Domain 1 Summary Cards Flashcards
Control Objectives for Information and Related Technologies (COBIT)
IT governance framework for risk, control, and performance management. It outlines end to end IT governance objectives and processes that encompass many security requirements and concepts.
ISO/IEC 27001
International standard for information security management systems (ISMS)
NIST Cybersecurity Framework (CSF)
Guidelines for improving cybersecurity posture.
Information Technology Infrastructure Library (ITIL)
IT service management best practices.
Policies
High-level statements of security objectives (e.g., “All data must be encrypted”).
Standards
Mandatory security controls that enforce policies (e.g., “AES-256 encryption for sensitive data”).
Guidelines
Recommended best practices (e.g., “Use passphrases instead of passwords”).
Procedures
Step-by-step instructions for implementing policies (e.g., “How to configure encryption”).
Risk Management Process
- Risk Identification
- Risk Assessment (Analysis)
- Risk Treatment (Response Options)
- Risk Monitoring
Risk Identification
Identify threats and vulnerabilities.
Qualitative
Subjective assessment (e.g., high, medium, low risk).
Quantitative
Uses numerical values
DREAD
Evaluates risk impact based on
Damage
Reproducibility
Exploitability
Affected Users
Discoverability
COBIT Principles
Principle 1: Meeting Stakeholder Needs
Principle 2: Covering the Enterprise End to End
Principle 3: Applying a Single, Integrated Framework
Principle 4: Enabling a Holistic Approach
Principle 5: Separating Governance from Management
STRIDE
Threat Modeling methodology developed by Microsoft to help identify and classify computer security threats
Spoofing
Tampering
Repudiation
Information Disclosure
Denial of Service
Elevation of Privilege
PASTA
Process for Attack Simulation and Threat Analysis. Risk based threat model that supports dynamic threat analysis.
Integrates business objectives with technical requirements.
7 stages of PASTA
Define objectives
Define technical scope
Application decomposition
Threat Analysis
Vulnerability analysis
Attack enumeration
Risk and impact analysis
General Data Protection Regulation (GDPR)
Regulations that require organizations around the world to protect the privacy of EU citizens.
GDPR 7 Principles for Processing Personal Data
Lawfulness, fairness, and transparency
Purpose limitation
Data Minimization
Accuracy
Storage limitation
Integrity and confidentiality
Accountability
NIST Risk Management Framework (RMF)
U.S government framework for security risk management
ISO 3100
Enterprise risk management framework
Common Vulnerabilities and Exposures (CVE)
Database of known security vulnerabilities
Common Vulnerability Scoring System (CVSS)
Measures severity of vulnerabilities
