Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

My CISSP > Domain 2 > Flashcards

Domain 2 Flashcards

1
Q

Asset

A

An asset is any data, device, or other component of the environment that supports information or information system related activities.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

The value of an Asset

A

The value of an asset is the worth of the asset to the owners, authorized users, and unauthorized users.
- Asset value can include the cost of liability or compromise.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

The cost of an asset

A

The cost of an asset is the monetary value it takes to acquire, develop, maintain, or replace it.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Asset Classification purpose

A

The purpose of asset classification is to ensure that assets are properly identified and protected throughout their life-cycles.
Asset classifications inform handling instructions, control decisions, audit score, and regulatory compliance activity.
- Information assets are generally classified by content.
- Infrastructure and physical assets are generally classified by operational criticality.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Data Classification Schemas

A
  • Government and Military

- Classifications for the private sector.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

FIPS 199

A

Federal Information Processing Standard 199 (FIPS 199) requires that information and information systems be categorized as low, medium, or high security based upon confidentiality, integrity, and availability.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Government / Military Data Classifications.

A
  • Top Secret (TS): Expected to cause exceptionally grave danger to national Security.
  • Secret (S): Expected to cause serious damage to national security.
  • Confidential: Expected to cause damage to national security.
  • Unclassified: No threat to national interest.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Sensitive but Unclassified (SBU)

A

US federal agencies use the Sensitive byt Unclassified (SBU) designation when information is not classified but still needs to be protected and requires strict controls over its distribution.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Information System Asset

A

An information system asset is any data, device, or other component of the environment that supports information or information systems related activities.
- Information and information system assets should be assigned an owner and a custodian.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Asset Ownership Responsibilities

A
  • Defining the asset.
  • Assigning Value (AV).
  • Classifying the asset.
  • Confirming the level of protection required.
  • Authorizing access rights and permissions.
  • Authorizing disclosure.
  • Ongoing governance.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Asset Custodian Responsibilities.

A
  • Implementing protection mechanisms.
  • Monitoring for problems or violations.
  • Reporting suspected incident.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Asset Management

A

Asset Management is a set of activities that focus on th protection, accounting and integrity of infrastructure and physical:
Asset Management = Classification + Inventory + Configuration Management.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Inventory Management

A

Inventory Management is a set of policies, standards, and procedures used to maintain optimum inventory levels, track assets, and schedule replacements. Benefits:

  • Tracking.
  • Providing context for vulnerability and patch management.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Software Asset Management (SAM)

A

Software Asset Management (SAM) is the practice of managing the life-cycle of software assets within an organization. The two significant benefits of the SAM program are control and risk reduction.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Configuration Management (CM)

A

Configuration Management (CM) is a set of activities focused on establishing and maintaining the integrity of systems through control of the processes of initializing, changing, and monitoring the configurations.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Baseline Configuration.

A

A Baseline Configuration (BC) is a set of specifications for a configuration item (CI), that has been reviewed and agreed on (authorized), and which can be changed only through change control procedures.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Configuration Management

A
  • Research | Plan.
  • Approve Baseline Configuration.
  • Assign CM version and update library.
  • Implement.
  • Configuration Changes.
  • Monitor.
  • Report.
  • Repeat.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Commonly used privacy framework

A

OECD Privacy Principles.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Privacy Threshold Assessment

A

Used by organizations to identity PI and determine how to treat the data.

20
Q

Information Life-Cycle.

A
  • Collection.
  • Use
  • Retention / Archiving
  • Deletion / Destruction
21
Q

Information Retention

A

Retention is a protocol (set of Rules) within an organization that dictates types of unaltered data that must be kept and for how long.
- Data retention strategies must be aligned with business and legal requirements

22
Q

Data Archiving

A

Data Archiving is the process of securely storing unaltered data for later potential retrieval.

23
Q

Legal Hold

A

A legal hold is the requirement for a organization to preserve all forms of relevant information when litigation, audit, or government, investigation is reasonably anticipated. The objective is to avoid evidence spoliation.

24
Q

eDiscovery

A

eDiscovery (also called electronic discovery) refers to any process in which electronic data is sought, located, secured, and searched with the intent of using it as evidence in a civil or criminal or criminal legal case.

25
Q

Data Deletion

A

When a file is deleted, the corresponding entry in the Master File Table (MFT) is removed and the MFT entry is marked as ready to be re-used. The data for the file is separate from the MFT entry.

26
Q

Data Remanence

A

Data Remanence is the residual representation of digital data that remains even after attempts have been made to delete or erase the data.

27
Q

Secure Deletion

A

Secure Deletion ensures that the deleted file or file fragments cannot be retrieved and/or reconstructed.

28
Q

Clearing

A

Clearing removes the data in such a way that data cannot be recovered using normal system functions of recovery utilities.

29
Q

Purging

A

Purging, which is the removal of data that cannot be reconstructed by any known technique.

30
Q

Destruction

A

Destruction, which is the physical act of destroying media in such a way that cannot be reconstructed.

31
Q

Disk Wiping

A

Disk Wiping is a clearing technique that overwrites all addressable storage and indexing locations multiple times.

32
Q

Degaussing

A

Degaussing is a purging technique that requires a machine or wand that produces a strong electromagnetic field which destroys all magnetically recorded data.

33
Q

Destruction

A

Destruction is the physical act of destroying media in such as way that it cannot be reconstructed.

  • Shredding: physically breaking media to pieces.
  • Pulverizing: reducing media to dust.
  • Pulp: Chemically altering media.
  • Burning: Incinerating media.
34
Q

Certificate of Destruction

A

Certificate of Destruction is issued by commercial services upon destruction of media (for example paper, CD/DVD, tape, and drives). The certificate should at a minimum include:
- Data of destruction.
- Description of media (including serial number, if appropriate)
- Method of destruction.
Witnesses.
- Company name.

35
Q

Data Management

A

Data Management is defined as the planning and execution of policies and practices that protect and, when possible, enhance the value of data throughout its life-cycle

36
Q

Data Ownership

A

Data Ownership refers to the responsibility for information which includes decisions pertaining to , and oversight of, classification, controls, access, and authorization throughout the data life-cycle.

37
Q

Scoping

A

Scoping instructs an organization how to apply and implement security controls (baselines)

38
Q

Tailoring

A

Tailoring allows an organization to align common security controls within specific objectives.

39
Q

Data Obfuscation

A

Data obfuscation is the act of making a data set difficult to find or understand.

40
Q

Data Loss Prevention (DLP)

A

Data Loss Prevention (DLP) automated tools are designed to detect and prevent data exfiltration (unauthorized release or removal of data)

41
Q

How DLP Technology work?

A
  • DLP technologies locate and catalogue data based on a predetermined set of handling standards.
  • DLP tools monitor target data while in use, in motion, and at rest.
42
Q

Possible DLP Implementations

A
  • Network-Based (on premise)
  • Storage Based
  • Endpoint based.
  • Cloud-based (off-premise)
43
Q

Labeling

A

Labeling is the vehicle for communicating the assigned classification to custodian, users, and applications.
- Labels make it easy to identify the data classification.
- Labels can take many forms: electronic, print, audio, or visual.
- Labels should be appropriate for the intended audience.
_ Labels transcend institutional knowledge and provide stability in environments that experience personnel turnover

44
Q

Term given to the unauthorized release or removal of data.

A

Exfiltration

45
Q

Handling standards are generally organized by?

A

Classification Level

46
Q

These assets inventory applications is used to discover and document devices and characteristics such as services, users, and groups.

A

Enumeration Tools.

47
Q

This type of assessment is used to identify personal information that has been acquired by the organization and to determine how to treat the data.

A

Privacy threshold assessment

My CISSP (6 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions