Security And risk Management Flashcards
Need to know access
Confidentiality
Information processed correctly and not modified by unauthorized persons and protecting data in transit
Integrity
Ensuring systems are up and running so that persons can use them when they need them
Availability
Who get access- who is authorized to speak behave access to the system
Availability
Lashes, digital signatures, parity bits, separation of duties
Integrity
Remote sites, backups, high availability, RAID levels,
Availability
Validates appropriate policies, procedures and standards and guidelines are implemented to ensure business operations
Information Security Management
Things measured on a long-term trends and illustrate the day-to-day workload
Metrics
Who is responsible for Security
Everyone
Who is ultimately responsible for Security
Executive Management/Executive Level
Who does security report too?
Chain of command
Detecting- pre-emptive measure made to avoid harm to other persons or their property
Due Diligence
Caring is correcting
Due Care
Legal term used to describe the care a “reasonable person” would exercise under given circumstances
Due Care
Examples: Background checks of employee credit checks of business partners Information security assessments Penetration testing Contingency testing of backup systems
Due Diligence
Dual use goods
Wassenaar Arrangement
3 types of access control
Administrative
Physical
Technical
Name 2 types of Risk
Likelihood
Impact
What is C.I.A?
Confidentiality; Availability and Integrity
idea that is certified and made public
Patent
Expression of an idea
Copyright
What organization concisely defines intellectual property?
World Intellectual Property Organization (WIPO)
What laws explain what is an export?
International Traffic in Arms Regulations Act (ITAR:1976)
What laws explain What is deemed export?
Export Administration Regulations Act Security (EAR:1979)
What is the most common Dual-Use goods?
Cryptography
Right and Obligations of individuals and Organizations with respect to the collection, use, retention and disclosure of personal information
Privacy
Limits collection of personal data
Collection Limitation Principle
data that should be relevant to the purposes for which they are to be used and to the extent necessary for those purpose
Data Quality Principle
Personal data collected is specified not later than at the time of data collection and the subsequent use is limited to the fulfillment
Purpose Specification Principle
data should not be disclosed , made available or used for purpose other than those specified except; with consent of the data subject
use Limitation Principle
Personal data protected by Security Safeguards
Security Safeguard Principle
openness of general policy about developments, practices and policies respect to personal data
Openness Principle
An event that has the potential to do harm
Incident
An event that is measurable or observable occurrence that involves any asset
Incident
An incident that results in the disclosure or potential exposure of data
Breach
Unauthorized acquisition of personal information maintained in computerized form by a person that compromises the security, confidentiality, or integrity of the personal information
Data Disclosure
provides a common language for describing security incidents in a structured and repeatable manner
VERIS (The Vocabulary for Event Recording and Incident Sharing)
Regulates the handling of personal information about individuals
Privacy Act
sets national standards for the security of electronically protected health information
Health Insurance Portability and Accountability Act (HIPPA)
certify the accuracy of financial information and penalties for fraudulent activity by providing outside auditors to review accuracy of financial statements
Sarbanes-Oxley Act
standard that requires notice of data breaches of personal data breach to the competent national authority no later than 24 hours after detection
Regulation for Electronic Communications Service
Ethical Standard that protects country
Global responsibilities
Ethical Standard Protect State
National standard
Ethical Standard Protect Company
Organizational standard
What you do when no one is there to navigate what you do legally or illegal
Personal Standard
Code of Ethic Canons
Protect Society (people)
Act Honorably (Honor)
Provide diligent and competent service to principals (Boss)
Advance and protect the profession (profession)
components that support the implementation of security policy
Procedure, standards, guidelines, and baselines
4 Steps in a BIA
Gather information, perform a vulnerability assessment, analyzing the information, Document the results
An event or situation that if occurred, would prevent the organization from operating in its normal manner, if at all
Threat
The amount of time the organization can function without that application before significant impact occurs
Recovery Time Objective (RTO) or Maximum Tolerable Downtime (MTD)
How quickly you need to have that application information available after downtime has occurred
Recovery Time Objective (RTO)
Refers to the point in time which data must be restored in order to successfully resume processing between the last backup and when the event occured
Recovery Point Objective (RPO)
Reduce Risk of Collusion between individuals
Job Rotation
to not have the same capability to execute all of the steps of a particular process
Separation of Duties
access to sensitive data to do there job
Need to know
Guidance that analyze risks and manage mitigation in alignment with business and compliance objective
GRC- Governance Risk Management and Compliance
Data Protection Directive (DPD), Personal Information Protection and Electronic Documents Acts (PIPEDA), Personally Identifiable Information (PII), HIPAA and Gramm-Leach Bliley ACt (GLBA), Payment Card Industry (PCI) are all examples of what?
Privacy Requirements Compliance
Idea that is certified and made public
Patent
Contribute to regional and international security and stability by promoting transparency and greater responsibility in transfers of conventional arms and dual-goods and technolgies
The Wassenaar Arrangement (AR)
Regulates the handling of personal information about individuals
The Privacy Act
sets national standards for the security of electronically protected health information
Health insurance Portability and Accountability ACt (HIPPA)
Top management must individually certify the accuracy of financial information and penalties for fraudulent financial activity are greater.
Sarbanes-Oxley Act
European Electronic Communication Service providers are required to provide notice of data breaches of a personal data breach to the competent national authority no later than 24 hours after the detection of the personal data breach, when feasible
Regulation for Electronic Communication Service (EU)
Procedures, standards, guidelines, and baselines are components that support the implementation of what?
Security Policy
1st step in building the BC program
Project initiation and management
Before the project can even start, it must have who’s support?
Senior/executive Management
Procedures implanted to define the roles, responsibilities, policies and administrative functions needed to manage the control environment
Administrative Controls
An estimate of how often a threat will be successful in exploiting a vulnerability over the period of a year
Annualized Rate of Occurrence (ARO)
The principle that ensures that information is available and accessible to users
Availability
An incident that results in the disclosure or potential exposure of data
Breach
Controls and hat substitute for the loss of primary controls and mitigate risk down to an acceptable level
Compensating Controls
Actions that ensure behavior that complies with established rules
Compliance
Covers the expression of ideas rather than the ideas themselves; it usually protects artistic property such as writing, recordings, database, and computer programs.
Copyright
Supports the principle of “Least Privilege” by providing that only authorized individuals, processes, or systems should have access to information on a need to know basis
Confidentiality
Covers the expression of ideas rather than the ideas themselves, usually protected artistic property such as writings, recording, databases, and computer programs
Copyright
Controls implemented to remedy circumstance, mitigate damage, or restore controls
Corrective Controls
A breach for which it was confirmed that data was actually disclosed(not just exposed) to an unauthorized party
Data Disclosure
Controls designed to signal warning when a security control has been breached
Detective Controls
Controls designed to discourage people from violating security directives
Deterrent Controls
Controls designed to specify acceptable rules of behavior within an organization
Directive Controls
Is similar to Due care with the exception that it is a pre-preemptive measure made to avoid harm to other persons or their property
Due Diligence
A process designed to identify potential events that may affect the entity, manage risk so it is within its risk appetite, and provide reasonable assurance regarding the achievement of entity objectives
Enterprise Risk Management
Authorized the President to regulate export of civilian goods and technologies that have military applications
Export Administration Act
Ensures the business focuses on core activities clarifies who in the organization has the authority to make decisions, determines accountability for actions and responsibility for outcomes, and addresses how expected performance will be evaulated
Governance
A Security Event that compromises the confidentiality, integrity, or availability of an information asset
Incident
Comes in two forms making sure that information is processed correctly and not modified by unauthorized persons and protecting information as it transits a network.
Integrity
Accountable for ensuring the protection of all of the business information assets from intentional and unintentional loss, disclosure, alteration, destruction and unavailabilty
Information Security Officer
Granting users only the accesses that are required to perform their job functions
Least Privilege
Electronic hardware and software solutions implemented to control access to information and information networks
Logical (Technical) Controls
Protects novel, useful, and non-obvious inventions
Patent
Controls to protect the organizations people and physical environment, such as locks, fire management, gates, and guards
Physical controls
Controls implemented to prevent a security incident
Preventive Controls
Controls implemented to restore conditions to normal after a security incident
Recovery Controls
How quickly you need to have that applications information available after downtime has occured
Recovery Time Objective (RTO)
The point in time to which data must be restored in order to successfully resume processing
Recovery Point Objective (RPO)
A Combination of the probability of an event and its consequences (ISO 27000)
Risk
An expectation of loss expressed as the probability that a particular threat will exploit a particular vulnerability with a particular harmful result (RFC 2828)
Risk
The practice of accepting certain risk, typically based on business direction that may also weigh the cost versus the benefit of dealing with the risk in another way
Risk Acceptance
The practice of coming up with alternatives so that the risk in question is not realized
Risk Avoidance
The practice of the elimination of or the significant decrease in the level of risk presented
Risk Mitigation
The practice of passion on the risk in question to another entity, such as an insurance company
Risk Transfer
A systematic process for identifying, analyzing, evaluation, remedying, and monitoring risk
Risk Management
Defined as the difference between the original value and the remaining value of an asset after a single exploit
Single Loss Expectancy (SLE)
An word, name, symbol, color, sound, product shape, device, or combination of these that is used to identify goods and distinguish them from those made or sold by others
Trademark
Proprietary business or technical information, processes, designs, practices, etc. that are confidential and critical to the business
Trade Secret
Determines the potential impact of disruptive events on the organizations business processes
Vulnerability Assessment
Established to contribute to regional and international security and stability by promoting transparency and greater responsibility in transfers of conventional arms and dual-use goods and technologies, this preventing destabilizing accumulations
Wassenaar Arrangement
Within the realm of IT Security, which of the following combinations best define risk:
A. Threat coupled with a breach
B. Threat coupled with a vulnerability
C. Vulnerability coupled with an attack
D. Threat coupled with a breach of security
B. Threat coupled with a vulnerability
(A vulnerability is a lack of countermeasure or a weakness in a countermeasure that is in place. A threat is any potential danger that is associated with the exploitation of a vulnerability)
When determining the value of an intagible asset which is the BEST approach:
A. Determine the physical storage cost and multiply by the expected life of the company
B. With the assistance of finance of accounting professional determine how much profit the asset has returned
C. Review the depreciation of intangible asset over the past three years
D. Use the historical acquisition or development cost of the intangible asset.
B.-
Qualitative risk assessment is ear marked by which of the following?
A. Ease of implementation and it can be completed by personnel with a limited understanding of the risk assessment process
B. Can be completed by personnel with a limited understanding of the risk assessment process and uses detailed metrics used for calculation of risk
C. Detailed metrics used for calculation of risk and ease of implementation
D. Can be completed by personnel with a limited understanding of the risk assessment process and detailed metrics used for the calculation of risk
A
Single Loss expectancy (SLE) is calulated by using:
A. Asset Value and annualized rate of occurence (ARO)
B. Asset Value, local annual frequency estimate (LAFE) and standard annual frequency estimate (SAFE)
C. Asset value and exposure factor
D. Local annual frequency estimate and annualized reate of occurence
C
Consideration for which type of risk assessment to perform includes all of the following:
A. Culture of the organization likelihood of exposure and budget
B. Budget, capabilities of resources and likelihood of exposure
C. Capabilities of resources, likelihood of exposure and budget
D. Culture of the organization, budget, capabilities and resources
D
Security Awareness training includes:
A. Legislated security compliance objectives
B. Security roles and responsibilities for staff
C. The high-level outcome of vulnerability assessments
D. Specialized curriculum assignments, coursework and an accredited institution.
B
What is the minimum and customary practice of responsible protection of assets that affects a community or societal norm? A. Due diligence B. Risk Mitigation C. Asset Protection D. Due Care
D
Effective Security Management A. Achieved security at the lowest cost B. Reduces risk to an acceptable level C. Prioritizes security for new products D. installs patches in a timely manner
B
Availability makes information accessible by protecting from:
A. Denial of services, fires, floods, hurricanes, and unauthorized transactions
B. Fire, floods, hurricanes, unauthorized transactions and unreadable backup tapes
C. unauthorized transactions fires, floods, hurricanes and unreadable backup tapes
D. Denial services, fires, floods, and hurricanes and unreadable backup tapes
D
Which phrase best defines a business continuity/disaster recovery plan?
A. A set of plans for preventing a disaster
B. An approved set of preparations and sufficient procedures for responding to a disaster
C. A set of preparations and procedures for responding to a disaster without management approval
D. The adequate preparations and procedures for the continuation of all organization functions
D
Which of the following steps should be performed first in a business impact analysis (BIA)?
A. Identify all business units within an organization
B. Evaluate the impact of disruptive events
C. Estimate the Recovery Time Objectives (RTO)
D. Evaluate the criticality of business functions
A
Tactical security plans are BEST used to:
A. Establish high-level security policies
B. Enable enterprise/entity-wide security management
C.Reduce downtime
D. Deploy new security technology
D
Who is accountable for implementing information security? A. Everyone B. Senior Management C. Security Officer D. Data Owners
C
Security is likely to be most expensive when addressed in which phase? A. Design B. Rapid Prototyping C. Testing D. Implementation
D
Information systems auditors help the organization?
A. Mitigate compliance issues
B. Establish and effective control environment
C. Identify control gaps
D. Address information technology for financial statements
C
The Facilitated Risk Analysis Process (FRAP)
A. Makes a base assumption that a broad risk assessment is the most effective way to determine risk in a system, business segment, application or process
B. Makes a base assumption that a narrow risk assessment is the most efficient way to determine risk in a system, business segment, application or process
C. Makes a base assumption that a narrow risk assessment is the least efficient way to determine risk in a system, business segment, application or process
D. makes a base assumption that a broad risk assessment is the least efficient way to determine risk in a system, business segments, application or process
B
Setting clear security roles has the following benefits:
A. Establishes personnel accountability, reduces cross-training requirements and reduced departmental turf battle
B. Enables continuous improvement, reduces cross-training requirements and reduced departmental turf battle
C. Established personal accountability, establishes continuous improvement and reduces turf battles
D. Reduced departmental turf battles, Reduces cross-training requirements and establishes personal accountability
C
Well-written security program policies are BEST reviewed:
A. At least annually or at pre-determined organization changes
B. After major project implementations
C. When applications or operating systems are updated
D. When procedures need to be modified
A
An organization will conduct a risk assessment to evaluate:
A. Threat to its assets, vulnerabilities not present in the environment, the likelihood that a threat will be realized by taking advantage of an exposure, the impact that the exposure being realized will have on the organization, the residual risk
B. Threat to its assets, vulnerabilities present int he environment, the likelihood that a threat will be realized by taking advantage of an exposure, the impact that the exposure being realized will have on another organization, the residual risk
C. Threat to its assets, vulnerabilities present int he environment, the likelihood that a threat will be realized by taking advantage of an exposure, the impact that the exposure being realized will have on organization, the residual risk
D.Threat to its assets, vulnerabilities present int he environment, the likelihood that a threat will be realized by taking advantage of an exposure, the impact that the exposure being realized will have on the organization, the total risk
C
A security policy which will remain relevant and meaningful over time includes the following:
A. Directive words such as shall, must, or will, technical specifications and is short in length
B. Defined policy development process, short in length and contains directive words such as shall, must or will
C. Short in length, technical specifications and contains directive words such as shall, must or will
D. Directive words such as shall, must, or will, defined policy development process and is short in length.
D
The ability of one person in the finance department to add vendors to the vendor database and subsequently pay the vendor violates which concept? A. A well-formed transaction B. Separation of duties C. Least Privilege D. Data sensitivity level
B
Collusion is best mitigated by: A. Job rotation B. Data Classification C. Defining job sensitivity level D. Least privilege
A
Data Access decisions are best made by: A. user managers B. Data Owners C. Senior Management D. Application developer
B
Which of the following statements BEST described the extent to which an organization should address business continuity or disaster recovery planning?
A. Continuity Planning is significant organizational issue and should include all parts or functions of the company
B. Continuity planning is a significant technology issue and the recovery of technology should be its primary focus
C. Continuity planning is required only where there is complexity in voice and data communications
D. Continuity planning is a significant management issue and should include the primary functions specified by managemen
A
Business impact analysis is performed to BEST identify:
A. The impacts of a threat to the organization operations
B. The exposure to loss to the organization
C. The impacts of a risk on the organization
D. The cost efficient way to eliminate threats
B
During the risk analysis phase of the planning, which of the following actions could BEST manage threats or mitigate the effects of an event?
A. Modifying the exercise scenario
B. Developing recovery procedures
C. Increasing reliance on key individuals
D. Implementing procedural controls
D
The BEST reason to implement additional controls or safeguards is to: A. deter or remove the risk B. Identify and eliminate the threat C. Reduce the impact of the threat D. identify the risk and the threat
C
Which of the following statements BEST describes organization impact analysis?
A. Risk analysis and organization impact analysis are two different terms describing the same project effort
B. A organization impact analysis calculates the probability of disruptions to the organizations
C. A organization impact analysis is critical to development of a business continuity plan
D. A organization impact analysis establishes the effect of disruptions on the organization
D
The term "disaster recovery" refers to the recovery of: A. organization operations B. Technology environment C. manufacturing environment D. personnel environments
B
Which if the following terms BEST described the effort to determine the consequences of disruption that could result from a disaster?\ A. Business Impact Analysis B. Risk Analysis C. Risk Assessment D. Project problem definition
A
the elements of risk are as follows:
A. natural Disasters and man-made disasters
B. Threats, assets and mitigating controls
C. Risk and business impact analysis
D. Business Impact analysis and mitigating controls
B
Which if the following methods is not acceptable for exercising the business continuity plan?
A. Table-top exercise
B. Call exercise
C. Simulated exercise
D. Halting a production application or function
D
Which of the following is the primary desired result of any well-planned business continuity exercise?
A. Identifies plan strengths and weaknesses
B. Satisfies management requirements
C. Complies with auditors requirements
D. Maintains shareholder confidence
A
A business continuity plan is best updated and maintained:
A. Annually or when requested by auditors
B. Only when new versions of software are deployed
C. Only when new hardware is deployed
D. During the configuration and change management process
D
Which of the following is MOST important for successful business continuity> A. Senior leadership support B. Strong technical support staff C. Extensive wide are network D. An integrated incident response team
A
A Service's recovery point objective is zero. Which approach BEST ensures the requirement is met? A. RAID 6 with a hot site alternative B. RAID 0 with a warm site alternative C. RAID 0 with a cold site alternative D. RAID 6 with a reciprocal agreement
A
The (ISC)2 code of ethics resolves conflicts between canons by:
A. there can never be conflicts between canons
B. Working through adjuducation
C. The order of the canons
D. Vetting all canon conflicts through the board of directives
C
