Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Cyber Security > Security Risk Management (SRM) > Flashcards

Security Risk Management (SRM) Flashcards

1
Q

27001

A

specifies the requirements for establishing, implementing, operating, monitoring, reviewing, maintaining, and improving a documented information security management system within the context of the organization’s overall business risks

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

27002

A

A standard that defines information’s confidentiality, integrity, and availability controls in a comprehensive information security management system

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

ISO/IEC 27011

A

telecommunications organization guidelines

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

ISO/IEC 27015

A

financial organization guidelines

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

ISO/IEC 27037

A

Digital evidence guidelines

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

ISO/IEC 27799

A

health organization guidelines

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

acceptable risk

A

concern that is acceptable to responsible management, due to the cost and magnitude of implementing controls

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

acceptable use policy

A

A policy that establishes an agreement between users and the organization and defines for all parties the ranges of use that are approved before gaining access to a network or the Internet

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

access rights

A

Permissions or privileges granted to users, programs, or workstations to create, change, delete or view data and files within a system as defined by rules established by data owners and the information security policy

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

accountablity

A

The ability to map a given activity or event back to the responsible party

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

administrative controls

A

The rules, procedures, and practices dealing with operational effectiveness, efficiency, and adherence to regulations and management policies

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

advanced threat

A

an attacker repeatedly using multiple different attack vectors repeatedly to generate opportunities

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

application controls

A

Manual or programmed activities intended to ensure the completeness and accuracy of records and the validity of entries made. The objectives of application controls are to ensure the completeness and accuracy of the records and the validity of the entries made therein resulting from manual and programmed processing

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Assurance

A

Grounds for confidence that the other four security controls (integrity, availability, confidentiality, and accountability) have been adequately met by a specific implementation. “Adequately met” includes (1) functionality that performs correctly, (2) sufficient protection against unintentional errors (by users or software), and (3) sufficient resistance to intentional penetration or bypass.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

audit trail

A

A visible trail of evidence enabling one to trace information contained in statements or reports back to the original input source

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Availability

A

Uptime, ready, in a condition to be used

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Chief information security officer

A

An executive position charged with responsibility for managing and protecting information assets

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

CFAA of 1986

A

Computer Fraud and Abuse Act (CFAA)

Affects any entities that may engage in hacking of “protected computers” as defined in the Act

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Computer Security Act of 1987

A

Was the first law written to require a formal computer security plan

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Confidentiality

A

An organization’s protection of data in storage, during processing, and in transit for use by the subjects that are specifically intended to have access to the data or resource

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Control Objectives for Information and related Technology

A

A complete, internationally accepted process framework for IT that supports business and IT executives and IT management in their definition and achievement of business goals and related IT goals by providing a comprehensive IT governance, management, control and assurance model. COBIT describes IT processes and associated control objectives, management guidelines (activities, accountabilities, responsibilities, and performance metrics) and maturity models. COBIT supports enterprise management in the development, implementation, continuous improvement and monitoring of good IT-related practices.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Control gaps

A

The amount of risk reduced by implementing safeguards

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Corporate governance

A

The system by which organizations are directed and controlled. Boards of directors are responsible for the governance of their organizations. It consists of the leadership and organizational structures and processes that ensure the organization sustains and extends strategies and objectives.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Corporate strategy

A

The pattern of decisions in a company that determines and reveals its objectives, purposes or goals; produces the principal policies and plans for achieving those goals; and defines the range of business the company is to pursue, the kind of economic and human organization it is or intends to be, and the nature of the economic and non-economic contribution it intends to make to its shareholders, employees, customers and communities.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

Countermeasure

A

a control after attack

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

Cross training

A

to know more than one job

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

Custodian

A

the guardian of asset(s), a maintenance activity

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

Data classification

A

The assignment of a level of sensitivity to data (or information) that results in the specification of controls for each level of classification. Levels of sensitivity of data are assigned according to predefined categories as data are created, amended, enhanced, stored or transmitted. The classification level is an indication of the value or importance of the data to the organization.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

Data regrade

A

Data is transferred from high network users to low network users

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

Decentralization

A

The process of distributing computer processing to different locations within an organization

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

Denial of Service

A

The prevention of authorized access to resources or the delaying of time critical operations

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

Dual control

A

A procedure that uses two or more entities (usually persons) operating in concert to protect a system resource such that no single entity acting alone can access that resource

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

Due care

A

Managers and their organizations have a duty to provide for information security to ensure that the type of control, the cost of control, and the deployment of control are appropriate for the system being managed. Doing the right action at the right time.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

Due diligence

A

Establishing a plan, policy, and process to protect the interests of an organization. Knowing what should be done and planning for it.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

ECPA of 1986

A

Electronic Communications Privacy Act

Extended government restrictions on wiretaps from telephone calls to include transmissions of electronic data by computer and prohibited access to stored electronic communications

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

Education

A

long term knowledge building

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

Ethics

A

the principles a person sets for themselves to follow

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

Exposure

A

an opportunity for a threat to cause loss. (terminology that encompasses many recent risk terms)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

Federal Privacy Act of 1974

A

Affects any computer that contains records used by a federal agency

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
40
Q

FISA of 1978

A

Federal Intelligence Surveillance Act (FISA)

Affects law enforcement and intelligence agencies

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
41
Q

Governance

A

Executive responsibilities of goal setting, delegation, and verification, based upon the mission.

42
Q

Guidelines

A

written suggestions that direct choice to a few alternatives

43
Q

Information owner

A

the one person responsible for data, its classification and control setting

44
Q

Information security governance

A

The set of responsibilities and practices exercised by the board and executive management with the goal of providing strategic direction, ensuring objectives are achieved, ascertaining that risks are managed appropriately and verifying that the enterprise’s resources are used responsibly

45
Q

Information security program

A

The overall combination of technical, operational and procedural measures, and management structures implemented to provide for the confidentiality, integrity and availability of information based on business requirements and risk analysis

46
Q

inherent risk

A

the amount of risk that exists in the absence of controls

47
Q

IT-Related Risk

A

The net mission impact considering (1) the probability that a particular threat-source will exercise (accidentally trigger or intentionally exploit) a particular information system vulnerability and (2) the resulting impact if this should occur. IT-related risks arise from legal liability or mission loss due to these 4 items: 1. Unauthorized (malicious or accidental) disclosure, modification, or destruction of information 2. Unintentional errors and omissions 3. IT disruptions due to natural or man-made disasters 4. Failure to exercise due care and diligence in the implementation and operation of the IT system.

48
Q

job rotation

A

to move from location to location, keeping the same function

49
Q

job training

A

employment education done one per position or at significant change of function

50
Q

mandatory access control

A

A means of restricting access to data based on varying degrees of security requirements for information contained in the objects and the corresponding security clearance of users’ programs acting on their behalf

51
Q

mandatory vacations

A

requirement to take time off

52
Q

mitigate

A

a choice in risk management, to implement a control that limits or lessens negative effects

53
Q

monitoring policy

A

The rules outlining or delineating the way in which information about the use of computers, networks, applications and information is captured

54
Q

objects

A

Data or systems, passive

55
Q

operational

A

intermediate level, pertaining to planning

56
Q

PASTA

A

Threat modeling focusing on developing countermeasures based on asset value

Stage 1 - Definition of Objectives
Stage 2 - Definition of Technical Scope
Stage 3 - App Decomposition and Analysis
Stage 4 - Threat Analysis
Stage 5 - Weakness and Vulnerability analysis
Stage 6 - Attack modeling and simulation
Stage 7 - Risk Analysis and Management

57
Q

policy

A

written core statements that rarely change

58
Q

privacy

A

Freedom from unauthorized intrusion or disclosure of information about individuals

59
Q

private/privacy

A

Individual owned or ownership

60
Q

procedure

A

written step-by-step actions

61
Q

procedures

A

The portion of a security policy that states the general process that will be performed to accomplish a security goal

62
Q

qualitative

A

a risk assessment method, intrinsic value

63
Q

quantitative

A

a risk assessment method, measurable real money cost

64
Q

residual risk

A

quantity of risk remaining after a control is applied
total risk - controls gap

65
Q

risk

A

the chance that something negative will occur

66
Q

risk analysis steps

A
  1. Inventory assets and assign a value (asset value or AV)
  2. Identify threats. Research each asset and produce a list of all possible threats of each asset. (and calculate EF and SLE)
  3. Perform a threat analysis to calculate the likelihood of each threat being realized within a single year (the ARO)
  4. Estimate the potential loss by calculating the annualized loss expectancy (ALE)
  5. Research the countermeasure for each threat, and then calculate the changes to ARO and ALE based on an applied countermeasure
  6. Perform a cost/benefit analysis of each countermeasure for each threat for each asset
67
Q

risk assessment

A

the collection and summation of risk data relating to a particular asset and controls for that asset

68
Q

risk formula

A

threat * vulnerability

69
Q

risk management

A

The total process of identifying, controlling, and mitigating information system-related risks. It includes risk assessment; cost-benefit analysis; and the selection, implementation, test, and security evaluation of safeguards. This overall system security review considers both effectiveness and efficiency, including impact on the mission and constraints due to policy, regulations, and laws.

70
Q

risk management phases

A

Framing
Assessing
Responding
Alternatives
Monitoring

71
Q

safeguard

A

a control before attack

72
Q

safeguard evaluation

A

Good security controls mitigate risk, are transparent to users, difficult to bypass, and are cost effective

73
Q

safeguard value

A

ALE before safeguard - ALE after safeguard - annual cost of safeguard

74
Q

security clearance

A

the level and label given to an individual for the purpose of compartmentalization

75
Q

security goals

A

The five security goals are integrity, availability, confidentiality, accountability, and assurance

76
Q

security metrics

A

Any form of measurement used to determine any aspect of the operation of any security-related activity

77
Q

separation of duties

A

to break a business process into separate functions and assign to different people

78
Q

standard

A

written internalized or nationalized norms that are internal to an organization

79
Q

steering committee

A

A management committee assembled to sponsor and manage various projects, such as an information security program

80
Q

strategic

A

high level, pertaining to planning

81
Q

STRIDE

A

Threat modeling
Spoofing
Tampering
Repudiation
Information Disclosure
Denial of Service
Elevation of Privilege

82
Q

subjects

A

people or groups, active

83
Q

tactical

A

low level, pertaining to planning

84
Q

threat

A

The potential for a threat-source to exercise (accidentally trigger or intentionally exploit) a specific vulnerability

85
Q

threat agent

A

those who initiate the attack

86
Q

threat analysis

A

The examination of threat-sources against system vulnerabilities to determine the threats for a particular system in a particular operational environment

87
Q

threats

A

vehicle or tool that exploits a weakness

88
Q

threat-source

A

Either (1) intent and method targeted at the intentional exploitation of a vulnerability or (2) a situation and method that may accidentally trigger a vulnerability.

89
Q

total risk

A

the amount of risk an organization would face if no safeguards were implemented

90
Q

total risk formula

A

calculation encompassing threats, vulnerabilities and assets
threats * vulnerabilities * assets

91
Q

transfer

A

a choice in risk management, to convince another to assume risk, typically by payment

92
Q

user

A

people who interact with assets

93
Q

VAST

A

Visual, Agile and Simple Threat model

Threat modeling concept that integrates threat and risk management into an Agile programming environment on a scalable basis

94
Q

vulnerability

A

weakness or flaw in an asset

95
Q

Framing Phase

A

Tactical/System
Operational/Business Process
Strategic/Whole business

96
Q

Assessing Phase

A

Set scope (Tactical/System, Operational/Business Process, Strategic/Whole business from Framing Phase)
Identify threat sources
Identify threat events
Identify vulnerabilities
Determine likelihood
Determine impacts
Determine risks

97
Q

Responding Phase

A

Developing alternatives
Evaluating alternatives (Avoid, Accept, Transfer from Alternatives Phase)
Determining course of action
Implementing (Mitigate = Control from Alternatives Phase)

98
Q

Alternatives Phase

A

Avoid = Stop Doing,
Accept = Do Nothing,
Transfer = Buy Insurance,
Mitigate = Control

99
Q

Monitoring Phase

A

Determining effectiveness of responses,
Identifying risk-impacting changes,
Verifying controls/compliance

100
Q

NIST 800-37

A

Risk Management Framework

101
Q

NIST 800-37 steps

A

People Can See I Am Always Monitoring

Prepare to execute RMF
Categorize information systems
Select security controls
Implement security controls
Assess the security controls
Authorize the system
Monitor security controls

Cyber Security (19 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions