Brainscape's Knowledge GenomeTM


Top Flashcards (Certified)
All Flashcards

CISSP > Security Concepts > Flashcards

Security Concepts Flashcards

1
Q

New Topic: Ethics

A

Ethic is set of moral principles

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Code of Ethics (COE)

A

Principles of professional conduct, . AS ISC2 members are required to commit fully to the COE

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Violation of COE

A

Subject to peer review panel and revocation of Certificate. Failure of COE is breach of code Canon IV

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Canon means

A

Values

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Canons in Practice are

A

PAPA: Protect everything you are responsible for , Act with good intentions . Provide your best efforts, Advance your knowledge skills

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Protect the Society

A

SAfeguard information and systems
Consider societal impact
Do your best
Thoroughky analyze policies
Provide or recommend

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Act Honorably

A

Any leakages, dont lose integrity. If a mistake is made then take ownership.Lead by example

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Provide diligent and competent service

A

Be good at your job, by staying up to date with current technology services

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Advance and protect profession

A

Growth and maturity of Cyber Security practices
Share knowledge, mentoring
Keep on current threats, vulnerabilities and attacks

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Summary of Cannons

A

Understand the importance of integrity and accountability in ethical decision making

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

New Topic: Information Security Concepts

A

CIA =
Confidentiality - Can the data be given to unauthorised persons
Integrity - Can these users change the data
Availabilty - How quickly the data need to be made available

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Confidentiality

A

Can all users see all of the data? Who can?
Can this data be release outside of the company?
How do we protect data from unauthorised access?

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Integrity

A

Who can change data in these file?
Can all users change update all of the data?
How does the file need to be protected from unauthorised changes?

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Availability

A

How important is this data to the company?
Does it need to be made available quickly or can it be stored somewhere safe?
How do we make sure data can be used when its needed?

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Authenticity

A

Data , action coming from legitimate subject. Don’t need a proof of this. E.g. Login. Username and password. Authenticity can be spoofed or maligned.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Non Repudiation

A

Data actions originated from a specific subject but cannot be disputed. If some one makes a change to data and they cannot dispute it. Its done by cryptography. Digital Signatures.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

New Topic: Security and the Organisation

A

Security Goverance

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Security Governance?

A

Defines Aligning ethically the business objectives to laws, regulations and standards

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

what does security must not impact?

A

Business Processes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What should security must support in an organisation?

A

1- Business objectives
2- Standards
3- principles and strategies of organisation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Who should be supporting security?

A

Senior Management buy-in is essential

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

What processes in an organisation security must account for?

A

1- System development
2- Change Management
3- Software development
4- DevOps
5-Operations

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

What is Top Down approach in Security?

A

1- Senior Management - Set the vision, Define policies for security
2- Middle Management - Document Artefacts, standards
3- All other personnel - Work on the implementation of security standards

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

What is Security Planning and what are the different plans?

A

Strategic plan - 3-5 years

Tactical plan - 1 year (e.g. migrating a local IS to a Cloud based )

Operational plan - 1-3 months (e.g. migration project)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Examples of aligning Security objectives to organisational processes
Purchase and Sale of an organisation must ensure the security objectives align to the organisation's policies.
26
New Topic: Organisation Roles and Responsibilities - What are the 4 key roles in an organisation?
(ESDS) Executive Security Data System
27
What are Executive roles?
CEO- responsible for everything but may delegate responsibility to other CIO - responsible for Information systems visions and changes. Responsible for security and may delegate this to a CISO CISO - responsible for the Security implementation in organisation and security mission CFO - CISO will speak to CFO for budget for buying assets
28
What are the Security general roles?
1- Security Manager - Management of Security personnel, vulnerabilities etc 2-Security Officer - implements security vision, ensures CIA is not impacted as part of the process 3- Security Analyst - Identify and resolve Threats 4- Security Engineer - Design and Implement security solutions
29
What are the Data roles? IMPORTANT FOR CISSP EXAM
1- Data Owner - Responsible for classification and protection of data 2- Data custodian - They are the ones who configure the systems that protect the data 3- Data Steward - Provide SME for specific data. CEO might not know how to protect HR data therefore SME is required. (Is it sensitive, etc)
29
What are the System roles?
1- System and Network Administrators - They can also become Data custodians. Previledged personnels. Responsible for maintaining the systems 2- Auditors - Responsible for auditing the compliance with Security policy - SYstem Level - WOrking with Admins to define configs 3- Users -Subject with access to the information
30
New topic: Security Awareness Education and Training- Etablishment and maintenance of Security Awareness and training - Goals, Methods, Content and how to guage the effectiveness, reasons for effectiveness and udates to our training
Create change in behaviour by Senior Management Teach personnel their Security Responsibilities Comply with governance regulation and compliance requirements
31
What value does Security Awareness and training add to the organisation?
Drives reduction of risks Ensures compliance and regulatory requirements are met
32
Security Training examples
Training teaches people how to do their work according to Security policy Exampless:Access compoents, data, assets, what to do in event of emergency, how to login remotely
33
Education?
Education is more like Certification. to satisfy work requirements Examples: CBT, Seminars, Live class
34
Awareness Examples
Post banners, flyers, posters and put them to breakout areas, pubs etc Weekly security Newsletters Website or blog updates Seminars, webinars Educational videos or organisation website
35
Methods of Encouragement
Assign Security Champion - Encouragement and motivated person Gamification - Attainable and achievable and fun.
36
Program Evaluations
Monitoring - Participation, Feedback Watch for behaviour changes as a result of trainin Example Phisiing Emails.
37
New Topic: Social Engineering
Manipulating trust, Creating guilt in a person for them to cooperate in a SOcial Engineering attack.
38
Types of Social Engineering
Pretexting? Quid Pro Quo? Phishing Attacks
39
Phishing Attacks (Virtual)
Spearing - targetted to an individual or a group of individuals Whaling - Target is high value individual such as CIO, CISO. Vishing - Over voice based communication SPIT - SPam over Internet Telephony - Prerecorded call Smishing - Phishing using SMS SPIM - Spam over Instant messaging - to collect data from a victim Shoulder Surfing - Someone looking over shoulder and getting your password Dumpster diving - Discovering unauthorised materials from bins
40
Social Engineering (Physical)
Tailgating - person follows authorised person to a protected area Piggybacking - Person follows authorised person to a protected area and ask them for help to gain access to that protected area.
41
New Topic: Personal Security Policies and Procedures
Reduce security risk of personnel accessing organisational information. HIre Candidates,Onboarding, Personnel are wekaest link but are also an assett. Enforce good policies and setting them up for success
42
New Topic: Due Care Due Diligence
Concept focus on taking reasonable steps for protecting assets to meet legal and ethical standards
43
Personnel Control Principles
Separation of duties: divide critical functions amongst multiple individuals Least privilege : Only giving them necessary privilege to do their tasks Need to Know: Access to data only need to perform their duties
44
Candidate Screening
- Job Description - Minimum and preferred qualification for the position - Knowledge skills and attributes - Candidate screening - Criminal History - Social media history - Drug Testing
45
Candidate Screening
- Ask Premlinary questions = Review CV, cover letter - Compliance Laws so be careful on the different types of questions asked are complied Screen Interview - F2F, Virtual, Real time questions, Body language
46
Candidate Hiring
Non Disclosure Agreement - requires then protection sensitive information within the organisation. Also it will preevent them to disclose even after they leave . Penalties, acknowledgement and signatureNon Repudiation that they agree to it SHould include Emplpyement details what is the proprietorshipp Employement agreement Regulations - HIPPA, PCISDSS, FISMA
47
Non Compete Agreement (NCA)
prevent employees from working for a competing organisation for a certain amount of time
48
Acceptable use policies
define how employees are to use orgnisatioal assets in compliant manner
49
Gift Policies
define the limit and how giifts are provided and recieved within the org. TO avoid blackmail,
50
Conflict of Interest policies
situations that conflict with the organisation best interest. e.g. broher makign software and asking them to buy their software.
51
Onboarding Process
Training on Security Policies and practices Acknowledge Authorise after training and agreements acknowledged
52
Offboarding
Termination Policy - Volunteery and IN volunteery terminations Require the immediate termination - Revoke access, collect belongings (keys, Id cards) Shared access or passwords are changed after termination It depends on org and sensitivity of data that you are working with. All NDAs are signed an in place before personnel leaves
53
New Topic: Personal Safety and Security -
Protect personnel from harm, injury or loss of life
54
What is ensured during a personnel travelling?
- Ensure they are travelling to safe and secure areas Ensure their wifi is protected Ensure their equipment is protected Ensure their Bluetooth is protected Ensure their network and remote access secuity protections are enabled They must know who to contact in an Emergency situation This needs to be in the policy and personnel to be trained.
55
What is ensured during Duress?
- When peron is held hostage or forced to provide facility access - Training on how to respond - e.g. How to egress the facility in terms of break-in. Duress code words - E.g. enter pin incorrect three times Duress numbers - Have a pin number- Enter pin number in case in a duress situation. It shoudl include in the BCDR plan
56
What to do in an Emergency?
- How to contact organisation in an emergency - Organisational policy must include this information It should be in the BCDR plan
57
For Exam
Understand personnel travel processes Understand personnel duress processes Understand emergency management process
58
What is Due Care?
Cornell law school: Due care is reasonable efforts to prevent harm and risk in an organisation. e.g customers clients etc
59
What is Due Deligence
Activities done to avoid liability. Activities are researching requirements. Ongoing assessments and evaluations. Installing , evaluating, making sure a firewall works is Due Diligence
60
Due Diligence Flow
1- Requirement - Employ Guards 24/7/365 for Data Centre 2- Due Diligence - Research Requirement - Research guard companies to find a reputable company where history is to guard DCs 3- Due Care - Compliant implementation to satisfy requirement - Employ guard and put them on exit points 4- Due Deiligence - Making sure the implementation works continuously - Training to Guards to improve and educate them on security risks
61
New Topic: Important Laws and Regulations
FTC (Federal Trade Commission Act)
62
FTC( Federal Trades Commission) Act
To protect the consumers from unfair competition and includes protection of personally identifiable information (pii)
63
GLBA (Gramme Leach Billey Act)
Focusses on safeguarding financial data and preventiing it from sharing to 3P organisations without customer consent. Normally used in Banks where customer financial data is used for lending applications.
64
ECPA (Electronic Communication Privacy Act)
Defines the collection of Electronic information and how US government can access it. In US where it covers anyone'data to be accessed by the US government via telephone, email etc
65
HIPAA (Health Insurance Portability and Accountability Act)
protects privacy related to Health data like Medical records
66
HITECH (Health Information Technology for Economic and Clinical Health)
mandates how organisations that handle protected health information (PHI) on behalf of HIPAA covered entity
67
GINA (Genetic Information Non Discrimination Act)
Protects individuals from the unauthorised use, disclosure and sale of genetic related information
68
SOX (Sarbanes Oxley Act)
Protects investors against the accounting frauds and requires reporting of the financial information to company investors
69
PCI DSS (Payment Card Industry Data Security Standard)
Global standard aimed at preventing credit card fraud for the card holder. Not a regulation or law but is there under user terms and conditions
70
PCI DSS requirements
Install and maintain protective asset Dont use vendor supplied username passwords. Change them Protect stored cardholder data Encrypt the data transmission on open and public networks Protect against malware Develop and maintain secure systems and applications Restrict access to cardholder data identify authentication for system components Restrict physical access to cardholder data Track and Monitor and Audit Regularly Test -Security Assessments Maintain a policy that addresses information security for all personnel
71
GDPR (General Data Protection Regulations)
GDPR in 2016, Came into Effect in 2018- Applies to organisation collecting data from EU data subjects
72
GDPR Roles
Controller: Determines the purpose and means of collecting the personal data Processor: Processes personal data on behalf of the controller.
73

CISSP (1 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2025 Bold Learning Solutions. Terms and Conditions