ISC MISSED Flashcards
How has Cloud changed how technology is managed?
Cloud relies on sharing of resources, in very secure, and leads to economies of scale. Cloud is not self-sustaining and requires managed resources.
Explain the Test of Controls and Results of a SOC Engagement.
*Type 2 only!
*It describes the tests performed by the service auditor to assess the design and operating effectiveness of the service organization’s controls, along with the results of those tests.
*Example: Auditor test authorization control and noted significant delays in the performance of the control in three of the nine sampled instances reviewed. So report with state “The authorization control was not performed in a timely manner for three of the nine sampled instances.
This details both the nature of the problem (timeliness) and the extent of the issue (three out of nine instances).
What implications can subsequently discovered facts have for future SOC engagements?
They may lead to considerations in planning and conducting future SOC examination. The service organization and the service auditor should take into account the new information and its impact on the control environment when planning and conduction future SOC examinations. This ensures that any potential risks or control deficiencies are adequately addressed in future engagements to provide assurance to user entities.
What is a common step in the pre-engagement activities for SOC engagements?
Obtain a signed engagement letter.
Determine scope, system, and relevant controls (SOC 1) or CAPPS (SOC 2)
What does the auditor do during the planning phase?
Evaluate management’s system description.
Gain understanding of the service organization’s system and assess the completeness and accuracy of management’s system description. This includes understanding the nature of the services provided, the system’s key components, and the applicable control objectives.
In a SOC 2 report, which component provides information about the specific controls in place to achieve the Trust Services Criteria?
Trust Services Criteria and Controls
What are the risks of Cloud Computing?
Additional Industry Exposure
Cloud Malware Injection Attacks
Compliance Violations
Loss of Control
Loss of Data
Loss of Visibility
Multi-Cloud and Hybrid Management Issues
Theft or Loss of Intellectual Property
Who has the responsibility for carrying out IT governance policies?
Middle management
Which section of SOC report includes a statement that the application of complementary user entity controls is considered necessary to achieve the related control objectives stated in management’s description of the service organization’s system?
The Opinion Section.
Backdoor vs Trapdoor
Both are methods to bypass security access procedures by creating an entry and exit point to a network that is undocumented.
Trapdoors are installed by system owners so they can bypass security measures to gain quick access.
Backdoors may be intentionally installed or unintentionally left available due to product defects.
Define Buffer overflow
Occurs when an attacker exceeds a software’s intended buffer size by inputting more data than it can handle.
*Inputting a lengthy string of characters triggers a buffer overflow, causing the system to crash or execute malicious code.
Define Watering hole attacks
Compromising legitimate websites commonly visited by the target group, injecting malicious code or redirecting users to harmful sites.
*Targeting a forum frequented by employees of a specific organization, injecting a script that installs malware on users’ devices to gain access to the company’s network.
System Interface Diagram
Demonstrates how users and functions, both internal and external to an organization, interface with the organization’s systems. Diagrams simple, logical relationships between functional areas, such as servers and offices, to actual networks and employees, vendors, and customers. These diagrams show how all the parties logically interact with one another and assist in the development and monitoring of physical connections.
Flow charts
Are visual representations of how documents and information flow through a process from both a logical and physical standpoint; however, it is focused on the flows and not the logical and physical interactions of the system and its users.
Data flow diagram
Visually depict the logical flow of data for business processes but do not incorporate the physical aspects and, as a result, may not allow for an understanding of how the system and users interact.
Define Monitor Risk
SAR Risk Management Framework
Helps organizations evaluate risk over time by reviewing ongoing risk response effectiveness, identifying risk-impacting changes, and verifying that risk responses are implemented. While ensuring that vulnerability scanning is happening over time falls within the purview of this component, its primary focus in not on how the organization is responding to risk.
Define Assess Risk
SAR Risk Management Framework
Covers the way organizations assess risk, with one of the goals being to identify vulnerabilities that are both internal and external to the company. This would include evaluating a vulnerability scanning function that identifies internal and external security risks to include in a SAR.
Define Respond to Risk
SAR Risk Management Framework
Was designed so that organizations could provide an organization-wide response to risk by developing and evaluation different courses of action. It does not specifically cover evaluation vulnerabilities regarding internal and external security risks.
What would include a statement from service organization management that significant assumptions used in making any material estimates are reasonable in a SOC 1 engagement?
The representation letter from management.
Top management’s most important role in business process design is?
Providing support and encouragement for IT development projects and aligning information systems with corporate strategies. Because business process design often takes time away from other duties, management must ensure that team members are given adequate time and support to work on the project.
What statement would be added to a SOC 1 Type 2 report prepared under the carve-out method?
Out examination did not extend to the controls of the subservice organization, and we have not evaluated the suitability of the design nor the operation effectiveness of such complementary subservice organization controls.
What is true regarding the description criteria for management’s description of the entity’s cybersecurity risk management program?
The description should include information regarding the cybersecurity objectives and the factors that have a significant effect on inherent cybersecurity risks.
When should major changes to a system be included in the description of the system?
If the changes took place during the period covered by the description in a Type 2 engagement.
As a Type 2 engagement covers a period rather than a point in time (Type 1), any relevant changes to the system should be included in the description of the system.
When implementing NIST SP 800-53 Security and Privacy Controls for Information Systems and Organizations, the approach that implements controls at the organizational level is referred to as the:
Common Approach.
The common approach implements controls at the organizational level, whereas the System-Specific approach implements controls at the information system level. Hybrid approaches implement controls at the organizational level where it is most applicable for the target organization, with the remaining controls implemented at the system level.
If a service organization uses a subservice organization, when is the service auditor’s report required to identify any services performed by a subservice organization?
When either the inclusive or carve-lout method is used.
The service auditor’s report is required to identify any services performed by a subservice organization under both the inclusive and carve-out methods. The report should also indicate the method used related to the complementary
In a SOC 2 engagement, for a vendor to be considered a service organization:
The services provided by the vendor must be relevant to the report users’ understanding of the service organization’s system.
For a vendor used by a service organization to be considered a subservice organization in a SOC 2 or SOC 3 engagement, the services provided by the vendor must be relevant to the report users’ understanding of the service organization’s system as it relates to the applicable trust services criteria; and controls at the subservice organization are necessary, in combination with the service organization’s controls, to provide reasonable assurance that the service commitments and system requirements are achieved.
NIST SP 800-39 main components and there key points
Risk Framework
-Rick assumptions
-Risk constraints
-Risk tolerance
-Priorities and trade-offs
Assess Risk
-Threats to nations, organizations, individuals, assets, or operations
-Vulnerabilities internal and external to organizations and entities.
-The harm that may occur given the potential for threats exploiting vulnerabilities.
-The likelihood that harm will occur.
Respond to Risk
-Developing alternative courses of action for responding to risk.
-Evaluating the alternative courses of action
-Determining appropriate courses of action consistent with organizational risk tolerance
-Implementing risk responses based on the selected courses of action.
Monitor Risk
-Determining the ongoing effectiveness of risk responses
-Identifying risk-impacting changes to organizational information systems and the environments in which the systems operate
-Verifying that planned risk responses are implemented and that information security requirements derived from, and traceable to, organizational missions/business functions, federal legislation, directives, regulations, policies, standards, and guidelines are satisfied.
What is data synthesis?
Is a step in the data life cycle.
This step is a bridge between preparation and usage: once the intended use of the captured data has been determined, calculated fields can be created to prepare that data has been determined, calculated fields can be created to prepare that data for quicker usage and analysis.
*Calculating key anniversary dates based on individual hire dates is an example of data synthesis to derive new meaningful insights from existing data.
The stage in a cyberattack in which an attacker proceeds with the primary objective of the fraud, such as stealing data, obtaining unauthorized access, or destroying resources, is called:
Exploitation and exfiltration
Define OMB Circular A-130 and the Federal Information Security Modernization Act (FISMA)
Requires the controls for federal information systems. FISMA requires the implementation of minimum controls to protect federal information and information systems.
Define Race Condition
An attacker exploits software by either forcing functions to occur out of order or simultaneously.
Define Timing Channel
Is a form of network-based attack in which an attacker alters the timing of data packets being transmitted in an attempt to hide malicious code sent to the victim.
