Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CISSP > Domain 2: Classifying Data > Flashcards

Domain 2: Classifying Data Flashcards

1
Q

Unauthorized disclosure could cause exceptionally grave damage to national security
Classification label

A

Top Secret

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Unauthorized disclosure could cause serious damage to national security

A

Secret

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Unauthorized disclosure could cause damage to national security

A

Confidential

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

A formal determination of whether a user can be trusted with a specific level of information

A

Clearance

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

A document approved from the data owner that outlines all the rules and requirements for accessing data, as well as the consequences should the data become lost, destroyed or compromised.

A

Formal Access Approval

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Sensitive info should not persist beyond a certain period or legal requirement, as this needlessly exposes the data to threats of disclosure when in fact the data is no longer needed.

A

Retention

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

AKA senior management creates the InfoSec program and ensures it is properly staffed and funded

A

Business or Mission Owners

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q
  • Manager who is ultimately responsible for the data of an organization i.e. CEO, president, dept. head
  • They determine data sensitivity labels and frequency of data backup
A

Data Owners

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q
  • Manager responsible for the actual computer that houses the data.
  • Typically the same person as the data owner, but this can be delegated to someone else
A

Asset Owner or (System Owner)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Responsible for granting appropriate access to personnel.

A

Administrators

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q
  • Personal that provides day-to-day tasks relating to the handling the data
  • i.e. perform data backups, patch systems, configure antivirus, etc.
  • i.e. personal in the IT dept. or the security admin.
A

Custodian

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q
  • Users that create and manage sensitive data within an organization
  • i.e. Human Resources
A

Data Controllers

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q
  • Manages data on behalf of data controllers

- i.e. outsource payroll company (Paycom)

A

Data Processors

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q
  • Created in 1980’s by the DoD to impose security standards for computers the gov purchased and used
  • Orange book of the rainbow series
  • Replaced by International Common Criteria
A

Trusted Computer System Evaluation Criteria (TCSEC)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What are TCSEC categories?

A

Category A Verified protection (Highest level of protection)
Category B Mandatory protection
Category C Discretionary protection
Category D Minimal protection

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q
  • Trusted Computer System Evaluation Criteria (TCSEC) category
  • In the development cycle for systems each phase is documented, evaluated, and verified before moving to the next step
A

Category A Verified protection (Highest level of protection)

17
Q
  • Trusted Computer System Evaluation Criteria (TCSEC) category
  • More granularity of control is mandated
  • Used to allow very limited sets of subjects/objects
A

Category B Mandatory protection

18
Q
  • Trusted Computer System Evaluation Criteria (TCSEC) category
  • Systems in this category do provide some security controls but are lacking more sophisticated and stringent controls that address specific needs for secure systems
A

Category C Discretionary protection

19
Q
  • Trusted Computer System Evaluation Criteria (TCSEC) category
  • Reserved for systems that have been evaluated but do not meet requirements to belong to any other category
A

Category D Minimal protection

20
Q
  • Part of the rainbow series
  • Gov standards relating to networking
  • Now outdated
A

Red Book

21
Q
  • Part of the rainbow series
  • Gov standards relating to password creation and management
  • Now outdated
A

Green Book

22
Q
  • Users must have a security clearance and access approval that permits all info processed by the system
  • A valid need to know only for the info they will access on the system
A

System high mode

23
Q
  • Users must have a security clearance, access approval, and a valid need to know for all info processed by the system
  • All users on the system can access all the data on the system
  • Enforced by admin personnel who physically limit access to the system
A

Dedicated mode

24
Q
  • Users must have a security clearance for all info processed by the system
  • Access approval and a valid need to know only for info they will access on the system, (not for all the info processed by the system)
A

Compartmented mode

25
Q
  • Users must have a security clearance, access approval, and a valid need to know that permits only the info they will access on the system
  • Do not need these things for all the info processed by the system
  • Enforced primarily by hardware or software on a system
A

Multilevel mode

26
Q
  • Component of TCSEC
  • System components that were designed to adhere to and enforce the security policy of the system as a whole
  • i.e. OS kernel and the supporting programs that configure file ownership and permissions
A

Trusted Computer Base (TCB)

27
Q
  • Data that is for internal use or for office use only

- Used to protected info that could violate the privacy rights of individuals

A

Sensitive but Unclassified

28
Q

Unauthorized disclosure does not compromise confidentiality or cause any noticeable damage

A

Unclassified

29
Q
  • Private sector classification level

- Proprietary data if disclosed could have drastic effects on the competitive edge of an organization

A

Confidential

30
Q
  • Private sector classification level
  • Data related to individuals of a company and intended for internal use only
  • i.e. medical data
A

Private

31
Q
  • Private sector classification level

- Data that could have a negative impact if disclosed

A

Sensitive

32
Q
  • Private sector classification level

- Disclosure does not have a serious impact on the organization

A

Public

33
Q
  • The imaginary boundary that separates the TCB from the rest of the system
  • TCB components communicate with non-TCB components using trusted paths
A

Security perimeter

34
Q

In order to implement a classification scheme, list the 7 steps you must perform:

A
  1. Identify the custodian, and define their responsibilities.
  2. Specify the evaluation criteria of how the information will be classified and labeled.
  3. Classify and label each resource. (The owner conducts this step, but a supervisor should review it.)
  4. Document any exceptions to the classification policy that are discovered, and integrate them into the evaluation criteria.
  5. Select the security controls that will be applied to each classification level
  6. Specify the procedures for declassifying resources and the procedures for transferring custody of a resource to an external entity.
  7. Create an enterprise-wide awareness program to instruct all personnel about the classification system.
35
Q
  • Defined a list of security controls based on industry best practices
  • Provided centralization of security controls across different organizational departments (i.e. facilities, IT, HR, etc)
  • First international standard used for developing an org internal security program
A

British Standard (BS)7799

36
Q
  • Based on BS7799
  • Defines general requirement for setting up an information security management system
  • Typically used to as a basis for certification by an accredited third-party
  • List of security controls based on industry best practices
A

ISO 27001

37
Q
  • Based on BS7799
  • Goes into more detail on the specifics of information security controls
  • Provides industry specific general security guidelines (i.e. financial services, healthcare, etc…)
  • Focuses on security governance
A

ISO 27002

38
Q

ISO guidelines for information security management system for organizations in the healthcare industry

A

ISO 27799

39
Q

ISO guidelines for information security management system for organizations in the financial industry

A

ISO 27015

CISSP (30 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions