Information Governance and Risk Management Flashcards
Availability
Reliable and timely access to data and resources is provided to authorized individuals.
Integrity
Accuracy and reliability of the information and systems are provided and any unauthorized modification is prevented.
Confidentiality
Necessary level of secrecy is enforced and unauthorized disclosure is prevented.
Shoulder Surfing
Viewing information in an unauthorized manner by looking over the shoulder of someone else.
Social Engineering
Gaining unauthorized access by tricking someone into divulging sensitive information.
What is the triad of security?
C.I.A. - Confidentiality, Integrity, Availability
Vulnerability
Weakness or a lack of a countermeasure
Threat Agent
Entity that can exploit a vulnerability
Threat
The danger of a threat agent exploiting a vulnerability.
Risk
The probability of a threat agent exploiting a vulnerability and the associated impact.
Control
Safeguard that is put in place to reduce risk, also called a countermeasure.
Exposure
Presence of a vulnerability, which exposes the organization to a threat.
What are the main categories/types of security controls?
Administrative, Technical (or Logical) and Physical
What are the different functionalities of security controls?
Preventative, Detective, Corrective, Deterrent, Recovery and Compensating.
Deterrent Control
Discourage a potential attacker.
Intended to discourage a potential attacker
Preventative Control
Stop an incident from occurring.
Intended to avoid an incident from occurring
Corrective Control
Fix items after an incident has occurred.
Fixes components or systems after an incident has occurred.
Recovery Control
Restore necessary components to return to normal operations.
Intended to bring the environment back to regular operations.
Detective Control
Identify an incidents activities after it took place.
Helps identify an incidents activities and potentially an intruder
Compensating Control
Alternative control they provides similar protection as the original control.
Controls that provide an alternative measure of control.
Vulnerability
Weakness or a lack of a countermeasure
Defense-In-Depth
Implementation of multiple controls so that successful penetration and compromise is more difficult to attain.
