Information Security Governance Flashcards
Core Goals of Security
CIA
Availability
Integrity
Confidentiality
Vulnerability
Weakness or lack of countermeasure
Threat agent
Entity that can exploit a vulnerability
Threat
The danger of a threat agent exploiting a vulnerability
Risk
The probability of a threat agent exploiting a vulnerability and the associated impact
Control
Safeguard that is put in place to reduce risk, also called a countermeasure
Exposure
Presence of a vulnerability, which exposes the organization to a threat
Availability
Reliable and timely data access to authorized individuals
Integrity
Accuracy and reliability of the information
Confidentiality
Necessary level of secrecy is enforced
Deterrent Control Function
Intended to discourage a potential attacker
Preventative Control Function
Intended to avoid an incident from occurring
Corrective Control Function
Fixes components or systems after an incident has occurred
Recovery Control Function
Intended to bring the environment back to regular operations
Detective Control Function
Helps identify an incident’s activities and potentially an intruder
Compenstating Control Function
Controls that provide an alternate measure of control
Control Types
Administrative, Technical, Physical
Defense-In-Depth
Implementation of multiple controls so that successful penetration and compromise is more difficult to attain
Security through obscurity
Assuming that your enemies are not as smart as you are and they cannot figure out something that you feel is very tricky
Zachman Architecture Framework
One of the first enterprise architecture frameworks that is a 2d mode consisting of what, how, where, who, when, why.
The Open Group Architecture Framework (TOGAF)
DOD enterprise architecture framework consisting of business, data, applications, and technology descending levels of possible architecture frameworks
Department of Defense Architecture Framework (DoDAF)
Military framework consisting of command, control, communications, computers, intelligence, surveillance, and reconnaissance categories
British Ministry of Defense Architecture Framework (MODAF)
A military framework based on DoDAD that focuses on compatible data formats and expedited delivery to those who need it
British Ministry of Defense Architecture Framework (MODAF)
A military framework based on DoDAD that focuses on compatible data formats and expedited delivery to those who need it
Enterprise security architecture
Subset of an enterprise architecture and defines the information security strategy that consists of layers of solutions, processes, and procedures and the way they are linked across an enterprise strategically, tactically, and operationally
Enterprise security architecture
Subset of an enterprise architecture and defines the information security strategy that consists of layers of solutions, processes, and procedures and the way they are linked across an enterprise strategically, tactically, and operationally
ISMS
Information Security Management System
Strategic alignment
Business drivers and regulatory and legal requirements are being met by the security enterprise architecture
Business enablement
The core business processes are integrated into the security operating model
Process enhancement
We can do stuff better
Security effectiveness
Metrics measuring performance
CobiT
Control objectives for information and related technology
NIST 800-53
Control objectives for government systems
COSO IC framework
Committee Of Sponsoring Organizations Internal Control - model for corporate governance; derived COBIT
ITIL
Information Technology Infrastructure Library - de facto standard of best practices for IT service management
Six Sigma
Process improvement methodology developed by Motorola using statistical methods of measuring operational efficacy by assigning a sigma rating.
CMMI
Capability Maturity Model Integration - model defining incremental security improvement developed by Carnegie Mellon
Top-down Approach
Implement a security program from top management down. Typically more effective than bottom-up.
Bottom-Up Approach
Implement a security program from IT up without buy in from management. Typically less effective than top-down.
