Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CISSP > Security and Risk Management > Flashcards

Security and Risk Management Flashcards

1
Q

5 Pillars of information security

A
  1. Confidentiality: Secure read access
  2. Integrity: Secure write access
  3. Availability: Systems are available for normal business use
  4. Authenticity: Proving an identity claim
  5. Nonrepudiation: The combination of integrity and authenticity
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

CIA Opposite

A

Disclosure, Alteration, Destruction

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Confidentiality (opp Disclosure)

A

Aims to prevent the unauthorized disclosure of information

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Integrity ( Opp Alteration)

A

Focuses on the prevention of unauthorized modification of assets.

Applies to both data and systems

Malware installation would be a violation of a system’s integrity

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Availability (Opp Destruction)

A

Ensures that required access to resources remains possible

Ransomware and denial of service(DoS) attacks represent breaches of availability

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Privacy

A

defined as confidentiality and protection of PII

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Identification

A

Provides a weak and unproven claim of identity

providing a username - an example of identification

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Authenticity

A

serves as proof a user’s identity claim is legitimate

strong authentication implies higher integrity means of proof

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Nonrepudiation

A

Combination of integrity and authenticity

Eg: proving a user signed a contract, while also proving that the contract was not subsequently altered

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Authorization

A

proceeds after successful authentication and determines what the authenticated user can do

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Accounting

A

details the interactions performed by individuals

Audit logs could be generated for accountability / documented actions

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

4 main categories of authentication

A

something you know
something you have
something you are
someplace you are (GPS ) - SANS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Two-factor or multi-factor authentication

A

using 2 of the categories

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

PoLP

A

Principle of least privilege(PoLP) known as Min necessary access

fundamental principle of security

Any additional rights, permissions, privileges, or entitlements violate this principle

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Separation of Duties (SoD)

A

Goal of SoD is to limit risk associated with critical functions/transactions

Risk is mitigated by requireing two parties to perform what one person could

Eg: Requiring multiple individuals to sign a check (financial transactions)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Rotation of duties

A

Another policy for fraud deterrence/detection
- force other people to be in charge of key tasks

eg: printing payroll checks

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Due Care and Due Deligence

A

Due Care: acting as any reasonable person would (referred to as prudent man rule)

Due diligence: practices to processes that ensure the decided upon standard of care is maintained

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

types of controls

A

preventive :deny unauthorised access to resources
detective: tries to detect that ther eis a pbm after an attack
corrective: reacts to an attack
deterrent: discourages security violations
recovery : restores after an attack/failure
compensating: used to shore up existing controls deficiencies

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

controls implemented across

A

Administrative : Background checks, policies n procedures
Technical: Encryption, smart cards
Physical: Locks, security laptops n magnetic media, protection of cable

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

detective control eg

A

eg: Auditing and IDS (Intrusion detection system)

CCTV, Motion sensors

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

preventive n deterrent control difference

A

eg: preventive control will not allow a user to violate the security policy

deterrent control will present a banner indicating not legal to use , but not orevent: eg: no trespassing sign

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

NIST SP 800-30

A

Risk mgmt guide for information technology systems

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Asset Identification and Evaluation

A

understanding assets is key to effective risk analysis
inventory assets and assess their role in the org

Evaluate the asset value
understand how uncertain the data obtained is

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Risk

A

Risk = Threat * Vulnerability

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Threat

A

Threat: anything that can cause harm to an infosystem

threat agents / threat sources are who (Adversary)

Threat agent: organised crime
threat: sys compromise thru server-side attack

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Vulenrabilities

A

a weakness in a system that could potentially be exploited

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

zero-day vulnerabilities

A

are those not publicly known (targeted with zero-day exploits)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

Exploits & the payload

A

Exploitation is the process of a threat taking advantage of a vulnerability

the actions triggered by the exploit are called the payload

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

Risk Analysis - Quantitative and Qualitative risk analysis

A
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

Quantitative formulas (SLE,ARO,ALE)

TCO , ROI, Cost/Benefit Analysis

A

SLE- Single loss expectancy
ARO -Annualised rate of occurrence
ALE - Annualised loss expectancy

SLE = EF (Exposure factor) * AV (Asset value)

ALE = SLE * ARO

TCO - Total cost of ownership
ROI - Return on investment

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

Risk Management Key Formulas

Quantitative

A

Asset Value(AV) : The value os the asset
ARO: Frequency of threat occurrence per year
Exposure Factor (EF) : % of asset value at risk due to a threat

SLE = AV EF
ALE : SLEARO

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

Qualitative risk analysis

A

Likehood and impact

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

Excessive Risk

A

level of risk is unacceptable to the decision makers
eg: Injury or loss of life

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

Risk mitigation

A

taking actions that decreases the risk

mitigation can come in flavours:
1. threat oriented : focused on reducing motivation of the threat agents
2.vulnerability oriented : reducing vulns
3.Impact oriented : reducing the impact
4. likelihood oriented : reducing likelihood

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

Risk avoidance

A

not to move fwd with a new project that introduces risk

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

transferring risk

A

eg:purchase of insurance
outsource risky systems to a third party

Eg:data breach insurance

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

Accepting risk

A

accept residual risk
accept a certain level of risk

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

controls identification and assessment

A

after identification, assess
TCO
ROI

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

Security architecture: mergers n acquisitions
divestitures (demergers or deacquisitions)

A

acquisitions - challenge
deacquisitions - nightmare

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

RFI / RFP/ / RFQ

A

Request for information / proposal / quote

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

BPA (Business process agreement)

A

typically addresses things like ownership, profit/losses, partner contributions

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
40
Q

MOU / MOA

A

Memorandum of understanding or agreement -
goal is to establish the basic roles, responsibilities, and requirements for interconnection

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
41
Q

NIST 800-47

A

Security guide for interconnecting info technology systems

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
42
Q

SLA / OLA /ELA

A

OLA is an internal agreement that supports SLA

SLA: Expectations customer has for their service provider

ELA : Enterprise license agreement

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
43
Q

FedRAMP

A

Federal risk and authorization management program

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
44
Q

SCRM - Supply chain risk management

A
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
45
Q
A
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
46
Q

SBOM ( Software bill of materials)

A

SBOM Minimums:
Supplier name
component name
version of the component
other unique identifiers
dependency relationship
author of SBOM data
timestamp

47
Q

SOC Reports - System and organisation controls

A

created/validated by auditors provide insight into 3rd party service providers

48
Q

SOC Reports : SOC 1, SOC 2, SOC 3

A

SOC1: Internal control over financial reporting (ICFR)
Focus on financial stmts

SOC2: Trust services criteria
emphasis on controls related to security

SOC3: Trust services criteria for general use report / public report

49
Q

SOC Type 1 / SOC Type 2

A

Type 1: Description / suitability of controls design

Type 2: Description/suitability/effectiveness of controls design

Note: SOC3 can be created as type 2 report

49
Q

SOC for cybersecurity
SOC for supply chain

A
49
Q

Threat modelling

A
50
Q

Microsoft STRIDE

A

Spoofing ID
Tampering with data
Repudiation
Information disclosure
DoS
Elevation of privilege

50
Q

Threat Identification

Vulnerability identification

A

identify various threats that could exeercise vulns
- understand various threats
-

50
Q

Attack Surface

A

A systems attack surface represents all the ways in which an attacker could attempt to introduce data to exploit a vuln

reducing attack surface — is by disabling unneeded services
or - not listening on unnecessary ports

50
Q

Scoring vulnerabilities
CVSS

A

5 to 1
CVSS - Common vulnerability scoring system
Developed by a consortium of US Govt orgs and vendors

51
Q

Threat Vectors

A

are methods attackers use to touch or exercise vulns

52
Q

Laws

A

Laws, directives, regulations do not normally provide detailed instructions for protecting computer related assets

instead they specify requirements such as restricting the availability of PII

53
Q

Types of laws

Statutes
Administrative
Civil
Common law
Religious

A

Constitution
Statutes
- criminal proceedings
- civil proceedings

Administrative :
Regulations : HIPAA

Common law:case law or judicial precedent

Legal systems:
Civil law:
- Statutory
- Most common
Common law ( case law)
eg: UK, US, Canada

Religious law:
Sharia : Islamic law

Customary law

54
Q

Criminal Law

A

society has been harmed
criminal charges are the only laws in which someone can get jail time

successful prosecution can warrant being removed from society

55
Q

Civil Law

A

Deals with civil actions initiated by individual or orgs

Eg: torts, contracts, property and loss by business/individual

takes less time in courtroom

person can be ordered to pay monetary damages

56
Q

Computer crime challenges

A

difficult to keep pace with rapidly changing tech

57
Q

Types of damages

A

Compensatory : monetary award — rel to actual loss/harm

Statutory: Monetary damages designated by law

Punitive: award meant to punish the defendant, not tied to actual losses

Legal fees:

58
Q

International difficulties , international cooperation

A
59
Q

IP - Intellectual Property

A

Patent
Copyright
Trademark
Servicemark
Trade secret

60
Q

Patent

A

protects inventions for 20 years from date of filing

invention must:
have utility
novelty
be non-obvious

must reduce the invention to practice and cover single idea

61
Q

Copyright

A

form of expression
provided to the authors of original works
recorded thought on - paper, vinyl, plastic, magnetic media, or other

62
Q

Trademark

A

is a word , name, symbol or device that is used in trade with goods

servicemark - a trademark for a service instead of a product

62
Q

Trade secret

A

protects critical IP that is not publicly available

63
Q

IP enforcement and attacks

A

Trademark attacks :
1. counterfeiting : products intended to be mistakenly associated with brand
2. Dilution: widespread use of brand names

Copyright attacks:
Piracy: unauthorised use or reproduction of material

Trade secrets:
economic/industrial espionage

64
Q

Counterfeit products

A

eg: cisco fiber transceiver

65
Q

Product implants and tampering

A

hardware supply chain attack
1. seeding: modify the product in the facotry itself
2. interdiction: intercept products that move between factories

66
Q

Software licensing issues

A

licensing can serve as a form of IP Protection

site license
per-user/per-device license
concurrent users license

67
Q

Workplace privacy

A

employee privacy
management responsibilities

68
Q

European Union

A

Data protection directive

69
Q

International privacy considerations

A

OECD : Org for economic co-operation and development
EU
GDPR

70
Q

GDPR - General data protection regulation

A

Supersedes EU data protection directive

71
Q

OECD Guidelines

A

key provisions
- limitations on collection
lawful collection
accuracy of data ensured
collected for legitimate purposes
no data disclosure
accountable for data controller

72
Q

GDPR principles

A

lawfulness, fairness, transparency
purpose limitation
data minimization
accuracy
storage limitation
integrity n confidentiality
accountability

73
Q

Enforcement of GDPR began in may 2018

A

eg: Google LLC , Amazon europe - 60,34 million euros for pushing advertising cookies without consent

74
Q

GDPR: Data breach

A

breach notification to supervisory authority within 72hrs of discsovery

communication of data breach to those affected

eg: british airways - 20million euros - 400k customers

Marriot : 18.4m - 339 million customers

75
Q

GDRP - DPIA - Data protection impact assessment

A

Designate a DPO Data protection officer

76
Q

PIPL - Personal information protection law (China) - 2021

A

SPI - Sensitive personal info

PIPIA - personal information protection impact assessment

77
Q

PoPIA - enforce 2021 - South Africa
Protection of personal information act

A
78
Q

CCPA - California consumer privacy act

A

2018 state-level law

78
Q

US - FIPPs (Fair information practice principles )

A
79
Q

Databreach - minimization

A
  • insure against the loss with data breach insurance
  • plan comms in advanceof a breach
80
Q

PCI DSS

A

developed by major credit card companies to reduce fraud associated with credit card companies

81
Q

Ethics bodies
IAB (Internet activities board)

A

what not to do
- seek to gain unauthorized access on internet
disrupt intended use of internet
waste resources
destroy the integrity of computer based info

81
Q

Code of Ethics:

A
  1. Protect society
  2. Act honorably, honestly, justly, responsibly, and legally
  3. provide diligent and competent service to principals
  4. Advance and protect the profession
82
Q

Security Policies

A

provide high level guidance regarding expected conditions

eg: password s must be changed every 90 days

83
Q

Policy components

A

Purpose
Related docs
Cancellation
background
scope/exceptions
policy statement
responsibility
ownership
effective date / expiration date

84
Q

Scope : Levels of policy

A

Policies can exist on differnet levels with a hierarchy that can determine scope
- enterprise-wide / corporate policy
- division-wide policy
- local policy
- Issue - specific policy

85
Q

Security procedures

A

are more detailed than security policies

  • focussed on how to achieve what security policies mandate

eg: follow these step-by-step instructions to build the server

86
Q

policies vs procedures

A

policies are high level, procedures are detailed guidance

87
Q

Security standard

A

organizational, compulsory

eg: admins must use windows server 2019 as the base OS

Baseline: is a more specific implementation of a standard

88
Q

Security Guideline

A

suggestions
not compulsory

89
Q

Personnel Security

A

prior to hiring, during employment, during the separation

90
Q

Background checks

A

pre-employment background checks and screenings are a common way of vetting candidates

91
Q

Cross-training
Job rotation

A
92
Q

Mandatory vacation

A

helps to force job rotation

92
Q

AUP - Acceptable use policy

A

establishes expectations of employees

93
Q

Personnel Monitoring

A
94
Q

Non-Disclosure Agreement (NDA)

A
  • Company data should not be shared with competitors
95
Q

Non-compete agreement

A

purpose is to establish that an employe who leaves the org agrees not to work for a competitor

Hiring, training, grooming employees can be costly for an org

96
Q

non-solicitation agreement

A

if an employee leaves the company, agreement prohibits an employee from
— soliciting other employees to also leave
–soliciting customers of the employer for business

97
Q

Termination

A

Mishandling access revocation poses significant risk

ensuring all access has been removed in a timely basis can decrease the likelihood of compromise

imp with disgruntled individuals

98
Q

Controlling your env : key principles

A

Policy : tells a user what to do
Training: provides the skillset
Awareness: changes user behaviour
Key threat: social engineering
- manipulation
- people need to be made aware of the dangers

99
Q

Audit Standards: SSAE

A

Statement on Standards for Attestation Engagements (SSAE),

100
Q

Audit Standards: AICPA

A

American institute of certified public accountants

101
Q

Audit Standards: ISAE

A

International standard on assurance engagements

102
Q

Audit Standards: IAASB

A

International Auditing and Assurance Standards Board

103
Q

global digital forensics standards:

A

1.ISO/IEC 27037:2012: Guide for collecting, identifying, and preserving electronic evidence
2. ISO/IEC 27041:2015: Guide for incident investigations
3. ISO/IEC 27042:2015: Guide for digital evidence analysis
4.ISO/IEC 27043:2015: Incident investigation principles and processes
5.ISO/IEC 27050-1:2016: Overview and principles for eDiscovery

104
Q

ISO 27001

A

ISO 27001 is the standard for international information security management.

ISMS - Information security management system

105
Q

ISO 27002

A

ISO 27002 is a supporting standard that guides how the information security controls can be implemented.

106
Q

ISO/IEC 27017:2015

A

A set of standards regarding the guidelines for information security controls applicable to the provision and use of cloud services and cloud service customers

107
Q
A

CISSP (9 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions