Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

ISC CC > Domain 1 - Security Principles > Flashcards

Domain 1 - Security Principles Flashcards

1
Q

What is the difference between IT security and Cybersecurity?

A

Cyber security has to do with assets that have internet access.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What does the CIA in CIA Triad stand for?

A

Confidentiality, Availability, Integrity

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Should IOT devices be on the same network as confidential systems?

A

No. IOT devices are usually created for functionality, not security. Keep them separate when possible.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What are the three states of data?

A

Data at rest, data in transit (motion), data in use

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What is Data Integrity?

A

Ensuring data has not been altered

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What is the opposite of the CIA Triad?

A

DAD (Disclosure, Alteration, and Destruction)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What does IAAA stand for?

A

Identification, Authentication, Authorization, and Accountability

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What is an “Identification” ?

A

Something that identifies you,. Username, ID Number, SSN, etc..

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What is type 1 authentication?

A

A password, pass phrase, pin number. Something you remember. These are also called Knowledge Factors.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What is Type 2 authentication?

A

IDs, Passports, tokens, cookies… Also known as possession factors.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What is Type 3 authentication?

A

Fingerprints, Facial recognition, iris scans, etc.. Realistic authentication is another term for these auth types.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What does DAC stand for?

A

Discretionary Access Control.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

When is DAC most often used?

A

When availability is most important.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

How does DAC work?

A

Access to an object is assigned at the discretion of the object owner.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What does MAC stand for?

A

Mandatory Access Control

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

When is MAC most often used?

A

When confidentiality is the most important

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What are labels assigned to when using MAC?

A

Objects

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What are clearances assigned to when using MAC?

A

Subjects / People

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What is RBAC?

A

Access by grouping

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

When is RBAC most often used?

A

When integrity is the most important

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

What does ABAC stand for?

A

Attribute based access control

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

How does ABAC work?

A

Access to objects is granted based on subjects, objects, and environmental conditions.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

What is context based access control?

A

Access to an object is based on certain contextual parameters such as location, time, sequence of responses, and access history.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

What is content based access control?

A

Accessed is provided based on the attributes of an objects.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

What is Accountability?

A

Often referred to as auditing. It traces an action to a subjects identity.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

What does non-repudiation mean when

A

It means a user cannot deny having performed a certain action.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

What are “Subjects”?

A

These can be users, but also programs.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

What are “Objects”?

A

Any passive data.. Physical paper and any server data

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

What is the equation for Risk?

A

Threat * Vulnerability (or likelihood)

30
Q

What is the equation for Total Risk?

A

Threat * Vulnerability * Asset Value

31
Q

What is the equation for Residual Risk?

A

Total Risk - Countermeasures

32
Q

What is Qualitative Risk Analysis?

A

How likely is it to happen and how bad is it if it happens? Subjective.

33
Q

What is Quantitative Risk Analysis?

A

What will it actually cost us in dollars

34
Q

What is Due Dilligence?

A

Doing research before implementation?

35
Q

What is Due Care?

A

The implementation itself.

36
Q

What is the first thing you need to do when you start a risk management iterative for the first time?

A

Classify your assets by risk criticality.

37
Q

What does Risk Mitigation mean?

A

Reducing the risk?

38
Q

What does Risk Transference mean?

A

Sharing or transferring the risk to someone else. Cyber insurance is a perfect example of risk transference.

39
Q

what is Risk Acceptance?

A

Accepting the risk. This can happen when the counter-measure is more expensive than the risk itself.

40
Q

What is Risk Avoidance?

A

When you stop doing whatever you are doing because you cannot mitigate, transfer, or accept this risk.

41
Q

What is Risk Rejection?

A

When a risk exists and you ignore it. This is NEVER acceptable.

42
Q

What does AV stand for in Risk Management?

A

Asset Value.. The value of the asset. The actual dollars and potential penalties for lost PII.

43
Q

What does EF stand for in Risk Management?

A

exposure factor. How much loss. In the case of a laptop being stolen it is 100%.

44
Q

What does SLE in Risk Management mean?

A

Single Loss Expectancy. This is the dollar value of the loss.

45
Q

What does ARO in mean in Risk Management?

A

Annual rate of occurrence.. For example, how many laptops are stolen per year?

46
Q

What does ALE mean in Risk Management?

A

Annualized Loss Expectancy. The total dollar value of the lost.

47
Q

What is KGI in risk management?

A

Measurement of the overall goal

48
Q

What is a KPI in Risk Management?

A

How well the IT process is performing to achieve the goal.

49
Q

What does KRI stand for?

A

Key Risk Indicator

50
Q

What does KRI in Risk Management mean?

A

It is a metric that demonstrates the risks an organization is facing or how risky an activity is.

51
Q

What are Administrative (Directive) Controls?

A

Organizational Policies and Procedures.

52
Q

What are the Physical (logical) Controls?

A

Locks, Fences, Guards, Dogs, etc..

53
Q

What are Technical controls?

A

Hardware, Software, Firmware…. Firewalls, antivirus, IDP / IPS , etc..

54
Q

What are Preventative controls?

A

It prevents an action from happening. Least privilege, IDS / IPS, etc..

55
Q

What is a Detective Control?

A

A control that detects during or after an attack. Logs, camera, etc..

56
Q

What is a Corrective Control?

A

A control that corrects an attack. AV and patching..

57
Q

What are Recovery controls

A

Controls that help us recover after an attack.

58
Q

What are Deterrent controls?

A

Controls that deter an attack.. They deter, but do not stop the attack.

59
Q

What are compensating controls?

A

Used to compensate for another weakness

60
Q

What are the code of ethics four canons?

A

Protect Society
Act Honorably
Provide diligent and competent services
Advance and protect the profession

61
Q

Who handles governance in an organization?

A

This is handled by the C-Level executives.

62
Q

Who handles the implementation to meet governance directives?

A

Management

63
Q

What is the definition of criminal law?

A

Incarceration, death, and financial fines

64
Q

What is the definition of Civil Law (Tort law)

A

Individuals, groups, or organizations are the victims and proof must be “the majority of proof”.This means more likely than not.

65
Q

What is the definition of Administrative Law (Regulatory Law)?

A

Laws enacted by government agencies. HIPAA is an example.

66
Q

What is the definition of Private Regulation?

A

compliance that is required by contract. PCI DSS is an example.

67
Q

What is the definition for customary law?

A

Handles the personal conduct and patterns of behavior.

68
Q

Does GDPR cover European citizens living abroad?

A

No. They need to be physically located in the EU for protections.

69
Q

Are policies specific?

A

No, they are high-level and non-specific

70
Q
A

ISC CC (4 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions