Security Risk Management (SRM) Flashcards
27001
specifies the requirements for establishing, implementing, operating, monitoring, reviewing, maintaining, and improving a documented information security management system within the context of the organization’s overall business risks
27002
A standard that defines information’s confidentiality, integrity, and availability controls in a comprehensive information security management system
ISO/IEC 27011
telecommunications organization guidelines
ISO/IEC 27015
financial organization guidelines
ISO/IEC 27037
Digital evidence guidelines
ISO/IEC 27799
health organization guidelines
acceptable risk
concern that is acceptable to responsible management, due to the cost and magnitude of implementing controls
acceptable use policy
A policy that establishes an agreement between users and the organization and defines for all parties the ranges of use that are approved before gaining access to a network or the Internet
access rights
Permissions or privileges granted to users, programs, or workstations to create, change, delete or view data and files within a system as defined by rules established by data owners and the information security policy
accountablity
The ability to map a given activity or event back to the responsible party
administrative controls
The rules, procedures, and practices dealing with operational effectiveness, efficiency, and adherence to regulations and management policies
advanced threat
an attacker repeatedly using multiple different attack vectors repeatedly to generate opportunities
application controls
Manual or programmed activities intended to ensure the completeness and accuracy of records and the validity of entries made. The objectives of application controls are to ensure the completeness and accuracy of the records and the validity of the entries made therein resulting from manual and programmed processing
Assurance
Grounds for confidence that the other four security controls (integrity, availability, confidentiality, and accountability) have been adequately met by a specific implementation. “Adequately met” includes (1) functionality that performs correctly, (2) sufficient protection against unintentional errors (by users or software), and (3) sufficient resistance to intentional penetration or bypass.
audit trail
A visible trail of evidence enabling one to trace information contained in statements or reports back to the original input source
Availability
Uptime, ready, in a condition to be used
Chief information security officer
An executive position charged with responsibility for managing and protecting information assets
CFAA of 1986
Computer Fraud and Abuse Act (CFAA)
Affects any entities that may engage in hacking of “protected computers” as defined in the Act
Computer Security Act of 1987
Was the first law written to require a formal computer security plan
Confidentiality
An organization’s protection of data in storage, during processing, and in transit for use by the subjects that are specifically intended to have access to the data or resource
Control Objectives for Information and related Technology
A complete, internationally accepted process framework for IT that supports business and IT executives and IT management in their definition and achievement of business goals and related IT goals by providing a comprehensive IT governance, management, control and assurance model. COBIT describes IT processes and associated control objectives, management guidelines (activities, accountabilities, responsibilities, and performance metrics) and maturity models. COBIT supports enterprise management in the development, implementation, continuous improvement and monitoring of good IT-related practices.
Corporate governance
The system by which organizations are directed and controlled. Boards of directors are responsible for the governance of their organizations. It consists of the leadership and organizational structures and processes that ensure the organization sustains and extends strategies and objectives.
Corporate strategy
The pattern of decisions in a company that determines and reveals its objectives, purposes or goals; produces the principal policies and plans for achieving those goals; and defines the range of business the company is to pursue, the kind of economic and human organization it is or intends to be, and the nature of the economic and non-economic contribution it intends to make to its shareholders, employees, customers and communities.
Countermeasure
a control after attack
Cross training
to know more than one job
Custodian
the guardian of asset(s), a maintenance activity
Data classification
The assignment of a level of sensitivity to data (or information) that results in the specification of controls for each level of classification. Levels of sensitivity of data are assigned according to predefined categories as data are created, amended, enhanced, stored or transmitted. The classification level is an indication of the value or importance of the data to the organization.
Data regrade
Data is transferred from high network users to low network users
Decentralization
The process of distributing computer processing to different locations within an organization
Denial of Service
The prevention of authorized access to resources or the delaying of time critical operations
Dual control
A procedure that uses two or more entities (usually persons) operating in concert to protect a system resource such that no single entity acting alone can access that resource
Due care
Managers and their organizations have a duty to provide for information security to ensure that the type of control, the cost of control, and the deployment of control are appropriate for the system being managed.
Due diligence
Establishing a plan, policy, and process to protect the interests of an organization
ECPA of 1986
Electronic Communications Privacy Act
Extended government restrictions on wiretaps from telephone calls to include transmissions of electronic data by computer and prohibited access to stored electronic communications
Education
long term knowledge building
