Putting it all together Flashcards
What is the HITRUST Common Security and Privacy Framework
HITRUST is an American Company working to have one framework, one certification, and one assessment as a globally recognized standard for exchanging attestations of trust between organizations public or private. HITRUST CSF normalizes the many different sets of security and privacy requirements, definitions, and controls, starting from the ISO/IEC 27000 family, U.S. government requirements, standards and guidelines such as NIST, HIPAA, and others, along with industry frameworks from COBIT and ITIL.
Why are security control frameworks different from other security governance frameworks
Security control frameworks (SCFs) provide the framework publishers’ minimum acceptable practices for implementation and operation of security controls within their span of activities. eg SWIFT PCI DSS
What actually is a framework?
Frameworks provide a set of principles upon which an organization builds its policies and processes.
Why is ISO 27000 not really applicable when adopting a framework?
Because ISO 27000 provides a general overview of the ISO “family” of standards. It includes such items as terms and definitions.
Within the U.S., the Health Insurance Portability and Accountability Act (HIPAA) was introduced to protect healthcare data. What framework was developed to support HIPAA?
HITRUST. The Common Security Framework (CSF).
Types of investigation
Administrative
Civil
Regulatory
Criminal investigation
International Organization of Standardization (ISO) 223XX Series
standards that define the requirements and guidelines of implementing a Business Continuity Management System in an organization
National Institute of Standards and Technology Special Publication 800-34
Contingency Planning Guide for Federal Information Systems,
What is the MAD
The maximum allowable downtime
BCDR What is read-through
A controlled, isolated role-playing activity, only involving those personnel tasked with disaster recovery or DR responsibilities and activities and a moderator. The participants should gather at a centralised location, such as a conference room, and bring all DR guidance materials
BCDR What is a walkthrough
in a walk-through, instead of staying around a conference table, the participants will walk to each of the locations they will need to visit for response activities, hence the name. They can still refer to written guidance and should be monitored by someone who can record any problems and successes. The walk-through is more beneficial than the tabletop exercise in terms of being able to assess physical limitations for response actions and establish timing for certain activities.
BCDR What is a simulation
A simulation can be thought of as a walk-through exercise with more complexity and involvement. A simulation might involve all personnel in each office or location participating in a scripted emergency situation. An example would be a fire drill where everyone evacuates from the worksite. Simulations can be much more expensive than tabletop or walk-through exercises because they involve more people and activity.
This is by far the most expensive BCDR exercise option, with the greatest impact to the organization and its stakeholders.
Simulation
Is running a parallel test a part of BC testing?
Yes, the business continuity test requires that we have solutions in place that allow business functions to continue. Testing the solution to see if it works would be considered a DR test.
A building evacuation test would be what type of test?
A DR test, as while the building is empty of staff there may be an interruption to business functions.
You are storing corporate data in the cloud. What would identify and control the type of media used to store the data?
A contract. The storage media is an example of one of the elements that might be included within the contract.
Your Internet Service Provider (ISP) has promised you a minimum download speed of 10Gbps. What document is designed to ensure compliance?
A service-level agreement (SLA). The contract will include levels of service.
Acceptable use policies (AUPs) detail, from the user’s expected perspective, the appropriate and approved usage of the organization’s assets, including the IT environment, devices, and data. Policy aspects commonly included in AUPs include the following except which one:
A. Data disclosure
B. Passwords
C. Ethical policies
D. Internet usage
The correct answer is C.
Ethical policies are not part of AUPs. The following policy aspects are commonly included in AUPs:
Data access
System access
Data disclosure
Passwords
Data retention
Internet usage
When should you use qualitative risk assessment
- Newness
- Uniqueness
When should you use quantitative risk assessment
Business process involved with the risks are well understood
Measurement techniques are available
Experience with the process in question will produce a large enough quantity of data samples
ALE = SLE x ARO
ALE = Annual loss expectancy
The annualized rate of occurrence (ARO) is the number of times per year a given impact is expected, expressed as a number.
The single loss expectancy (SLE) is the expected impact related to a particular risk (the risk being assessed).
There are various threat modeling tools, and one of the leading tools is
Microsoft STRIDE
These are the elements of STRIDE:
Spoofing identity: the type of threat wherein an attacker poses as an entity other than the attacker, often as an authorized user.
Tampering with data: when the attacker attempts to modify the target data in an unauthorized way.
Repudiation: when the attacker, as a participant of a transaction, can deny (or conceal) the attacker’s participation in that transaction.
Information disclosure: just like it sounds, this category can include both inadvertent release of data (where an authorized user discloses protected data accidentally to unauthorized users, or gains access to material that their authorization should not allow) and malicious access to data (an attacker getting unauthorized access).
Denial of service (DoS): an attack on the availability aspect of the CIA triad; creating a situation in the target where authorized users cannot get access to the system/application/data.
Elevation of privilege: when an attacker not only gains access to the target but also can attain a level of control with which to completely disable/destroy the entire target system.
Aside from STRIDE name two other threat models
OOCTAVE and TRIKE
Types of controls
Technical controls (firewalls)
Physical controls (walls fences guards locks)
Administrative controls
Security control categories
Directive
Deterrent
Preventative
Compensating
Detective
Corrective
Recover
What type of control is a badge system
Preventative and compensating
When selecting security and privacy controls, an organization can use various frameworks. According to NIST SP 800-37, Revision 2, the Select Step of the Risk Management Framework, there are two approaches that can be used for the initial selection of security and privacy controls
baseline control selection approach, or an organization-generated control selection approach.
The baseline control selection approach
uses control baselines, which are pre-defined sets of controls specifically assembled to address the protection needs of a group, organisation, or community of interest.
The organisation-generated control selection approach differs from the baseline selection approach because
the organisation does not start with a pre-defined set of controls. Rather, the organisation uses its own selection process to select controls.
When would organisation generated controls be necessary
when the system is highly specialized (like a weapons system or a medical device) or has limited purpose or scope (such as a smart meter). In these situations, it may be more efficient and cost-effective for an organization to select a specific set of controls for the system (a bottom-up approach) instead of starting with a pre-defined set of controls
Risk management key performance indicators
Time to detect (user behaviours, indicators of intrusion, intrusions)
Number of endpoints connected to systems that have required security updates and patches
numbers of systems with known exploitable vulnerabilities
The SSAE 16 standard details three types of reports intended for different uses; these are
the SOC reports
What are the differences between the SOC reports
SOC 1 is a financial audit report, SOC 2 is a security and controls report and SOC 3 report is similar to SOC 2 drafted to be presented to a general audience.
SOC 1 offers two types of reports: Type I and Type II. While Type I showcases that your company’s internal financial controls are properly described and designed at a point in time, a Type II report tests
the effectiveness of your controls over a period (for example, six months).
SOC 2 Type II compliance audit looks at
the effectiveness of the same controls over a period, say, six months or a year, and takes longer for service providers to prepare for it.
What are the four perspectives on risk
Asset Based
Outcomes-based
Vulnerability-based
Threat-based
What is the converse of risk acceptance
Risk avoidance
What is the difference between risk acceptance and residual risk
risk acceptance means that the organisation does nothing
What does Mitigate become with ISO 27005:2018
Modification
What does transfer become with ISO 27005:2018
Sharing
Risk exposure is a term that has three meanings in risk management.
An exposure window measures over the time of the likelihood or probability of occurrence of a risk event.
the fraction of an asset’s value or the outcome to an organization that is reduced by a single occurrence of a risk event
an estimate or a description of how certain risks are categorically much lower or higher than others for a given organisation or person eg. companies operating or not operating in Iran
In risk management what is FAIR
The factor analysis of information risk, FAIR, method provides a solid numerically straightforward and managerially simple way to make most risk assessment tasks start out quantitative and stay that way.
Where is FAIR used
It’s been integrated into the NIST CSF HITRUST and is fully compatible with ISO 31000, COBIT and COSO risk management frameworks.
What are the common areas of security learning
Education
Training
Awareness
What is the difference between Education and Training
Education is focussed on cause and effect
Training is about get a set of skills
What type of security learning might be provided by an academic institution?
Question options:
A) Education
B) Training
C) Awareness
D) All of the above
All of the above
The process of reviewing a system for compliance against a standard or baseline. Examples include audits of security controls, configuration baselines, and financial records
Audit or Auditing
Adherence to a mandate; both the actions demonstrating adherence and the tools, processes, and documentation that are used in adherence.
Compliance
An act that involves the use of information, information systems, or information technologies in ways that violate the laws that pertain to the system and the information in question.
Cybercrime
The natural person who is identified or described by the data.
Data subject
A legal and ethical duty owed by a provider to a customer, and the actions taken by provider to fulfill that duty
Due Care
Specific mandates explicitly stating expectations of performance or conformance. Standards can be defined by one entity and adopted by others, or may be internal mandates exclusive to an organization.
Standards
The phases that an asset goes through from creation (collection) to destruction.
Asset Lifecycle
The process of grouping sets of data, information, or knowledge that have comparable sensitivities (impact or loss ratings), and have similar security needs mandated by law, contracts, or other compliance regimes.
Categorisation
The process of recognizing the impacts to the organization if its information suffers any security compromise - to its confidentiality-, integrity-, availability-, non-repudiation-, authenticity-, privacy-, or safety-related characteristics.
Classification
The removal of sensitive data from storage devices in such a way that there is assurance the data may not be reconstructed using normal system functions or software recovery utilities.
Clearing
Eliminating data using a controlled, legally defensible, and regulatory compliant way.
Defensible destruction
The removal of sensitive data from a system or storage device with the intent that the data cannot be reconstructed by any known technique.
Purging
The process of jointly addressing business resiliency and restoration of critical infrastructure and functionality after a disruption.
Recovery
Limiting the general baseline recommendations by removing those that do not apply.
Scoping
The process by which a security control baseline is modified based on (i) the application of scoping guidance, (ii) the specification of compensating security controls, if needed, and (iii) the specification of organization-defined parameters in the security controls via explicit assignment and selection statements. Source: NIST SP 800-37 Rev 1
Tailoring
Means to ensure that access to assets is authorized and restricted based on business and security requirements related to logical and physical systems.
Access control system
This is achieved when the type I and type II are equal.
Crossover Error Rate (CER)
The individual or entity who is responsible to classify, categorize and permit access to the data.
Data owner / controller
Any entity, working on behalf or at the behest of the data controller, that processes data
Data processor
The individual that the PII refers to
Data Subject
The system owner decides who gets access.
Discretionary access control (DAC)
This is erroneous recognition either by confusing one user with another, or by accepting an imposter as a legitimate user.
False Acceptance Rate (Type II)
This is failure to recognize a legitimate user.
False Rejection Rate (Type I)
The process of collecting and verifying information about a person for the purpose of proving that a person who has requested an account, a credential, or other special privilege is indeed who he or she claims to be and establishing a reliable relationship that can be trusted electronically between the individual and said credential for purposes of electronic authentication.
Identity proofing
Non-physical system that allows access based upon pre-determined policies
Logical access control system
What is the data lifecycle
Create, store, use, share, archive and destroy
In data destruction what is CLEARING
usually involves writing multiple patterns
of random values throughout all storage
media (such as main memory, registers,
and fixed disks). This is sometimes called
“clobbering” or “zeroizing”
In data destruction what is PHYSICAL DESTRUCTION
Physical destruction of the device or
system is the ultimate remedy to data
remanence. Magnetic or optical disks and
some flash drive technologies may require
being mechanically shredded, chopped,
or broken up,
SP800-181 Rev. 1 discusses
National Initiative for Cybersecurity Education (NICE). SP800-207
Which NIST publication addresses the engineering-driven actions for defensible systems?
SP800-160
SP800-207 discusses
zero-trust architecture
SP800-210 discusses
access control guidance for cloud systems.
