Final Exam Flashcards
What is vulnerability testing?
Vulnerability testing – is the assessment of physical and logical vulnerabilities in InfoSec and related systems. These systems may be technical/nontechnical. Prevention, Inside Out!
What is penetration testing?
Penetration testing – is a set of security tests and evaluations that simulate attacks by a hacker or other malicious external source (ethical hack). Basically an authorized security test and evaluation. This is a control, Outside in!
What are examples of vulnerability testing?
scanners (tools designed to identify if a system represents security threats). Patch management and Endpoint Configuration.
What are examples of penetration testing?
White box test (complete info), Black box test (high-level info), Gray box test (limited info).
What is an InfoSec framework/model?
InfoSec Framework/Model – a generic outline that describes what the intended security control will look like. The framework/model basically outlines the organization-specific blueprint. The blueprint includes the details on how to get there.
What are the benefits of an InfoSec framework/model?
a framework essentially sets out a structure and path for the design, selection, and implementation of security controls, including policies, education, and training programs to make an overall best InfoSec program for the org.
Best approach for using InfoSec models?
InfoSec can use security models as an outline. Two (2) of the most widely referenced InfoSec models are the ISO 27000 Series and NIST, both can be used “as is”, or be customized by an organization based on their specific business requirements and risk appetite.
What is good InfoSec Governance?
Good InfoSec Governance – set of responsibilities & practices exercised with the goal of providing strategic direction, ensuring that objectives are achieved, ascertaining that risks are managed appropriately, and verifying that the enterprise’s resources are used responsibly.
How to best deliver (execute) good InfoSec Governance?
Good Delivery – asking for every information resource what security technologies protect it, and what every security technology protects.
What are key best practices for InfoSec Governance?
Governance Best Practices – When selecting recommended practices, you should use the following criteria: Does your organization resemble the target organization? Are the resources you spend similar to those called for by the practice? Are you in a similar threat environment as the one assumed by the practice? The biggest limitation to benchmarking in InfoSec is the fact that organizations do not talk to each other. Another limitation is that no two organizations are identical. A third limitation is that recommended practices are a moving target.
What is Contingency Planning and why is it necessary?
CP – The overall planning for unexpected adverse events.
Why is it necessary – the main goal of CP is to restore normal modes of operation with minimum cost and disruption to normal business activities as quickly as possible after an unexpected adverse event.
What are the 4 components of Contingency Planning?
BIA: Helps orgs determine which business functions and information systems are most critical to the success of the org.
IR Plan: Focuses on the immediate response to an incident. Determines the criticality of the incident from Recognition, to Containment, to Recovery, & Follow-up
DR Plan: Focuses on restoring ops at the primary site, is invoked. Determines criticality of the incident from Initial Response, to Relocation, to Recovery, & Restoration of Key IT Business Systems & Architecture
BC Plan: Focuses on enabling the business to continue at an alternate site. Determines the criticality of the incident from Initial Response, to Relocation, to Recovery, & Restoration of key Business Processes & possibly supporting IT services.
Describe why & how are InfoSec Policies, Procedures, & Standards relate to a Security Education, Training, and Awareness (SETA) Program.
The benefits of awareness, training, and education include improving employees’ behavior as they become knowledgeable and aware of the different aspects of security. Also, the organization can hold employees responsible for their actions because they have been given training on security issues. In addition, employees realize that any false actions would cause major harm to their company.
What are examples of best practices of InfoSec policies procedures?
Frequent – Formal Training should take place minimally every 12 months
Relevant – Training content should apply to the employee’s role & context, should be done at least 4 times a year.
Interesting – Content should be informative & challenging
Explain how & why organizations should manage risk.
How/Why Orgs Manage Risk – Know yourself and know your enemy! Risk management is the process of discovering and assessing the risks to an organization’s operations and determining how those risks can be controlled or mitigated. It is important because management needs to know the value of each company asset and what losses will be incurred if an asset is compromised.
