called OCTAVE (Operationally Critical Threat, Asset, and Vulnerability Evaluation) was created by Carnegie Mellon University’s Software Engineering Institute. It is a methodology that is intended to be used in situations where people manage and direct the risk evaluation for information security within their company. This places the people that work inside the organization in the power positions as being able to make the decisions regarding what is the best approach for evaluating the security of their organization. This relies on the idea that the people working in these environments best understand what is needed and what kind of risks they are facing.

Answer 56

The scope of an OCTAVE assessment is usually very wide compared to the more focused approach of FRAP. Where FRAP would be used to assess a system or application, OCTAVE would be used to assess all systems, applications, and business processes within the organization.