Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

EMC VDCCIPD > Module 3 Governance, Risk and Compliance > Flashcards

Module 3 Governance, Risk and Compliance Flashcards

0
Q

Two Governance Components

A
  1. Separation of Duties

2. Policy Definition

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
1
Q

GRC

A

Governance
Risk
Compliance

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

3 Characteristics of GRC

A
  1. Integrated and holistic
  2. Organization structures
  3. Process oriented
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Two Risk Management Components

A
  1. Change Management

2. Configuration Management

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Two Compliance Components

A
  1. Adherence to Regulations

2. Industry Aligned

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Integrated approach to organization-wide governance, risk management, and compliance.

A

GRC

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Helps ensure that an organization acts ethically correct and in accordance with its risk appetite, internal policies and external regulations.

A

GRC

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Integrated, holistic, and organization-wide

A

GRC

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Managed and supported through GRC

A

Operations

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Defines the guidelines and performance goals of an organization.

A

Governance

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Must include measurements of success to determine if the operation is performing to the company’s standard and, if not, what type of remediation is required.

A

Governance

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Four Consequences of Bad / Failed / No GRC

A
  1. Risk of fines for failed audits.
  2. Compliance concerns stall virtualization and Cloud.
  3. Audits - time consuming and costly.
  4. Concerns of identifying risk and proper valuation.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Examples of external events that drive a company to have a GRC program

A
  1. A breach where information is lost and has to be reported due to regulations.
  2. A new Federal regulation
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Companies usually accept the risk of exposure until what?

A

Until they have an actual breach

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Why GRC is important

A
  1. Breach
  2. Regulation
  3. Other?
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Is security GRC?

A

No. Security is not GRC.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q
  1. Related to information processing systems.

2. Mechanisms and techniques that control who may use or modify the computer or the information stored in it.

A

Security

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Three key security tenets

A
  1. Confidentiality
  2. Integrity
  3. Availability

CIA

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

CIA

A

Confidentiality
Integrity
Availability

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Purpose of IT security

A

To mitigate risks

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

IT risks are coupled with what?

A

Business risks

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

A framework for decision making, accountability, and measuring success.

A

Governance

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Data protection and regulatory laws require what?

A

Security controls

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

How does Compliance relate to Security?

A
  1. Data protection and regulatory laws require security controls.
  2. Access to information and enforcement.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Related to information processing systems

A

Security

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

Mechanisms and techniques that control who may use or modify the computer or the information stored in it.

A

Security

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

Key security rule regarding information

A

Always ensure that your company owns the information; retain ownership no matter who stores / maintains it.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

Key security rule regarding the Cloud

A

Make your information Cloud ready - clearly understand:

  1. Data you’re putting in the Cloud.
  2. Regulations and legislation surrounding that data.
  3. Worst case outcomes related to a breach of this information.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

Required for data

A

A creation-to-deletion plan

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

Layered Security Approach

A

Take a layered approach to protections with defense-in-depth, measuring against the CIA model, and keep roles segregated.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

Term for End-to-end Data Lifecycle

A

Information Lifecycle Management

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

Key because most regulated data has data lifecycle requirements and should be how all data is handled.

A

The end-to-end data lifecycle (Information Lifecycle Management)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

Four GRC Requirements for Virtualize Step

A
  1. Visibility into virtual infrastructure
  2. Privileged user monitoring
  3. Access management
  4. Network security
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

Four GRC Requirements for Operationalize Step

A
  1. Security compliance
  2. Information-centric
  3. Risk-driven policies
  4. IT & security operations alignment
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

Three GRC Requirements for IT-as-a-Service Step

A
  1. Secure hyrbid Clouds
  2. Secure multi-tenancy
  3. Chain of trust
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

3 Infrastructure Characteristics for Virtualize Step

A
  1. Automation
  2. Efficiency
  3. Integration of virtual OS and infrastructure
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

3 Infrastructure Characteristics for Operationalize Step

A
  1. On-demand
  2. Service Level Management
  3. Increased range of capability
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

3 Infrastructure Characteristics for IT-as-a-Service Step

A
  1. Metering and charge-back
  2. Federation of resources
  3. Geographically independent
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

Must be included when securing hybrid Clouds

A

Secure multi-tenancy and hardware root of trust

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

How do enterprises need to look at the Cloud?

A

As an extension of the data center

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
40
Q

Looking at the Cloud as an extension of the data center means what?

A

That security and GRC controls should already be in place and be enforceable with measurable results.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
41
Q

Most large enterprises fall between what two stages?

A

Between the Virtualize and Operationalize stages

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
42
Q

7 Top Threats - Cloud Security Alliance (CSA)

A
  1. Abuse and nefarious use of Cloud computing
  2. Insecure interface and APIs
  3. Malicious insiders
  4. Shared technology issues
  5. Data loss or leakage
  6. Account or service hijacking
  7. Unknown risk profile
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
43
Q

7 Top Threats - ENISA

A
  1. Loss of governance
  2. Lock-in
  3. Isolation failure
  4. Compliance risks
  5. Data protection
  6. Insecure or incomplete data deletion
  7. Malicious insider
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
44
Q

True or False: Currently, there are few tools, procedures, standard data formats, or services interfaces to guarantee data, application, and service portability.

A

True

45
Q

Dependency on a particular hypervisor for service provisioning, especially if data portability is not enabled.

A

Lock-in

46
Q

Includes the failure of mechanisms separating storage, memory, routing - and even reputation between different tenants (e.g., guest-hopping attacks).

A

Isolation Failure

47
Q

True or False: Attacks on resource isolation mechanisms (e.g., against hypervisors) are less numerous and much more difficult for an attacker to put in practice compared to attacks on traditional OSs.

A

True

48
Q

Compliance risks of migration to the VDC

A
  1. If the VDC cannot provide evidence of their own compliance with the relevant requirements.
  2. If the VDC does not permit audit by the VDC customer.
  3. If using a multi-tenant infrastructure implies that certain kinds of compliance cannot be achieved (e.g., Electronic Healthcare Records).
49
Q

True or False: Management interface compromise is not a Cloud security risk.

A

False

50
Q

Threat associated with requests to delete a Cloud resource

A

As with most OSs, may not result in true wiping of the data - insecure or incomplete data deletion

51
Q

Definition of Enterprise Governance

A

The active distribution of decision-making rights and accountability among different stakeholders in an organization and the rules and procedures for making and monitoring those decisions to determine and achieve desired behaviors and results.

52
Q

Questions related to Enterprise Governance

A
  1. Who makes directing, controlling and executing decisions?
  2. How will the decision be made?
  3. What info is required to make the decisions?
  4. What decision-making mechanisms should be required?
  5. How will exceptions be handled?
  6. How should governance results be reviewed and improved?
53
Q

Directors should govern ICT through which three main tasks?

A
  1. Evaluate the use of ICT.
  2. Direct preparation and implementation of plans and policies.
  3. Monitor conformance to policies, and performance against the plans.
54
Q

Four applications that require GRC

A
  1. Email
  2. Accounts Payable
  3. Accounts Receivable
  4. Expense Management
55
Q

Defines the rules of electronics discovery

A

U.S. Federal Rules of Civil Procedure (FRCP)

56
Q

FRCP

A

Federal Rules of Civil Procedure

57
Q

Requires improved transparency in financial services reporting methods, data collection, and aging standards.

A

Graham Leach Bliley Act (GLBA) - Financial Modernization Act of 1999

58
Q

GLBA

A

Graham Leach Bliley Act - Financial Modernization Act of 1999

59
Q

SOX

A

Sarbanes Oxley Act of 2002

60
Q

Requires improved transparency in public company filings.

A

Sarbanes Oxley Act of 2002

61
Q

Requires supporting information be kept in compliance with specifications around: ease of restore, length of data retention, types of data retained, and auditing processes.

A

Sarbanes Oxley Act of 2002 (SOX)

62
Q

PII

A

Personally Identifiable Information

63
Q

Usually includes Social Security Number (government ID), name, address, and credit card numbers

A

Personally Identifiable Information (PII)

64
Q

PCI DSS

A

Payment Card Industry Data Security Standard

PCI DSS

65
Q

Worldwide standard that specifies how cardholder information is collected, stored, processed, and shared with requirements for the processes (monitoring, audits) as well as the technology (encryption) used to manage PCI data.

A

Payment Card Industry Data Security Standard (PCI DSS)

66
Q

US regulations which apply to email

A

FRCP
GLBA
SOX
HIPAA

67
Q

US regulations which apply to accounts payable

A

GLBA

SOX

68
Q

US regulations which apply to accounts receivable

A

GLBA

SOX

69
Q

US regulations which apply to expense management

A

GLBA
SOX
PII
PCI

70
Q

Typical security requirements for email, accounts payable, accounts receivable, and expense management applications.

A

2 factor authentication

45 day password expiration

71
Q

The potential that a specific action or activity (including no action) will lead to an undesirable outcome

A

Risk

72
Q

3 VDC Risk & Risk Assessment Considerations

A
  1. What decision-making mechanisms should be required?
  2. How will exceptions be handled?
  3. How should governance results be reviewed and improved
73
Q

3 Cloud Risk & Risk Assessment Considerations

A
  1. Potential for data flow across boundaries in the public Cloud?
  2. Third party controls need to be clearly documented.
  3. Handoffs.
  4. Clear process to manage information flow.
74
Q

True or False: Traditional data centers have risk assessment considerations and they should be the foundation of any VDC and Cloud GRC implementation.

A

True

75
Q

Tenancy GRC Consideration

A

When data is no longer kept on a system dedicated to just one business unit or application and is now in a multi-tenant shared resource pool - what are the implications from a risk perspective?

76
Q

Auto-migration GRC Consideration

A

Does automatically migrating a VM and/or the data to another system or location have an impact on the risk level?

77
Q

Auto-scaling GRC Considerations

A

As workloads scale up is there an availability risk or performance risk?
Can the environment automatically scale up to handle the workload and what happens when it scales down?
Are all the systems left “clean” of residual data that could be exposed?

78
Q

Virtual provisioning GRC Considerations

A

Can it be considered a risk if it exhausts resources?

Has that consideration been included in the risk assessments?

79
Q

Cloud boundary GRC Considerations

A

With a public Cloud environment there are new risks such as the potential for data to be flowing across boundaries. Does the environment have adequate controls to assure that the data won’t cross borders if it is not allowed to due to rules of law or regulation?

80
Q

Cloud GRC considerations for trusted 3rd parties

A

Are there clearly understood controls for trusted 3rd parties, such as the Cloud SP?
Are they clearly documented to mitigate the risks as much as possible.

81
Q

Cloud GRC Considerations for Incidents

A

When an incident occurs, is there a clear definition of where / when / who handoffs are done to facilitate efficient incident response escalation and post mortems?

82
Q

Cloud GRC Consideration for Service Provider Information Flow

A

Do you as the customer have a clear process in place that manages the information flow and timing from the SP into your own organization and vice versa?

83
Q

5 Steps in the Risk Assessment Process

A
  1. Perform a quick, very high level risk check.
  2. Based on the risk score, determine what mitigation needs to be applied to allow the asset to be placed in a VDC or Cloud environment.
  3. Perform a full, detailed risk assessment. Understand all exposures; any further mitigations can be applied as necessary.
  4. Deploy the asset within the shared environment. Security controls are in place with compliance requirements being met.
  5. Re-evaluate the environment with another assessment and potentially an external audit.
84
Q

3 levels of a risk scoring system

A

Low
Medium
High

85
Q

5 Steps in Risk Assessment Process (Abbreviated Version)

A
  1. Quick Risk (L/M/H)
  2. Mitigation
  3. Full Risk Assessment
  4. Deploy
  5. Evaluate
86
Q

3 Quick Risk (L/M/H) Components

A
  1. Asset Valuation
  2. Pass / Fail
  3. For VDC or Cloud
87
Q

2 Mitigation Components

A
  1. Apply Standards

2. Apply Internal Mitigation

88
Q

3 Components of Full Risk Assessment

A
  1. Perform Deeper Assessment
  2. Determine Exposures
  3. Apply Mitigations
89
Q

2 Components of Deploy Stage in Risk Assessment Process

A
  1. With Security Controls

2. With Compliance Controls

90
Q

2 Components of Evaluate Stage of Risk Assessment Process

A
  1. People, Process and Technology

2. Execute Full Audits Internal and External

91
Q

Assessment usually applied to a whole business unit’s IT infrastructure and processes - or even a whole company.

A

ISO 27002 Assessment

92
Q

IRM

A

Information Rights Management

93
Q

True or False: Risk determination must be asset-centric.

A

True

94
Q

3 Risk Determination Quick Scoring Systems

A
  1. Balanced Scorecard
  2. Pre-Assessment
  3. Blended Methor
95
Q

What does a Balanced Scorecard risk determination evaluate?

A

Business and technology risk

96
Q

Pre-assessment usually pertains to privacy assessments.

A

True

97
Q

Pre-assessment IOS standard designed for financial services

A

ISO/IEC 22307

98
Q

4 Primary Risk Determination Considerations

A
  1. CIA - Confidentiality, Integrity, Availability
  2. Management and organization
  3. Value of application and data
  4. Leverage standards for mitigation
99
Q

Most important dimension to evaluate the risk

A

The value of the application and data to the company

100
Q

3 Information Security Questions

A
  1. Where is this application hosted?
  2. How are support processes performed for the application?
  3. Are there documented vulnerabilities in the application or associated infrastructure?
101
Q

3 Business Considerations for Risk Scoring

A
  1. Classify Data Sensitivity
  2. Cost of Financial Damage
  3. Value of Application Product and Data
102
Q

ALE

A

Average Loss Expectancy

103
Q

A state of being in accordance with established guidelines, specifications, or legislation

A

Compliance

104
Q

Compliance Issues

A
  1. Inventory applications
  2. Pre-assessment for risk level for the VDC and Cloud
  3. Deploy / apply rating system
  4. Evaluate based on regulatory requirements
  5. Evaluate compliance criteria for virtualization / Cloud
  6. If data will handled by SP, evaluate them for transitive risks
  7. Evaluate for vendor lock-in and future need to migrate to another provider.
105
Q

Generally used before the asset is to be placed in a new environment

A

Privacy Assessments

106
Q

Regulation which applies to financial data (personal and corporate)

A

PCI

107
Q

Regulations which apply to healthcare data

A

HIPAA

HITECH/HER

108
Q

Regulation which applies to financial data (corporate)

A

SOX

109
Q

Regulation which applies to personal information data

A

PII

110
Q

Examples of 3rd party audit

A

SAS 70 Type II

EMC VDCCIPD (5 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions