Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CISSP > Security Governance > Flashcards

Security Governance Flashcards

1
Q

What is the CIA triad ?

A

CIA are the primary goals and objectives of a security infrastructure. Security controls are evaluated how well they address these three core principal

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What is the concept of Confidentiality in the CIA triad ?

A

This is a concept of the measures to ensure the protection of the secrecy of data objects and resources.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What controls are aimed at providing Confidentiality ?

A

Encryption
Access Controls
Steganography

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Is Confidentiality always breeched through intentional acts ?

A

No it can be breeched by accident or incompetence and carelessness such as leaving documents on a printer

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

In the CIA triad what is the concept of subject and object ?

A

A subject is Active element in a security relationship such as users, programs and computers which acts upon the object which could be a database, filesystem or another person

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What are the 8 related concepts to confidentiality ?

A

Isolation,
Sensitivity,
Discretion,
Criticality,
Concealment,
Secrecy,
Privacy,
Seclusion

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What are the treats to Confidentiality ?

A

Threats to encryption (cryptanalysis)

Social Engineering

Key Loggers

IOT

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What are the three modes of data involved with Confidentiality ?

A
  1. Data at rest - Encryption
  2. Data in transit - TLS, IPSEC,SSL
  3. Data in Use - Clean desk policy & PC Locking
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What are the common attacks on Integrity ?

A
  1. Cryptanalysis
  2. Code Injections
  3. Alteration of Data
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What are some of the protections for Integrity ?

A
  1. Hashing
  2. Encryption
  3. Digital Signatures
  4. Checksums
  5. Access Control
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What are the common threats to Availability ?

A
  1. Malicious attacks (DDOS, physical attack)
  2. Application (Malicious or bad code)
  3. Hardware Failure
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What are some of the measure to stop attacks on availability ?

A
  1. IPS/IDS
  2. SLA
  3. Patch Management
  4. Redundancy and High Availability measures
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What is the opposite of the CIA triad ?

A

Disclosure, Destruction, Alteration

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What is happening that brings about the DAD scenario ?

A

Disclosure, Alteration and Destruction are symptoms of the mix between CIA being incorrect

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What is identification ?

A

It is something that uniquely identifies you such as a username or a social security number

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Does just claiming identity imply access or authority ?

A

No

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What are the three types of authentication ?

A

Type 1 - Something you know such as a password

Type 2 - Something you have which is a MFA token

Type 3 - Something you are such as Biometric

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What is authorisation ?

A

Determines what you can access ?

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What are the four most common types of access control ?

A

Discretionary

Mandatory

Role Based

Accountability Based

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What is accountability ?

A

The ability to trace an action to a subjects identity

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Give an example of an action that helps accountability/auditing ?

A

Log files

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

What is the difference between monitoring and auditing ?

A

Monitoring is a type of watching or oversight whereas auditing is a recording of information to a record or a file

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Why is accountability important ?

A

If you are unable to legally support your security and support non repudiation with accountability then it may be difficult to prove malicious intent

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Whats the difference between discretionary and mandatory access control ?

A

Discretionary gives you more permissions that you strictly need i.e. there is some discretion where as mandatory is the exact access permissions that you need and no more

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

In Security what is the need to know principle ?

A

Even if you have access if you dont have a reason then you should not access the data

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

What is the difference between governance and management ?

A

Governance is a enterprise led vision and direction undertaken by company owners, board members etc and shows where the organisation wants to go whereas management is how to get there and is implemented by managers and team leads

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

Does the governance or management function determine an organisations risk appetite ?

A

Governance

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

What is risk tolerance ?

A

It is the how we are going to work with our environments and risk appetite

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

What are the typical six c - level executive roles responsible for governance ?

A
  1. CISO
  2. CTO
  3. CEO
  4. CIO
  5. CFO
  6. CSO
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

Why must CISO and CEO function report independently of the IT function ?

A

To ensure independence

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

What is PCI-DSS

A

A required standard for the credit card payments industry

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

What is Octave

A

Operationally Critical Threat Asset Vulnerability Evaluation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

What is COBIT

A

Control Objectives for Information related Technology -Stakholders needs are mapped to goals for IT

34
Q

What is COSO

A

Committee Of Sponsoring Organisations - Goals for entire organisation

35
Q

What is ITIL

A

Information Technology Infrastructure Library - IT Service Management

36
Q

What is FRAP ?

A

Facilitated Risk Analysis Process - Focusses on Individual Business units with internal employees

37
Q

What is ISO207001

A

Government Standard around Establish Implement Control of information systems management

38
Q

What is ISO27002

A

Provides practical help on implementing security controls

39
Q

Whats is ISO27004

A

Provides metrics for measuring success of ISO program

40
Q

What is ISO27005

A

Standards around risk management

41
Q

What is ISO27799

A

Controls and Standards around Protected Health Information

42
Q

What is defence in depth ?

A

A layer approach to IT security aka Onion defence covers physical, logical and administrative controls

43
Q

Should you use Defence in Depth in series or in parallel ?

A

In Series

44
Q

What is abstraction ?

A

A process where similar elements are put into groups, classes or roles that are assigned security controls

45
Q

What is data hiding ?

A

Data hiding is the act of intentionally positioning data so that it is not viewable or accessible to an unauthorised subject

46
Q

What is a security boundary ?

A

A line of intersection between any two areas, subnets or environments that have different security requirements or needs

47
Q

Why are security boundaries important ?

A

They represent a point where security controls must be added

48
Q

Can Security boudaries exist between physical and logical items ?

A

Yes

49
Q

What is security governance ?

A

Collection of practices related to the supporting, evaluating, defining and directing the security efforts of the organisation

50
Q

Who performs security governance ?

A

Board of directors and C level executives not managers

51
Q

What is third party governance ?

A

This is where the governance effort is carried out by independent third party contractors may include things such as technical support or accounting services

52
Q

What is documentation review ?

A

The process of reading the exchanged materials and verifying them against standards and expectations.

53
Q

Does an on site review take place before or after document exchange ?

A

after

54
Q

What is ATO ?

A

Authorisation to Operate - can be revoked if there is a failure to supply governance bodies with documentation that can be reviewed

55
Q

What is the security function ?

A

That area of the business that is responsible for evaluating and improving security overtime

56
Q

What is a top down approach to security ?

A

Initiation by senior management middle management to flesh out implemented by security professionals

57
Q

Is security management the responsibility of IT staff ?

A

No Upper management

58
Q

What is the strategic plan ?

A

A stable long term plan defined by Upper management describing the security vision of the organisation

59
Q

What is the tactical plan ?

A

More detail on the strategic plan covering months

60
Q

What is operational plan ?

A

Covers the implementation of the tactical plan (weeks)Updated regularly to maintain compliance with tactical plan

61
Q

What are the six types of law/regulations ?

A
  1. Criminal - Where society is the victim aim is to Punish and deter
  2. Civil - Individual/Single organisation is victim and financial penalties apply
  3. Administrative - Gov Agencies e.g. HIPAA
  4. Private - Compliance required for contract PCI-DSS
  5. Customary - Personal Conduct - Individual org as relating to an areas customs
  6. Religious - Code of ethics
62
Q

What is liability ?

A

Determining who is at fault and who has to pay. Ultimate liability lies with senior management but individuals lower down can also be liable.

63
Q

What is due diligence and due care ?

A

Steps required to show appropriate action and care aimed at answering the question what would a prudent organisation or individual do

64
Q

What is negligence ?

A

Opposite of due care i.e. a lack of implementation of due care and diligence

65
Q

What is the difference between due diligence and due care ?

A

Due diligence (Preparation) is what you do up front such as research due care is the ongoing implementation such as patching, and monitoring

66
Q

You have found a vulnerability in your webserver what are the due diligence and due care actions ?

A

Due diligence - research vulnerability and possible fixes

Due care - implementation of the fix and monitoring the results

67
Q

What are the five types of evidence ?

A
  1. Real Evidence - Tangible and Physical objects in IT security
  2. Direct - Testimony from direct witness gathered through their five senses
  3. Circumstantial - Evidence that supports circumstances
  4. Corroborative - Facts that support facts or elements of the case
  5. Hearsay - Not first hand evidence not normally admissable
68
Q

Do you perform forensics on the original object ?

A

No you always make a copy and prove that the copy is the same through hashing

69
Q

What are the four rules around evidence ?

A
  1. Best Evidence - Accurate, Relevant, Authentic, Convincing
  2. Secondary Evidence - Logs and audits
  3. Evidence Integrity - Preserved through hashing
  4. Chain of Custody - Who handled it, When, What, Where
70
Q

What US Law protects citizens from unreasonable searches ?

A

fourth ammendment

71
Q

Who in the US determines if a search is legal ?

A

Courts

72
Q

What are the exceptions to the fourth ammendment ?

A

Immediate Threat to life or destruction of evidence

73
Q

Do you have to inform your employees that you are monitoring them ?

A

Yes

74
Q

What is entrapment ?

A

Illegal and unethical practice that persuades someone to commit a crime that they had not intention of committing

75
Q

What is enticement ?

A

Legal and Ethical - Making committing the crime more enticing as the person has already committed to breaking the law or has decided to do so.

76
Q

Are Honeypots entrapment of enticement ?

A

If done properly they are enticement

77
Q

What are the five types of intellectual property ?

A
  1. Copyright - Anything that is created such as books or art 70 years for individuals 95 for corporations
  2. Brand Names - Logos - must be registered can last from ten ears to indefinite
  3. Patents - Protects inventions 20 years
  4. Cryptography Algorithms
  5. Trade Secrets
78
Q

Do you have to apply for copyright ?

A

No it is automatically granted

79
Q

What is an attack against copyright ?

A

Piracy

80
Q

What is an attack against Trademarks ?

A

Counterfeiting

81
Q

What is an attack on Patents ?

A

Patent infringement

CISSP (1 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions