Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Cyber Security > SRM > Flashcards

SRM Flashcards

1
Q

specifies the requirements for establishing, implementing, operating, monitoring, reviewing, maintaining, and improving a documented information security management system within the context of the organization’s overall business risks

A

27001

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

A standard that defines information’s confidentiality, integrity, and availability controls in a comprehensive information security management system

A

27002

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

telecommunications organization guidelines

A

ISO/IEC 27011

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

financial organization guidelines

A

ISO/IEC 27015

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Digital evidence guidelines

A

ISO/IEC 27037

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

health organization guidelines

A

ISO/IEC 27799

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

concern that is acceptable to responsible management, due to the cost and magnitude of implementing controls

A

acceptable risk

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

A policy that establishes an agreement between users and the organization and defines for all parties the ranges of use that are approved before gaining access to a network or the Internet

A

acceptable use policy

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Permissions or privileges granted to users, programs, or workstations to create, change, delete or view data and files within a system as defined by rules established by data owners and the information security policy

A

access rights

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

The ability to map a given activity or event back to the responsible party

A

accountablity

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

The rules, procedures, and practices dealing with operational effectiveness, efficiency, and adherence to regulations and management policies

A

administrative controls

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

an attacker repeatedly using multiple different attack vectors repeatedly to generate opportunities

A

advanced threat

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Manual or programmed activities intended to ensure the completeness and accuracy of records and the validity of entries made. The objectives of application controls are to ensure the completeness and accuracy of the records and the validity of the entries made therein resulting from manual and programmed processing

A

application controls

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Grounds for confidence that the other four security controls (integrity, availability, confidentiality, and accountability) have been adequately met by a specific implementation. “Adequately met” includes (1) functionality that performs correctly, (2) sufficient protection against unintentional errors (by users or software), and (3) sufficient resistance to intentional penetration or bypass.

A

Assurance

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

A visible trail of evidence enabling one to trace information contained in statements or reports back to the original input source

A

audit trail

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Uptime, ready, in a condition to be used

A

Availability

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

An executive position charged with responsibility for managing and protecting information assets

A

Chief information security officer

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

CFAA of 1986

A

Computer Fraud and Abuse Act (CFAA)

Affects any entities that may engage in hacking of “protected computers” as defined in the Act

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Computer Security Act of 1987

A

Was the first law written to require a formal computer security plan

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

An organization’s protection of data in storage, during processing, and in transit for use by the subjects that are specifically intended to have access to the data or resource

A

Confidentiality

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

A complete, internationally accepted process framework for IT that supports business and IT executives and IT management in their definition and achievement of business goals and related IT goals by providing a comprehensive IT governance, management, control and assurance model. COBIT describes IT processes and associated control objectives, management guidelines (activities, accountabilities, responsibilities, and performance metrics) and maturity models. COBIT supports enterprise management in the development, implementation, continuous improvement and monitoring of good IT-related practices.

A

Control Objectives for Information and related Technology

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

The system by which organizations are directed and controlled. Boards of directors are responsible for the governance of their organizations. It consists of the leadership and organizational structures and processes that ensure the organization sustains and extends strategies and objectives.

A

Corporate governance

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

The pattern of decisions in a company that determines and reveals its objectives, purposes or goals; produces the principal policies and plans for achieving those goals; and defines the range of business the company is to pursue, the kind of economic and human organization it is or intends to be, and the nature of the economic and non-economic contribution it intends to make to its shareholders, employees, customers and communities.

A

Corporate strategy

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

a control after attack

A

Countermeasure

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

to know more than one job

A

Cross training

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

the guardian of asset(s), a maintenance activity

A

Custodian

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

The assignment of a level of sensitivity to data (or information) that results in the specification of controls for each level of classification. Levels of sensitivity of data are assigned according to predefined categories as data are created, amended, enhanced, stored or transmitted. The classification level is an indication of the value or importance of the data to the organization.

A

Data classification

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

Data is transferred from high network users to low network users

A

Data regrade

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

The process of distributing computer processing to different locations within an organization

A

Decentralization

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

The prevention of authorized access to resources or the delaying of time critical operations

A

Denial of Service

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

A procedure that uses two or more entities (usually persons) operating in concert to protect a system resource such that no single entity acting alone can access that resource

A

Dual control

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

Managers and their organizations have a duty to provide for information security to ensure that the type of control, the cost of control, and the deployment of control are appropriate for the system being managed. Doing the right action at the right time.

A

Due care

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

Establishing a plan, policy, and process to protect the interests of an organization. For example, developing a formalized security structure containing a security policy, standards, baselines, guidelines, and procedures. Knowing what should be done and planning for it.

A

Due diligence

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

ECPA of 1986

A

Electronic Communications Privacy Act

Extended government restrictions on wiretaps from telephone calls to include transmissions of electronic data by computer and prohibited access to stored electronic communications

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

long term knowledge building

A

Education

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

the principles a person sets for themselves to follow

A

Ethics

37
Q

an opportunity for a threat to cause loss. (terminology that encompasses many recent risk terms)

A

Exposure

38
Q

Federal Privacy Act of 1974

A

Affects any computer that contains records used by a federal agency

39
Q

FISA of 1978

A

Federal Intelligence Surveillance Act (FISA)

Affects law enforcement and intelligence agencies

40
Q

Executive responsibilities of goal setting, delegation, and verification, based upon the mission.

A

Governance

41
Q

written suggestions that direct choice to a few alternatives

A

Guidelines

42
Q

the one person responsible for data, its classification and control setting

A

Information owner

43
Q

The set of responsibilities and practices exercised by the board and executive management with the goal of providing strategic direction, ensuring objectives are achieved, ascertaining that risks are managed appropriately and verifying that the enterprise’s resources are used responsibly

A

Information security governance

44
Q

The overall combination of technical, operational and procedural measures, and management structures implemented to provide for the confidentiality, integrity and availability of information based on business requirements and risk analysis

A

Information security program

45
Q

The net mission impact considering (1) the probability that a particular threat-source will exercise (accidentally trigger or intentionally exploit) a particular information system vulnerability and (2) the resulting impact if this should occur. IT-related risks arise from legal liability or mission loss due to these 4 items: 1. Unauthorized (malicious or accidental) disclosure, modification, or destruction of information 2. Unintentional errors and omissions 3. IT disruptions due to natural or man-made disasters 4. Failure to exercise due care and diligence in the implementation and operation of the IT system.

A

IT-Related Risk

46
Q

to move from location to location, keeping the same function

A

job rotation

47
Q

employment education done one per position or at significant change of function

A

job training

48
Q

A means of restricting access to data based on varying degrees of security requirements for information contained in the objects and the corresponding security clearance of users’ programs acting on their behalf

A

mandatory access control

49
Q

requirement to take time off

A

mandatory vacations

50
Q

a choice in risk management, to implement a control that limits or lessens negative effects

A

mitigate

51
Q

The rules outlining or delineating the way in which information about the use of computers, networks, applications and information is captured

A

monitoring policy

52
Q

Data or systems, passive

A

objects

53
Q

intermediate level, pertaining to planning

A

operational

54
Q

written core statements that rarely change

A

policy

55
Q

Freedom from unauthorized intrusion or disclosure of information about individuals

A

privacy

56
Q

Individual owned or ownership

A

private/privacy

57
Q

written step-by-step actions

A

procedure

58
Q

The portion of a security policy that states the general process that will be performed to accomplish a security goal

A

procedures

59
Q

a risk assessment method, intrinsic value

A

qualitative

60
Q

a risk assessment method, measurable real money cost

A

quantitative

61
Q

quantity of risk remaining after a control is applied
total risks - controls gap

A

residual risk

62
Q

the chance that something negative will occur

A

risk

63
Q

the collection and summation of risk data relating to a particular asset and controls for that asset

A

risk assessment

64
Q

The total process of identifying, controlling, and mitigating information system-related risks. It includes risk assessment; cost-benefit analysis; and the selection, implementation, test, and security evaluation of safeguards. This overall system security review considers both effectiveness and efficiency, including impact on the mission and constraints due to policy, regulations, and laws.

A

risk management

65
Q

risk management phases

A

Framing
Assessing
Responding
Alternatives
Monitoring

66
Q

a control before attack

A

safeguard

67
Q

the level and label given to an individual for the purpose of compartmentalization

A

security clearance

68
Q

The five security goals are integrity, availability, confidentiality, accountability, and assurance

A

security goals

69
Q

Any form of measurement used to determine any aspect of the operation of any security-related activity

A

security metrics

70
Q

to break a business process into separate functions and assign to different people

A

separation of duties

71
Q

written internalized or nationalized norms that are internal to an organization

A

standard

72
Q

A management committee assembled to sponsor and manage various projects, such as an information security program

A

steering committee

73
Q

high level, pertaining to planning

A

strategic

74
Q

people or groups, active

A

subjects

75
Q

low level, pertaining to planning

A

tactical

76
Q

The potential for a threat-source to exercise (accidentally trigger or intentionally exploit) a specific vulnerability

A

threat

77
Q

those who initiate the attack

A

threat agent

78
Q

The examination of threat-sources against system vulnerabilities to determine the threats for a particular system in a particular operational environment

A

threat analysis

79
Q

vehicle or tool that exploits a weakness

A

threats

80
Q

Either (1) intent and method targeted at the intentional exploitation of a vulnerability or (2) a situation and method that may accidentally trigger a vulnerability.

A

threat-source

81
Q

calculation encompassing threats, vulnerabilities and assets
threats * vulnerabilities * assets

A

total risk

82
Q

a choice in risk management, to convince another to assume risk, typically by payment

A

transfer

83
Q

people who interact with assets

A

user

84
Q

weakness or flaw in an asset

A

vulnerability

85
Q

Framing Phase

A

Tactical/System
Operational/Business Process
Strategic/Whole business

86
Q

Assessing Phase

A

Set scope (Tactical/System, Operational/Business Process, Strategic/Whole business from Framing Phase)
Identify threat sources
Identify threat events
Identify vulnerabilities
Determine likelihood
Determine impacts
Determine risks

87
Q

Responding Phase

A

Developing alternatives
Evaluating alternatives (Avoid, Accept, Transfer from Alternatives Phase)
Determining course of action
Implementing (Mitigate = Control from Alternatives Phase)

88
Q

Alternatives Phase

A

Avoid = Stop Doing,
Accept = Do Nothing,
Transfer = Buy Insurance,
Mitigate = Control

89
Q

Monitoring Phase

A

Determining effectiveness of responses,
Identifying risk-impacting changes,
Verifying controls/compliance

Cyber Security (19 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions