Security and Risk Management Flashcards
1
Q
What is a Threat
A
Potential Danger associated with exploitation of a vulnerability
-A Tornado COULD happen.
2
Q
What is a Threat Agent
A
Entity taking advantage of vulnerability - the person, or actor
Example: The Wind of a tornado, or flying objects caused BY the tornado. If there was an actual tornado
3
Q
What is Risk
A
Likelihood a threat source exploits a vulnerability and the business impact involved
4
Q
What is Exposure
A
Instance of being exposed to losses. For instance a vulnerability exposing possible damage.
5
Q
What is a Control
A
Also known as a countermeasure or safeguard. Put into place to mitigate, or reduce, potential risk
6
Q
Types of Security Controls
A
Physical, Administrative, Technical
7
Q
Administrative Controls
A
“Soft Controls” ie security documentation, risk management, personnel security, and training
8
Q
Technical Controls
A
AKA Logical Controls. Software OR hardware such as Firewalls, IDS, IPS, HIPS, encryption, and identification and authentication methods
9
Q
Physical Controls
A
Protection of facility, personnel, and resources. IE Door Locks, Alarms, Security Guards, Lighting, fences, CCTV, Turn-styles
10
Q
Defense-In-Depth meaning
A
Mixture of admin, technical, and physical controls to help minimize exposure to risk of exploitation. Page 9 Shon Harris
11
Q
The more sensitive and asset the more____controls should be used
A
security
12
Q
What are the different functionalities of security controls?
A
Preventative, Detective, Corrective, Deterrent, Recover, and Compensating
13
Q
Preventative Function of Control
A
avoid an incident from occurring
14
Q
Detective Function of a Control
A
Assist in the detection of incident activities and potentially an intruder
15
Q
Corrective Function of a Control
A
Fixes components or systems AFTER an incident occurs
16
Q
Deterrent Function of a Control
A
Discourages potential hackers
17
Q
Recovery Function of a Control
A
Intended to bring environment back to regular ops
18
Q
Compensating Function of a Control
A
Provides an alternate measure of control that provides similar protection, but is often times cheaper or allows specific business functions to operate. Example: After evaluating cost of security guards, you use a fence instead since it is cheaper.
19
Q
Examples of Preventative Admin Controls
A
Policies, procedures, testing, effective hiring practices, pre-employment background checks, controlled termination processes, data classification, labeling, security awareness training
20
Q
Examples of Preventative Physical Controls
A
Badges, swipe cards, Guards, dogs, Fences, locks, mantraps, NOT A CAC OR SMART CARD
21
Q
Examples of Technical Controls
A
Passwords, biometrics, smart cards, CAC, Encryption, security protocols, call-back systems, database views, IPS, Antivirus Software, ACLs, Firewalls, IDS
22
Q
Corrective functions only apply to what type of control? How?
A
Technical via Server Images
23
Q
Recovery functions only apply to what type of controls? How?
A
Physical and Technical. Physical: Offsite facility Technical: Data backups
24
Q
Deterrent functions only apply to what type of control? How?
A
Physical: Fences, Lighting, Dogs
25
Security through obscurity should be avoided? True or False? Why?
True! Like hiding a key under a doormat. Burglers know these tricks so try to avoid shortcuts to security.
26
Ways to find vulnerabilities in code?
Fuzzing, input validation,
27
Security Programs are also called?
Security Framework
28
Security Framework
different types of technologies, methods, and procedures to accomplish the right protection level required to secure environment.
29
ISO/IEX 27000
How to Develop and maintain an ISMS developed by ISO and IEC. AKA Security Program Development
30
Zachman Framework
Model for development of enterprise architectures
31
TOGAF
Model for development of enterprise architecture developed by THE OPEN GROUP.
Arhictecture Development Method (ADM)
32
DoDAF
US DoD architecture framework that ensures interoperability of systems to meet military mission goals.
33
MODAF
Framework used by British Ministry of Defense. Based on DoDAF
34
SABSA Model
Framework for development of enterprise security architecture
35
COBIT 5
business framework developed by ISACA "Information Systems Audit and Control Association"
36
NIST 800-53
Security controls to protect US Fed Systems
37
COSO Internal Control - Integrated Framework
Created to reduce risk of financial fraud by the Committee of Sponsoring Organization of the Treadway Commission
38
ITIL
Developed by the UK office of Gov't Commerce
39
Six Sigma
Business management strategy used to carry out process improvement
40
Capability Maturity Model Integration
AKA CMMI , process development created by Carnegie Mellon University
41
ISO/27001
Remember this one most - Requirements for organizations- ISMS Requirements
42
What is Enterprise Architecture?
Enterprise Structure (form) and behavior (function) embodies enterprise components and relationship to one another
43
Framework
Like a blueprint. Blueprints can be modified to meet needs (enterprise) but all starts with blueprint
44
Clinger-Cohen Act
Passed to reduce federal agency IT expenditure waste (spending) "Cling to the money"
45
Zachman Architecture Framework
2-dimenstional chart that uses 6 comms interrogativeds (What, How, Where, Who, When, Why) vs. role prespectives (Executive, business Mans, sys ads, engineers...)
46
What is Enterprise Security Architecture?
Subset of Enterprise Architecture,
47
Governace Analogy
Policy: Employees will nail boards together using a company-issued hammer
Standard: Company-issued hammers will be 11 inches long, and made of fiberglass
Guideline: To avoid splitting wood, a pilot hole will be drilled before hammering
Prodedure: 1. Position nail on board. 2. Strike nail head with hammer. 3. repeat until nail is flush with board and board is secure. 4. If catch finger between hammer and nail, see "First-Aid Procedure".
48
ISC Code of Ethic Canons (1-4). Which one is the most important?
1. Protect society, the commonwealth, and the infrastructure. *MOST IMPORTANT*
2. Act honorably, honestly, justly, responsibly, and legally.
3. Provide diligent and competent service to principals
4. Advance and protect the profession *LEAST IMPORTANT*
49
ISC2 Ethical Basis. Where were ethics derived?
- Golden Rule - reciprocity
- Kants Categorical Imperative - uniformity - No exceptions without extreme consideration
- Descartes Rule of change - Slippery slope - when you DO make exceptions opens the door to issues
- Utilitarian Principle - What does the most good. Subjective because it can be opinionated
- Risk Aversion Principle - least harm - also subjective
- Avoid Harm - Do No Harm.
- No Free Lunch Rule - assumes ownership
- Legalism - is it against the law?
- Professionalism - is it contrary to the code of ethics?
- Demonstrate due care/diligence?
- Evidentiary guidance - can you prove it?
- Client/customer choice - affected people make decisions "informed consent
- Equity - equal distribution of costs/benefits
- Competition - Market sets prices/quality
- Compassion - Most vulnerable parties protected - Elderly/Children
- Impartiality/Objectivity - biases?
- Impartiality/Full Disclosure - affected persons informed?
- Confidentiality - individual security
- Trustworthiness - is IT staff/technology accountable?
50
Ways to obtain leadership support (3)
1. Financially - Probability * Magnitude (Value of items) = Cost (of plan to implement)
2. Reputation
3. Regulatory - Prudent Person Rule
51
Data Retention Policies - Business Docs
7 yrs
52
Data Retention Policies - Invoices
5 years
53
Data Retention Policies - Accounts Payable/Receivable
7 Years
54
Data Retention Policies - Human Resources
7 years for employees who leave
| 3 years for candidates who did not get hired
55
Data Retention Policies - Tax Records
4 years AFTER tax has been paid
56
Data Retention Policies - Legal Docs
FOREVER
57
What are the information life cycle phases
Acquisition, Use, Archival, Disposal (AUAD)
58
Recovery Point Objective
Amount of time an org can function until the function will cause irreversable damage, if not restored. ex 5 Days of lost customer revenue
59
Recovery Time Obective
Amount of time that an org will start to lose data. Ex. 1 days worth of data.
60
Differential Backup
All changes since last full backup
61
Incremental Backup
All changes since last increment
62
Mirrored Site
Full functioning backup with all data
63
Hot site
Full network infrastructure, however data may not be loaded. RTO = 4 hours
64
Warm Site
Partially equipped. More set up required than Hot site. RTO = a few days
65
Cold Site
Site not equipped. Empty warehouse, long setup time.
66
Service Level Agreement (SLA)
Agreement between 2 parties where a level of service is defined
67
Business Partner Agreement (BPA)
Contract between 2 entities dictating their business relationship. Defining expectations and obligations of each party
68
Memorandum of Understanding (MOU)
Letter of intent (not legally binding) with a means to document the specifics of an agreement or arrangement between 2 parties.
69
Interconnection Security Agreement (ISA)
Formal declaration of the security stance, risks, and technical requirements of a link between 2 orgs
70
5 Phases of SDLC
1. Initiation
2. Acquisition/Development
3. Implementation
4. Operation/Maintenance
5. Disposition
71
Difference between trademark and copyright?
Trademark is something like a logo. Copyright is literary or artistic such as a book, drawing, or other written documentation.
72
Which symmetric cipher is a Feistal-type block cipher with 64-128 bit blocks?
CAST
73
What is a tangible asset?
Physical - Can be owned. If you can drop it on your head or bump your foot AND HAS VALUE, it is tangible
-Servers, Hard disks, Data Centers, Optical Disks, Facilities, workforce
74
What is a intangible asset?
- Software, soft data, intellectual property.
| - Software, databases, source code, data files, PII
75
______ implies the absence of a countermeasure
Vulnerability
76
Types of confidentiality threats
Eavesdropping, shoulder surfing, sniffing, dumpster diving
| - an ACTIVE attack
77
Types of Integrity threats
- Errors and omissions
- Insider Threats
- Man in the middle - NOT a sniffer because sniffer is passive. man in the middle is not passive. A person could intercept, modify, then deliver
- Falsified invoices.
- A PASSIVE attack
78
Is a man in the middle attack effect confidentiality or integrity?
Integrity because it is not passive. They could intercept and alter network traffic, then redeliver.
79
Threat to Availability examples
Hard disk crash
Server Failure
Corruption
DoS, DDoS
80
Non-repudiation relates to C. I. or A.
Integrity
81
What is nonrepudiation?
Proving validity of an action or task -- being able to identify the origin of an event. Cannot be disproven
82
Order of reliance for the C.I.A.
It all starts with confidentiality, then integrity, then accessibility. In that order.
83
Authentication, Authorization, and Accounting (AAA) actually have 5 components -- what are they
1. Identification
2. Authentication
3. Authorization
4. Auditing
5. Accountability
IN THAT ORDER -- user (subject) must identify themselves, then authenticate themselves, then they are authorized based on permissions. Objects are auditing subject activity, logs, etc, and then are accounted for by reviewing logs
84
3 types of organizational plans
Strategic - Long term ~5 year plan - includes risk assessment
Tactical - ~1 year plans - project plans, aquisitions plans, hiring plans, budget plans, system development plans
Operational - VERY short term plan. highly detailed. Staffing assignments, close-range schedule, budget requirements, training plans, system deployment plans, product design plans.
85
Business Classifications NOT DoD
Confidential, Private, Sensitive, Public
Confidential - High Security relating to BUSINESS only -- Propriatary business functions could be an example
Private - High Security relating to PERSONNEL data such as PII, or medical data.
Sensitive - causes a negative business impact if disclosed
Public - No impact
86
What is a Security Manager
Ultimate responsibility for protection of assets. SIGNS off all security policies. All activities approved and signed by SM. Also held organizationally responsible for due care. due diligence. RARELY implements solutions and leaves this up to Security Professional
87
What is a Security Professional
Information Security Officer, CIRT, or other experienced IT. IS/IT function role where responsible for writing the security policy and implementing it. NOT decision makers. ARE implementers.
88
Data Owner
high-level manager whos sole responsibility is data protection. Usually delegates actual data management responsibilities to Data Custodian.
89
Data Custodian
Assigned to user by Data Owner. Responsible for implementing protection defined by senior management. Performs all activities to provide CIA protection -- backups, validating data, deploying security solutions, etc
90
COBIT
Control Objectives for Information and Related Technology
ISACA framework
91
COBIT 5
5 Principles:
1. Meeting Stakeholder needs
2. Covering the Enterprise End-to-End
3. Applying a Single, Integrated Framework
4. Enabling a Holistic Approach
5. Separating Governance from Management
92
OSSTMM
Open Source Security Testing Methodology Manual - Testing and analysis of a security infrastricture
93
ISO/IEC 27002
Replaced ISO 17799 - International standard used for implementing org security practices
94
ITIL
Information Technology Infrastructure Library
Developed by British - recommended security practices
95
Due Care is Dependent on Due Diligence?
False - Due Diligence is dependent on Due Care
Due Care - reasonable care to protect assets of an org
Due Diligence - activities that maintain the Due Care effort.
96
What is a Security Policy
defines scope of security needed at org/discusses org assets
used as proof by senior management to show due care
97
How many different types of security policies?
3 - Organizational, Issue-Specific, and System-Specific
98
Organizational Security Policy
issues relevant to every aspect of the organization
99
Issue Specific Security Policy
Focuses on specific organizational procedures -- network services, departments, functions...
100
System Specific Security Policy
focuses on individual systems or types of systems and appliance related security controls -- Firewalls, base-lining, approved hardware and software use
101
Security Policy Categories (3)
Regulatory, Advisory, Informative
Regulatory - Required by industry or legal standards
Advisory - Provide behaviors and activities that are acceptable (MOST POLICIES ARE ADVISORY)
Informative - Informational in nature, provides information about specific subjects
102
Security Policies should address specific individual responsibilities? T or F
False -- Policy should define tasks and responsibilities to FIT a role.
103
Confidentiality Controls
Encryption
Least Privilege
Access Control (MAC, DAC, Physical...)
Need to Know
104
Integrity Controls
Hashing
Separation of Duties
Dual Control
105
Availability Controls
Backups
Remote site hosting / recovery
High Availability
Fault Tolerance
