Domain X: Difficult to Memorize Flashcards
What is the purpose of ISO 27001?
ISO 27001: Establish, implement, control and improve the ISMS. Uses PDCA (Plan, Do, Check, Act)
What is the purpose of ISO 27002?
ISO 27002: (From BS 7799, 1/2, ISO 17799) Provides practical advice on how to implement security controls. It has 10 domains it uses for ISMS.
What is the purpose of ISO 27004?
ISO 27004: Provides metrics for measuring the success of your ISMS.
What does ISO 27005 contain?
ISO 27005: Standards-based approach to risk
What are the requirements of the EU Data Protection Directive? (4 points)
EU Data Protection Directive Very aggressive pro-privacy law.
- Organizations must notify individuals of how their data is gathered and used.
- Organizations must allow for opt-out for sharing with 3rd parties.
- Opt-in is required for sharing “most” sensitive data.
- No transmission out of EU unless the receiving country is perceived to have adequate (equal) privacy protections; the US does NOT meet this standard. EU-US Safe Harbor, optional between organization and EU
What is the ISC2 code of ethics preamble?
Code of Ethics Preamble:
The safety and welfare of society and the common good, duty to our principles, and to each other, requires that we adhere, and be seen to adhere, to the highest ethical standards of behavior. Therefore, strict adherence to this code is a condition of certification.
What are the ISC2 code of ethics canons?
Code of Ethics Canons:
Protect society, the common good, necessary public trust and confidence, and the infrastructure.
Act honorably, honestly, justly, responsibly, and legally.
Provide diligent and competent service to principles.
Advance and protect the profession.
What are the 5 components of information security governance?
Information Security Governance:
Policies – Mandatory. Standards – Mandatory. Guidelines – non-Mandatory. Procedures – Mandatory. Baselines (Benchmarks) - Mandatory.
What are the 7 types of security controls?
Access Control Defensive Types:
Preventive: Prevents an action from occurring
Detective: Controls that Detect during or after an attack – IDS, CCTV, alarms, antivirus.
Corrective: Controls that Correct an attack – Anti-virus, patches, IPS.
Recovery: Controls that help us Recover after an attack – DR Environment,backups, HA Environments .
Deterrent: Controls that Deter an attack – Fences, security guards, dogs, lights, Beware of the dog signs.
Compensating: Controls that Compensate – other controls that are impossible or too costly to implement.
Directive: directs, confines, or controls the actions of subjects to force or encourage compliance with security policy
What are the 5 types of risk responses?
Types of risk responses:
Accept the Risk – We know the risk is there, but the mitigation is more costly than the
cost of the risk (Low risks). We ensure we have a paper trail and this was a calculated decision.
Mitigate the Risk (Reduction) – The laptop encryption/wipe is an example – acceptable level (Leftover risk = Residual).
Transfer the Risk – The insurance risk approach – We could get flooding insurance for the data center, the flooding will still happen, we will still lose 15% of the infrastructure, but we are insured for cost.
Risk Avoidance – We don’t issue employees laptops (if possible) or we build the data center in an area that doesn’t flood. (Most often done before launching new projects – this could be the data center build).
Risk Rejection – You know the risk is there, but you are ignoring it. This is never acceptable. (You are liable).
What are the 9 steps in the risk management process within NIST 800-30?
NIST 800-30 - United States National Institute of Standards and Technology Special Publication. A 9-step process for Risk Management.
- System Characterization (Risk Management scope, boundaries, system and data sensitivity).
- Threat Identification (What are the threats to our systems?).
- Vulnerability Identification (What are the vulnerabilities of our systems
- Control Analysis (Analysis of the current and planned safeguards, controls and mitigations).
- Likelihood Determination (Qualitative – How likely is it to happen)?
- Impact Analysis (Qualitative – How bad is it if it happens? Loss of CIA).
- Risk Determination (Look at 5-6 and determine Risk and Associate Risk Levels).
- Control Recommendations (What can we do to Mitigate, Transfer, … the risk).
- Results Documentation (Documentation with all the facts and recommendations).
What are the 10 commandments of computer ethics?
Ten Commandments of Computer Ethics are:
- Thou shalt not use a computer to harm other people.
- Thou shalt not interfere with other people’s computer work.
- Thou shalt not snoop around in other people’s computer files.
- Thou shalt not use a computer to steal.
- Thou shalt not use a computer to bear false witness.
- Thou shalt not copy or use proprietary software for which you have not paid.
- Thou shalt not use other people’s computer resources without authorization or proper compensation.
- Thou shalt not appropriate other people’s intellectual output.
- Thou shalt think about the social consequences of the program you are writing or the system you are designing.
- Thou shalt always use a computer in ways that ensure consideration and respect for your fellow humans.
What are the 5 steps in the BIA process?
Identification of priorities Risk identification Likelihood assessment Impact assessment Resource prioritization
What are the 4 components of the Common Criteria?
- Target of evaluation (ToE)
- Security target
- Protection profile
- Evaluation assurance level (EAL)
What are the 7 common criteria levels?
The Common Criteria levels are
• EAL1: Functionally tested
• EAL2: Structurally tested
• EAL3: Methodically tested and checked
• EAL4: Methodically designed, tested, and reviewed
• EAL5: Semiformally designed, and tested
• EAL6: Semiformally verified, designed, and tested
• EAL7: Formally verified, designed, and tested
What are the 11 areas of ISO 17799/27002?
ISO 17799./27002 has 11 areas, focusing on specific information security controls:
- Policy
- Organization of information security
- Asset management
- Human resources security
- Physical and environmental security
- Communications and operations management
- Access control
- Information systems acquisition, development, and maintenance
- Information security incident management
- Business continuity management
- Compliance
What are the four domains of COBIT?
COBIT has four domains: Plan and Organize, Acquire and Implement, Deliver and Support, and Monitor and Evaluate
What are the five service publications of ITIL?
ITIL® contains five Service Management Practices—Core Guidance publications: • Service Strategy • Service Design • Service Transition • Service Operation • Continual Service Improvement
What are the properties of the Bell LaPadula model?
Bell-LaPadula: (Confidentiality) (Mandatory Access Control):
- Simple Security Property “No Read UP”.
- Subjects with Secret clearance can’t read Top Secret data.
- Security Property: “No Write DOWN”.
- Subjects with Top Secret clearance can’t write Top Secret information to Secret folders.
- Strong * Property: “No Read or Write UP and DOWN”.
- Subjects can ONLY access data on their own level.
What are the properties of the BIBA model?
BIBA: (Integrity) (Mandatory Access Control):
- Simple Integrity Axiom: “No Read DOWN”.
- Subjects with Top Secret clearance can’t read Secret data.
- Remember that integrity is the purpose here; we don’t want to have wrong or lacking lower clearance level data confuse us.
- Integrity Axiom : “No Write UP”.
- Subjects with Secret clearance can’t write Secret information to Top Secret folders.
- We don’t want wrong or lacking lower level information to propagate to a higher level.
- Invocation Property: “No Read or Write UP”.
- Subjects can never access or alter data on a higher level
What are the 8 rules that a subject can execute on an object in the Graham-Denning model?
The 8 rules that a specific subject can execute on an object are:
- Transfer Access.
- Grant Access.
- Delete Access.
- Read Object.
- Create Object.
- Destroy Object.
- Create Subject.
- Destroy Subject.
What are the six frameworks of the Zachman Framework? What rules do those six frameworks map to?
Zachman Framework (for Enterprise Architecture):
- Provides six frameworks:
- What, How, Where, Who, When, and Why.
- Mapping those frameworks to rules for:
- Planner, Owner, Designer, Builder, Programmer, and User.
What must all users have in the dedicated security mode?
Dedicated security mode - All users must have:
- Signed NDA for ALL information on the system.
- Proper clearance for ALL information on the system.
- Formal access approval for ALL information on the system.
- A valid need to know for ALL information on the system.
What must all users have in the system high security mode?
System high security mode - All users must have:
- Signed NDA for ALL information on the system.
- Proper clearance for ALL information on the system.
- Formal access approval for ALL information on the system.
- A valid need to know for SOME information on the system.
- All users can access SOME data, based on their need to know
What must all users have in the compartmented security mode?
Compartmented security mode - All users must have:
- Signed NDA for ALL information on the system.
- Proper clearance for ALL information on the system.
- Formal access approval for SOME information they will access on the system.
- A valid need to know for SOME information on the system.
- All users can access SOME data, based on their need to know and formal access approval.
What must all users have in the multilevel security mode?
Multilevel security mode - (Controlled Security Mode) - All users must have:
- Signed NDA for ALL information on the system.
- Proper clearance for SOME information on the system.
- Formal access approval for SOME information on the system.
- A valid need to know for SOME information on the system.
- All users can access SOME data, based on their need to know, clearance and formal access approval.
