Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Information Security > Information Assurance > Flashcards

Information Assurance Flashcards

1
Q

is data endowed with relevance and purpose

A

Information

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Useful characteristics that the information should possess

A

Timely
Accurate
Complete
Verifiable
Consistent
Available

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

the following are all aspects of
system quality:

A

functionality
adequacy
interoperability
correctness
security
reliability
usability
efficiency
maintainability
portability

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

what characteristics should information possess to be useful?

A

accurate,
timely,
complete,
verifiable,
consistent,
available

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

all distinct
conceptual resources:

A

Noise
Data
Information
Knowledge

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

raw facts with an unknown coding system

A

Noise

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

raw facts with a known coding system

A

Data

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

processed data

A

Information

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

: accepted facts, principles, or rules of thumb that are
useful for specific domains. Knowledge can be the
result of inferences and implications produced from
simple information facts.

A

Knowledge

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Actions taken that protect and defend information and
information systems by ensuring their availability,
integrity, authentication, confidentiality and
non-repudiation. This includes providing for restoration
of information systems by incorporating protection,
detection and reaction capabilities.

A

IA

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

is the study of how to protect your
information assets from destruction, degradation, manipulation and
exploitation. But also, how to recover should any of those happen.
Notice that it is both proactive and reactive.

A

Information Assurance

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

According to the DoD definition, these are some aspects of
information needing protection:

A

Availability
Integrity
Confidentiality
Authentication
Non-repudation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

assurance that the sender is provided with proof
of a data delivery and recipient is provided with proof
of the sender’s identity, so that neither can later deny
having processed the data.

A

Non-repudiation:

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

security measures to establish the validity of a
transmission, message, or originator.

A

Authentication:

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

assurance that information is not disclosed to
unauthorized persons;

A

Confidentiality:

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

protection against unauthorized modification or
destruction of information;

A

Integrity:

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

timely, reliable access to data and information
services for authorized users;

A

Availability:

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

According to Debra Herrmann (Complete Guide to Security and
Privacy Metrics), IA should be viewed as spanning four security
engineering domains:

A

physical security
personnel security
IT security
operational security

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

The simple truth is that IT security cannot be
accomplished in a vacuum, because there are a multitude
of dependencies and interactions among all four security
engineering domains

A

(Herrmann, p. 10

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

refers to the protection of hardware, software,
and data against physical threats to reduce or prevent disruptions
to operations and services and loss of assets.

A

“Physical security

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

is a variety of ongoing measures taken to
reduce the likelihood and severity of accidental and intentional
alteration, destruction, misappropriation, misuse, misconfiguration,
unauthorized distribution, and unavailability of an organization’s
logical and physical assets, as the result of action or inaction by
insiders and known outsiders, such as business partners.”

A

“Personnel security

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

is the inherent technical features and functions that
collectively contribute to an IT infrastructure achieving and
sustaining confidentiality, integrity, availability, accountability,
authenticity, and reliability.

A

“IT security

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

involves the implementation of standard
operational security procedures that define the nature and
frequency of the interaction between users, systems, and system
resources, the purpose of which is to
1 achieve and sustain a known secure system state at all times,
and
2 prevent accidental or intentional theft, release, destruction,
alteration, misuse, or sabotage of system resources.”

A

Operational security

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

According to Raggad’s taxonomy of information security, a
computing environment is made up of five continuously interacting
components:

A

activities,
people,
data,
technology,
networks.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

According to Blyth and Kovacich, IA can be thought of as
protecting information at three distinct levels:

A

Physical
Information Infrastructure
perceptual

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

knowledge and understanding in human decision
space.

A

perceptual

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

data and data processing activities in physical space;

A

Physical

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

information and data manipulation
abilities in cyberspace;

A

information infrastructure:

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

The lowest level focus of IA , computers,
physical networks, telecommunications and supporting systems
such as power, facilities and environmental controls. Also at this
level are the people who manage the systems.

A

Physical Level

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

The second level focus of IA,
This covers information and data manipulation ability maintained
in cyberspace, including: data structures, processes and programs,
protocols, data content and databases

A

information structure level

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

The third level focus of IA, also called social
engineering. This is abstract and concerned with the management
of perceptions of the target, particularly those persons making
security decisions.

A

perceptual level,

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

COMPSEC

A

computer security

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

COMSEC

A

communications and network security;

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

ITSEC: (which includes both COMPSEC and COMSEC);

A

Information Technology Security Evaluation Criteria

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

OPSEC

A

operations security

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

An
attacker on any information system will use
the simplest means of subverting system
security.

A

Principle of Easiest Penetration

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

The flip side of Information Assurance

A

Information Warfare (IW)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

involves managing an opponent’s perception through
deception and psychological operations. In military circles,
this is called Truth Projection

A

Type 1

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

involves denying, destroying, degrading, or distorting
the opponent’s information flows to disrupt their ability to
carry out or co-ordinate operations.

A

Type II

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
40
Q

gathers intelligence by exploiting the opponent’s use
of information systems.

A

Type III

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
41
Q

the offensive players in the world of IW come in six
types:

A

Insider
Hacker
Criminals
Corporations
Governments and agencies
Terrorists

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
42
Q

usually politically motivated and may seek to cause
maximal damage to information infrastructure as well
as endanger lives and property.

A

Terrorists

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
43
Q

seek the military, diplomatic, and
economic secrets of foreign governments, foreign
corporations, and adversaries. May also target
domestic adversaries.

A

Governments and agencies

44
Q

target information that may be of value to them:
bank accounts, credit card information, intellectual
property, etc.

A

Criminals:

45
Q

actively seek intelligence about competitors or steal
trade secrets.

A

Corporations

46
Q

consists of employees, former employees and
contractors.

A

Insiders

47
Q

one who gains unauthorized access to or breaks into
information systems for thrills, challenge, power, or
profit

A

Hackers

48
Q

While experts may disagree on the definition of cyber
war, there is significant evidence that nations around the
world are developing, testing and in some cases using or
encouraging cyber means as a method of obtaining
political advantage.

A

–McAfee Virtual Criminology Report
2009

49
Q

A plausible worst-case worm could cause $50 billion or
more in direct economic damage by attacking widely used
services in Microsoft Windows and carrying a highly
destructive payload.”

A

–Nicholas Weaver and Vern
Paxson, 6/14/04

50
Q

America’s failure to protect cyberspace is one of the most
urgent national security problems facing the new
administration that will take office in January 2009. … It
is a battle we are losing. Losing this struggle will wreak
serious damage on the economic health and national
security of the United States.

A

–CSIS report on Securing
Cyberspace for the 44th Presidency, Dec. 2008

51
Q

Note that IA is both proactive and reactive involving:

A

: protection,
detection, capability restoration, and response

52
Q

“ensure the availability,
integrity, authenticity, confidentiality, and non-repudiation of
information”

A

IA environment protection pillars:

53
Q

“timely attack detection and reporting is
key to initiating the restoration and response processes.”

A

Attack detection:

54
Q

“relies on established procedures and mechanisms for
prioritizing restoration of essential functions. Capability
restoration may rely on backup or redundant links, information
system components, or alternative means of information
transfer.”

“A post-attack analysis should be conducted to determine the
command vulnerabilities and recommended security
improvements.

A

Capability restoration:

55
Q

“involves determining actors and their
motives, establishing cause and complicity, and may involve
appropriate action against perpetrators… contributes … by
removing threats and enhancing deterrence.”

A

Attack response

56
Q

If adversaries intended to attack nations in cyber space,
they would select targets which would cause the largest
impacts and losses to their opponents with the least
effort. It is therefore a very reasonable assumption that
adversaries would attack critical infrastructure systems
via the Internet. –

A

–McAfee Virtual Criminology Report
2009, p. 16

57
Q

“worldwide interconnection
of communication networks, computers, databases, and
consumer electronics that make vast amounts of information
available to users.”

A

Global Information Infrastructure:

58
Q

those within or serving
the U.S., for government, commerce and research

A

National Information Infrastructure:

59
Q

those within or serving
the DoD (e.g. nodes on SIPRNET and NIPRNET)

A

Defense Information Infrastructure:

60
Q

Civilian systems are “essential to the minimum operations o
f
the economy and government”
Examples: telecommunications, energy, banking,
transportation and emergency services

A

Presidential Decision Directive (PDD-63) of 1998

61
Q

is the resource being protected,

A

Physical assets
Logical assets
system assets

62
Q

devices, computers,
people

A

Physical Assets

63
Q

: information, data (in
transmission, storage, or processing), and
intellectual property;

A

Logical Assets

64
Q

any software, hardware,
data, administrative, physical,
communications, or personnel resource
within an information system

A

System assets

65
Q

Often a security solution/policy is phrased in terms of the following
three categories:

A

Objects
Subjects
Actions

66
Q

: the items being protected by the system (documents,
files, directories, databases, transactions, etc.)

A

Objects

67
Q

entities (users, processes, etc.) that execute activities
and request access to objects.

A

Subjects

68
Q

operations, primitive or complex, that can operate on
objects and must be controlled

A

Actions

69
Q

is the possibility that a particular threat
will adversely impact an information system by
exploiting a particular vulnerability. The
assessment of risk must take into account the
consequences of an exploit.

A

Risk

70
Q

is a process for an
organization to identify and address the risks
in their environment.

A

Risk management

71
Q

is the implementation (policy,
procedures, technology) of the security effort within an
organization.

A

security posture or security profile

72
Q

is a type of consequence, involving
accidental exposure of information to an agent not authorized
access.

A

Inadvertant disclosure

73
Q

is the outcome of an attack. In a purposeful threat,
the threat actor has typically chosen a desired consequence for the
attack, and selects the IA objective to target to achieve this.

A

consequence

74
Q

targets availability

A

Disruption

75
Q

targets integrity

A

Corruption

76
Q

targets confidentiality

A

Exploitation

77
Q

is an instance when the system is vulnerable to attack.

A

Exposure

78
Q

is a situation in which the attacker has succeeded.

A

compromise

79
Q

is a recognized action—specific, generalized or
theoretical—that an adversary (threat actor) might be expected to
take in preparation for an attack.

A

indicator

80
Q

is an attempt to gain access, cause damage to or
otherwise compromise information and/or systems that support it.

A

Attack

81
Q

an attack in which the attacker observes
interaction with the system.

A

Passive attack

82
Q

at attack in which the attacker directly interacts
with the system.

A

Active attack

83
Q

an attack where there is not a deliberate
goal of misuse

A

Unintentional attack

84
Q

the active entity, usually a threat actor, that
interacts with the system.

A

Attack subject

85
Q

the targeted information system asset.

A

Attack object:

86
Q

is the set of ways in
which an adversary can enter the system and potentially caus
e
damage

A

attack surface

87
Q

is an instance when the system is vulnerable to attack

A

Exposure

88
Q

is a situation in which the attacker has succeeded.

A

compromise

89
Q

is a recognized action—specific, generalized or
theoretical—that an adversary (threat actor) might be expected to
take in preparation for an attack.

A

indicator

90
Q

is one for which there is no known threat
(vulnerability is there but not exploitable).

A

dangling vulnerability

91
Q

is one that does not pose a danger as there is no
vulnerability to exploit (threat is there, but can’t do damage).

A

dangling threat

92
Q

is a weakness or fault in a system that exposes
information to attack.

A

vulnerability

93
Q

is a method for taking advantage of a known
vulnerability

A

exploit

94
Q

is a collection of computing environments connected by
one or more internal networks under the control of a single
authority and security policy, including personnel and physical
security.

A

enclave

95
Q

is a nonhostile environment that may be
protected from external hostile elements by physical, personnel,
and procedural countermeasures.

A

benign environment

96
Q

for assets is one that has known threats.
Example: locating an asset in a war zone or a flood zone, or
placing an unprotected machine on the Internet.

A

hostile environment

97
Q

is a specific instance of a threat, e.g. a specific
hacker, a particular storm, etc.

A

threat actor

98
Q

is a category of entities, or a circumstance, that poses a
potential danger to an asset (through unauthorized access,
destruction, disclosure, modification or denial of service).

A

threat

99
Q

is the process by which an asset is managed from its
arrival or creation to its termination or destruction.

A

lifecycle

100
Q

is a generic term that implies a mechanism in place to
provide a basis for confidence in the reliability/security of the
system.

A

Trust

101
Q

are the security features of a system that
provide enforcement of a security policy

A

Trust mechanisms

102
Q

is a collection of all the trust
mechanisms of a computer system which collectively enforce the
policy.

A

trusted computing base (TCB)

103
Q

is a measure of confidence that the security features,
practices, procedures, and architecture of a system accurately
mediates and enforces the security policy

A

Assurance

104
Q

risks not avoided or transferred are retained by
the organization. E.g. sometimes the cost of
insurance is greater than the potential loss.
Sometimes the loss is improbable, though
catastrophic.

A

Risk acceptance

105
Q

not performing an activity that would incur risk.
E.g. disallow remote login.

A

Risk avoidance

106
Q

taking actions to reduce the losses due to a risk;
many technical countermeasures fall into this
category

A

Risk mitigation:

107
Q

: shift the risk to someone else. E.g. most insurance
contracts, home security systems

A

Risk transfer

Information Security (1 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions