Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

ICS 1 > ICS1 > Flashcards

ICS1 Flashcards

Regulations, Standards, Framework

1
Q

Application of Information Technology is the systematic implementation of…

A

Hardware and software so data can be
-Transmitted
-Modified
-Accessed
-Stored securely and efficiently

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Name three NIST Frameworks

A

-NIST Cybersecurity Framework
-NIST Privacy Framework
-NIST 800-53 Security and Privacy controls for informations systems and organizations

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

NIST Cybersecurity Framework primary components

1

A

Voluntary framework
1. Framework Core
2. Framework implementation tiers
3. Framework profile

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Purpose of NIST CSF

A

To develop a set of plain language controls for protection of IT infrastructure

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What are the NIST CSF Framework Core Areas of Focus

A
  1. Identify
  2. Protect
  3. Detect
  4. Respond
  5. Recover
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What is the purpose of the NIST CSF Framework Core Focus Areas?

A

Things to help develop a program to identify, assess, and manage cyber security risks in a cost effective and repeatable manner. Each core area represent points in the security risk management life cycle and are performed concurrently

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

NIST CSF - Core Area - IDENTIFY

1

A

Keep record of:
- Assets used to support information processing operations
- Users both internal and external
-Systems

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

NIST CSF - Core Area - PROTECT

1

A

Focuses on:
- Safegaurds and access controls to networks, applications, and other devices.
- Updates to security software
-Encryption of information
-Data backups
-Plans for disposing of files/devices
-User training

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

NIST CSF - Core Area - DETECT

1

A

Deploy tools to:
-Detect active attacks
-Monitor network access points, devices, unauthorized personal access, and high risk employee behavior or use of high risk devices

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

NIST CSF - Core Area - RESPOND

1

A

Develop response policies addressing how to:
-contain a cybersecurity event
-react using planned responses to mitigate losses

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

NIST CSF - Core Area - RECOVER
1

A

Restoration of network to normal operations through:
-repairing equiptment
-restoring back up files/env.
-positioning employees to rebound w/ right responses

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

1 NIST CFS - Categories/Sub categories of Functions or Core Areas

A

Core areas have categories that are tied to specific activities/company needs

and further into subcategories for mgmt and technical activities to help achieve outcomes.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

NIST CFS - Implementation Tiers - purpose

1

A

Provides a measure of an organizations informaiton security infrastructure sophistication.

The 4 tiers act as a benchmark to identify the degree to which informaiton security practices are integrated throughout an organization.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

How does an organization deteremine their implementation tier?

A

Based on perception of its own risk given the cybersecurity policies in place.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

NIST CFS Implementation Tiers vs. Framework Profiles?

A

Profiles determine success or failure of information security implementation

Tiers inform the org as to the effectiveness of those profiles.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

1 NIST CFS - Implementation Tiers - List Them

A

Divided into four levels:
1. Partial (Lowest)
2. Risk-Informed
3. Repeatable
4. Adaptive

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q
A
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

NIST CFS - Implementation Tiers - division

A

Tiers are subdivided into
1. Risk Management process
2. Risk management program integration
3. External participation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

NIST CFS Implementation Tier - Partil

A

incident mgmt is not incorporated into processes.

RM Process/Program Integration - RM is ad hoc/reactive
External Participation - corporate cybersecurity is isolated, does not evaluate external risks.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

NIST CFS - Implementation Tier - Risk Informed

A

Involves cybersecurity awareness but not security managed

RM Process - cybersecurity prioritization is based on org. risk, and mgmt approves cybersecurity efforts - CS may be isolated from org processes.

Awareness of environmental security risks impact org, but inconsistent actions to respond to risk.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

NIST CSF - Implementation Tier - Repeatable

A

Integrated into planning and regularly communicated.

RMP - Cybersecurity planning and in policies
RMPM - org risk approach
External participation - org collabs w/ and contributes to security community & governance structures to manage cyber risk.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

NIST CFS Implementation Tier - Adaptive

A

RPP - Org. cybersecurity is based on iterative improvement based on incidents and is responsive to evolving threats
RMPM - org. wide affair - cyber risk is prioritized to other risks
External participation - robustly participates in external info sharing and frequency contributes to community.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

1 NIST CFS - Framework profiles - purpose

A

Mechanism by which companies measure cybersecurity risk and how to minimize risk. - implementation guides w/ industry insights

should consider - org goals, industry goals, legal/reg requirements, best practices, RM priorities.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

1 NIST CFS - Framework profiles - Categories

A

Current profile - current state of org. RM
Target profile - desired future state
Gap analysis - differences between 2

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

1 NIST Privacy Framework

A

To protect individuals data as used in data processing applications

any industry

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

What concepts are present in both NIST Cyber Security Framework and Privacy Frameworks

A

similar structures, RM approaches but applied to each subject matter differently.

Identify, Protect

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

1 NIST Privacy Framework - Core

A

Identify, Govern, Control, Communicate, Protect

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

1 NIST Privacy Framework - Core - Identify

A

What are the privacy risks related to data processing?

Inventory/mapping, business env., RA, data processing ecosystem RM.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

1 NIST Privacy Framework - Core -Govern

A

What is the best governance structure ?

Governance P&P, RM strategy, awareness/trainings, monitoring review.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

1 NIST Privacy Framework - Core - Control

A

What is the best management structure

  • data processing P&P, mgmt, and disassociated processing.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

1 NIST Privacy Framework - Core - Communication

A

How to drive dialog around privacy risk related to data processing activities.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

1 NIST Privacy Framework - Core - Protect

A

What safeguards should be in place, five categories

  1. data protection p&p,
  2. identity mgmt, authentication and
    access control
  3. , data security, maintenance, protective technology.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

NIST Privacy Framework Core - subdivisions

A

Functions are subdivided into categories to address privacy program considerations, and further subdivided to sub-categories.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

1 NIST Privacy Framework profile

A

Mirrors Cybersecurity framework (current, target, gap analysis)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

1 NIST Privacy Framework Implementation Tiers

A

Mirrors cybersecurity framework (partial, risk informed, repeatable, adaptive)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

1 NIST SP 800-53 - what is it

A

Set of security and privacy controls applicable to all Info systems and the standard for federal info security systems.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

1 NIS SP 800-53 purpose

A

designed for protecting info systems against sophisticated threats

establishes controls for systems/orgs that can be implemented within org/system that process, store or transmit information.

Helps to identify security and privacy controls needed to manage risk and satisfy requirements by OMB A-130 and FISMA.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

1 Office of Management Budget CircularA-130

A

requires controls for federal Info Systems

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

1 Federal IS Moderization Act (FISMA)

A

required implementation of minimum controls to protect federal info and IS.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
40
Q

1 Target Audience of NIST SP 800-53

A
  • System admins : individuals with system, info security, privacy, or RM and oversight responsibilities

-System developers: program managers, engineers, developers

-logistical personnel: procurement, system integrators property managers

  • security/privacy personnel and assessment and monitoring personnel

-Commerical entities (3rd party vendors) producing products/system/services that support security or privacy.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
41
Q

1 NIST SP 800-53 Organizational Responsibilities

A
  • Well defined security and privacy requirement for systems/orgs.
  • Use of trustworthy system components (
  • Rigorous security and privacy planning and system development life cycle mgmt.
  • Application of security and privacy practices for system integration of info systems.

-Documented practices

  • Continuous monitoring of info system to eval effectiveness of controls.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
42
Q

1 NIST SP 800-53 Control Families

A

They cover org. risk and are subdivided into controls and control enhancements. Controls are to be implemented for family conformance enhancements are best practices (some recommended, some required for baseline conformance)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
43
Q

1 NIST SP 800-53 Control Implementation approaches

A

3 approaches that are to be implemented on a per control basis:

  1. Common - inheritable, implement controls at org. level, which are adopted by Info Systems.
  2. System Specific - at info system level
  3. Hybrid - org level where appropriate and remainder at system level.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
44
Q

2 Privacy laws

A

regulate how those entrusted w/ private information collect, process, maintain and disclose it.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
45
Q

2 General Data Protection Regulation

A

EU enacted one comprehensive data privacy law that applies and governs how all entrusted w/ personal data handle that info.

imposes steep penalties and fines

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
46
Q

2 Where does GDPR apply?

A

Data processors based in EU, or those offering services to those in EU, or where public international law applies.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
47
Q

2 GDPR Princpals

A
  1. Lawfulness, Fairness, Transparency
  2. Purpose Limitation
  3. Data minimization
  4. Accuracy
    5.Storage Limit
  5. Integrity/Confidentiality
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
48
Q

2 Safe Harbor Framework

A

support transatlantic commerce, EU/US, transmit data -

EU declarer invalid replaced with Privacy Shield, which also was invalid.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
49
Q

2 four categories of costs incurred for data breach

A
  1. Detection/escalation
  2. notification
  3. Response
  4. Loss of business/rev. (during downtime)”
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
50
Q

2 HIPPA covered entities

A

Health care providers that transmit info electronically, health plans, health care clearing houses, business associates who are service providers who need access to PHI

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
51
Q

2 Who can PHI be disclosed to w/o permission

A
  1. individuals,
  2. for treatment, payment, and health care operations
  3. incident to otherwised permitted use and disclosure
  4. With valid auth
  5. Redacted for research, public health or health care ops
  6. public interst and benefit activities provided by law
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
52
Q

2 Under HIPPA for electornic PHI MUST

A
  1. ENSURE - confidentiality, integrity and availability of electronic PHI
  2. PROTECT against reasonably anticipated threats to security of info, impermissible use or disclosures
  3. ENSURE compliance by workforce
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
53
Q

2 HIPPA - Administrative Safeguards

A
  1. Security mgmt processes
  2. assigned security responsibilties, 3. workforce security
  3. Info access mgmt
  4. security awareness/training, 6. security incident procedures
  5. contingency plans,
  6. evaluation.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
54
Q

2 HIPPA - Physical Safegaurds

A

facility access, workstation use/security, device/media controls

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
55
Q

2 HIPPA - Technical Safegaurds

A

access controls, audit controls, data integrity controls, person/entity authentication, transmission security

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
56
Q

2 HITECH

A

Health Information Tech for Economic and Clinical Health Act

Amended HIPPA to increase penalties, patients option to obtain records electronically, and add business associates as covered entities, breach notification rule.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
57
Q

2 HITECH - Breech Notification Rule

A

w/in 60 days to impacted people

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
58
Q

2 Payment Card Industry Data Security Standards (PCI DSS)

A

Data protected includes cardholder data, authentication data - Account data

Six goals and 12 requirements
1. Build/Maintain a secure network of system
2. Protect account data
3. vulnerability mgmt program
4. strong access control measures
5. Regular monitor/test
6. maintain info sec policy”

59
Q

3 Center for Internet Security Controls (CIS) - define

A

recommended set of actions, processes and best practices to strengthen cybersecurity defenses.,
(Supported by SANS institute)

Controls are task focused and organized by activity (instead of who manages the device) a total of 18 controls and 153 subcategories of safeguards.

60
Q

3 CIS Design Principles

A
  1. Align - controls should map to other top CS standards
  2. Measurable - simple, measurable and avoid vague language
  3. Offense Informs Defense - controls drafted based on events
  4. Focus - help prioritize most critical problems and avoid resolving every issue
  5. Feasible -
61
Q

3 CIS Implementation

A

Implementation of CIS can be tailored to org. size by using one of three implementation groups, these are self assessed categories that ID subset of the CIS controls which are critical to adopt given size.

62
Q

3 CIS Implementation Groups - 1

A

Small or Medium sized org that have limited cybersecurity defense mechinism in place.

Main focus - keep operational since limited expertise, not sensitive data, cant sustain long periods of downtime.

63
Q

CIS Implementation Group 2

A

Orgs that have IT staff who support departments that have various risk profiles.

Sensitive client data and can tolerate short term disruption.

Biggest concern - lost of trust

64
Q

CIS Implementation Group 3

A

Orgs have security experts in all domains w/in CS.

Sensitive data assets subject to compliance or reg oversight.

Attacks cause significant damage to company/public.

65
Q

3 CIS Control 1 - Inventory and Control of Enterprise Assets

A
  • helps organizations actively track/manage all IT assets
    connect to IT infrastructure physically or virtually/cloud. Also focus on external devices connect via guest network

-Gives visibility on how data flows, which device contains sensitive data to help prioritize security/maintenance

66
Q

3 CIS Control 1- challenges w/ inventory

A

portable end-user devices that periodically connect to network and then disappear - makes it hard to have a holistic view of inventory.

67
Q

3 CIS Control 2- Inventory and Control of Software Assets

A

Track and actively manage all software applications so that only authorized software is installed on company devices

-Guidance on finding unmanaged and unauthorized software already installed so it can be removed and remediated.

Control lists and policies should be in place

(operating systems, programming software, business applications, drivers, open-source software, some firmware)

68
Q

What does a software control list help with?

A

info on if software patches are installed, applications reaching end of life support are renewed or transitioned out, safeguards needed are in place

69
Q

3 CIS Control 3 - Data Protection

A

Develop ways to securely manage the entire life cycle of their data, from the initial identification and classification data to its disposal.

Must identify, archive, label, and classify their data to understand implications of data being lost or compromised

70
Q

3 CIS Control 3 - Data Protection - data classification categories

A

Labeled at discretion of the enterprise and should be assigned based on sensitivity (i.e. internal, public, sensitive, and confidential)

71
Q

3 CIS Control 3 - Data Protection - data mapping

A

After sensitivity is defined, mapping should be developed to ID software that access, and allow consolidation of sensitive classification into one network.

72
Q

3 CIS Control 4 - Secure Configuration of Enterprise Assets and Software

A

Establish and maintain secure baseline configurations for enterprise assets (hardware/software - network devices, mobile/end user, IoT, operating systems).

73
Q

3 Problem with applications?

A

Many are sold with preconfigured settings that can present vulnerabilities, therefore should have control activities to assess configurations and modify and move to continuous monitoring.

74
Q

3 What are good tools to assess asset configerations?

A

CIS Benchmark Program or NIST National Checklist Program Repository

75
Q

3 security hardening

A

process of making an organization less vulnerable to attacks, examples include removing unused software, closing network ports, changing default passwords, turning off non essential services.

76
Q

3 CIS Control 05: Acount Management

A

best practices managing credentials and authorization for user accounts, privledge user accounts, and service accounts for hardware/software.

77
Q

3 what are actions realted to CIS Control 5: Account Managmenet

A
  • central account mgmt, acceptable use policy and account safety guidelines, credential are sensitive info, training for users, password requirements, controls for inactivity, and account lockouts.
78
Q

3 CIS Control 06: Access Control Management

A

Specifies the types of access that user accounts should have.

79
Q

3 What principal should be followed for user access?

A

least privledge or “need to know”
only what is needed to do job

80
Q

3 what are actions realted to CIS Control 5: Account Control Management?

A

Protocols for granting access and revoking access, MFA or privledge account management for security, a comprehensive solution for provisioning and de-provisioning access

81
Q

3 CIS Control 07: Continuous Vulnerability Management

A

Assist in continuously identifying and tracking vulnerabilities within infrastructure so they can be remediated and eliminate weak points/widows of opportunity.

82
Q

zero-day exploits

A

unknown vulnerabilities - no known solution to weak point

83
Q

3 What can be used to help determine vulnerablity impact?

A

Classification schemes like Common Vulnerablity Scoring System or Common Vulnerabilites Exposure

84
Q

3 CIS Control 08: Audit Log Management

A

Establishes and enterprise log management process so that organizations can be alert and recover for an attack in real time using log collection and analytic features.

85
Q

3 CIS Control 09: Email and Web Browser Protections

A

How to detect and protect against cybercrime attempted through email or internet by engaging w/ EE.

86
Q

3 Actions realted to CIS Control 09: Email and Web Browser Protections

A

policies and tools to enforce URL filtering, blocking certain file types, restrict users add-ons

URL filtering can be done by Domain Name System (DNS) filtering - which blocks users from accessing certain domains on a blacklist.

87
Q

4 CIS Control 10: Malware Defenses

A

Prevent the installation and propagation of malware onto company assets and its network. Endpoint assets and devices can be leveraged as entry points and targets

88
Q

4 what is malware

A

viruses, worms, spyware, adware, keyloggers, ransomware

can cause damage by stealing intellectual property, log-ins, destroying data, or encryption for ransom.

89
Q

4 Anti-malware

A

solution should be centrally managed, maintained, and deployed to all potential entry points.

Autorun/auto play features should be disabled

90
Q

4 LotL

A

Living off the land approach minimizes likelihood attacker will get caught by using organization’s existing tools against them - quick window

91
Q

4 CIS Control 11: Data Recovery

A

Establishes data backup, testing, restoration processes that allow organizations to effectively recover company assets to a pre-incident state.

backup and restorage methods will be based on data value, sensitivity, classification, and retention requirements.

92
Q

4 Actions related to CIS Control 11: Data Recovery

A

automating back-up process, off site storage and encryption. These should be tested once per quarter - restore using test bed environment

93
Q

4 CIS Control 12: Network Infrastructure Management

A

procedures and tools for managing and securing a company’s network infrastructure (both physical/virtual devices - firewall, gateways routers, switches, wireless access points).

94
Q

4 Actions for CIS Control 12: Network Infastructure Management

A

network architecture documenation/diagrams should be kept up to date to reflect network topology and layout

Should include critical vendor contract info to increase likelihood for upgrade/patches timely,

Monitor for end of life network components to make upgrades or mitigating controls

Continuously identify and remediate insecure default network config settings, misconfig network, insecure protocol usage, outdated network software

95
Q

4 CIS Control 13: Network Monitoring and Defense

A

Processes for monitoring and defending network infrastructure against threats.

96
Q

4 Denial of Service

A

ways networks are attacked.

DoS - gain access to network and overloading it with traffic so it is rendered useless.

97
Q

How to defend DoS and Ransomware

A

Establish event logging and alerting mechanisms tools such as security info and event management (SIEM) to help centralize and assist in log analysis.

Traffic flow monitoring, alerting and detection safeguards can also be implemented (network intrusion prevention system, next-gen firewall, data loss prevention end point detection systems)

98
Q

4 CIS Control 14: Security Awareness and Skills Training

A

guides in establishing security awareness and training program to reduce cybersecurity risk.

99
Q

4 CIS Control 15: Service Provider Management

A

Develop processes to evaluate 3rd party service providers that have access to data or manage IT functions.

100
Q

4 Actions for CIS Control 16: Service Provider Management

A

Processes to oversees service provider life cycle

Providers should be assessed and their performance and standards catalogued from initial engagement through decommissioning for adherence to security standards, protocols, and best practices. SOC audit reports can be used.

101
Q

4 CIS Control 16: Application Software Security

A

Safegaurds that manage the entire life cycle of software that is aquired, hosted or developed to detect, deter and resolve cybersecurity weaknesses before they are exploited.

102
Q

Types of software vulnerabilities

A

Buffer overflows,
corss site scripting - xxs inject content and code into a website to take over
Sql injections - sql query to extract or corrupt data
race conditions - two apps share the same data, race to get data first

103
Q

CIS Control 16: Application Software Security - ACTIONS

A

Consider if best practices/safegaurds are followed (secure design standards, secure code reviews, security testing tools)

introuce application security as early as possible

process in place to inventory 3rd party components, tools, and apps (ensuring software up to date, configurations are reviewed, compensating controls for attach mitigation) SAAS can be an weak spot

can implemenet bug bounty programs

104
Q

4 CIS Control 17: Incident Response Management

A

Establish incident response management program to detect, respond, and prepare for cybersecurity attacks.

105
Q

4 Actions for CIS Control 17: Incident Response Management

A

-Designation of key contact,
- establishment of incident response team
-development of communications plans for notifying impacted business units, stakeholders, and regulatory agencies.
-Exercises/test the incident response process

106
Q

4 CIS Control 18: Pentration Testing

A

Test sophistication of cybersecurity defense system in place by simulating attacks in an effort to find and exploit weaknesses.

Begins with discovery or observation of env., followed by scans to find vulnerablities that can gain access, results are studied, revise controls - at least annually for large orgs w/ significant risks

107
Q

5 Control Objectives for Information and Related Technologies (COBIT)

A

-ISACA developed
-Most widely used IT governance standards
-Provides a roadmap to implement best practices for IT governance and management

108
Q

5 COBIT Governance Stakeholders

A

-Governance - BOD

-Management - daily planning/admin of operations CEO, CFO, COO

-Internal Stakeholders - BOD/MGMT, managers, assurance providers, RM

  • External stakeholders - regulators, investors, business partners
109
Q

What is the COBIT core model?

A

Formed by princples, standards and regulations (Cobit 5, 6 principals for governance systems 3 principals of governance framework, community collabor, regs)

The core model can be customized through design factors and focus areas to arrive at a enterprise governance system.

There are Framework guides (Intro/Methodology and governance and mgmt objecgices) a Design guide and implemenation guide that can be refernced.

110
Q

5 COBIT - 6 Principles for Goverance System

A

VHDDTE (very healthy diet do try everything)
1. Provide Stakeholder VALUE
2. HOLISTIC Approach
3. DYNAMIC Governance System
4. Governance DISTINCT From Management
5. TAILOR Enterprise Needs
6. END to END Governance System

111
Q

COBIT Principal for Governance System

  1. Provide Stakeholder Value
A

governance system should create value for stakeholders by balancing benefits, risks, and resources through well designed governance system with actionable strategy.

112
Q

COBIT Principal for Governance System

  1. Holistic Approach
A

governance systems for IT can comprise diverse components, collectively providing an holistic model (18 CIS controls)

113
Q

COBIT Principal for Governance System

  1. Dynamic Governance System
A

When a change in one governance system occurs, the impact on all others should be considered so they system continues to meet demands - system that is dynamic enough that it can be relevant while adjusting

114
Q

COBIT Principal for Governance System

  1. Governance Distinct from Mgmt
A

Management activites and governance systems should be clearly distinguished from each other as they have different functions

115
Q

COBIT Principal for Governance System

  1. Tailored to Enterprise Needs
A

Customized to each company, using design factors to prioritize and tailor the system. No one size fits all.

116
Q

COBIT Principal for Governance System

5.End to End Governance System

A

More than just the IT function should be considered - all processes involving information and technology should be factored.

117
Q

5 COBIT - 3 Principals for Governance Framework

  1. Based on Conceptual Model
A

Should identify key components and relationships between those components to provide for greater automation and max consistency.

118
Q

5 COBIT - 3 Principals for Governance Framework

  1. Open and Flexible
A

Ability to change adding relevant content and removing irrelevant content, while keeping consistency and integrity.

119
Q

5 COBIT - 3 Principals for Governance Framework

  1. Aligned to major standards
A

align with regulations, frameworks, and standards

120
Q

5 COBIT Core Model - Governance Objectives

A

Responsibility of BOD
Evaluate, direct, monitor - evaluate strategic objectives, direct management to achieve those objectives, and monitor if they are being met.
1. Ensuring benefits delivery
2. governance framework setting
3. risk optimizatoin
4. resource optimization
5. stakeholder engagement

121
Q

5 COBIT Core Model - Management Objectives 4 Domains

  1. Align Plan and Organize
A

Focus on aligning technology’s overall strategy, planning how to utilize technology in business operations, organizing resources for most efficient and effective usage.

Managed data is one of the most significant objectives

Things such as: IT infrastructure, budgeting, HR, vendors, quality, security, managing risk.

122
Q

5 COBIT Core Model - Management Objectives 4 Domains

Build Acquire Implement

A

building, acquiring, and Implementation of IT solutions in business processes

11 objectives on requirements definitions, ID solutions, managing capacity, dealing with org and IT change, managing knowledge, administering assets, managing configuration

123
Q

5 COBIT Core Model - Management Objectives 4 Domains

Deliver, Services Support

A

Address the delivery, service, and support of IT services. 6 objectives cover managed operations, service requests, managed problems, continuity, security services, business process controls.

124
Q

5 COBIT Core Model - Management Objectives 4 Domains

Monitor Evaluate Assess

A

address IT conformance with performance targets and control objectives w/ external requirements : managed performance,

Through continuous monitoring, evaluations and assessments
of IT systems, controls and components.

125
Q

5 Components of Governance System define

A

factors collectively or individually contribute to successful execution of governance system over IT and systems.

126
Q

What 7 components satisfy COBIT 19 core model management and governance objectives?

A
  1. Process - activities to ach. overall tech goals
  2. Org Structure - decision making entities in org
  3. principals, policies, and frameworks - guidance to turn desired behavior into practice
  4. information -
  5. cultuer, ethics, behavior
  6. people skills and competencies
  7. service infrastructure and applications
127
Q

5 COBIT Design Factors

A

Influence design of IT governance system, 11 factors

128
Q

5 COBIT Design Factor - Enterprise Stategy

A

primary and secondary strategy like growth and acquisition, innovation/differentiation, cost leadership strategies, and client service/stability strategies

129
Q

5 COBIT Design Factor - Enterprise Goal

A

goals support the strategy and are structured based on the balance scorecard dimensions (which are financial, customer, interal, and growth)

130
Q

5 COBIT Design Factor - Risk Profile

A

addresses current risk exposure and maps which risks exceed appetite - risks include IT operational incidents, software adoption and usage problems, noncompliance, tech-based innovation, and geopolitical issues

131
Q

5 COBIT Design Factor - IT Issues

A

regular IT audit findings of poor IT quality or controls, insufficient IT resources, frustration between IT and departments, hidden IT spending, problems with data quality, noncompliance w/ regs.

132
Q

5 COBIT Design Factor - Threat Lanscape

A

Environment in which company operates - classified as normal or high due to geopolitical issues, industry, or economic issues.

133
Q

5 COBIT Design Factors - Compliance Requirements

A

Compliance demands can be low (minimal demands), normal (typical for the industry), or high

134
Q

5 COBIT Design Factors - Role of IT - Support

A

system not critical for operating or maintain business

135
Q

5 COBIT Design Factors - Role of IT - Factory

A

immediate impact on business ops and continuity if fails

136
Q

5 COBIT Design Factors - Role of IT - Turnaround

A

drives innovation but not required for critical business ops

137
Q

5 COBIT Design Factors - Role of IT - Stategic

A

crucial for both innovation and business ops

138
Q

5 COBIT Design Factor - Sourcing Model for IT

A

type of IT procurement model from outsources to cloud to built in house or hybrid

139
Q

5 COBIT Design Factor - IT Implementation Methods

A

methods to implement new IT projects - agile, DevOps, traditional waterfall or hybrid

140
Q

5 COBIT Design Factor - Tech Adoption Strategy - First Mover

A

emerging technologies adopted as soon as possible to gain edge

141
Q

5 COBIT Design Factor - Tech Adoption Strategy - Follower

A

emerging technologies adopted after proven

142
Q

5 COBIT Design Factor - Tech Adoption Strategy - Slow Adopter

A

very late to adopt new technologies

143
Q

5 COBIT Design Factor - Enterprise Size

A

Large - FT count > 250 , small/medium with 50-250 FT.

ICS 1 (1 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions