Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CISSP > Domain 3 -InfoSec Governance & Risk Mgt > Flashcards

Domain 3 -InfoSec Governance & Risk Mgt Flashcards

0
Q

A potentially negative occurrence

A

Threat

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
1
Q

The cost of loss due to risk over a year

A

Annualised Loss Expectancy (ALE)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

A weakness in a system

A

Vulnerability

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

A matched threat and vulnerability

A

Risk

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

A measure taken to reduce risk

A

Safeguard

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

The cost of a safeguard

A

Total Cost of Ownership

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Money saved by deploying a safeguard

A

Return on Investment - ROI

If your annual TCO is less than your ALE then you have positive ROI and have made a good choice. If the TCO is higher than ALE, you have made a poor choice.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Cornerstone concept of information security that seeks to prevent unauthorised disclosure of information

A

Confidentiality

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Cornerstone concept of information security that seeks to prevent unauthorised modification of information

A

Integrity

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Cornerstone concept of information security that ensures information is available when needed

A

Availability

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Unauthorised disclosure of information

A

Disclosure

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Unauthorised modification of information or data

A

Alteration

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Making systems unavailable

A

Destruction

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Is a claim of who you are

A

Identity / identification

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Proving an identity claim

A

Authentication

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Describes the action you can perform on a system once you have identified and authenticated

A

Authorisation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Holds user accountable for their actions

A

Accountability

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Means a user cannot deny (repudiate) having performed a transaction

A

Non-repudiation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

You must have both authentication and integrity to have non repudiation. True or False?

A

True

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Means a user should be granted the minimum amount of access (authorisation) required to do his job, but no more

A

Least privilege

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Means a user can access data if he has business need todo so.

A

Need to know. User must need to know that specific piece of information before accessing it.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Is a layered defences that applies multiple safeguards (also called controls or measures taken to reduce risk) to protect an asset

A

Defence in depth. All controls can fail and sometimes multiple controls will fail. Deploying a range of different defence in depth safeguards lower the chance that all controls will fail

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Assessing risk

A

Risk analysis

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Valuable resources you are trying to protect. Eg. Data, systems, buildings, property etc.

A

Assets.

The value or criticality of the assets will dictate what safeguards to deploy. People are your most valuable nasset.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

A potentially harmful occurrence. Eg. Earthquake, power outage, network based worm.

A

Threat. A negative action that may harm a system.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

Threat * vulnerability

A

Risk

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

A weakness that allows a threat to cause harm

A

Vulnerability

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

The severity of the damage

A

Impact

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

Threat * vulnerability * impact

A

Risk. When calculating risk using the formula, any risk including loss of human life is extremely high, and must be mitigated.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

Allow you to perform qualitative risk analysis based on likelihood ( from rare to almost certain ) , consequences (or impact) from insignificant to catastrophic

A

Risk Analysis Matrix

It uses a quadrant to map the likelihood of a risk occurring against the consequences or impact the risk would have.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

Allows you to determine the annual cost of a loss due to a risk as well as allows you to make informed decisions to mitigate the risk

A

Annualised Loss Expectance - ALE

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

The value of an asset that you are trying not protect

A

Asset value

32
Q

Is the percentage of value an asset lost due to an incident

A

Exposure Factor - EF

33
Q

Cost of single loss

A

Single Loss Expectancy - SLE

34
Q

Number of losses you suffer per year

A

Annual Rate Of Occurrence - ARO

35
Q

Is your yearly cost due to a risk

A

Annualised Loss Expectancy -ALE

36
Q

The total cost of a mitigating safeguards

A

Total Cost Of Ownership - TCO

37
Q

Asset value * Exposure Factor

A

Single Loss Expectancy - SLE

38
Q

SLE * ARO

A

ALE

39
Q

What are the risk choices?

A
  1. Accept the risk if TCO is higher than ALE
  2. Mitigate the risk
  3. Transfer the risk - Insurance
  4. Avoid the risk
40
Q

A risk analysis that uses hard metrics such as dollars. It requires you to calculate the quantity of the asset you are protecting. It is more objective.

A

Quantitative Risk Analysis

41
Q

A risk analysis that uses simple approximate values. The Risk Analysis Matrix can also be use. This type is more subjective.

A

Qualitative Risk Analysis

42
Q

Is information security at the organisation level: senior management, policies, processes and staffing

A

Information Security Governance

43
Q

A high level management directives; is mandatory and does not delve into specifics

A

Policy

44
Q

Step by step guide for accomplishing a task; low level and specific; are mandatory

A

Procedures

45
Q

Describes the specific use of technology often applied to hardware or software ; are mandatory

A

Standards

46
Q

Are recommendations which are discretionary

A

Guidelines

47
Q

Uniform ways of implementing a safeguard; are discretionary

A

Baselines

48
Q

Changes user behaviour about security

A

Security Awareness

49
Q

Teaches a user how to do something

A

Security Training

50
Q

Its roles and responsibility is to ensure all assets are protected and creates a security program

A

Senior Management

51
Q

The information owner or business owner

A

Data Owner

52
Q

He provides hands on protection of assets such as data. Don’t make decisions

A

Custodian

53
Q

He follow rules and comply with mandatory policies and procedures

A

User

54
Q

Protection of the confidentiality of persona information (PII)

A

Privacy

55
Q

Doing what is reasonable person would do. Prudent man rule

A

Due Care

56
Q

Management of due care

A

Due Diligence

57
Q

Opposite of due care

A

Gross negligence

58
Q

A consensus of the best way to protect CIA of assets

A

Best Practice

59
Q

The use of third party to provide IT support or services

A

Outsourcing

60
Q

Is outsourcing to another country

A

Offshoring

61
Q

Means verifying compliance to a security control framework.

A

Auditing

62
Q

What is OCTAVE?

A

Operationally Critical Threat, Asset and Vulnerability Evaluation. A Risk Management Framework from Carnegie Mellon University

63
Q

What are the 3 phases for managing risks according to OCTAVE?

A

Phase 1 - identifies staff knowledge, assets and threats
Phase 2 - identifies vulnerabilities and evaluates safeguards
Phase 3 - conducts risk analysis and develop the risk mitigation strategy.

64
Q

Risk management guide for information technology systems developed by NIST

A

NIST SP-800-30

65
Q

9 Steps Risk Analysis Process (NIST SP800-30)

A
  1. System characterisation - scope
  2. Threat identification
  3. Vulnerability identification
  4. Control analysis - Safeguard
  5. Likelihood determination
  6. Impact analysis
  7. Risk determination
  8. Control recommendation
  9. Results documentation
66
Q

Information Technology/Security techniques; codes of practice of information security management introduced by ISO

A

ISO/IEC 17799:2005

67
Q

11 Areas of ISO 17799

A
  1. Policy
  2. Organisation of Information Security
  3. Asset Management
  4. Human Resources Security
  5. Physical and Environmental Security
  6. Communications and operations management
  7. Access Control
  8. Information systems acquisition,development and maintenance
  9. Information security incident management
  10. Business Continuity Management
  11. Compliance
68
Q

Is a control framework created by ISACA for deploying/employing information security governance best practices with in an organisation.

A

COBIT - Control Objectives for Information and related Technology

69
Q

4 Domains of COBIT

A
  1. Plan and organise
  2. Acquire and implement
  3. Deliver and support
  4. Monitor and evaluate
70
Q

Is a framework for providing best services in IT Service Management or ISTM

A

ITIL - information technology infrastructure library

71
Q

5 ITIL Service Management Pactices

A
  1. Service strategy
  2. Service design
  3. Service transition
  4. Service operation
  5. Continual Service Improvement
72
Q

Is a detailed inspection that verifies whether a system meets the documented security requirements

A

Certification

73
Q

Data owner’s acceptance of the risk represented by that system.

A

Accreditation

74
Q

NIST guide for Credit and Accreditation

A

NIST SP-800-37

75
Q

4 Steps Process of NIST SP800-37 (Certification and Accreditation)

A
  1. Initiation phase
  2. Security certification phase
  3. Security accreditation phase
  4. Continuous monitoring phase
76
Q

Doing what is morally right

A

Ethics

77
Q

What are the four ISC2 canons - code of ethics

A

In order:

  1. Protect society, the commonwealth and the infrastructure
  2. Act honourably, honestly, justly, responsibly and legally
  3. Provide diligent and competent service to principals
  4. Advance and protect the profession

CISSP (10 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions