Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Security Plus > Domain 5 > Flashcards

Domain 5 Flashcards

1
Q

Security Policy

A

Sets overall vision and goals for Information Security. Defines Why behind security measures. General statements. Policies are major input to standards

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Security Standards

A

Translate the Policy into specific technical requirements and best practices. What and When for security goals. Mandatory

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Security Procedure

A

Provide detailed instructions on how to implement standards. Defines How

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Security Guidelines

A

Offer additional recommendations and best practices that can be adopted to further enhance security. They are not mandatory. Least specific.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Acceptable Use Policy (AUP)

A

Allowed/Appropriate Uses of the organisations IT resources

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Information Security Policy

A

Sets overall direction for information security

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Business Continuity Policy

A

Defines organisations overall strategy for business continuity

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Disaster Recover Policy

A

Focuses on recover from disasters

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Incident Response Policy

A

Sets high-level direction for how organisations will identify, contain, eradicate and recover from security incidents

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Software Development Lifecycle (SDLC)

A

Guidance that Software development teams must follow in creating software

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

FIPS 140-2/3

A

Mandatory standard for protection of sensitive data within federal systems

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Board

A

Highest level of authority

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Committees

A

Subgroups that focus on specific areas or tasks, reporting to the Board

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Government Entities

A

Eg NIST - These entities issue security regulations, standards and Best practices that organisations must comply

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Centralized

A

Decisions are managed by central security team

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Decentralized

A

Delegates security decisions and controls to some extent to business units and departments

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Data Owner

A

Legal rights and complete control over a single piece of data. Member of senior Management. Can delegate day-to-day activities. Cannot delegate total responsibility

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Data Custodian

A

Responsible for safe custody, transport, and storage of data. IT Department

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Data Processor

A

Legal person, public authority, agency or other body which processes personal data solely on behalf of data controller

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Data Controller

A

Person or entity that controls that controls processing of the data

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Data Subject

A

Person who can be identified

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Data Steward

A

Data’s context and meaning are understood and business rules governing the data usage are known and followed

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Risk Identification

A

Process of identifying the threats and vulnerabilities that exist in operating environment

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Risk Assessment

A

Process of Identifying, analysing, evaluating and prioritizing potential risks

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

Ad hoc Risk Assessment

A

One time assessments in response to a specific event

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

Recurring Risk Assessment

A

Assessments conducted periodically

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

One-Time Risk Assessment

A

One time assessment - In response to security incident or management request

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

Continuous Risk Assessment

A

Automated such as recurring system scan integrated into daily operations

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

Quantitative Risk Analysis

A

Assigns dollar Value to evaluate effectiveness of countermeasures

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

Qualitative Risk Analysis

A

Scoring System to rank effectiveness of countermeasures. Low/Medium/high

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

Impact

A

Potential consequences or negative effects that could occur if the risk materializes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

Asset Value

A

Monetary value of the asset

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

Exposure Factor (EF)

A

Percentage of loss if a specific asset were violated by a realised risk

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

Single Loss Expectancy (SLE)

A

Cost associated with a single realized risk against a specific asset.
SLE == Asset Value X Exposure Factor (%)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

Annualized Rate of Occurrence (ARO)

A

Expected frequency with which a specific threat or risk will occur within a single year. Example risk occurs every 5 years = 1/5 =0.2

36
Q

Annualized Loss Expectancy

A

SLE XARO = ALE - How much will you loose per year.
ALE = Asset value X Exposure Factor X ARO

37
Q

Risk Register

A

Track Potential Issues

38
Q

Risk Matrix

A

Heat map . Visual Representation of risks affecting a company

39
Q

Key Risk Indicators (KRIs)

A

Measurable metrics that signal potential changes

40
Q

Risk Owner

A

Assigned designated owner

41
Q

Risk Threshold

A

Level of risk tolerance established by the organisation

42
Q

Risk Appetite

A

Risk an organisation is willing to accept without mitigating

43
Q

Risk Tolerance

A

Ability to take on risk

44
Q

Risk Exception

A

Temporary deviation for a defined period

45
Q

Risk Exemption

A

Permanent deviation

46
Q

Risk Reporting

A

Risk discovered and includes recommendations as well

47
Q

Business Impact Analysis (BIA)

A

Includes 2 benefits Cost Benefit Analysis and Return on Investment

48
Q

Recovery Point Objective (RPO)

A

Max tolerable data loss between last backup and disaster

49
Q

Recovery Time Objective (RTO)

A

Duration or time within which a business process must be restored

50
Q

Mean time between Fails (MTBF)

A

Time for how long IT infrastructure will continue to work before it fails

51
Q

Mean time to Repair (MTTR)

A

Time how long it will take to get hardware/software back online

52
Q

Right to Audit Clause

A

Written into supply chain contracts allow auditor can visit the premises to inspect

53
Q

Service Level Agreements

A

Stipulate Performance Expectation

54
Q

Memorandum of Understanding

A

Formal agreement between 2 parties intention to work together towards common goal. Lacks binding contract

55
Q

Memorandum of Agreement

A

Serves as a legal document and describes terms and details of the agreement. MOA is legal contract

56
Q

Master Service Agreement

A

Agreement for vendors that you will work with repeatedly. Has compliance and process requirements

57
Q

Statement of Work

A

SOW is legal document created after MSA . SOW has requirements, expectations and deliverables

58
Q

Business Partner Agreement

A

2 companies or individual who want to participate in a business venture to make a profit

59
Q

Right to be forgotten

A

Deletion of their personal data

60
Q

Attestation

A

Independent Verification of an organisation adherence to specific controls or standards

61
Q

Penetration Testing

A

Actively assesses deployed security controls, trying to exploit vulnerabilities by simulating or performing an attack

62
Q

Offensive Pentest

A

Focuses on technical security of computer systems and networks attempting to exploit vulnerabilities to gain unauthorised access

63
Q

Defensive Pentest

A

Focuses on evaluating the effectiveness of existing security controls to withstand attacks

64
Q

Integrated Pentest

A

Combines Physical, Offensive and Defensive techniques

65
Q

Known Environment

A

White box test - Substantial/ Full Information

66
Q

Unknown Environment

A

Black box test - Completely Blind

67
Q

Partially Known Environment

A

Grey Box Test - Limited Information

68
Q

Rules of Engagement

A

Purpose and Scope of Pentesting

69
Q

Passive Reconnaissance

A

Not interacting with the target - Involves gathering data from publicly available sources ( Searching Internet, Reviewing Media, Analysing DNS records, Using Search Engines) - Google Dorking

70
Q

Active Reconnaissance

A

Interacts Directly with Target (Using Port Scanners, Sending Ping sweeps, Utilizing vulnerability scanners, Employing social engineering techniques)

71
Q

Authority

A

Position, Responsibility or Affiliation that grants the attacker the authority to make the request

72
Q

Intimidation

A

Suggesting you may face negative outcomes

73
Q

Scarcity

A

Similar to Urgency - Limited Opportunity, diminishing Availability

74
Q

Consensus

A

Claiming that someone in a similar position or peer has carried out the same task

75
Q

Familiarity

A

Liking - Attempting to establish a personal connection

76
Q

Urgency -

A

Time Sensitivity to demand action

77
Q

Trust

A

Citing Knowledge and experience

78
Q

SPAM

A

Unsolicited Email

79
Q

SPIM

A

SPAM over Instant Messaging

80
Q

Dumpster Diving

A

Gathering important details (Intelligence ) from things people have thrown in the Trash

81
Q

Tailgaiting

A

Unauthorised individual follow you without badging in themselves

82
Q

Eliciting Information

A

Casual Conversation to extract information

83
Q

Shoulder Surfing

A

Criminal Practice steal your personal data by spying over your shoulder

84
Q

Pharming

A

Online Scan where website traffic is manipulated thru DNS, redirects a user to different website

85
Q
A

Security Plus (4 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions