Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

3RD YEAR - SECOND SEM > Information Security 1 > Flashcards

Information Security 1 Flashcards

1
Q

5 Pillars of Information Assurance

A
  1. Integrity
  2. Availability
  3. Confidentiality
  4. Authentication
  5. Non repudiation
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

role of information assurance

A

to protect and defend information and information systems

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

integrity

A

assurance that information is not tampered with

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

authentication

A

assuring those who have access in information, are they say who they are

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

availability

A

timely, reliable access to data for authorized users

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

confidentiality

A

assurance that information is not disclosed to unauthorized persons

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

non repudiation

A

someonewith access to your organizations
information system cannot deny having
completed an action within the system, as
there should be methods in place to prove
that they did make said action.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

2011-2016 National Security

A

It is to ensure the permanent inviolability of our national territory and its effective control by the Government and the State.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Republic Act No. 8792

A
  • recognizes use of electronic commercial and non-commercial transactions and electronic signature
  • legal recognition to electronic data messages, electronic documents and electronic signatures
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

REPUBLIC ACT NO. 9995

A

protects the victims who are made to believe that they are performing sexual acts in private

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Republic Act No. 10173

A

aims to protect personal data in information and communications systems both in the government and the private sector

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

REPUBLIC ACT NO. 9775

A

“Child” refers to a person below eighteen (18) years of age or over but is unable to fully take care of, or protect, himself/herself from abuse, neglect, cruelty, exploitation or discrimination because of a physical or mental disability or condition.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Republic Act No. 10175

A

completely address crimes committed against and by means of computer system

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q
  • prevents negligence
  • the development and implementation of
    policies and procedures to aid in performing the ongoing maintenance necessary to keep an information assurance process operating properly to protect assets and peoplefrom threats.
A

due care

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

due care

A

development and implementation of policies and procedures to did in performing the ongoing maintenance necessary to keep information assurance process operating properly to protect assets and people from threats

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

due diligence

A

is the reasonable investigation, research, and understanding of the risks an organization faces
before committing to a particular course of action. The organization should do its homework and ensure
ongoing monitoring.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Implications from lack of AI

A
  1. penalties from legal authorities
  2. loss of information assets
  3. customer loss
  4. loss of image and reputation
  5. operational losses and operational risk management
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

information assurance fundamental expectations and common beliefs

A
  1. be a business enabler
  2. protect interconnecting element of an organization’s systems
  3. be cost effective and cost benefitial
  4. establish responsibility and accountability
  5. require robust method
  6. be assessed periodically
  7. be restricted by social obligations
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

includes all information an organization may process, store, transmit, or disseminate regardless of media. Thus, information on paper, on a hard drive, in the mind of an employee, or in the cloud is considered to be “in scope.”

A

Information assurance

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

INFORMATION ASSURANCE AND SECURITY
PARTNER AGENCIES

A
  1. DOST ICT Office
  2. National Security Agency (NSA)
  3. National Bureau of Investigation (NBI) -Cybercime
    Division
  4. Philippine National Police
  5. DOJ Office of Cybercrime
  6. Data Privacy Commission
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Memorandum Order No. 37, s. 2001

A

PROVIDING FOR THE FOURTEEN PILLARS OF POLICY AND ACTION OF THE GOVERNMENT AGAINST TERRORISM

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Administrative Order No. 39, s. 2013

A

MANDATING GOVERNMENT AGENCIES TO MIGRATE TO THE GOVERNMENT WEB HOSTING SERVICE (GWHS) OF THE DEPARTMENT OF SCIENCE AND TECHNOLOGY-INFORMATION AND COMMUNICATIONS TECHNOLOGY OFFICE (DOST-ICTO)

23
Q

Executive Order No. 810, s. 2009

A

INSTITUTIONALIZING THE CERTIFICATION SCHEME FOR DIGITAL SIGNATURES AND DIRECTING THE APPLICATION OF DIGITAL SIGNATURES IN E-GOVERNMENT SERVICES

24
Q

ISO/IEC 27001:2005

A

specifies the requirements for establishing, implementing, operating, monitoring, reviewing, maintaining and improving a documented Information Security Management System within the context of the organization’s overall business risks.

25
Q

PNS ISO/IEC 27002:2005

A

(Information technology — Security techniques — Code of practice for information security management)

26
Q

Laws/Policies/Standards in force relating to cyber/information security (Abstract or summary of each document with URL pointing to authoritative source)

A
  1. 2011-2016 National Security Policy
  2. R.A. 8792 (E-Commerce Act)
  3. R.A. 9775 (Anti-Child Pornography Act of 2009)
  4. R.A. 9995 (Anti-Photo and Video Voyeurism Act of 2009)
  5. R.A. 10173 (Data Privacy Act of 2012)
  6. R.A. 10175 (Cybercrime Prevention Act of 2012)
  7. M.O. 37, s2001 (Providing for the Fourteen Pillars of Policy and Action of the Government Against Terrorism – critical infrastructure is defined in this document and requires the preparation of a comprehensive security plan [1][a] above)
  8. E.O. 810, s2009 (Institutionalizing the Certification Scheme for Digital Signature)
  9. A.O. 39, s2013 (Government Web hosting Service of DOST ICT Office
  10. PNS ISO/IEC 270001:2005 (Information technology — Security techniques — Information security management systems – Requirements)
  11. PNS ISO/IEC 27002:2005 (Information technology — Security techniques — Code of practice for information security management)
27
Q

STRATEGIES OF INFORMATION ASSURANCE

A
  1. COMPREHENSIVE
  2. INDEPENDENT
  3. LEGAL AND REGULATORY REQUIREMENTS
  4. LIVING DOCUMENT
  5. LONG LIFE SPAN
  6. CUSTOMIZABLE AND PRAGMATIC
  7. RISK-BASED APPROACH
  8. ORGANIZATIONALLY SIGNIFICANT
  9. STRATEGIC, TACTICAL, AND OPERATIONAL
  10. CONCISE, WELLSTRUCTURED, AND EXTENSIBLE
28
Q

COMPREHENSIVE

A

programs should cover topics, areas, and domains needed for modern organizations. Each topic, domain, and area within a policy should contain sufficient breadth and detail to support strategic, tactical, and operational implementation

29
Q

A strategy should contain independent contents and perspectives related to the defined mission. Organizations are various sizes and use products and services from vendors

A

INDEPENDENT

30
Q

must be consistent with existing laws and regulations
applicable to but not limited to information assurance, human resources, healthcare, finance, disclosure, internal control, and privacy within the organizational context.

A

LEGAL AND REGULATORY
REQUIREMENTS

31
Q

organizations benefit from updated written policies,
procedures guidance, and standards to direct
operations. Organizations should use the ideas,
concepts, and approach outlined in this work to keep
their own policies, procedures, standards, and
practices up to date.

A

LIVING DOCUMENT

32
Q

To increase the value and relevance of an organization’s information assurance strategy, the strategy must focus on the fundamentals of information assurance that remain constant over time

A

LONG LIFE SPAN

33
Q

Organizations should adopt and adapt their tactical and operational plans to reflect identified organizational information assurance requirements and risk profiles.

A

CUSTOMIZABLE AND
PRAGMATIC

34
Q

must be broad enough to give guidance to subcomponents with diverse risk profiles. This is analogous to risk portfolio approaches in finance

A

RISK-BASED APPROACH

35
Q

should be considered significant in an organization’s strategy and ongoing operations, and it is a significant investment and area of concern for any organization.

A

ORGANIZATIONALLY
SIGNIFICANT

36
Q

provides a framework to assist senior managers
and executives in making strategic (long-term)
planning and decisions.

A

STRATEGIC, TACTICAL,
AND OPERATIONAL

37
Q

The structure and contents of the organization’s
information assurance strategy should
demonstrate high cohesion and low coupling.

A

CONCISE, WELL-STRUCTURED, AND EXTENSIBLE

38
Q

Security Controls for IA

A
  1. PROTECTION OF CRITICAL AND SENSITIVE ASSETS
  2. COMPLIANCE TO REGULATIONS AND CIRCULARS/LAWS
  3. MEETING AUDIT AND COMPLIANCE REQUIREMENTS
  4. PROVIDING COMPETITIVE ADVANTAGE
39
Q

Prior to implementing security controls, an
organization must identify the critical business
processes and value of the associated assets

A

PROTECTION OF CRITICAL AND
SENSITIVE ASSETS

40
Q

the organization is required to analyze how the
requirements can be addressed without compromising the policies and procedures already available within the organization.

A

COMPLIANCE TO REGULATIONS AND
CIRCULARS/LAWS

41
Q

is a process that checks and verifies compliance with
generally accepted standards, a particular
regulation, or a specific requirement

A

MEETING AUDIT AND COMPLIANCE
REQUIREMENTS

42
Q

Frequently, individuals fail to recognize that
information assurance is a competitive advantage.
Organizations with proactive controls stay competitive and survive longer.

A

PROVIDING COMPETITIVE
ADVANTAGE

43
Q

DEFENSE IN DEPTH

A

cannot be expected torespond to unknown and potentially urgent risk situations such as last-minute patches and catch-up planning, but it can reduce the
impact of such weaknesses

44
Q

SIX CHARACTERISTICS-OF A
DEFENSE-IN-DEPTH STRATEGY

A
  1. Self-organizing
  2. Adapting to unpredictable situations
  3. Evolving in concert with an ever-changing environment
  4. Reactively resilient
  5. Proactively innovative
  6. Harmonious with system purpose
45
Q

INFORMATION ASSET LIFE CYCLE

A
  1. create
  2. process
  3. use of transmission
  4. retain
  5. dispose
46
Q

PLAN-DO-CHECK-ACT MODEL

A
  • demonstrates the process of managing security throughout the life cycle
  • includes implementation of continuous improvement process to attain an effective information management system
47
Q

Boyd’s OODA Loop

A

Observe
Orient
Decide
Act

48
Q

Boyd’s OODA Loop ORIENT

A

this step is designed to weed out bias and includes areas such as genetic heritage, cultural tradition, and previous experiences

48
Q

Boyd’s OODA Loop OBSERVE

A

gather raw information about the situation at hand. be as accurate and thorough as possible

49
Q

Boyd’s OODA Loop DECIDE

A

based on output of orientation, a decision is made to act

50
Q

Boyd’s OODA Loop ACT

A

the action is performed

51
Q

THE KILL CHAIN

A

US millitary targeting doctrine describes the kill chain as find, track, target, engage, and assess (FT2TEA)

51
Q

Organizations and institutions exist to train and equip security professionals

A
  1. The International Information System Security Certification Consortium (ISC)2
  2. The Computing Technology Industry Association (CompTIA)
  3. Information System Audit and Control Association (ISACA)
  4. Information System Security Association (ISSA)
  5. SysAdmin, Audit, Network and Security (SANS)
  6. Disaster Recovery Institute, International (DRII)
  7. Business Continuity Institute (BCI)
52
Q

PROFESSIONAL CERTIFICATIONS

A

3RD YEAR - SECOND SEM (25 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions