IT Controls

Question 1

Multi-Tiered Risk Management (3 tiers)

Answer 1

Tier 1: Organization
Tier 2: Mission/Business Processes
Tier 3: Information Systems

Question 2

Addressing Tier 3 Risk

Answer 2

1. Categorize
2. Select
3. Implement
4. Assess
5. Authorize
6. Monitor

Question 3

Trustworthiness

Answer 3

Belief that a security-relevant entity will behave in a predictable manner when satisfying a defined set of security requirements under specified conditions/circumstances
Expresses the degree to which the systems can be expected to preserve the confidentiality, integrity, and availability of the information systems

Question 4

Security Functionality

Answer 4

Security features, functions, mechanisms, services, procedures, and architectures implemented within organizational information systems or the environments in which those systems operate

Question 5

Security Assurance

Answer 5

Measure of the confidence that the security functionality is implemented correctly, operating as intended, and producing the desired outcome with respect to meeting the security requirements for the system

Question 6

3 classes security controls are split into

Answer 6

1. Management/Directive
2. Operational/Physical
3. Technical/Logical

Question 7

Security Control Structure (5 sections)

Answer 7

1. Control
2. Supplemental Guidance
3. Control Enhancements
4. References
5. Priority and Baseline Allocation

Question 8

Baseline Controls

Answer 8

Starting point for the security control selection process and are chosen based on the security category and associated impact level of information systems

Question 9

Security Control Designations include

Answer 9

1. Common Controls
2. System Specific Controls
3. Hybrid Controls

Question 10

Common Controls

Answer 10

Inheritable by one or more organizational information systems

Question 11

Hybrid Controls

Answer 11

One part of the control is common and another part of the control is system-specific

Question 12

6 Control Categories (Don’t Do Crack Riding Pregnant Cows)

Answer 12

1. Deterrent
2. Preventative
3. Compensating
4. Detective
5. Corrective
6. Recovery

Question 13

Deterrent Controls

Answer 13

Designed to discourage people from violating security directives
Keeps some potential attackers from attempting to circumvent the control
Example: authorization needed to perform certain functions (action is monitored and recorded)

Question 14

Preventative Controls

Answer 14

Implemented to prevent a security incident or information breach
Controls that keep a user from performing some activity or function
Not optional (like deterrent) and cannot be bypassed (the only way to bypass is finding a flaw in control’s implementation)
Example: segregation of duties (prevents certain users from performing certain tasks)

Question 15

Compensating Controls

Answer 15

Implemented to substitute for the loss of primary controls and mitigate risk down to an acceptable level
Introduced when the existing capabilities of a system do not support the requirement of a policy or when a primary control does not mitigate the risk to a level lower than the acceptable risk
Example:

Question 16

Detective Controls

Answer 16

Warning when something has happened (security breach), and are the earliest point in the post-incident timeline
Example: Intrusion detection system

Question 17

Corrective Controls

Answer 17

Implemented to remedy circumstance, mitigate damage, or restore controls

Question 18

Recovery Controls

Answer 18

Implemented to restore conditions to normal after a security incident
Example:

Question 19

Directive Controls (Administrative)

Answer 19

Provide guidance to personnel as to the expected behavior with respect to security within the organization
Example: Personnel security, monitoring, security policies

Question 20

Physical Controls (Operational)

Answer 20

Protect organization’s people and physical environment

Example: Locks, guards

Question 21

Technical Controls (Logical)

Answer 21

Electronic hardware and software solutions implemented to control access to information and information networks
Examples: User controls, network access, remote access