Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

4th Year - 1st Sem > IA 2 - UNIT 2 > Flashcards

IA 2 - UNIT 2 Flashcards

1
Q

different types of assets

A
  1. Tangible
  2. Intangible
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Three Controls Assigning Responsibility

A
  1. Inventory
  2. Ownership
  3. Acceptable Use
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Responsibilities of Assets

A
  • provides adequate levels of security
  • assigned to identified entities
  • risk management and security responsibilities
  • provides accountability for asset protection
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Organization’s Assets

A
  1. Data / Information
  2. Hardware
  3. Intangible
  4. People
  5. Service
  6. Software
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q
  • Identify and record information about the
    assets
  • Movements and changes are documented and updated
A

Inventory

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q
  • Assets have established owners
  • Responsibility of security of assets
  • Review of Classification and use authorisation
A

Ownership

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q
  • Develop policies and guidelines
  • Similar categories covered under the same policy
  • Disclosure and release of information are cited
A

Acceptable Use

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Organising information by sensitivity and loss disclosure, modification and unavailability.

A

Classification and Handling

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Two controls in place

A
  1. Classification Guidelines
  2. Information labeling and handling
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q
  • Organised by information needs and impact in case of breach
  • Originator is responsible for classifying and protecting information based on policies and procedures
A

Classification Guidelines

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Classification is based on value and impact
determines the level of

A
  • confidentiality
  • integrity
  • availability
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Classification Guidelines Considers

A
  • Security classification
  • Information assurance
  • Information owners Business,
  • Industry, and Legal requirements
  • Organisation Culture
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Classification Process

A
  1. Creation ->
  2. access control implementation ->
  3. method of process ->
  4. information disposal
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q
  • Organisations must develop information handling protocols based on the policy on classification
  • This preserves information assets
A

Labeling and Handling

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Risk Management Process

A
  1. Background Planning
  2. Asset Analysis
  3. Threat Analysis
  4. Vulnerability Analysis
  5. Risk Identification
  6. Risk Analysis
  7. Risk Treatment
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Organisations must develop information handling protocols based on the policy on classification This preserves information assets

A

Labeling and Handling

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Background Planning Critical Elements

A
  1. Establish the Aim, Scope and Boundary
  2. Establish the risk evaluation criteria
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

process of managing the risks involved in Information Technology systems. These include identifying, assessing, and acting on risks to data confidentiality or integrity.

A

Risk Management

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q
  • The measure or the extent of which an entity is threatened by circumstance or event
  • The likelihood of a threat event occuring
A

Risks

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Using the CIA Triad

A
  • Confidentiality: What happens if people could see this?
  • Integrity: What happens if people could change this?
  • Accessibility: What happens if authorized users can’t use this?
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q
  • Analyze your assets based on their type (Hardware, Software, People, Services, Platforms)
  • Determine their owner, the value and their impact to the organization using the CIA triad
A

Asset Analysis

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

conducted while referring to a database of known major threats.

A

threat analysis

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Human threats are divided into three dimensions

A
  1. The Motive
  2. The Opportunity
  3. The Means
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

are typically weather-related phenomena.

A

Natural Threats

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q
  • Identify the vulnerabilities for which threat events.
  • The goal is to identify flaws or weaknesses that the threat can exploit.
A

Vulnerability Analysis

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q
  • Risks should be identified as early as possible.
  • A good practice is to brainstorm with the risk management team. If the team lacks the expertise, outside help should be brought in.
A

Risk Identification

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q
  • A qualitative approach to risk analysis using the “quadrants” method.
  • Risk in the “Low” category may be ignored or lowered in priority
A

Risk Matrix

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q
  • Periodical Risk Assessment should be conducted. Risk reviews should occur when there are changes to the I.T. infrastructure.
  • Organizations should develop “risk dashboards”. This ensures that the risks are monitored in accordance to their priority.
A

Monitoring Risks

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

identify what methods are in place to control the risk, and the strengths/weaknesses of the system.

A

Risk Analysis

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

Basing off of the risk assessment:

A

Avoid risk: If the activity causes risk, don’t do it.
Reduce Likelihood of Occurrence
Reduce the consequences
Transfer Risk: Insurances, partnerships, etc.
Accept Risk: Just let it happen.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

Integration w/ Other Management Practices

A
  1. Budgeting
  2. Business Planning
  3. Internal Audit
  4. Periodic Reporting
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

Risk management requires resources that may otherwise be used in other areas of the organization.

A

Budgeting

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

Organization may have a busin s plan. Certain exercise such as SWOT & PEST may be u n risk analysis

A

Business Planning

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

a tool that Management may use to monitor risks Frequency of the reporting should be based on impact of the risk.

A

Periodic Reporting

35
Q

Organizations should use data from the risk manage ent team to aid in internal auditing & control reviews

A

Internal Audit

36
Q

Assures that unauthorized people do not have access to any information and every information that is transferred must be encrypted wherein only authorized people have the ability to decrypt it.

A

Confidentiality

37
Q

It is the practice of managing risks involving information such as the use, storage, transmission and processing. This includes the systems or devices that are being used in the process.

A

Information Assurance Policy

38
Q

It prevents unauthorized access, use, disclosure, disruption, modification, or destruction of the data

A

Information Assurance Policy

39
Q

Pillars of Information Assurance Security

A
  1. Confidentiality
  2. Integrity
  3. Availability
  4. Authenticity
  5. Non-repudiation
40
Q

This assures that the system is capable of protecting the data thus the information shall retain its original state. It ensures that no one can tamper and modify the information without authorization.

A

Integrity

41
Q

This ensures that the people who are guaranteed access have easy and timely access to the information. Wherein information is available even during unexpected scenarios.

A

Availability

42
Q

Ensures that the information transmitted through parties are accurate and specific. The system must be capable of preventing impersonation and must confirm the identities before giving access to the information.

A

Authenticity

43
Q

Ensures that both parties receive confirmation or proof that their messages are delivered to the correct individuals which means by confirming these identities both parties shall allow each other to send or receive data respectively.

A

Non-repudiation

44
Q

There are four essential areas of focus applicable to the
recruitment process.

A
  • Inclusion of information assurance aspects in the job scope and description.
  • Defined level of confidentiality or sensitivity required
  • Filling the vacant positions with suitable candidates
  • Use of legal documents to enforce information assurance
45
Q

eliminates “gray” areas about employee responsibilities and how to respond in different situations.

A

job scope and description

46
Q

should give a clear explanation about employees’ roles, responsibilities, and authorities in the organization. It is crucial to state the access level during the employee’s tenure.

A

scope and description

47
Q

NICE

A

United States National Initiative for Cybersecurity Education

48
Q

The NICE framework features:

A
  1. Operate and Maintain
  2. Protect and Defend
  3. Investigate
  4. Collect and Operate
  5. Analyze
  6. Securely Provision
  7. Oversight and Development
49
Q

Individuals should be placed in specific positions within an organization based on their qualifications.
the position’s confidentiality level, suitable screening, and selection methods. Insert the the best candidate for the job.

A

Filling the Position

50
Q

There are two general principles that apply when
granting access

A
  1. job division
  2. employee rights restriction
51
Q
  • brings more privacy issues on the table
  • organization’s information assurance requirements should follow the organizations information onto any media or platform
A

BYOD

52
Q

Two documents used frequently as legally binding in organizations

A
  1. employment contract
  2. nondisclosure agreements (NDAs)
53
Q
  • an agreement between the organization and the employee defining all the terms and conditions of employment.
  • Hence, from the point of view of information assurance, the employee’s information assurance roles and responsibilities should be defined pertaining, but not limited to, copyright, data protection rights, information ownership, information management, and information classification.
A

employment contract

54
Q
  • Organizations must ensure they clearly delineate the expectations of the employee in terms of privacy when it comes to employee- owned devices or employees using organizational equipment for personal use.
  • Organizations may offer a de minimus policy for employees that states an employee may use organizational information systems and resources for personal use during a break or lunch period as long as there is no material cost to the organization.
  • de minimus is Latin for “minimal things,” and in risk assessment it refers to a level of risk too low to be concerned with.
  • If the organization is intercepting the connection and decrypting the information,
  • it may be wading into the waters of a privacy violation.
  • Organizations must work carefully with their legal departments to determine appropriate policies for work- life balance that ensure proper scoped monitoring can be performed when needed.
A

Monitoring and Privacy Expectations

55
Q
  • defines the identity of the organization and the employee, the level of confidentiality of the information covered, and to whom information may not be divulged.
  • Hence, an employee should sign an before they have access to the organization’s information systems or facilities.
  • Furthermore, ________ should be reviewed whenever terms and conditions of employment change.
A

NDA

56
Q
  • a form of control that minimizes fraud. It may also keep an individual from staying in a job position for long periods; it helps manage their level of motivation.
  • keeping an employee in one job position for extended periods may lead the employee to having too much control over certain business functions.
  • Such employee control may lead to fraud, can lead to misuse of resources, or may even jeopardize data integrity.
A

Rotation of Duties

57
Q

  • An organization may perform periodic monitoring of employees’ activities to detect potential fraud.
  • Clearly, this must be consistent with local laws; however, it is important for employees to know that such monitoring may take place.
  • The organization should be cautioned against routine and undisclosed monitoring because this may trigger employees’ uneasiness: feelings that they are not being trusted and are being spied upon.
A

Periodic Monitoring

58
Q
  • Organizations must ensure they clearly delineate the expectations of the employee in terms of privacy when it comes to employee- owned devices or employees using organizational equipment for personal use
A

Monitoring and Privacy Expectations

59
Q
  • The recruitment process does not stop once an employee is hired.
  • The new employee will be trained to perform job-specific tasks including information assurance duties and responsibilities.
A

Employee Training and Awareness

60
Q
  • Organizations should establish policy and procedures for secure offboarding by defining actions to be taken to handle absence and departure.
  • The actions should include temporary or permanent closing of accounts, steps for forwarding e-mails, change of critical passwords and phone numbers, and disabling access to all systems.
A

Termination or Change of Employment

61
Q
  • Establish and explain a formal disciplinary process for all employees specific to security breaches.
  • The disciplinary process should ensure that employees suspected of committing any security breach are treated correctly and fairly.
A

Disciplinary Process

62
Q
  • Refers to the formal process of assessing and certifying that an organization’s information systems and processes meet certain security standards and compliance requirements.
  • The Information Assurance Planning Process involves a series of steps and activities aimed at ensuring the confidentiality, integrity, and availability of an organization’s information assets.
A

Accreditation

63
Q

This process includes identifying the information systems and assets to be accredited, understanding the relevant security requirements, and establishing an accreditation team.

A

Preparation and Planning:

64
Q
  • outlines the system’s security requirements, policies, procedures, and controls.
  • It serves as a foundational document for the accreditation process.
A

System Security Plan (SSP) Development

65
Q
  • Organizations perform a comprehensive risk assessment to identify potential threats, vulnerabilities, and risks associated with the information systems.
  • This assessment helps in determining the appropriate security controls and countermeasures
A

Risk Assessment

66
Q

Based on the SSP and risk assessment, the organization implements the necessary security controls to mitigate identified risks and meet security requirements. This may involve the deployment of technical safeguards, security policies, and employee training.

A

Security Controls Implementation

67
Q

The organization conducts security testing and evaluation to assess the effectiveness of the implemented security controls. This may include vulnerability scanning, penetration testing, and other security assessments.

A

Security Testing and Evaluation

68
Q

Detailed documentation of all security-related activities, including security control implementation, testing results, and incident response procedures, is essential for the accreditation process.

A

Documentation

69
Q

The accreditation team compiles all relevant documentation and evidence into an accreditation package. This package is submitted to the accrediting authority for review.

A

Accreditation Package Preparation

70
Q
  • employees that states an employee may use organizational information systems and resources for personal** use during a break or lunch period as long as there is no material cost to the organization**
  • and in risk assessment it refers to a level of risk too low to be concerned with
A

de minimus policy

71
Q
  • often a designated security or compliance officer within the organization or a regulatory body, reviews the accreditation package.
  • They assess whether the security controls are effectively mitigating risks and whether the organization is in compliance with applicable standards and regulations.
A

Accrediting Authority Review

72
Q

This decision can be to accredit the system (grant authorization to operate), deny accreditation, or require further remediation and reevaluation

A

Accreditation Decision

73
Q
  • Organization must maintain continuous monitoring and oversight of the accredited systems.
  • This includes ongoing security assessments, incident response, and periodic reviews to ensure compliance with security requirements.
A

Continuous Monitoring

74
Q
  • Accreditation is not a one-time process.
  • Periodically, the organization must undergo reaccreditation to ensure that the security controls remain effective and that the system remains compliant with evolving security standards and regulations.
A

Reaccreditation

75
Q

Two Approaches to Implementing Information Assurance

A
  1. The Bottom-up Approach
  2. The Top-down Approach
76
Q

places the responsibility of successful information security on a single staff member or security department

A

The Bottom-up Approach

77
Q

starts with upper management and top-level managers are the ones responsible for initiating, creating, and implementing your data protection strategy

A

The Top-down Approach

78
Q

The Bottom-up Approach Advantages

A
  • uses a person or team’s experience and expertise to handle intricate security concerns
  • you may be able to assign the task to an existing employee with the appropriate background instead of hiring someone new
79
Q

The Top Down Approach Advantages

A
  • has more efficacy because it makes data protection a company-wide priority instead of placing all the responsibility on one person or team
  • incorporates more available resources and a clearer overview of the company’s assets and concerns
80
Q

The Bottom-up Approach Disadvantages

A
  • it doesn’t involve assistance or input from top-level management
  • infosec program won’t have the same thoroughness that it would have if you were incorporating information and directives from the top
81
Q

Structure of an Information Assurance Organization

A
  1. Centralized Structure
  2. Distributed Structure
  3. Hybrid Structure
82
Q

where an information assurance management program is managed under a centralized unit with ultimate accountability and responsibility for the program

A

Centralized Structure

83
Q

where roles, responsibilities, and authorities are spread throughout the organization’s business units, operations areas, and geographical locations

A

Distributed structure

84
Q
  • that is a mix of the centralized and distributed structures
  • features centralized management of information assurance with decentralized execution of security activities.
A

Hybrid structure

4th Year - 1st Sem (8 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions