Brainscape's Knowledge GenomeTM


Top Flashcards (Certified)
All Flashcards

CISSP > Security Governance > Flashcards

Security Governance Flashcards

1
Q

What is the CIA triad ?

A

CIA are the primary goals and objectives of a security infrastructure. Security controls are evaluated how well they address these three core principal

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What is the concept of Confidentiality in the CIA triad ?

A

This is a concept of the measures to ensure the protection of the secrecy of data objects and resources.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What controls are aimed at providing Confidentiality ?

A

Encryption
Access Controls
Steganography

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Is Confidentiality always breeched through intentional acts ?

A

No it can be breeched by accident or incompetence and carelessness such as leaving documents on a printer

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

In the CIA triad what is the concept of subject and object ?

A

A subject is Active element in a security relationship such as users, programs and computers which acts upon the object which could be a database, filesystem or another person

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What are the 8 related concepts to confidentiality ?

A

Isolation,
Sensitivity,
Discretion,
Criticality,
Concealment,
Secrecy,
Privacy,
Seclusion

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What are the treats to Confidentiality ?

A

Threats to encryption (cryptanalysis)

Social Engineering

Key Loggers

IOT

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What are the three modes of data involved with Confidentiality ?

A
  1. Data at rest - Encryption
  2. Data in transit - TLS, IPSEC,SSL
  3. Data in Use - Clean desk policy & PC Locking
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What are the common attacks on Integrity ?

A
  1. Cryptanalysis
  2. Code Injections
  3. Alteration of Data
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What are some of the protections for Integrity ?

A
  1. Hashing
  2. Encryption
  3. Digital Signatures
  4. Checksums
  5. Access Control
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What are the common threats to Availability ?

A
  1. Malicious attacks (DDOS, physical attack)
  2. Application (Malicious or bad code)
  3. Hardware Failure
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What are some of the measure to stop attacks on availability ?

A
  1. IPS/IDS
  2. SLA
  3. Patch Management
  4. Redundancy and High Availability measures
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What is the opposite of the CIA triad ?

A

Disclosure, Destruction, Alteration

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What is happening that brings about the DAD scenario ?

A

Disclosure, Alteration and Destruction are symptoms of the mix between CIA being incorrect

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What is identification ?

A

It is something that uniquely identifies you such as a username or a social security number

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Does just claiming identity imply access or authority ?

A

No

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What are the three types of authentication ?

A

Type 1 - Something you know such as a password

Type 2 - Something you have which is a MFA token

Type 3 - Something you are such as Biometric

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What is authorisation ?

A

Determines what you can access ?

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What are the four most common types of access control ?

A

Discretionary

Mandatory

Role Based

Accountability Based

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What is accountability ?

A

The ability to trace an action to a subjects identity

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Give an example of an action that helps accountability/auditing ?

A

Log files

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

What is the difference between monitoring and auditing ?

A

Monitoring is a type of watching or oversight whereas auditing is a recording of information to a record or a file

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Why is accountability important ?

A

If you are unable to legally support your security and support non repudiation with accountability then it may be difficult to prove malicious intent

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Whats the difference between discretionary and mandatory access control ?

A

Discretionary gives you more permissions that you strictly need i.e. there is some discretion where as mandatory is the exact access permissions that you need and no more

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
In Security what is the need to know principle ?
Even if you have access if you dont have a reason then you should not access the data
26
What is the difference between governance and management ?
Governance is a enterprise led vision and direction undertaken by company owners, board members etc and shows where the organisation wants to go whereas management is how to get there and is implemented by managers and team leads
27
Does the governance or management function determine an organisations risk appetite ?
Governance
28
What is risk tolerance ?
It is the how we are going to work with our environments and risk appetite
29
What are the typical six c - level executive roles responsible for governance ?
1. CISO 2. CTO 3. CEO 4. CIO 5. CFO 6. CSO
30
Why must CISO and CEO function report independently of the IT function ?
To ensure independence
31
What is PCI-DSS
A required standard for the credit card payments industry
32
What is Octave
Operationally Critical Threat Asset Vulnerability Evaluation
33
What is COBIT
Control Objectives for Information related Technology -Stakholders needs are mapped to goals for IT
34
What is COSO
Committee Of Sponsoring Organisations - Goals for entire organisation
35
What is ITIL
Information Technology Infrastructure Library - IT Service Management
36
What is FRAP ?
Facilitated Risk Analysis Process - Focusses on Individual Business units with internal employees
37
What is ISO207001
Government Standard around Establish Implement Control of information systems management
38
What is ISO27002
Provides practical help on implementing security controls
39
Whats is ISO27004
Provides metrics for measuring success of ISO program
40
What is ISO27005
Standards around risk management
41
What is ISO27799
Controls and Standards around Protected Health Information
42
What is defence in depth ?
A layer approach to IT security aka Onion defence covers physical, logical and administrative controls
43
Should you use Defence in Depth in series or in parallel ?
In Series
44
What is abstraction ?
A process where similar elements are put into groups, classes or roles that are assigned security controls
45
What is data hiding ?
Data hiding is the act of intentionally positioning data so that it is not viewable or accessible to an unauthorised subject
46
What is a security boundary ?
A line of intersection between any two areas, subnets or environments that have different security requirements or needs
47
Why are security boundaries important ?
They represent a point where security controls must be added
48
Can Security boudaries exist between physical and logical items ?
Yes
49
What is security governance ?
Collection of practices related to the supporting, evaluating, defining and directing the security efforts of the organisation
50
Who performs security governance ?
Board of directors and C level executives not managers
51
What is third party governance ?
This is where the governance effort is carried out by independent third party contractors may include things such as technical support or accounting services
52
What is documentation review ?
The process of reading the exchanged materials and verifying them against standards and expectations.
53
Does an on site review take place before or after document exchange ?
after
54
What is ATO ?
Authorisation to Operate - can be revoked if there is a failure to supply governance bodies with documentation that can be reviewed
55
What is the security function ?
That area of the business that is responsible for evaluating and improving security overtime
56
What is a top down approach to security ?
Initiation by senior management middle management to flesh out implemented by security professionals
57
Is security management the responsibility of IT staff ?
No Upper management
58
What is the strategic plan ?
A stable long term plan defined by Upper management describing the security vision of the organisation
59
What is the tactical plan ?
More detail on the strategic plan covering months
60
What is operational plan ?
Covers the implementation of the tactical plan (weeks)Updated regularly to maintain compliance with tactical plan
61
What are the six types of law/regulations ?
1. Criminal - Where society is the victim aim is to Punish and deter 2. Civil - Individual/Single organisation is victim and financial penalties apply 3. Administrative - Gov Agencies e.g. HIPAA 4. Private - Compliance required for contract PCI-DSS 5. Customary - Personal Conduct - Individual org as relating to an areas customs 6. Religious - Code of ethics
62
What is liability ?
Determining who is at fault and who has to pay. Ultimate liability lies with senior management but individuals lower down can also be liable.
63
What is due diligence and due care ?
Steps required to show appropriate action and care aimed at answering the question what would a prudent organisation or individual do
64
What is negligence ?
Opposite of due care i.e. a lack of implementation of due care and diligence
65
What is the difference between due diligence and due care ?
Due diligence (Preparation) is what you do up front such as research due care is the ongoing implementation such as patching, and monitoring
66
You have found a vulnerability in your webserver what are the due diligence and due care actions ?
Due diligence - research vulnerability and possible fixes Due care - implementation of the fix and monitoring the results
67
What are the five types of evidence ?
1. Real Evidence - Tangible and Physical objects in IT security 2. Direct - Testimony from direct witness gathered through their five senses 3. Circumstantial - Evidence that supports circumstances 4. Corroborative - Facts that support facts or elements of the case 5. Hearsay - Not first hand evidence not normally admissable
68
Do you perform forensics on the original object ?
No you always make a copy and prove that the copy is the same through hashing
69
What are the four rules around evidence ?
1. Best Evidence - Accurate, Relevant, Authentic, Convincing 2. Secondary Evidence - Logs and audits 3. Evidence Integrity - Preserved through hashing 4. Chain of Custody - Who handled it, When, What, Where
70
What US Law protects citizens from unreasonable searches ?
fourth ammendment
71
Who in the US determines if a search is legal ?
Courts
72
What are the exceptions to the fourth ammendment ?
Immediate Threat to life or destruction of evidence
73
Do you have to inform your employees that you are monitoring them ?
Yes
74
What is entrapment ?
Illegal and unethical practice that persuades someone to commit a crime that they had not intention of committing
75
What is enticement ?
Legal and Ethical - Making committing the crime more enticing as the person has already committed to breaking the law or has decided to do so.
76
Are Honeypots entrapment of enticement ?
If done properly they are enticement
77
What are the five types of intellectual property ?
1. Copyright - Anything that is created such as books or art 70 years for individuals 95 for corporations 2. Brand Names - Logos - must be registered can last from ten ears to indefinite 3. Patents - Protects inventions 20 years 4. Cryptography Algorithms 5. Trade Secrets
78
Do you have to apply for copyright ?
No it is automatically granted
79
What is an attack against copyright ?
Piracy
80
What is an attack against Trademarks ?
Counterfeiting
81
What is an attack on Patents ?
Patent infringement

CISSP (1 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2025 Bold Learning Solutions. Terms and Conditions