Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

ISC > S1 > Flashcards

S1 Flashcards

1
Q

NIST

A

National Institute of Standards and Technology Framework (1901) (1995 - Info Security). Here to protect us

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Why do we need IT?

A

Organizations adopt technology to enhance or support business operations; protect digital records and assets; safeguards physical assets

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

NIST Cybersecurity Framework

A

Voluntary framework that includes three components to manage cybersecurity risk:
1. Framework
2. Framework Implementation
3. Framework Profile

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

CS Framework Core ComponentsDRRIP

A

Identify
Protect
Detect
Respond
Recover

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Identify ID

Privancy Core

A

Keep records of: assets of the organization, system users internal/external, information process operations and all system used

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Protect

Privancy Core

A

Focus on deploying safeguards and access controls to networks, applications, and devices.
Performing regular updates to security software
Performing data backups, developing plans for disposing of files or unused devices and user training

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Detect

A

Deploy tools to: Detect cyber security attacks.
Monitor network access points, user devices, unauthorized personnel access.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Respond

A

Develop response polices addressing how to:
Contain a cybersecurity event
React using planned responses that mitigate losses
Notify

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Recover

Privacy Core

A

Focuses on:
Supporting the restoration of a company’s network to normal operations
Restoring backed up files or environments

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Implementation Tiers

A

How sophisticated is a company’s security infrastructure?
Inform an organization as to the effectiveness of those profiles.
Tiers act as a benchmark, identifying the degree to which information security practices are integrated throughout an organization.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

CSF Framework Profiles

A

Determine success or failure of information security implementation. Implementation guides with insight specific to a particular industry

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Tier Levels

A

Tier 1 (partial)
Tier 2 (risk informed)
Tier 3 (Repeatable)
Tier 4 (Adaptive)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Tier Categories

A

Risk management process
Integrated risk management program
External participation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Tier 1 (partial)

A

Risk management Process: Ad hoc and reactive
Integrated Risk Management: Not integrated into organization processes
External Participation: does not evaluate external risks, cybersecurity is isolated

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Tier 2 (Risk Informed)

A

Risk Management Process: CS prioritization is based on org risk, and management approves CS efforts
Integrated Risk Management: org is aware of CS but not managing securely
External Participation: there is awareness but inconsistent actions are taken to respond to those risks

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Tier 3 (Repeatable)

A

Risk Management Process: org utilizes CS in planning and has enshrined CS practices in formal policies
Integrated Risk Management: a org risk approach to CS where CS is integrated into planning and regularly communicated
External Participation: org collabs w/ and contributes to security community at large. Has gov structures internally to manage cyber risk

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Tier 4 (Adaptive)

A

Risk Management Process: org CS is based on iterative improvements based on internal/external cyber incidents
Integrated Risk Management: managing CS is a org wide affair, cyber risk is prioritized
External Participation: org robustly participates in external info sharing activities

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Current Profile

A

Current state of the org risk managment

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Target profile

A

Desired future state of org risk management

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Gap Analysis

A

Identifies differences between the current and desired state

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

NIST Privacy Framework

A

Protect individuals data as used in data processing applications. Developed to be industry agnostic and to account for cultural and individual constructs around privacy

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Privacy Framework Core Components (PICCG)

A

Identify
Govern
Control
Communicate
Protect

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Govern

Privacy Core

A

What is the best governance structure for privacy risks related to the company’s data processing activities?

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Control

Privacy Framework Core

A

What is the best management structure for privacy risks related to data processing activities

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

Communicate

Privacy Framework Core

A

How should the org drive dialogue around privacy risks related to data processing activities

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

NIST SP 800-53 Framework

A

Set of security and privacy controls applicable to all info systems and now the standard for federal info security systems. Designed for protecting, care about effectiveness not cost

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

SP 800-53 Security and Privacy Requirements

A

OMB - requires the controls for federal information systems
FISMA - requires the implementation of minimum controls to protect federal info and info systems

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

Common (Inheritable) Control

NIST SP 800-53

A

Implement controls at the org level, which are adopted by info systems

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

System Specific Control

NIST SP 800-53

A

Implement controls at the information system level

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

Hybrid Control

NIST SP 800-53

A

Implement controls at the org level where appropriate and the rest at the info system level

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

Data Breach Costs

A

Detection and escalation: Cost to detect
Notification: costs to notify parties
Post-breach Response: Cost to rectify effects
Loss of Business and Revenue: temp lost do to down time

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

HIPAA

A

Health Insurance Portability and Accountability Act required the department of health and human services to adopt national standards promoting health care privacy and security

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

HIPAA Security Rule

A

Specifically governs electronic PHI. Under the security Rule all covered entities must:
ensure the confidentiality, integrity, and availability of all electronic PHI;
Protect against reasonably anticipated threats;
Ensure compliance

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

HITECH

A

Amended HIPPA:
Increased penalties for HIPPA violations
Required that patients receive the option to obtain records in electronic form
Breach rule to notify within 60 days of discovery

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

GDPR (Data Protection) Principals

A

European Unions general applicability law regulating the privacy of data

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

Lawfulness, Fairness, Transparency

GDPR

A

Data must be processed lawfully, fairly, and in a transparent manner

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

Purpose Limitation

GDPR

A

Data must be processed for specified, explicate, and legitimate purposes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

Data Minimization

GDPR

A

Data processing must be adequate, relevant, and limited to what is necessary

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

Accuracy

GDPR

A

Data must be accurate and kept updated

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
40
Q

Storage Limitation

GDPR

A

Data must be stored only for as long as necessary. storing it for longer periods is permitted for public interest archiving, scientific or historical research, or statistical purposes.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
41
Q

Integrity and Confidentiality

GDPR

A

Data must be processed securely and protected against unauthorized access, accidental loss, destruction, or damage

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
42
Q

Payment Card Industry Data Security Standard

A

A framework to apply to promote data security when processing payments

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
43
Q

Build and Maintain a Secure Network and System

PCI DSS

A
  1. Install and maintain a firewall configuration to protect cardholder data
  2. Do not use vendor supplied defaults for system passwords
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
44
Q

Protect cardholder Data

PCI DSS

A
  1. Protect stored cardholder data
  2. Encrypt transmission of cardholder data across open networks
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
45
Q

Maintain a Vulnerability Management Program

PCI DSS

A
  1. Protect all systems against malware and regularly update anti-virus software programs
  2. Develop and maintain secure system applications
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
46
Q

Implement Strong Access Control Measures

PCI DSS

A
  1. Restrict access to cardholder data through need to know restrictions
  2. Identify and authenticate access to system components
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
47
Q

Regularly Monitor and Test Networks

PCI DSS

A
  1. Track and monitor all access to network resources and cardholder data
  2. Regularly test security systems and processes
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
48
Q

CIS

A

The Center for Internet Security. Controls are a recommended set of actions, processes, and best practices that can be adopted and implemented by organizations to strengthen their cybersecurity defenses.

49
Q

CIS Control Principles OFFAM

A

Offense Informs Defense
Focus
Feasible
Align
Measurable

50
Q

Align

CIS Principle

A

Controls should map to other top cybersecurity standards like NIST VS, COBIT, HIPPA

51
Q

Measurable

CIS Principle

A

Controls should be simple and measurable, avoiding vague language

52
Q

Offense Informs Defense

CIS Prinicple

A

Controls are drafted based on data from actual CS attacker behavior and how to defend against it

53
Q

Focus

CIS Principle

A

Controls should help prioritize the most critical problems and avoid resolving every CS issue

54
Q

Feasible

CIS Principle

A

All recommendations should be practical

55
Q

IG1

CIS Impletmentation Group

A

Group is for small or mid sized orgs that have limited CS defense mechanisms in place

56
Q

IG2 (includes IG1)

CIS Impletmentation Group

A

Group is for companies that have IT staff who support multiple departments that have various risk profiles and typically handle sensitive client data

57
Q

IG3 (Includes IG1 and IG2)

CIS Impletmentation Group

A

Group for companies that have security experts in all domains within CS such as penetration testing, risk management, and application security.

58
Q

CIS Control 01

Inventory and Control of Enterprise Assets

A

Inventory and Control of Enterprise Assets: Helps orgs actively track and manage all IT assets connected to a company’s IT infrastructure physically or virtually with a cloud environment

59
Q

CIS Control 2

Inventory and Control of Software Assets

A

Provides recommendations for orgs to track and actively manage all software applications so that only authorized software can be installed

60
Q

CIS Control 3

Data Protection

A

Helps orgs develop ways to securely manage the entire life cycle of their data

61
Q

CIS Control 4

Configuration of Enterprise Assets and Software

A

this control helps orgs establish and maintain secure baseline configurations for their enterprise assets

62
Q

CIS Control 5

Account Management

A

Outlines best practices for companies to manage credentials and authorization for user accounts, privileged user accounts, and service accounts for company hardware and software applications

63
Q

CIS Control 6

Access Control Management

A

Control expands on 5 by specifying the type of access that user accounts should have

64
Q

CIS Control 7

Continuous Vulnerability Management

A

Control assists org in continuously identifying and tracking vulnerabilities within its infrastructure so that it can remediate and eliminate weak points or windows

65
Q

CIS Control 8

Audit Log Management

A

Control establishes an enterprise log management process so that organizations can be alerted and recover from an attack in real time

66
Q

CIS Control 10

Malware Defense

A

assists companies in preventing the installation and propagation of malware onto company assets and its network

67
Q

CIS Control 9

Email and Web Browser Protections:

A

Provides recommendations on how to detect and protect against cybercrime attempted through email or the internet

68
Q

CIS Control 11

Data Recovery

A

Establishes data backup, testing, and restoration processes that allow organizations to effectively recover company assets

69
Q

CIS Control 12

Network Infrastructure Management:

A

This control establishes procedures and tools for managing and securing a company’s network infrastructure. Network infrastrucutre is up to date, maintain a secure network architecture

70
Q

CIS Control 13

Network Monitoring and Defense

A

Establishes processes for monitoring and defending a company’s network infrastructure against internal and external security threats

71
Q

CIS Control 14

Security Awareness and Skill Training:

A

Guides organizations in establishing a security awareness and training program to reduce cybersecurity risk

72
Q

CIS Control 15

Service Provider Management

A

helps organizations develop processes to evaluate third party service providers that have access to sensitive data or that are responsible for managing some or all of a company’s IT functions

73
Q

CIS Control 16

Application Software Security

A

establishes safeguards that manage the entire life cycle of software that is acquired, hosted, or developed in house to detect, deter and resolve CS weaknesses before they are exploited

74
Q

CIS Control 17

Incident Response Management:

A

Provides the recommendations necessary to establish an incident response management program to detect, respond, and prepare for potential CS attacks

75
Q

CIS Control 18

Penetration Testing

A

Control helps organizations test the sophistication of their CS defense system in place by simulating actual attacks in effort to find and exploit weakness.

76
Q

COBIT

A

Control Objectives for Information and Related Technologies
provides a road map that organizations can use to implement best practices for IT governance and management.

77
Q

COBIT Principles for Governance System GETPHD

A

Governance Distinct from Management (Distinct)
End to end governance system (End to end)
Tailored to enterprise needs (Tailored)
Provide stakeholder Value (Value)
Holistic approach (Holistic)
Dynamic governance system (Dynamic)

78
Q

COBIT Principles for a Governance Framework BOA

A

Based on conceptual model
Open and flexible
Aligned to major standards

79
Q

Provide stakeholder Value (Value)

COBIT

A

gov system should create value for the company’s stakeholders by balancing benefits, risks, and resources

80
Q

Holistic approach (Holistic)

COBIT

A

gov systems for IT can comprise diverse components, collectively providing a holistic model.

81
Q

Dynamic governance system (Dynamic)

COBIT

A

When a change in one gov system occurs, the impact on all others should be considered so that the system continues to meet the demands of the organization. continue to be relevant while adjusting as a new challenge arises

82
Q

Governance Distinct from Management (Distinct)

COBIT

A

Management activities and governance systems should be clearly distinguished from each other because they have different functions

83
Q

Tailored to enterprise needs (Tailored)

COBIT

A

gov models should be customized to each individual company, using design factors to prioritize and tailor the system

84
Q

End to end governance system (End to end)

COBIT

A

All processes in the org involving info and tech should be factored into an end to end approach

85
Q

COBIT Governance Objectives

A

One domain: evaluate, direct, and monitor (EDM): those charged with governance evaluate strategic objectives, direct management to achieve those objectives, and monitor whether they are being met

86
Q

COBIT Management Objectives

A

Four domains
Align, plan and organize (APO)
Build, acquire, and implement (BAI)
Deliver, service, and support (DSS)
Monitor, evaluate, and assess (MEA)

87
Q

EDM Domain

A

Those charged with governance evaluate strategic objectives, direct managment to achieve those objectives, and monitor wheather objectives are being met. 5 objectives:
ensuring business delivery, governance framwork setting, risk optimization, resouce optimization, and stakeholder engagment

88
Q

APO Domain

A

Focuses on aligning information tech overall strategy, planning how to utilize technology in business operation of the organization, and organizing the resources for their most effective and efficient usage. 14 objectives - managed data is most significant

89
Q

BAI Domain

A

Addresses the building, acquiring, and implementation of information technology solutions in the organizations business processes. 11 objectives, offering guidance on requirements definition, identifying solutions, managing capacity, availability, org change…

90
Q

DSS Domain

A

Addresses the delivery, service, and support of IT services. 6 objectives - service request is most important

91
Q

MEA Domain

A

Addresses information tech conformance to the company’s performance targets and control objectives along with external requirements. Accomplished through continuous monitoring, evaluation, and assessment of info tech systems. 4 objectives - managed system of internal control is most important

92
Q

COBIT Components to Satisfy Objectives

A

Components are factors that either collectively or individually contribute to the successful execution of a company’s governance system over information technology and systems.

93
Q

COBIT Design Factors

A

Influence the design of a companys IT goverance system, with a total of 11 factors to consider

94
Q

COBIT Publications

A

Designed so that companies could adopt its recommendations in a way that is customized to their own needs

95
Q

COBIT 2019 Framework: Introduction and Methodology

A

Introduces the core concepts of the framework

96
Q

COBIT 2019 Framework: Governance and Management Objectives

A

Provides a outline of the 40 management and governance objectives, components and references

97
Q

COBIT 2019 Design Guide: Designing an Information and Technology Governance Solution

A

Covers design topics that influence governance as well as a guideline for designing a customized gov system

98
Q

COBIT 2019 Implementation Guide: Implementing and Optimizing an Information nd Technology Governance Solution

A

Provides a road map for continuous improvements when designing information tech gov systems -used in conjunction with design guide

99
Q

Processes COBIT Component

A

activities to achieve goals

100
Q

Organizational Structures

A

decision making entities

101
Q

Principals, Policies and Frameworks

COBIT Compenent

A

These serve as the guide for turning desired behavior into practice

102
Q

Information

COBIT Compenent

A

info needed for gov system to work

103
Q

Culture, Ethic, and Behavior

COBIT Component

A

These factors influence the success of all management and governance activities

104
Q

People, Skills, and Competencies

COBIT Component

A

These are needed so that sound decisions are made, corrective actions are taken when necessary, and critical objectives are complete

105
Q

Services, Infrastructure, and Applications

COBIT Component

A

gov system tools and resources needed for info tech processing

106
Q

Enterprise Strategy

COBIT Design Factor

A

IT governance strategies generally include a primary strategy and a secondary strategy. Examples include growth/acquisition, innovations/differentiation, cost leadership

107
Q

Enterprise Goals

COBIT Design Factor

A

Goals support the strategy and are structured based on the balanced scorecard dimensions, which are financial, customer, internal, and growth

108
Q

Risk Profile

COBIT Design Factor

A

Addresses current risk exposure for the organization and maps out which risks exceed the orgz risk appetite

109
Q

Information and Tech Issues

COBIT Design Factor

A

Common issues include regular IT audit findings of poor IT quality or control, insufficient IT resources, frustration between IT and different departments, hidden IT spending, problems with data quality, and non compliance with applicable regulations.

110
Q

Threat Landscape

COBIT Design Factor

A

the environment in which the company operates. The threat landscape may be classified as normal or high because of geopolitical threats or issues, the industry sector, or economic issues.

111
Q

Compliance Requirements

COBIT Design Factor

A

Compliance demands on the company can be classified as low, normal, or high. Classifications are intuitive, with low requirements implying minimal compliance demands, normal compliance indicating that the organization is typical of its industry

112
Q

Role of IT

COBIT Design Factor

A

Categorized as:
Support - system that is not critical for operating a business or maintaining continuity
Factory - system that will have an immediate impact in business operations and continuity if it fails
Turnaround - system that drives innovation for the business but s not required for critical business operations
Strategic - system that is crucial for both innovation and business operations

113
Q

Sourcing model for IT

COBIT Design Factor

A

Sourcing is the type of IT procurement model the company adopts, ranging from outsourcing, to cloud based, built in house, or a hybrid of any of these sources

114
Q

Technology Adoption Strategy

COBIT Design Factor

A

First mover strategy - emerging technologies are adopted as soon as possible to gain an edge
Follower strategy - emerging technologies are adopted after they are prove
Slow-adopter strategy - very late to adopt new tech

115
Q

Enterprise Size

COBIT Design Factor

A

Two enterprise sizes are defined - large companies with total full-time employee count of more than 250, and small/mid companies with 50 to 250 full time employees

116
Q

Govern Function

NIST Privacy Framework Core

A

governance policies, process, and procedures
-risk management strategy
-awareness and training
-monitoring review

117
Q

What is are examples of admin safeguards?

HIPPA

A

-security and awareness training
-information access management
-Contingency plans

118
Q
A

ISC (18 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions