Rate of competitor adoption Being in the same risk ecosystem as CSP and other tenants Transparency Reliability and Performance Lack of application portability Security and compliance Cyber attacks Data leakage IT Org change CSP long-term viability

ISC R1 Flashcards by Aron Librea

Framework Implementation Tier: cybersecurity risk gauging

Tier 1

Tier 1 (partial) - not integrated, not formalized, ad-hoc (need based), reactive manner

How well did you know this?

Not at all

Perfectly

Framework Implementation Tier: Gauging Cybersecurity Risk

Tier 2

Tier 2 (Risk-informed): approved by management but not org-wide policy. Has established risk management practices.

How well did you know this?

Not at all

Perfectly

Framework Implementation Tier 3:

Tier 3 (Repeatable): risk management practices are consistently implemented. Adapt based on lesson learned and predictive indicators.

How well did you know this?

Not at all

Perfectly

Framework Implementation Tier 4:

Tier 4 (Adaptive): adapt its lessons based on lessons learned and predictive indicators from previous and current cybersecurity activities. RM is part of org culture, evolves, continuous awareness.

How well did you know this?

Not at all

Perfectly

COBIT 2019 Core Model: Governance Objectives:

EDM (Evaluate, Direct and Monitor) = ensuring business delivery, governance framework setting, risk optimization, resource optimization, shareholder engagement.

How well did you know this?

Not at all

Perfectly

Three Principles of Governance Framework (COBIT):

Based on Conceptual Model
Open and Flexible
Aligned to Major Standards

How well did you know this?

Not at all

Perfectly

Most widely used enterprise IT Governance Standards

COBIT 2019 Framework (Control Objectives for Information and Related Technologies)

How well did you know this?

Not at all

Perfectly

COBIT Management Objectives: APO

APO (Align, Plan and Organize)

Managed data - most significant
guidance on IT infrastructure, innovation, budgeting Human resources, vendors, quality, security and managing risk.

How well did you know this?

Not at all

Perfectly

COBIT Management Objective: BAI

BAI (Build, Acquire, Implement)

guidance on requirement definitions
identifying solutions
managing capacity,
dealing with organizational IT change, managing knowledge, administering assets and managing configurations

How well did you know this?

Not at all

Perfectly

COBIT Management Objective: DSS

DSS (Deliver, Service and Support)

addresses security, delivery and support services
manage operations, service request, manage problems, continuity, security services, business process controls

How well did you know this?

Not at all

Perfectly

COBIT Management Objective: MEA

MEA (Monitor, Evaluate and Assess)

technology conformance to performance targets
manage performance and conformance monitoring, manage system internal controls, compliance, assurance

How well did you know this?

Not at all

Perfectly

CIS Control 12 : securely managing the network, ensuring network components updated, establishing and maintaining a secure network

CIS Control: Network Infrastructure Management

How well did you know this?

Not at all

Perfectly

Open Systems Interconnection (OSI)

How protocols work and how well networking devices work with each other - has 7 layers

How well did you know this?

Not at all

Perfectly

OSI Layer 1

Physical - after decapsulation happens, converts message sent from data link layer, transmitted to other physical devices.

How well did you know this?

Not at all

Perfectly

OSI Layer 2:

Data Link Layer - data packets are formatted for transmission. Determined by Ethernet. Adds Media Access Control

How well did you know this?

Not at all

Perfectly

OSI Layer 3

Network Layer - adds routing or address header or footers to the data. IP addresses. Detect errors.

How well did you know this?

Not at all

Perfectly

OSI Layer 4

Transport Layer - supports and controls communication between devices. Setting the rules, validating integrity, data can be transmitted, data has been lost.

How well did you know this?

Not at all

Perfectly

OSI Layer 5

Session Layer - allows sessions between communicating devices to be established and maintained. Have dialogue with others.

How well did you know this?

Not at all

Perfectly

OSI Layer 6

Presentation Layer - transforms data into a format others can interpret. Encryption occurs.

How well did you know this?

Not at all

Perfectly

OSI Layer 7

Application Layer - serves as interface between application and the network protocol. Does not represent actual application being used.

How well did you know this?

Not at all

Perfectly

CSP Deployment Model that provides entire virtual data center of resources. Company is responsible for keeping the environment consistently up and running, CSP is responsible for physical management of infrastructure. Org more control, CSP less control.

IaaS (Infrastructure-as-a-Service)

How well did you know this?

Not at all

Perfectly

CSP Deployment Model that provides proprietary tools to fulfill a specific business purpose. Run on CSP’s hosted infrastructure. CSP is responsible for keeping the application uptime at acceptable level. CSP more control, Org less control.

Business PaaS (Plaftorm-as-a-Service)

How well did you know this?

Not at all

Perfectly

CSP Deployment Model that provides business application or software that org use to perform specific functions or processes. Customers purchase through licensing. Access through internet - upgrades.

Software-as-a-Service (SaaS)

How well did you know this?

Not at all

Perfectly

Cloud Risk

Rate of competitor adoption
Being in the same risk ecosystem as CSP and other tenants
Transparency
Reliability and Performance
Lack of application portability
Security and compliance
Cyber attacks
Data leakage
IT Org change
CSP long-term viability

How well did you know this?

Not at all

Perfectly

COSO ERM Framework - help company understand to which it wants to outsource technology options

Internal Environment

COSO ERM - how outsourcing can hinder or reach its objectives.

Objective-setting

COSO ERM where management must understand how CSP identify a problem, more complex or easier.

Event Identification

COSO ERM - risk of its cloud strategy, risk profile, likelihood of impact of all risks.

Risk Assessment

COSO ERM - to avoid risk, reduce its likelihood, share the risk by transferring a portion.

Risk Response

COSO ERM - how traditional controls, detective, preventative, automated and manual - modified in cloud environment.

Control Activities

COSO ERM - operating in cloud will affect timeliness, availability and dissemination of information.

Information and Communication

COSO ERM - should modify to accommodate new complexities introduced by adopting a cloud solution.

Monitoring

Pick Ticket - list provided to warehouse for inventory, items and quantities picked and packaged, sent to shipping = what transaction cycle?

Revenue Cycle

Business Improvement Process = Adapting one system and loading to another system

Robotic Process Automation

Business Improvement Process - consolidating similar functions from different departments/geographic locations - promote efficiencies.

Shared Services

Business Improvement Process - hiring a third-party org to process a function within the organization - potentially cut costs, employees to be repurposed, fill job vacancies.

Outsourcing

Difference between AIS and ERP

ERP - integrating multiple departments for a smooth flow of business process. Shipping data, data is less intensive and there is a central repository. AIS - accounting and financial system, stores financial data AIS is part of ERP.

Type of test in controls that shows an error when transaction amount exceeded the original.

Reasonableness Test

CIS Control 1 : actively track and manage all IT assets connected to a company’s IT Infrastructure physically or virtually within a cloud environment.

Inventory and Control of Enterprise Assets

CIS Control 2 : provides recommendations for orgs to track and manage all software applications so that only authorized software is installed on company devices.

Inventory and Control of Software Assets

CIS Control 3 : develop ways to securely manage the entire life cycle of their data, from the initial identification and classification data to its disposal.

Data Protection

CIS Control 4 : Establish and maintain secure baseline configurations for their enterprise assets, including network devices, mobile and portable end-user devices, non-computing assets such as IOT.

Secure Configuration of Enterprise Assets and Software

CIS Control 5 : outlines best practices for companies to MANAGE credentials and AUTHORIZATION for user accounts, privilege user accounts and service accounts.

Account Management

CIS Control 6 : specifying the type of ACCESS that user accounts should have. Organization’s users should only have the necessary privileges required for their job roles.

Access Control Management

CIS Control 7: CONTINUOUSLY identifying and tracking VULNERABILITIES within its infrastructure so that it can remediate and eliminate weak points or windows of opportunity for bad actors.

Continuous Vulnerability Management

CIS Control 8 : establishes and enterprise LOG management process so that organizations can be alerted and recover from an attack in real time or near real time using log collection and analytic feature.

Audit Log Management

CIS Control 9 : provides recommendations on how to detect and protect against cybercrime attempted through EMAIL or the INTERNET by directly engaging employees.

Email and Web Browser Protections

CIS Control 10 : assists companies in preventing installation and propagation of MALWARE onto company assets and its network.

Malware Defenses

CIS Control 11 : establishes DATA backup, testing and RESTORATION processes that allow organizations to effectively RECOVER company assets to a pre-incident state.

Data Recovery

CIS Control 13 : establishes processes for MONITORING and DEFENDING a company’s NETWORK infrastructure against internal and external security threats.

Network Monitoring and Defense

CIS Control 14: guides organization in establishing a SECURITY AWARENESS AND TRAINING PROGRAM to reduce cybersecurity risk.

Security Awareness and Skill Training

CIS Control 15 : helps organization develop processes to evaluate THIRD-PARTY SERVICE providers that have access to sensitive data or that are responsible for managing some or all of company’s IT functions.

Service Provider Management

CIS Control 16 : establishes safeguards that manage the entire LIFE CYCLE OF SOFTWARE that is acquired, hosted, or developed in-house to detect, deter and resolve cybersecurity weaknesses before they are exploited.

Application Software Security

CIS Control 17 : provides recommendations necessary to establish and incident response management program to detect, RESPOND and PREPARE for potential cybersecurity attacks.

Incident Response Management

CIS Control 18 : Helps organization TEST the soPhistication of their cybersecurity defense system in place by simulating actual attacks in an effort to find and exploit weaknesses.

Penetration Testing

A design factor under COBIT that drives innovation for business but is not required for critical business operations.

Turnaround

A design factor under COBIT that is not critical for operating a business or maintaining continuity

Support

A design factor under COBIT that will have an immediate impact for the business but is not required for critical business operations.

Factory

A design factor under COBIT that is crucial for both innovation and business operations.

Strategic

A Benefit of cloud service provider

Distributed/reduced redundancy among many data centers, having cloud storage reduce the likelihood that data is lost in an attack or disaster.

CSP’s often serve multiple cloud customers at ONCE, and use COMMON resource and technology (shared), referred as…

Multi-tenant

COSO ISP Component: sets company tone and reinforces the importance of having oversight of ERM. Related to behavior and values.

Governance and Culture

COSO ISP Component: company risk’s appetite should be aligned with its strategy and business objectives. During strategic planning process.

Strategy and Objective Setting

COSO ISP Component: reviewing company’s performance over time and making revisions of functions needed.

Review and Revisions

COSO ISP Component: recommends continual process to be in place that support sharing both internal and external information throughout the organization.

Information Communication and Reporting

Process Improvement where business processes use computer programs to perform repetitive tasks.

Business Process Automation

Process improvement : seeking out redundant services, combining them and sharing to a group of organizations. (Different countries/locations)

Shared Services

Process Improvement: Contracting Services to an external provider

Outsourcing

Relate to outsourcing of services to an external part in a different country.

Offshore operations

Use of programs to perform repetitive tasks that do not require human labor, such as extracting information from a user interface and inputting that data into a form.

Robotic Process Automation

Involves technology developed and used to encode, decode, and interpret human languages so that the technology can perform tasks. Text documents / speeches

Natural Language Processing (NLP) Software

Involve an input layer, a hidden layer, and an output layer - modeled after neurons that facilitate the function of human or animal memory.

Neural Networks

Purging Data means…

Permanently removing data from storage systems

Change management methodology characterized by different teams of employees working on separate tasks in sequence. * pre-written authoritative agreement Plan - analyze - design - develop - test - deploy - maintain

Waterfall Method

Challenges of Waterfall Method

*Requires great deal of time to complete *benefits of new system are not realized until completion *no customer input and change can be difficult to manage *employees may be idle before beginning or after completing

Change management methodology that offers more flexibility, characterized by cross-functional teams, each dedicated to particular functions or improvements of a system drawn from a prioritized list of customers remaining needs for the system.

Agile Method

Characteristics of Agile Method

*Team works linearly * Different teams working on different phases simultaneously * Works on shorter deadlines to encourage efficiency, communication critical. *Stakeholder feedback, consistent communication

Alternative site: - off site - with connection - no equipment in place - 1-3 days operations - cheapest

Cold Site

Alternative site: - off-site - with/without connection - Yes/No equipment in place - 0-3 days operations - moderately expensive

Warm site

Alternative site: - off-site - with connection in place - with equipment in place - Immediately - Most expensive

Hot Site

Steps in BIA (Business Impact Analysis)

1. Establish the BIA Approach - executives, time frames, methodologies 2. Identify Critical Resources - interviews with key personnel and documentation review 3. Define Disruption Impacts - qualitative/quantitative effects maybe natural or human-inflicted threats 4. Estimate Losses - ARO, ALE, SLE 5. Establish Recovery Priorities - MTTR, RPO, RTO 6. Create the BIA Report - completed at department level, company wide BIA 7. Implement BIA Recommendations - evaluating report and implementing preventative and corrective actions to remediate risks

ARO (Annual Rate of Occurrence) Formula

Number of Occurrences / relevant years

Damage in terms of Dollars, expressed as percentage of asset’s value

Exposure Factor

SLE (Single Loss Expectancy)

Cost of Individual Loss = EF x value of asset

ALE (Annualized Loss Expectancy)

Cost of specific loss in a given year = SLE x ARO

System backup: exact copy of entire database - time-consuming so weekly, least-time consuming in restoration

Full Backup

System backup: copying only the data that changed since last backup. Slowest of all three backups. Initial creation is fast.

Incremental backup

System backup: copies all changes made since last backup. Takes longer than incremental. Restoration is simpler. Recovery is slower than full but faster than incremental.

Differential Backup

Amount of time that services are operational, expressed in hours or days.

AST (Agreed Service Time)

Amount of time system or application is not functional.

Downtime (DT)

MTBF (Mean Time Between Failures)

Total Operational Time / Number of Failures

MTTR (Mean Time to Repair)

Total downtime / Number of Failures

Four Benefits of Relational Database

1. Completeness 2. No Redundancy 3. Business Rules Enforcement 4. Communication and Integration of Business Processes

In designing a database, it refers to normalization that eliminates any attributes that DEPEND on both the primary key and other non-key attributes.

3NF (Third Normal Form)