Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CAP > Misc. > Flashcards

Misc. Flashcards

1
Q

Assessment Object

A

AIMS

  • Activity
  • Individual
  • Mechanism
  • Specification
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Assessment Objective Methods

A

TIE

  • Test
  • Interview
  • Examine
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Assessment Objective Security Control Classes

A

MOT

  • Management
  • Operations
  • Technical
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

An Information System containing what cannot have an confidentiality impact level below moderate?

A
  • Privacy Information

- Trade Secrets

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

6 Steps of the Tailoring Guidance

A
  • Identifying and Designating Common Controls
  • Applying Scoping Considerations
  • Selecting Compensating Controls
  • Assigning Security Control Parameter Values
  • Supplementing Baseline Security Controls
  • Providing Additional Specification Information for Implementation
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Tiered Roles

A

Tier 1:

  • Organization (Governance)
  • Head/CEO, CIO, SISO, RE

Tier 1/2:
- CCP, ISO, SCA

Tier 2:

  • Mission/Business Process (Information Flow)
  • AO, AODR

Tier 3:

  • Information System (Environment of Operations)
  • ISO, IO, ISSO, ISSE
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Organizational Risk Frame

determines Risk Assessment Model

A
  • Risk Assumptions
  • Risk Constraints
  • Priorities and Tradeoffs
  • Risk Tolerance
  • Uncertainty
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

NIST 800-60 Process

A
  • Step 1: Identify Information Type
  • Step 2: Select Provisional Impact Level
  • Step 3: Review Provisional Impact Level and Adjust/Finalize Provisional Impact Level
  • Step 4: Assign System Security Category
  • Leads to Security Categorization and Security Control Selection
Low = Minor/Limited
Moderate = Serious
High = Severe/Catastrophic
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Risk Assessment Methodology

determined by Organizational Risk Frame

A
  • Risk Assessment Process
  • Risk Model
  • Assessment Approach
  • Analysis Approach
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Risk Management Process; what is it, where is it from?

A
  • NIST SP 800-39
  • Frame
  • Assess
  • Respond
  • Monitor
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Risk Assessment Process; what is it, where is it from?

A
  • NIST SP 800-39
  • Prepare
  • Conduct
  • Communicating
  • Maintaining
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What are the criteria for a National Security System? Where is it from?

A
  • NIST SP 800-59
  • Intelligence Activities
  • Cryptographic Information
  • Command and Control of Military Forces
  • Weapon/ Weapon System
  • Military or Intelligence Missions
  • Processes Classified Information
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What is the standard wording for an effective control?

A

Implemented correctly, operating as intended and producing the desired outcome

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Risk = ?

A

Likelihood x Impact

Threat and Vulnerability feed into Likelihood and Impact

Threat Source - initiates - Threat Event - exploits - Vulnerability - causing - Adverse Impact - producing - Organizational Risk

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Enterprise Architechture

A

People
Process
Technology

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Architecture Description Inputs

A
  • Architecture Reference Models
  • Segment and Solution Architectures
  • Mission and Business Processes
  • Information System Boundaries
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Organization Inputs

A
  • Laws, Directives, Policy Guidance
  • Strategic Goals and Objectives
  • Priorities and Resource Availability
  • Supply Chain Considerations
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

CIO

A
  • Will use words like “ensure a program does…”
  • Primarily administrative
  • Makes sure the ISCM program exists
  • Ensures resources are available to support
  • High level
  • Inherently government function
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

SCA

A
  • Will use words like “assessment” a lot
  • Updates the SSP and SAR
  • Submits the SAP for approval
  • Has to be an engineer (technically competent)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

SISO

A
  • Responsible for developing and implementing the ISCM program
  • Looks at initial monitoring strategy put together by the ISO and CCP
  • Tracks and analyzes POAMs
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

CCP

A
  • Only really involved a lot if some common controls need updating/remediation
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

RE

A
  • Oversees strategy and program
  • Matrix position
  • Collaborates and shares news with everyone
  • Uses words like: Shared, Communicated, Collaborated
  • Inherently government position
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

AO

A
  • Ensures security posture of the program is acceptable

- Makes authorization decisions

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

ISO

A
  • Does the grunt work
  • Ensures operational impacts are being done
  • Conducts assessments
  • Reports back to AO/SCA
  • Updates documentation
  • Only one who registers anything
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

ISSO

A
  • Assists the ISO
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

Safeguards v Countermeasures

A

Safeguards are designed into a system to prevent risk

Countermeasures are reactive and added after the risk assessment

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

RTO

A

Recovery Time Objective

Amount of time a system is allowable to be down; no impacts

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

MTD

A

Maximum Tolerable Downtime

Maximum amount of time a system can be down

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

RPO

A

Recovery Point Objective

Point to which you want to be able to restore to

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

Boxes and Knowledge

A
  • Basic (Black Box) - Zero Knowledge
  • Focused (Grey Box) - Partial Knowledge
  • Comprehensive (White Box) - Full Knowledge, Explicit and substantial
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

Forms of Authorization

A
  • Single Authorization
    - Traditional
    - One AO
  • Joint Authorization
    - Multiple AOs (maybe different services)
    - Have to agree on everything
  • Leveraged Authorization
    - Use an existing ATO and create your own ATO
    - Have to be willing to accept the risk or make changes (when able if it’s not your system)
    - ie: Cross service
32
Q

Cleaning v. Purging

A

Cleaning is erasing, but data can be recovered using forensic capabilities (overwriting)

Purging is erasing, but the data cannot be recovered using forensic capabilities (degaussing)

Purging: Rendering sanitized data unrecoverable by laboratory attack methods

33
Q

Continuous Monitoring Process

A 
Define/Monitor
Establish
Implement
Analyze
Respond
Review
34
Q

Risk Assessment and Risk Determination, in order

A

Threats
Vulnerabilities
Probability
Impact

35
Q

Types of Assessment Approaches

A

Quantitative
Qualitative
Semi-Quantitative

36
Q

Information Type

A

A specific category of information, defined by an organization or a specific law

37
Q

Subsystems in a service-oriented architecture (SOA) or net-centric architecture are registered in RMF Task 1-3 by:

A
  • Establishing a separate registration process
  • As a subset of systems or registered separately as a dynamic subsystem
  • Proper identification during system categorization
38
Q

What is an Overlay?

A

A specification that may be more or less stringent than the original criteria for security controls, control enhancements, supplemental guidance and other supporting information employed during the tailoring process, and is intended to complement (and further refine) security control baselines.

39
Q

What is Baseline Security?

A

The minimum security controls required for safeguarding an information technology system based on its identified impact levels for confidentiality, integrity and availability.

40
Q

What types of security are the two fundamental components that affect the trustworthiness of information systems?

A

Functionality-related (does it work?)

Assurance-related (can I prove it?)

(cited in NIST SP 800-53)

41
Q

What is a PIA?

A

Privacy Impact Assessment
Established by the E-Government Act of 2002

  • Ensure handling conforms to applicable legal, regulatory and policy requirements regarding privacy
  • Determine the risks and effects of collecting, maintaining and disseminating information in identifiable form in an electronic IS
  • Examine and evaluate protections and alternative processes for handling information to mitigate potential privacy risks
42
Q

Configuration Management has the following benefits:

A
  • Reliance
  • Quality Control
  • Risk Control
43
Q

What is a hybrid control?

A

A control determined partly by the organization and partly system-specific

44
Q

Contingency Planning Process (per NIST 800-34)

A
  1. Develop the contingency planning statement
  2. Conduct the Business Impact Analysis (BIA)
  3. Identify preventative controls
  4. Create contingency strategies
  5. Develop an information system contingency plan
  6. Ensure plan test, training and exercise
  7. Ensure plan maintenance
45
Q

Backup/Recovery Strategy for each Impact Level

A

Low

  • Back up: Tape backup
  • Strategy: Relocate or Cold site

Moderate

  • Backup: Optical backup, WAN/LAN replication
  • Strategy: Cold or Warm site

High

  • Backup: Mirrored systems and disc replication
  • Strategy: Hot site
46
Q

Partial assessments can be performed and are reusable if:

A

the assessor is deemed to be independent and technically competent. Additionally, the security control must be under configuration or version management.

47
Q

Logical flow for conducting security control assessments?

A

Assessment procedures, assessment objectives and assessment objects, all of which are evaluated using assessment methods

48
Q

RMF Step 4 primary documents

A
  • NIST 800-37
  • NIST 800- 53A
  • NIST 800- 115
49
Q

Security control assessments provide:

A
  • Evidence about the effectiveness of security controls
  • Information about the strengths and weaknesses of IS which are supporting organizational and business functions
  • An indication of the quality of the risk management process employed within the organization
50
Q

What documents form the Security Authorization Package?

A
  • SSP for the system to be authorized
  • SAR for the system to be authorized
  • POAMs for the system to be authorized
  • Same documents for all common control systems that are used to mitigate risks
51
Q

Sanitization

A

Process to remove information from media such that information recovery is not possible. Includes removing all labels, markings and activity logs.

52
Q

The security control analysis results and recommended changes are contained in the:

A

Security Assessment Report (SAR)

53
Q

The structure for POAMs is determined by:

A

The Office of Management and Budget (OMB)

54
Q

The pillars of continuous monitoring are:

A
  • Ongoing authorization

- Near real-time risk management

55
Q

Continuous Monitoring Strategy ensures that:

A
  1. Items on the POAM receive adequate oversight
  2. Controls with greater volatility or importance are assessed more frequently
  3. Control implementations that have changed since the last assessment are reevaluated
56
Q

Primary reference documents for RMF Step 6?

A

NIST SP 800-37

NIST SP 800-53A

57
Q

Before a rescission letter, the AO consults with:

A

SISO and RE

58
Q

Per NIST 800-55, performance management criteria translate into KPI using what evaluation criteria?

A
  • Measures of effectiveness
  • Measures of efficiency
  • Impact measures
59
Q

Compliance Management is:

A

A collection of processes employed to ensure that an agency conforms to the legal, policy and associated regulatory mandates that apply to a system

60
Q

Adequate security

A

Security commensurate with the risk and magnitude of harm resulting from the loss, misuse or unauthorized access to or modification of information

61
Q

Baseline security

A

The minimum security controls required for safeguarding an information technology system based on its identified impact levels for Confidentiality, Integrity and Availability

62
Q

System of Records Notice

A

An official notice of an organization’s system(s) of records, as required by the Privacy Act of 1974 that identifies:

  • the purpose for the system of records
  • the individuals covered by information in the system of records
  • the categories of records maintained about individuals
  • the ways in which the information is shared
63
Q

Information System

A

A discrete set of information resources organized for the collection, processing, maintenance, use, sharing, dissemination or disposition of information

64
Q

Threat Source

A

The intent and method targeted at the intentional exploitation of a vulnerability or a situation and method that may accidentally trigger a vulnerability

65
Q

Threat Scenario

A

A set of discrete threat events, associated with a specific threat source or multiple threat sources, partially ordered in time

66
Q

Threat Event

A

An event or situation that has the potential for causing undesirable consequences or impact

67
Q

NIST 800-37 Steps

A
  1. Categorize the IS
  2. Select Security Controls
  3. Implement Security Controls
  4. Assess Security Controls
  5. Authorize the IS
  6. Monitor Security Controls
68
Q

Organizational Risk Management Strategy includes

A
  • SORN
  • Strategic Goals and Objectives
  • Organizational Culture and Infrastructure
  • Investment Strategies?
69
Q

Risk Response options:

A

Risk Acceptance
Risk Avoidance
Risk Transfer/Sharing
Risk Mitigation

Combination of above

70
Q

Interconnecting system phases

A

From NIST SP 800-47

Plan
Establish
Maintain
Disconnect

71
Q

Incident Response Phases

A
  • Prepare
  • Detect and Analyze
  • Containment, Eradication and Recovery
  • Post-Incidence Activity
72
Q

Security Configuration Management Process

A
  • Planning
  • Identifying and Implementing Configurations
  • Controlling Configuration Changes
  • Monitor
73
Q

Inherently government roles

A
  • CIO
  • RE
  • SISO
  • AO/DR
  • IO/Steward
  • CEO (no primary roles)
74
Q

Depth means ?

Coverage means ?

A 
Depth = Rigor
Coverage = Scope
75
Q

Risk assessment incorporates

A

threat and vulnerability analysis and considers mitigations

76
Q

NIST 800-60 Exceptions/Key Statements

A
  • Aggregation
  • Privacy and Trade Secrets require minimum Moderate Confidentiality impact value
  • PIA must exist before developing systems with PII
  • The system categorization process, including determination of impact values, is reused during development of a BIA
  • System categorization contributes and provides inputs into capital planning and investments processes
  • Info sharing and system interconnection agreements should use aggregated and individual security categorization when assessing interconnection agreements
  • Specific guidance is provided related to critical infrastructure programs (CIP) and the relationship to Homeland Security Presidential Directive 7
77
Q

Defense-in-Depth

Defense-in-Breadth

A

Defense-in-Depth:
Strategy to establish visible barriers across multiple layers and dimensions

Defense-in-Breadth:
Set of activities that seeks to identify, manage and reduce risk of exploitable vulnerabilities at every stage of the system

CAP (4 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions