ISC Flashcards
What is the key difference in controls when changing from a manual system to a computer system?
Methodologies for implementing controls change. The controls almost always are different. Objectives and principles remain the same. Implementation of the principles are different.
What is the purpose of an organization’s company-wide acceptable use policy (AUP)?
An acceptable use policy (AUP) is a control document that is created by an organization to regulated and protect technology resources by assigning varying levels of responsibilities to job roles, listing acceptable behaviors by employees and vendors, and specifying consequences of those who violate the AUP. Users are often asked to sign and agree to the terms of an AUP prior to being granted access to systems, applications, and devices issued by the organization.
Define an Access Control List (ACL)
Is a list of rules that outlines which users have permission to access certain resources, such as a file, folder, directory, or other IT resources. Also administers account restrictions, which govern what type of action the user can execute using those resources, such as the ability to edit a file, apply read-only status, or execute a program. Access and account restrictions are enforced by controlling network traffic based on the rules defined in the ACL.
What are the two types of ACLs
Filesystem ACL:
These ACLs grant or deny privileges in an operating system by restricting access to certain files, folders, and directories.
Networking ACL:
These ACLs are used to regulate the type of network traffic that is allowed to flow across a network by configuring routers, switches, and other network devices with an array of lists to enforce. Networking ACLs are not only used for controlling access, but also for improving network performance by restricting or channeling the flow of data.
Define a Adverse Event
Is any event with a negative consequence. System crashes, packet floods, unauthorized use of system privileges, and unauthorized access to sensitive data would all be examples that best describe an adverse event.
What is the difference between Confidentiality and Privacy
Independent terms when it comes to cybersecurity.
Privacy:
Protects the rights of an individual and gives the individual control over what information they are willing to share with others.
Confidentiality:
Protects unauthorized access to information gathered by the company.
What are the System Conversion Methods in Change Management?
Direct:
Involves the organization ceasing the use of the old system and starting the new one immediately.
Parallel:
The new system is implemented while the old system is still in use for an extended period of time.
Pilot:
An organization performs a conversion on a small scale within a test environment while continuing to use the older system. Allows for validation and testing before rolling it out to the entire organization so adjustments can be made.
Phased:
Also referred to as gradual or modular conversion, this transition plan gradually adds volume to the new system while still operating the old system. Useful for businesses with distributed locations as it allows them to implement one site at a time.
Hybrid:
These are custom combinations of the above approaches, tailored to the unique needs of an organization.
What are the types of Data Storage?
Operational Data Store (ODS):
Is a repository of transactional data from multiple sources and is often an interim aria between an data source and data warehouses.
Data Warehouse:
Very large data repositories that are centralized and used for reporting and analysis rather than for transactional purposes.
Data Mart:
Is much like a data warehouse but is more focused on a specific purpose such as marketing or logistics and is often a subset of a data warehouse.
Data Lake:
Is a repository similar to a data warehouse, but it contains both structured and unstructured data, with data mostly being in its natural or raw format.
How is a document encrypted?
A sender used an algorithm to convert cleartext to ciphertext.
Cybersecurity Event vs Incident
Cybersecurity Event:
Is a change in the normal behavior of a given system, process, environment or workflow.
In other words: When something happens, it’s an event.
Occurs within a network or information system.
Examples: Employee flags a suspicious email. Someone downloads software (authorized or unauthorized) to a company device. A security lapse occurs due to a server outage.
Cybersecurity Incident:
Is a change in a system that negatively impacts the organization, municipality, or business. Might take place when a cyber attack occurs.
Examples: Employee replies to a phishing email, divulging confidential information. Equipment with stored sensitive data is stolen. A password is compromised through a brute force attack on your system.
Network Security
Media Access Control (MAC) Filtering
Is a way to control which devices can connect to your WiFi network based on their physical addresses.
This is a form of filtering in which an access point blocks access to unauthorized devices using a list of approved MAC addresses. A MAC address, also referred to as a physical or hardware address, is a unique identifier found on devices in a network that is used as an address for communication with other devices on that network.
What should service auditors do when it comes to Reporting Failures, System Incidents, and Concerns
They should gain an understanding of processes in place to report system failures, system incidents, and complaints by either external or internal system users by inquiring of management about the controls in place.
Who is responsible for identifying the nature, extent, and timing of system incidents in the service organization’s system description?
Management.
What are the ways to delete confidential information?
Physical destruction = involves the physical act of disassembling or changing the chemical construct of the data (i.e. through heat, pressure, or shredding).
Erasing = Performance of a delete operation of a file or its data.
Overwriting (Clearing) = Involves preparing media for reuse by replacing the old data with unclassified data.
Purging = Repeats the clearing process various times and may combine that process with another method, such as degaussing, which involves creating a strong magnetic field used to erase data on storage devices that use magnetism, such as magnetic tapes.
Which deletion of confidential data method has the least risk?
Physical destruction of data.
Whaat is the biggest risk to confidential information when deleting/purging confidential information from storage devices?
When data is removed, a residual magnetic flux or imprint may remain on storage devices where tools can reverse the effects of wiping.
What is the difference between Denial-of-Service (DoS) and Distributed Denial-of-Service (DDoS)?
DoS = An attacker floods a system’s network by congesting it with large volumes of traffic that are greater than the bandwidth it was designed to handle.
DDoS = These occur when multiple attackers or compromised devices are working in unison to flood an organization’s network with traffic. These attacks manipulate the operation of network equipment and services in such a way that they may be more powerful than a traditional DoS attack.
What is Data Obfuscation and what are the three most common obfuscation applications?
Obfuscation = is the process of replacing production data or sensitive information with data that is less valuable to unauthorized users.
Encryption = Scrambles unencrypted data using cryptography so that it can generally only be deciphered with a key.
Tokenization = Removes production data and replaces it with a surrogate value or token. Uses mathematical algorithms.
Masking = Swaps data with other like data so that the original identifying characteristics are disguised, or masked, while maintaining a similar structure to the unmodified data set.
What is a complementary user entity controls (CUECs)?
Are controls that are necessary to be implemented by the user entity, in combination with the service organization’s controls, to provide reasonable assurance that the control objectives stated in management’s description of the service organization’s system (SOC 1) or the service organization’s service commitments and system requirements (SOC 2) were achieved.
Who is responsible for determining whether to carve out or include a subservice organization?
Management.
What is the Carve-Out Method?
This method is most common and means that the subservice organization’s controls are NOT included in the scope of the SOC report.
The vendor has CARVED OUT all the controls that the subservice is responsible for and essentially make them not applicable.
What is the Inclusive Method?
In this method, the controls from the subservice organization that support normal operations are included in the SOC report and will be reviewed by the auditor.
When complementary user entity controls are identified, which sections of the service auditor’s SOC report will be amended to include language that references the complementary user entity controls?
Both the scope and opinion sections of the service auditor’s report will refer to the identified complementary user entity controls.
Describe Patch Management
Is an important part of minimizing security threats that works in conjunction with vulnerability management solutions. Keeps devices up to date and secure.
What do Detective Controls do? List examples of them.
They detect a threat event while it is occurring and provide assistance during investigations and audits after the event has occurred.
Network Intrusion Detection System (NIDS)
Antivirus Software Monitoring
Network Monitoring Tools
Log Analysis
Intrusion Detection Systems (IDS)
What do Corrective Controls do? List examples of them.
Are intended to fix known vulnerabilities as a result of recent security incidents, security self-assessments, or changes in industry practices. These controls become preventive or detective once they are put in place and operating effectively.
Reconfigurations
Upgrades and Patches
Revised Policies and Procedures
Updated Employee Training
Recovery and Continuity Plans
Antivirus Software Removal of Malicious Viruses
Virus Quarantining
When a service organization has more than one subservice organization, do they choose carve-out or inclusive method?
It is up to the service organization management to apply the carve-out method, inclusive method, or a mix of both to the subservice organizations. There is no requirement for a consistent application of one method.
When a service organization uses multiple subservice organizations, it may prepare its description using the carve-out method for one or more subservice organizations and the inclusive method for others.
What are the five trust criteria?
CAPPS
Confidentiality = Information designated as confidential is protected to meet the entity’s objectives.
Availability = Information and systems are available for operation and use to meet the entity’s objectives.
Processing Integrity = System processing is complete, valid, accurate, timely, and authorized to meet the entity’s objectives.
Privacy = Personal information is collected, used, retained, disclosed, and disposed of to meet the entity’s objectives.
Security = Information and systems are protected against unauthorized access; unauthorized disclosure of information; and damage to systems that could compromise the availability, integrity, confidentiality, and privacy of information or systems and affect the entity’s ability to meet its objectives.
What is a service commitment of a SOC 2?
Declarations made by service organization management to user entities and others (such as user entities’ customers) about the system used to provide the service.
What are system requirements for a SOC 2?
Specifications on how the system should function to meet all service commitments for user entities, user entity customers, vendors, business partners, laws and regulations.
What are the stages of a cyberattack
Reconnaissance: First stage, attackers discover and collect as much information about the target IT system as possible.
Gaining Access: When information collected in the previous steps is used to gain access to the target of an attack using a variety of techniques.
Escalation of Privileges: Once access into a system is obtained, attackers attempt to gain higher levels of access in this stage.
Maintaining Access: Attacker remains in the system for a sustained period of time until the attack is completed and looks for alternative ways to prolong access or return later.
Network Exploitation and Exfiltration: Attackers proceed with the objective of disrupting system operations by stealing sensitive data, modifying data, disabling access to systems or data, or performing other malicious activities.
Covering Tracks: Occurs while the attack is in progress or after the attack is completed and involves the attacker concealing the entry or exit points in which access was breached.
What are the criteria that must be met for a vendor to be considered a subservice organization?
The services provided by the vendor must be relevant to the users’ understanding of the service organization’s system and the controls must be necessary, in combination with the controls of the service organization, to provide reasonable assurance that the system commitments and service requirements are achieved.
What are examples of Personal Identifiable Information (PII)?
Name
SSN, Passport Number, Driver’s License Number, Taxpayer Number, Credit Card Number
Address, Street or Email
Personal Characteristics, Photos, Fingerprints, Handwriting, or other Biometric Data
What are the three Threat Methodologies?
Process for Attack Simulation and Threat Analysis (PASTA)
Visual, Agile, and Simple Threat (VAST)
Spoofing, Tampering, Repudiation, Information Disclosure, Denial-of-service attack, and Elevation or privilege (STRIDE)
CIS Control 16: Application Software Security
Manage the security life cycle of in-house developed, hosted, or acquired software to prevent, detect, and remediate security weaknesses before they can impact the enterprise.
Types of system backups
Full: Exact copy of the entire database.
Incremental: Copying only the data items that have changed since the last backup.
Differential: Copies all changes made since the last full backup.
Main contents of a Type 1 report
Management’s description of the service organization’s system.
A written assertion by management of the service organization about whether, AS OF A SPECIFIED DATE, based on the criteria:
- Management’s description of the system fairly presents the service organization’s system that was designed and implemented.
- The controls related to the control objectives stated in management’s description of the system were suitably designed to achieve those control objectives.
A report that expresses an opinion on the matters described above.
Main contents of a Type 2 report
Management’s description of the service organization’s system.
A written assertion by management of the service organization about whether, THROUGHOUT A SPECIFIED DATE, based on the criteria:
- Management’s description of the system fairly presents the service organization’s system that was designed and implemented.
- The controls related to the control objectives stated in management’s description of the system were suitably designed and operated effectively to achieve those control objectives.
A report that expresses an opinion on the matters described above and includes a description of the tests of controls and the results.
Key differences between Type 1 and Type 2 SOC Report
A type 1 report covers the system design as of a given point in time whereas a type 2 report covers both the design and operating effectiveness over a period of time.
Who are SOC 1 reports restricted to?
Management of the service organization
User entities of the service organization’s system
Independent auditors of such user entities.
*It does not include potential users of the service organization.
