Information Security Management Principles_learner_stats_20121120

Question 1

Information Security - Confidentiality

Answer 1

The property that information is not made available or disclosed to unauthorised individuals, entities or processes (ISO 13335)

Question 2

Information Security - Integrity

Answer 2

The property of safeguarding the accuracy and completeness of assets (ISO 13335)

Question 3

Information Security - Availability

Answer 3

The property of being accessible and usable upon demand by an authorised entity (ISO 13335)

Question 4

Assets & Asset Types - Asset Definition

Answer 4

Anything that has valve to the organisation, its business operations and its continuity (ISO 13335)

Question 5

Assets & Asset Types - 3 Main Asset Types

Answer 5

Pure Information, Physical Assets, Software

Question 6

Assets & Asset Types - Pure Information Definition

Answer 6

Information in what ever format

Question 7

Assets & Asset Types - Physical Assets Definition

Answer 7

Buildings, Computer Systems

Question 8

Assets & Asset Types - Software Definition

Answer 8

Software used to process or manage information

Question 9

Threat, Vulnerability, Risk & Impact - Threat Definition

Answer 9

A potenial cause of an incident that may result in harm to a system or organisation (ISO 13335)

Question 10

Threat, Vulnerability, Risk & Impact - Vulnerability Definition

Answer 10

A weakness of an asset or group of assets that can be exploited by one or more threats (ISO 13335)

Question 11

Threat, Vulnerability, Risk & Impact - Risk Definition

Answer 11

The potential that a given threat will exploit vulnerabilities of an asset or group of assets and thereby cause harm to the organisation (ISO 13335)

Question 12

Threat, Vulnerability, Risk & Impact - Impact Definition

Answer 12

The result of an Information Security Incident, caused by a threat, which affects assets (ISO 13335)

Question 13

Information Security Policy Concepts - Information Assurance Control Definition

Answer 13

Controls in the Information Assurance sense are these activities that are taken to manage the risks identified. There are 4 main types of control.

Question 14

Information Security Policy Concepts - The Types of Information Assurance Controls are:

Answer 14

Eliminate Risk, Reduce Risk, Transfer Risk & Accept Risk.

Question 15

Information Security Policy Concepts - Define Information Assurance Control: Eliminate Definition

Answer 15

Eliminate: Risk avoidance - decision not to be involved in, or action to withdraw from a risk situation (ISO Guide 73)

Question 16

Information Security Policy Concepts - Define Information Assurance Control: Reduce Definition

Answer 16

Reduce: Risk reduction - action taken to lessen the probability or the negative consequences or both, associated with risk (ISO Guide 73)

Question 17

Information Security Policy Concepts - Define Information Assurance Control: Transfer Definition

Answer 17

Transfer: Risk Transfer - Sharing with another party the burden of loss or benefit of gain for a risk (ISO Guide 73)

Question 18

Information Security Policy Concepts - Define Information Assurance Control: Accept Definition

Answer 18

Accept: Risk Acceptance - Decision to accept a risk (ISO Guide 73)

Question 19

Identity, Authentication and Authorisation - Define Identity

Answer 19

Indentity: The properties of an individual or resouce that can be used to identify uniquely one individual or resource (Authors)

Question 20

Identity, Authentication and Authorisation - Define Authentication

Answer 20

Authentication: Ensuring that the identity of a subject or resouce is the one claimed (Dervied from Authenticity in ISO 13335)

Question 21

Identity, Authentication and Authorisation - Define Authorisation

Answer 21

The process of checking the authentication of an individual or resouce to establish and confirm their authorished use of or access to information or other assets (Authors)

Question 22

Accountability, Audit & Compliance - Define Accountability

Answer 22

Accountiability: The responsibility for actions and processes (Authors)

Question 23

Accountability, Audit & Compliance - Define Audit

Answer 23

Audit: Formal review of actions, processes, policies and procedures (Authors)

Question 24

Accountability, Audit & Compliance - Define Compliance

Answer 24

Compliance: Working in accordance with actions, processes, policies and procedures liad down without necessarily having indepentant reviews (Authors)