Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CISSP > Domain 1 Security & Risk Management > Flashcards

Domain 1 Security & Risk Management Flashcards

1
Q

What is a vulnerability

A

A weakness in a system that could be potentially be exploited.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What is a Threat

A

Anything that can bring harm to a system

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What is Impact

A

attempts to determine what the outcome of a successful exploitation would be

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What is Likelihood

A

An additional input into the Risk equation outside of just threat and vulnerability

How likely successful exploitation of a vulnerability.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Quantitative risk analysis

A

always numerically based and tied directly back to money

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Single Loss Expectancy

A

SLE = EF (Exposure Factor) X AV (Asset Value)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Asset Value

A

The value of the asset

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Exposure Factor (EF)

A

% of the asset value (AV) due to a threat

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Annualized Rate of Occurrence (ARO)

A

Frequency of threat occurrence per year

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Annualized Loss Expectancy (ALE)

A

Single Loss Expectancy (SLE) x Annualized Rate of Occurrence (ARO)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Principle of least privileges

A

Aka Minimum Necessary Access

Individuals only be granted the access necessary to perform their required business functions

Applies to system configuration, firewall rule sets, etc…

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Rotation of duties

A

force other people to be in charge of carrying out key tasks normally performed by another employee.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Separation of duties

A

limit risk associated with critical functions/transactions by requiring two parties to perform what one person could otherwise perform.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Risk Transfer

A

Involve 3rd party to help address the risk

Most common type is breach insurance.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Risk Avoidance

A

declining not to move forward with a project that introduces the unacceptable level of risk.

e.g. decommissioning of a deployed system.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Risk Mitigation

A

Take actions that decreases the risk

Reduce the risk to an acceptable level

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Request for Information (RFI)

A

gather information about the available providers of the items or service being procured

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Request for Proposal (RFP)

A

determine which provider will bid for the project, what their proposal looks like, and what the cost will be

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Request for Quote (RFQ)

A

included as overall part of RFP

determining the cost a supplier/provider would charege

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Business Partnership Agreement (BPA)

A

typically used when business operates legally as partnership

address things like ownership, profit/losses, and contributions

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Memorandum of Understanding/Agreement (MOU/)

A

two organizations interconnect information systems/networks.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Interconnection Security Agreement (ISA)

A

technical security requirements with two organization connect

Supports MOU/MOA

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Service Level Agreement (SLA)

A

force providers to agree to provide an acceptable level of security.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Operating Level Agreement (OLA)

A

Internal agreement that supports SLA

determines level of service required of internal departments in order to be able to fully satisfy the details of the SLA

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

Enterprise License Agreement (ELA)

A

govern how an organization that licenses large volume of software is allowed to use that software

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

Acceptable Use Policy (AUP)

A

catch all policy that tried to define both expected user behavior and prohibited user behavior

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

Risk

A

=Threat x Vulnerability

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

Exploit

A

Process of threat taking advantage of a vulnerability

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

Threat

A

anything that can cause harm to an information system

30
Q

Virus

A

malware that requires a carrier

31
Q

Worm

A

malware that self propagates

32
Q

Trojan

A

Benign-appearing function

Cover malicious function

33
Q

Non-Disclosure Agreement (NDA)

A

neither employer nor employee will divulge sensitive data

34
Q

Non-Compete Agreement

A

establishes employee who leaves the organization agrees not to work for a competitor

35
Q

Non-Solicitation Agreement

A

Prohibits an employee that leaves the company from
soliciting other employees to also leave
soliciting customers of the employer for business

36
Q

Opposite of
Confidentiality
Integrity
Availability

A

Disclosure
Alteration
Destruction

37
Q

Confidentiality

A

prevents unauthorized disclosure of data

38
Q

Integrity

A

prevents unauthorized modification of assets

39
Q

Availability

A

ensure required access to resource remains possible

40
Q

Identification

A

weak unproven claim of identity

41
Q

Authentication

A

proof that user’s identify claim was legitimate

42
Q

Authorization

A

proceeds after successful authentication and determines what authenticated users can do

43
Q

Accountability

A

logging - details the interaction performed by the individuals

44
Q

Compensatory Damages

A

Money awarded directly related to the actual losses/harm incurred (e.g. usb stick)

45
Q

Statutory Damages

A

Monetary damages designated by law

46
Q

Punitive Damages

A

Awards meant to punish the defendant (not tied to actual loss)

47
Q

Legal Fees

A

some but not all jurisdictions considered fees a form of compensatory damages that could be awarded.

48
Q

Civil Law

A

primary associated with torts, contracts, and property

preponderance of evidence

no jail time

49
Q

Criminal Law

A

Society itself has been harmed

burden of proof beyond reasonable doubt

Jail time

50
Q

Qualitative risk analysis

A

Not tied to dollar amount associated with potential lost
Risk Rating
Useful for prioritization of risk

51
Q

Types of Authentication

A

Something you know (password/phrases)
Something you have (token)
Something you are (biometrics)
Someplace you are (GPS)

52
Q

Preventive Control

A

prevent attack from being successful

53
Q

Detective Control

A

Tries to detect problem after an attack occurs
used after the fact
Hiring procedures and human resources are detective controls
Rotating users and PTO discover illegal activities

54
Q

Deterrent Control

A

discourages security violations

55
Q

Compensating Control

A

Adding another control/layer

56
Q

Corrective Control

A

reacts to an attack and takes corrective action for data recovery

57
Q

Recovery control

A

Restores the operating state to normal after an attack or system failure

58
Q

Due Care

A

base level of protection that a reasonable person takes to check piece of code

Acting as any reasonable would

59
Q

Due Diligence

A

Practice or process that ensure the decided upon standard of care is maintained

60
Q

Patent

A 
Protects invention for 20 years
Must:
Having utility
Novelty
non-obvious
61
Q

Copyright

A

Form of Expression (paper, vinyl etc..)

62
Q

Trademark

A

word, name, symbol, or device that is used in trade with goods to indicate the source of the goods
Distinguish them from other goods

63
Q

Trade Secret

A

Project critical intellectual property that is not publicly available

64
Q

Risk Analysis

A

Determine where level of risk is unacceptable

Two approaches: Qualitative and Quantitative.

65
Q

Threat Modeling

A

seeks to understand threats and consider how they might negatively impact security

66
Q

Attack Surface

A

represents all the ways in which an attacker could attempt to introduce data to exploit a vulnerability.

67
Q

Security Policy

A

High level guidance regarding expectation

This is the Why

68
Q

Standards

A

Focused on how to achieve what security policies mandate

This is they What

69
Q

What makes up a policy

A 
Purpose
Related documents
Cancellation
Background
Scope
Policy Statement
Responsibility
70
Q

Standards

A

Provide the detailed guidance for carrying out tasks

This is the How

71
Q

Baseline

A

more specific implementation of the standard

72
Q

Guidelines

A

Are not mandatory

Best practices

CISSP (8 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions