Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

ITEC85A - Information Assurance And Security 1 > Lecture 4 > Flashcards

Lecture 4 Flashcards

1
Q

?

process of identifying and controlling risks facing an organization

Risk Management

A

Risk Management

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

?

process of examining an organization’s current information technology security situation

Risk Management

A

Risk Identification

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

?

applying controls to reduce risks to an organizations data and information systems

Risk Management

A

Risk Control

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

?

Began as a advantage

Competitiveness

Risk Management

A

Information Technology Role

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

?

Now falling behind is a disadvantage

Competitiveness

Risk Management

A

Information Technology Role

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

?

is a necessity

Competitiveness

Risk Management

A

Availability

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

?

Understand the technology and systems in your organization

An Overview of Risk Management

Risk Management

A

Know yourself

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

?

Identify, examine, understand threats

An Overview of Risk Management

Risk Management

A

Know the enemy

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

(3) Role of Communities of Interest

An Overview of Risk Management | Enumerate

Risk Management

A
  • Information Security
  • Management and Users
  • Information Technology
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Verify ? of asset inventory

The Roles of Communities of Interest - Management Review

Risk Management

A

completeness/accuracy

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Review and verify threats as well as ? strategies

The Roles of Communities of Interest - Management Review

Risk Management

A

controls and mitigation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Review ? of each control

The Roles of Communities of Interest - Management Review

Risk Management

A

cost effectiveness

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

? of controls deployed

The Roles of Communities of Interest - Management Review

Risk Management

A

Verify effectiveness

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Risk management involves identifying ? and identifying ??

Risk Identification

Risk Management

A
  • organization’s assets
  • threats/vulnerabilities
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

?

begins with identification of assets, including all elements of an organization’s system (people, procedures, data and information, software, hardware, networking)

Asset Identification and Valuation

Risk Management

A

Iterative Process

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

?

are then classified and categorized

Asset Identification and Valuation

Risk Management

A

Assets

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Human resources, documentation, and data information assets are more difficult to ?

People, Procedures, and Data Asset Identification

Risk Management

A

identify

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

People with knowledge, experience, and good judgment should be assigned this ?

People, Procedures, and Data Asset Identification

Risk Management

A

task

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

These assets should be recorded using reliable ? process

People, Procedures, and Data Asset Identification

Risk Management

A

data-handling

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Asset attributes for ?: position name/number/ID; supervisor; security clearance level; special skills
* Try to avoid names

People, Procedures, and Data Asset Identification

Risk Management

A

people

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Asset attributes for ?
* Intended purpose
* Relationship to software, hardware, network elements
* Storage location

People, Procedures, and Data Asset Identification

Risk Management

A

procedures

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Asset attributes for ?
* classification; owner/creator/manager; data structure size; data structure used; online/offline; location; backup procedures employed

People, Procedures, and Data Asset Identification

Risk Management

A

data

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

(4) Asset attributes to be considered are:

Hardware, Software, and Network Asset Identification

Risk Management

A
  • Name (device or program name)
  • IP address
  • Media access control (MAC) address
  • Element type – server, desktop, etc. Device Class, Device OS, Device Capacity
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Where on network

Hardware, Software, and Network Asset Identification

Risk Management

A

Logical Location

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

Organization unit to which it belongs

Hardware, Software, and Network Asset Identification

Risk Management

A

Controlling entity

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

Many organizations have ? schemes (e.g., confidential, internal, public data)

Information Asset Classification

Risk Management

A

data classification

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

?

must be specific enough to allow determination
of priority

Information Asset Classification

Risk Management

A

Classification

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

?

all info fits in list somewhere

Information Asset Classification

Risk Management

A

Comprehensive

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

?

fits in one place

Information Asset Classification

Risk Management

A

Mutually exclusive

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

?

help develop criteria for asset valuation: which information asset

Information Asset Valuation

Risk Management

A

Questions

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

?

(4) Questions help develop criteria for asset valuation: which information asset

Information Asset Valuation | Enumerate Example

Risk Management

A
  • is most critical to organization’s success?
  • generates the most revenue?
  • generates the most profit?
  • would be most expensive to replace?
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

?

help develop criteria for asset valuation: which information asset

Information Asset Valuation

Risk Management

A

Questions

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

?

(2) Questions help develop criteria for asset valuation: which information asset

Information Asset Valuation | Enumerate Example

Risk Management

A
  • would be most expensive to protect?
  • would be most embarrassing or cause the greatest liability is revealed?
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

?

Calculate the relative importance of each asset

Listing Assets in Order of Importance

Risk Management

A

Weighted factor analysis

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

(3) Each info asset assigned score for each critical factor (0.1 to
1.0)

Listing Assets in Order of Importance | Enumerate

Risk Management

A
  • Impact to revenue
  • Impact to profitability
  • Impact to public image
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

Each critical factor is assigned a weight ?

Listing Assets in Order of Importance | Enumerate

Risk Management

A

(1-100)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

(2) Variety of classification schemes used by corporate and military organizations

Data Classification and Management | Enumerate

Risk Management

A
  • Georgia-Pacific Corporation (G-P) scheme
  • U.S. military classification scheme
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

?

Confidential, sensitive or proprietary

Data Classification and Management

Risk Management

A

Georgia-Pacific Corporation (G-P) scheme

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

?

Internal, G-P employee, authorized contractors

Data Classification and Management

Risk Management

A

Georgia-Pacific Corporation (G-P) scheme

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
40
Q

?

External, public

Data Classification and Management

Risk Management

A

Georgia-Pacific Corporation (G-P) scheme

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
41
Q

(5) U.S. military classification scheme

Data Classification and Management | Enumerate Example

Risk Management

A
  • Unclassified Data
  • Sensitive by unclassified data
  • Confidential data
  • Secret data
  • Top secret data
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
42
Q

?

responsible for classifying their information assets

Data Classification and Management

Risk Management

A

Information owners

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
43
Q

?

must be reviewed periodically

Data Classification and Management

Risk Management

A

Information classifications

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
44
Q

Most organizations do not need detailed level of classification used by ? or ?? agencies.

Data Classification and Management

Risk Management

A
  • military
  • federal
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
45
Q

(4) Organizations may need to classify data to provide protection

Data Classification and Management | Enumerate

Risk Management

A
  • Public
  • For official use only
  • Sensitive
  • classified
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
46
Q

Assign classification to all ?

Data Classification and Management

Risk Management

A

data

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
47
Q

Grant access to data based on ?

Data Classification and Management

Risk Management

A

classification and need

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
48
Q

Devise some method of managing data relative to ?

Data Classification and Management

Risk Management

A

classification

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
49
Q

?

: each data user assigned a single level of authorization indicating classification level

Security Clearances

Risk Management

A

Security clearance structure

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
50
Q

Before accessing specific set of data, employee must meet ? requirement

Security Clearances

Risk Management

A

need-to-know

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
51
Q

Extra level of protection ensures information confidentiality is ?

Security Clearances

Risk Management

A

maintained

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
52
Q

Storage, distribution, portability, and destruction of ?

Management of Classified Data

Risk Management

A

classified data

53
Q

Information not unclassified or public must be clearly ? as such

Management of Classified Data

Risk Management

A

marked

54
Q

?

requires all information be stored in appropriate storage container daily; unneeded copies of classified information are destroyed

Management of Classified Data

Risk Management

A

Clean desk policy

55
Q

?

can compromise information security

Management of Classified Data

Risk Management

A

Dumpster diving

56
Q

?

need investigation; unimportant threats are set aside

Threat Assessment

Risk Management

A

Realistic threats

57
Q

Each of the treats must be ? to assess potential
damage

Threat Assessment

Risk Management

A

examined

58
Q

(4) (Questions)

Threat Assessment

Risk Management

A
  • Which threats present a danger to an organization’s assets?
  • Which threats represent the most danger -probability of attack
  • How much would it cost to recover
  • Which treat requires the greatest expenditure to prevent?
59
Q

Identify each ? and each ?? it faces

Vulnerability Identification

Risk Management

A
  • asset
  • threat
60
Q

Create a list of ?

Vulnerability Identification

Risk Management

A

vulnerabilities

61
Q

Examine how each of the threats are likely to be ?

Vulnerability Identification

Risk Management

A

perpetrated

62
Q

? evaluates the relative risk for each vulnerability

Risk Assessment

Risk Management

A

Risk assessment

63
Q

Assigns a ? to each ??

Risk Assessment

Risk Management

A
  • risk rating or score
  • information asset
64
Q

Final summary comprised in ?

Documenting Results of Risk Assessment

Risk Management

A

ranked vulnerability risk worksheet

65
Q

(5) Worksheet details ?, ??, ???, ????, and ?????.

Documenting Results of Risk Assessment | Enumerate

Risk Management

A
  • asset
  • asset impact
  • vulnerability
  • vulnerability likelihood
  • risk-rating factor
66
Q

Order by ? factor

Documenting Results of Risk Assessment

Risk Management

A

risk-rating

67
Q

?

is initial working document for next step in risk management process: assessing and controlling risk

Documenting Results of Risk Assessment

Risk Management

A

Ranked vulnerability risk worksheet

68
Q

Once ranked vulnerability risk worksheet complete, must choose one of four strategies to control each risk:

Risk Control Strategies | Enumerate

Risk Management

A
  • avoidance
  • transference
  • mitigation
  • acceptance
69
Q

Apply safeguards that eliminate or reduce residual risks (?)

Risk Control Strategies - 4 Strategies

Risk Management

A

avoidance

70
Q

Transfer the risk to other areas or outside entities (?)

Risk Control Strategies - 4 Strategies

Risk Management

A

transference

71
Q

Reduce the impact should the vulnerability be exploited (?)

Risk Control Strategies - 4 Strategies

Risk Management

A

mitigation

72
Q

Understand the consequences and accept the risk without control or mitigation (?)

Risk Control Strategies - 4 Strategies

Risk Management

A

acceptance

73
Q

?

Attempts to prevent exploitation of the vulnerability

Risk Management

A

Avoidance

74
Q

?

accomplished through countering threats, removing asset vulnerabilities, limiting asset access, and adding protective safeguards

Avoidance

Risk Management

A

Preferred approach

75
Q

(3) Three common methods of risk avoidance:

Avoidance | Enumerate

Risk Management

A
  • Application of policy
  • Training and education
  • Applying technology
76
Q

?

Control approach that attempts to shift risk to other assets, processes, or organizations

Risk Management

A

Transference

77
Q

(5) Examples (of Transference I think)

Transference | Enumerate Example

Risk Management

A
  • Rethinking how services are offered
  • Revising deployment models
  • Outsourcing
  • Purchasing insurance
  • Implementing service contracts
78
Q

?

Concentrate on what you do best

Transference

Risk Management

A

In Search of Excellence

79
Q

?

Attempts to reduce impact of vulnerability exploitation through planning and preparation

Risk Management

A

Mitigation

80
Q

Approach includes three types of plans:

Mitigation | Enumerate

Risk Management

A
  • Incident response plan (IRP)
  • Disaster recovery plan (DRP)
  • Business continuity plan (BCP)
81
Q

?

is most common mitigation procedure

Mitigation | 3 types of plans

Risk Management

A

Disaster recovery plan (DRP)

82
Q

The actions to take while incident is in progress is defined in ?

Mitigation | 3 types of plans

Risk Management

A

Incident response plan (IRP)

83
Q

?

encompasses continuation of business activities if catastrophic event occurs

Mitigation | 3 types of plans

Risk Management

A

Business continuity plan (BCP)

84
Q

?

Doing nothing to protect a vulnerability and accepting the outcome of its exploitation

Risk Management

A

Acceptance

85
Q

?

Valid only when the particular function, service, information, or asset does not justify cost of protection

Risk Management

A

Acceptance

86
Q

?

describes the degree to which organization is willing to accept risk as trade-off to the expense of applying controls

Acceptance

Risk Management

A

Risk appetite

87
Q

Level of threat and value of asset play major role in ?

Selecting a Risk Control Strategy

Risk Management

A

selection of strategy

88
Q

?

implement security control to reduce likelihood

Selecting a Risk Control Strategy

Risk Management

A

When a vulnerability exists

89
Q

?

apply layered protections, architectural designs, and administrative controls

Selecting a Risk Control Strategy

Risk Management

A

When a vulnerability can be exploited

90
Q

?

apply protection to increase attackers costs

Selecting a Risk Control Strategy

Risk Management

A

When attacker’s cost is less than potential gain

91
Q

?

redesign, new architecture, controls

Selecting a Risk Control Strategy

Risk Management

A

When potential loss is substantial

92
Q

(4) Categories of Controls

Categories of Controls | Enumerate

Risk Management

A
  • Control Function
  • Architectural Layer
  • Strategy Layer
  • Information Security Principle
93
Q

?

Preventive & detective

Categories of Controls

Risk Management

A

Control Function

94
Q

?

Organizational policy, external networks, intranets, network devices, systems

Categories of Controls

Risk Management

A

Architectural layer

95
Q

?

Avoidance, mitigation, or transference

Categories of Controls

Risk Management

A

Strategy layer

96
Q

?

Classified by characteristics: Confidentiality, integrity, availability, authentication, authorization, accountability, privacy

Categories of Controls

Risk Management

A

Information security principle

97
Q

?

Compare cost to potential loss

Risk Management

A

Feasibility Studies

98
Q

?

is the process of avoiding the financial impact of an incident

Feasibility Studies

Risk Management

A

Cost avoidance

99
Q

?

Evaluate worth of asset

Risk Management

A

Cost Benefit Analysis

100
Q

Loss of value if asset ?

Cost Benefit Analysis

Risk Management

A

compromised

101
Q

(4) Items affecting cost of control

Cost Benefit Analysis | Enumerate Example

Risk Management

A
  • Cost of development or acquisition
  • Cost of implementation
  • Services costs
  • Cost of maintenance
102
Q

?

value gained by using controls

Cost Benefit Analysis

Risk Management

A

Benefits

103
Q

Calculate the single loss expectance
* ? = asset value * exposure factor
* ?? = % loss from exploitation

Cost Benefit Analysis - Assess worth of asset

Risk Management

A
  • SLE
  • Exposure factor
104
Q

Calculate Annualized loss expectancy
* ? = SLE * ARO (annualized rate of occurrence)

Cost Benefit Analysis - Assess worth of asset

Risk Management

A

ALE

105
Q

?

determines whether or not control alternative being evaluated is worth cost incurred to control vulnerability

Cost Benefit Analysis Formula

Risk Management

A

ALE

106
Q

? = ALE (prior) – ALE (post) – ACS

Cost Benefit Analysis Formula

Risk Management

A

CBA

107
Q

?

is annualized loss expectancy of risk before implementation of control

Cost Benefit Analysis Formula

Risk Management

A

ALE(prior)

108
Q

?

is estimated ALE based on control being in place for a period of time

Cost Benefit Analysis Formula

Risk Management

A

ALE(post)

109
Q

?

is the annualized cost of the safeguard

Cost Benefit Analysis Formula

Risk Management

A

ACS

110
Q

?

An alternative approach to risk management

Risk Management

A

Benchmarking

111
Q

?

is process of seeking out and studying practices in other organizations that one’s own organization desires to duplicate

Risk Management

A

Benchmarking

112
Q

(2) One of two measures typically used to compare practices:

Benchmarking

Risk Management

A
  • Metrics-based measures
  • Process-based measures
113
Q

(6) Metrics-based measures are comparisons based on numerical standards:

Benchmarking –Metrics-based measures

Risk Management

A
  • Number of successful attacks,
  • staff-hours spent of systems protection,
  • dollars spent on protection,
  • number of security personnel,
  • estimated value of info lost in attacks,
  • loss in productivity hours
114
Q

?

Less focus on numbers

Risk Management

A

Benchmarking – Process-based measures

115
Q

More strategic than ?

Benchmarking – Process-based measures

Risk Management

A

metrics-based measures

116
Q

Examine ? an individual company performs

Benchmarking – Process-based measures

Risk Management

A

activities

117
Q

?

when adopting levels of security for a legal defense, organization shows it has done what any prudent organization would do in similar circumstances

Benchmarking

Risk Management

A

Standard of due care

118
Q

?

demonstration that organization is diligent in ensuring that implemented standards continue to provide required level of protection

Benchmarking

Risk Management

A

Due diligence

119
Q

Failure to support standard of due care or due diligence can leave organization open to ?

Benchmarking

Risk Management

A

legal liability

120
Q

security efforts that provide a superior level protection of information

Benchmarking – Best Practices

Risk Management

A

Best business practices

121
Q

Organizations don’t talk to each other (?)

Problems with Applying Benchmarking and Best Practices

Risk Management

A

biggest problem

122
Q

No two organizations are ?

Problems with Applying Benchmarking and Best Practices

Risk Management

A

identical

123
Q

Knowing what was going on in information security industry in recent years through ? doesn’t necessarily prepare for what’s next

Problems with Applying Benchmarking and Best Practices

Risk Management

A

benchmarking

124
Q

Analysis of measures against established standards

Risk Management

A

Baselining

125
Q

In information security, ? is comparison of security activities and events against an organization’s future performance.

Risk Management

A

baselining

126
Q

The information gathered for an organization’s ? becomes the baseline for future comparison.

Baselining

Risk Management

A

first risk assessment

127
Q

“the goal of information security is not to bring ? to zero; it is to bring
residual risk into line with an organization’s comfort zone or ??

KEY

Risk Management

A
  • residual risk
  • risk appetite
128
Q

At minimum, each information ? should have documented control strategy clearly identifying any remaining residual risk, and feasibility studies to justify the findings.

Documenting Results

Risk Management

A

asset-threat pair

130
Q

?

document outcome of control strategy for each information asset-vulnerability pair as an action plan

Documenting Results

Risk Management

A

Another option

ITEC85A - Information Assurance And Security 1 (9 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2025 Bold Learning Solutions. Terms and Conditions