Extra Practice Flashcards
Due Care
A legal concept pertaining to the duty owed by a provider to a customer.
practicing the individual activities that maintain the due diligence effort.
I’m doing care
Due diligence
“Actions taken by a vendor to demonstrate/provide due care.
establishing a plan, policy, and process to protect the interests of an organization.”
Control Objectives for Information and Related Technologies (COBIT)
“Documented set of best IT security practices crafted by the Information Systems Audit and Control Association (ISACA).
Sy. 22
Controls orbit our technologies
Provide Stakeholder Value
Holistic Approach
Dynamic Governance System
Governance Distinct from Management
Tailored to Enterprise Needs
End-to-End Governance System”
STRIDE
A Microsoft threat categorization scheme composed of spoofing, tampering, repudiation,
information disclosure, denial of service, and elevation of privilege.
Steps of Decomposition Process
“Trust boundaries, where levels of security changes
dataflow paths, movement of data between locations
input points, where external input is received
Privileged operations, any activity that requires greater privileges, making changes to security or system changes.
Details of security stance, mapping to security policy and assumptions”
authorization to operate (ATO)
Often related to government or military agencies or contractors, an ATO is the formal approval to perform business functions once compliance with a contract, standard, framework, or regulation is confirmed. An ATO is often issued for a limited period of time and can be lost or canceled by the approving authority at any time based on any significant change to the environment.
Authorizing Official (AO)
“An authorized entity who can evaluate an IT/IS system, its operations, and its risks, and potentially issue an ATO. Aka designated approving authority (DAA), Approving Authority (AA), Security Control Assessor (SCA), and Recommending Official (RA).
5 years”
Annualized Loss Expectancy
“the possible yearly loss of all instances of a specific realized threat against a specific asset.
ALE = ARO * SLE (ale is arousal)”
Single-loss expectancy (SLE)
“percentage of loss that an organization would experience if a specific asset were violated by a realized risk.
SLE = Asset Value * Exposure Factor”
Risk
The possibility of damage or harm and the likelihood that damage or harm will be realized.
Threat* Vulnerability
Residual Risk
“The risk remaining after security controls have been put in place as a means of risk mitigation.
Risk that remains “
Inherent risk
The level of natural, native, or default risk that exists in an environment, system, or product prior to any risk management efforts being performed.
Security professional
Has the functional responsibility for security, including writing the security policy and implementing it.
Senior management
Ultimately responsible for the security maintained by an organization and should be most concerned about the protection of its assets.
Business Continuity(BC) Steps
- Project Scope and planning: review the organization, create a bcp team, assess resources available, get legal information.
- Business Impact Analysis: Identify processes, critical tasks, assess likelihoods, find priorities, MTD, RTO, RPO, Identify risks and likelihood.
- Continuity Planning: Strategy development and provisions and processes, Continuity of Operations Plan (COOP)
- Approval and Implementation:
Disaster recovery(DR)
Those tasks and activities required to bring an organization back from contingency operations and reinstate regular operations. Disaster recovery plans pick up where business continuity plans leave off. After a disaster strikes and the business is interrupted, the disaster recovery plan guides response teams in their efforts to quickly restore business operations to normal levels.
Bureau of Industry and Security
within the Department of Commerce sets regulations on the export of encryption products outside of the United States. The other agencies listed here are not involved in regulating exports.
Federal Information Security Management Act (FISMA)
includes provisions regulating information security at federal agencies. It places authority for classified systems in the hands of the National Security Agency (NSA) and authority for all other systems with the National Institute for Standards and Technology (NIST).
Communications Assistance for Law Enforcement Act (CALEA)
required that communications carriers assist law enforcement with the implementation of wiretaps when done under an appropriate court order. CALEA only applies to communications carriers and does not apply to financial institutions, healthcare organizations, or websites.
Fourth Amendment
sets the “probable cause” standard that law enforcement officers must follow when conducting searches and/or seizures of private property. It also states that those officers must obtain a warrant before gaining involuntary access to such property.
Privacy Act of 1974
limits the ways government agencies may use information that private citizens disclose to them under certain circumstances.
HIPAA Relationships with 3rd Party
Organizations subject to HIPAA may enter into relationships with service providers as long as the provider’s use of protected health information is regulated under a formal business associate agreement (BAA). The BAA makes the service provider liable under HIPAA.
Gramm–Leach–Bliley Act (GLBA)
provides, among other things, regulations regarding the way financial institutions can handle private information belonging to their customers.
Data Destruction
the final stage in the life cycle of backup media
degausser
“a heavy magnetic field, which realigns the magnetic fields in magnetic media such as traditional hard drives, magnetic tape, and floppy disks.
Does not work with SSDs”
Demagnetize
Purging
The removal of sensitive data from a system or storage device with the intent that the data cannot be reconstructed by any known technique.
Erasing or deleting
processes rarely remove the data from media but instead mark it for deletion.
End of Support (EOS)
the date that the vendor will stop supporting a product.
End of Life (EOL)
The date that a vendor stops producing and offering a product for sales but the vendor continues to support the product until the EOS date.
Confusion
occurs when the relationship between the plaintext and the key is so complicated that an attacker can’t merely continue altering the plaintext and analyzing the resulting ciphertext to determine the key.
Diffusion
occurs when a change in the plaintext results in multiple changes spread throughout the ciphertext.
Symmetric Key Exposure Formula
Number of keys = n(n-1) / 2
M of N Control
requires that a minimum number of agents (M) out of the total number of agents (N) work together to perform high‐security tasks. M of N Control is an example of a split knowledge technique, but not all split knowledge techniques are used for key escrow.
Galois/Counter Mode (GCM)
same as CTR but includes authentication tags to the encryption process for more authenticity
closed system
one that uses largely proprietary or unpublished protocols and standards.
trusted computing base (TCB)
has a component known as the reference monitor in theory, which becomes the security kernel in implementation.
The collection of all the hardware, software, and firmware components within an architecture that is specifically responsible for security and the isolation of objects. TCB is a term usually associated with security kernels and referencemonitor.
reference monitor
validates access to every resource prior to granting the requested access.
Bell-LaPadula Model
“Dept of Def, clearance levels and need to know,
Can’t read a higher clearance level, and you can’t write DOWN to a lower clearance level.”
there’s no I (integrity) in Bell-LaPadula
Biba Model
“Opposite of Bell-LaPadula, More about the modification of objects and data. Designed to address integrity issues of objects
Lacks confidentiality and availability”
Clark-Wilson Model
“Multifaceted approach to enforcing data integrity where the formal state machine limits modification to a system through a limited or controlled intermediary program or interface
Restricted Interface Model
Enforces separation of duties”
