Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CISSP OWN SET > Security Fundamentals > Flashcards

Security Fundamentals Flashcards

1
Q

CODE OF ETHICS CANONS

A
  • Protect society, the common good, necessary public trust and confidence, and the infrastructure
  • Act honorably, honestly, justly, responsibly, and legally
  • Provide diligent and competent service to principles
  • Advance and protect the profession
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Confidentiality

A
  • Unauthorized access to application, system, or data
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Integrity

A
  • Change or removal of data from a system or product
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Availability

A
  • Disruption or prevention of access to data or services
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Incorporating Stakeholder Input

A
  • Look for subject-matter expertise with internal stakeholders, regardless of roles and responsibility
  • Stake holder input is critical in early phases
  • Stakeholder buy-in is necessary
  • Input from project and program managers is critical
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Owner

A
  • Owns the information

* Determines the classification level

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Steward

A
  • Manages the data and metadata

* Ensures compliance (standards/controls) and data quality

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Custodian

A
  • Is the keeper of the information

* Ensures CIA is maintained

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Chief privacy officer

A
  • Ensures privacy of all data in the entire organization
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Protecting Privacy: Often mandate from regulations or industry compliance such as HIPAA or PCI-DSS

A
  • Data owners
  • Data Processors
  • Data Remanence
  • Collection Limitations
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Data Loss Prevention (DLP)

A
  • Provides strategic methods for ensuring that end users do not transmit sensitive or critical information outside the corporate network
  • Stops data breaches and leakage
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Personally Identifiable information (PII)

A
  • Individuals identifiable information
  • Consists of first name or initial with last name and one or more pieces of info
  • Social Security number, driver’s license number, ID card, financial account number, medical/health info
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Protected health information (PHI)

A
  • Individuals identifiable health information
  • Contains at least one piece of info
  • Name, address, birth date, phone number, mail or e-mail address, social security number, URL, IP
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Data Retention

A
  • Keeping data until it’s no longer needed
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Data retention policy

A
  • Identifies how, where, and why data will be retained
  • Operational use / Current and Future use
  • Adherence to legal and regulatory requirements
  • Periodic audits
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Destruction

A
  • Burning
  • Shredding
  • Pulverizing
  • Pulping
17
Q

Sanitization

A
  • Degaussing: Removing the magnetic field of drive
  • Purging: Clearing everything off the media
  • Wiping: Overwriting every sector of drive with 1s and 0s
  • Encryption: Encrypting all files before deleting or disposing of media
18
Q

Security Control Categories

A

Administrative, Technical, and Physical

19
Q

Administrative

A

Defines policies, procedures, and guidelines:

* Password policy, hiring policy, screening policy, mandatory vacations, training, Rotation of duties

20
Q

Technical

A

Controls access to a resource:

* Firewalls, encryption, passwords, IDS/IPS, smart cards, bio-metrics, RADIUS, Anti-Virus Software

21
Q

Physical

A

Controls access to facility:

* Locks, Guards, Fences, Video cameras, Gates, Bollards, Dogs, Alarms, Motion Detectors

22
Q

Preventive

A
  • Stops attacker from performing attack

: Fences, IPS sensor, Security Guard gates, Locks

23
Q

Detective

A
  • Identifies an attack that is happening

: Cameras, IDS Sensor, Anti-malware

24
Q

Corrective

A
  • Restores a system to state before attack

: Disaster recovery policies, Business continuity planning, Automated, Cloud-based, antivirus, anti-malware and DLP

25
Q

Deterrent

A
  • Discourages attacker from performing attack

: Presence of security guards or cameras

26
Q

Compensating ( Recovery)

A
  • Aids controls already in place

: Automated cloud services, Cloud access security broker, Managed security service provider

27
Q

Data at rest (data in storage)

A
  • On hard disks, memory cards, data centers, cloud storage, archives and backups, external and removable drives
28
Q

Data in motion (data in transit)

A
  • Data sent on LAN, WAN, MAN, dedicated lines, wired, wireless
29
Q

Data in use (volatile data)

A
  • Data in CPU registers, RAM memory, volatile storage
30
Q

Protecting Data at Rest

A
  • Conventional perimeter based defenses like firewalls, IPS, and antivirus programs
  • Defense-in-depth access controls and MFA
  • Volume, disk, and file encryption
  • Partitioned storage
31
Q

Protecting Data in Motion

A
  • Encapsulation
  • Dedicated channels
  • Transport Layer Security (SSL/TLS)
  • IPSec VPN’s
  • EAP wireless variants
  • 802.1X and 802.11AE MACsec
32
Q

Protecting Data in Use

A
  • The least mature protection system
  • Newer methods for protecting volatile data in memory
  • Trusted computing system (SE-Linux)
  • Overhead due to encryption/decryption and often costly and difficult to implement
33
Q

Enterprise information security Architecture (EISA)

A
  • The current and/ or future and behavior of an organization’s security processes
  • Information security systems
  • Personnel and organizational sub units that align with the organization’s core goals and strategic direction
  • A structured approach to developing an integrated and comprehensive security architecture

CISSP OWN SET (2 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions