Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Information Assurance Midterms > Information Security Risk Management > Flashcards

Information Security Risk Management Flashcards

1
Q

a combination of public and private clouds

A

Hybrid cloud

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

a cloud service reserved for only one customer or company

A

Private cloud

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

IaaS

A

(Infrastructure-as-a-Service)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Paas

A

(Platform-as-a-Service)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

SaaS

A

(Software-as-a-Service)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

a cloud-based system managed by a cloud provider and shared among multiple customers, like

A

Public cloud

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

It’s simply means that the application is running in a shared environment. Businesses must make sure that there is adequate isolation between different processes in shared environments.

A

Cloud Security

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

The sender must not be able to deny sending the data or communication.

A

(non-repudiation)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

The recipient should be able to ______ the sender,

A

authenticate

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Its _______ must be maintained in transit (meaning the data isn’t altered)

A

integrity

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Information must be kept __________

A

confidential

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

are commonly used in cryptography to validate the authenticity of data.

A

Digital Signatures

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Encrypting data in transit and data at rest helps ensure data confidentiality and integrity.

A

Encryption

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Validates that a user has permission to access the application by comparing the user’s identity with a list of authorized users

A

Authorization

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Software developers build procedures into an application to ensure that only authorized users gain access to it. This procedure ensure that a user is who they say they are.

A

Authentication

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Involves using a mathematical algorithm called a hash function to convert input data into a fixed-size string of characters, known as a hash value or hash code.

A

Hash Function

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q
  • One key is used to only encrypt the data (the public key) and another key is used to decrypt (the private key).
A

Asymmetric Cryptography

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

The same key used to encrypt the data is used to decrypt the data. This makes sharing the key difficult, as anyone who intercepts the message and sees the key can then decrypt your data

A

Symmetric Cryptography

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Resource owners can manage access using discretionary access control (DAC).

A

Discretionary Access Control (DAC):

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Authorization based on preestablished rules is known as rule-based authorization.

A

Rule-Based Authorization:

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

ABAC bases choices on the user, resource, and context attributes. It makes use of rules that specify circumstances affecting these characteristics.

A

ABAC (Attribute-Based Authorization):

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Role-Based Authorization (RBAC): RBAC grants access permissions based on the roles allocated to users.

A

Authorization

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

This authorization technique verifies the user using the authorization server’s authentication. an interoperable authentication protocol based on the OAuth 2.0 framework of specifications

A

OpenID Authorization

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

This authorization technique enables an API to authenticate and provide access (access token) to the user for the requested resource or action.

A

Oauth

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

Its primary role in online security is that it enables you to access multiple web applications using one set of login credentials. It works by passing authentication information in a particular format between two parties, usually an identity provider (idP) and a web application

A

SAMlL

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

This authorization technique is a Single Sign-On format, also called SS0, in which the authentication information is transferred through XML documents signed digitally

A

SAML (Security Assertion Markup Language):

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

Validates that a user has permission to access the application by comparing the user�s identity with a list of authorized users

A

AUTHORIZATION

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

The best authentication method should not compromise a user�

A

PRIVACY

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

If your authentication process ask the user to follow too many instructions, or if it takes too long, or it needs repeated attempts before succeeds, there�s a risk of drop-offs and lost business, this impacts any organization, whether it�s a retailer dealing with abandoned baskets or citizens failing to return to access online government services

A

COMPLETION RATES

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

Its possible to make things too easy

A

REASSURANCE

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

Customers value convenience, and some authentication methods are better than others in this regard

A

CONVENIENCE

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

If authentication is overly complex, people find workarounds � consider who your service is aimed at but remember to be inclusive, most online services need to offer maximum inclusivity, so simplicity and effortlessness are always the aim

A

USABILITY

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

If the risk profile of the transaction is high, you�ll need a more secure method of authentication

A

SECURITY

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

Where you are

A

LOCATION FACTOR

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

What you are

A

INHERENCE FACTOR

36
Q

What you have

A

POSSESSION FACTOR

37
Q

What you knew

A

KNOWLEDGE FACTOR

38
Q

The combination of the following factors

A

? Multi-Factor Authentication (MFA)

39
Q

Security system that requires combination of distinct forms of identification in order to access something or confirm an identity

A

? Dual- Factor Authentication (2FA)

40
Q

A process for securing access to a given system such as a network or a website, that identifies the party requesting access through only one category of credentials

A

? Single- Factor Authentication (SFA)

41
Q

The individuality of authentication o When you claim to be someone, you need to provide further information to prove that you are who you say you are

A

FACTOR

42
Q

Where you are

A

USERS LOCATION

43
Q

Something who you are - Biometrics such as fingerprints

A

USERS CHARACTERISTICS

44
Q

Something that you have - Tangible assets( smartphones, laptops, wearable devices), OTP

A

USERS POSSESSIONS

45
Q

Something that you know; memory sharpness - Passwords/ passcodes/ pins

A

USERS KNOWLEDGE

46
Q

Software developers build procedures to ensure that only authorized users gain access to it

A

AUTHENTICATION

47
Q

Commonly used when logging into an account or authorizing a financial transaction remotely

A

AUTHENTICATION

48
Q

Needed to securely identify online users

A

AUTHENTICATION

49
Q

These vulnerabilities may be found in authentication and authorization of users, integrity of code and configurations, and mature policies and procedure.

A

APPLICATION SECURITY

50
Q

Covers software vulnerabilities in web and mobile applications and application programming interfaces(APIs)

A

APPLICATION SECURITY

51
Q

Risk management reporting ensures that those responsible for governance, oversight, and compliance are well-informed and can make decisions that align with the organization�s security objectives

A

MONITORING & REPORTING

52
Q

Another critical aspect is the reporting processincludes creating detailed reports, presentations, or dashboards that convey complex information in a format understandable to non-technical stakeholders

A

MONITORING & REPORTING

53
Q

Must monitor risk and update treatment plans regularly because new assets, vulnerabilities, threats, and controls are constantly emerging

A

MONITORING & REPORTING

54
Q

A continuous process

A

MONITORING & REPORTING

55
Q

Discontinuing the use of a software application

A

AVOIDANCE

56
Q

Eliminating risk by changing processes, technologies, or practices

A

AVOIDANCE

57
Q

For risk that are too costly or difficult to mitigate

A

ACCEPTANCE

58
Q

A strategy appropriate for risk that are low in likelihood or impact

A

ACCEPTANCE

59
Q

Making a conscious decision to accept the risk

A

ACCEPTANCE

60
Q

Transferring the risk to another party

A

Transference

61
Q

Lessen the risk by implementing a business continuity plan or educating employees on cybersecurity best practices

A

MITIGATION

62
Q

Reducing the likelihood or impact of a risk

A

MITIGATION

63
Q

Patching a software vulnerability or implementing a new security control

A

REMEDIATION

64
Q

Eliminating the underlying vulnerability that is creating the risk

A

REMEDIATION

65
Q

There is involvement

A

Risk

66
Q

The likelihood of a hazard causing harm

A

Risk

67
Q

something that has the potential to harm

A

HAZARD

68
Q

No contactor involvement

A

HAZARD

69
Q

Risk scoring is not a precise science

A

PRIORITIZING RISK

70
Q

RISK = LIKELIHOOD x IMPACT

A

PRIORITIZING RISK

71
Q

Not all risk are equal

A

PRIORITIZING RISK

72
Q

Impact is the severity of the consequences if it does occur

A

RISK ASSESSMENT

73
Q

Likelihood is the probability of the danger

A

RISK ASSESSMENT

74
Q

Can be preventive like firewalls, or detective like security monitoring and log reviews

A

CONTROL

75
Q

Measures that organizations implement to mitigate risk

A

CONTROL

76
Q

Bugs are unintentional and seen on codes while malwares are intentional to harm the system

A

VULNERABILITY

77
Q

Can be technical (software bugs, security configuration flaws) or procedural (no strong password policy, lack of training)

A

VULNERABILITY

78
Q

Are weaknesses

A

VULNERABILITY

79
Q

Can be internal ( malicious insiders) or external ( hackers, cyber criminals, natural disasters)

A

THREATS

80
Q

Actors or events that could exploit vulnerabilities and harm assets

A

THREATS

81
Q

Digital assets like data, software and intellectual property

A

ASSETS

82
Q

Physical equipment like server, laptops, and mobile devices

A

ASSETS

83
Q

End goal of this process is treat risk in accordance with an organizations overall risk tolerance

A

Information Security Risk Management

84
Q

Phases, Identifying, assessing and treating risks

A

Information Security Risk Management

85
Q

Process of managing risks associated with the use of Information Technology

A

Information Security Risk Management

Information Assurance Midterms (2 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions