Standards and Important

Question 1

DPO

Answer 1

Makes sure organization complies with laws regarding data privacy such as GDPR.

Question 2

PHI

Answer 2

Protected Health Information

Question 3

GDPR

Answer 3

General Data Protection Regulation

Data protection and privacy for individuals in the EU. Prevents privacy data from being exported outside of the EU and gives the user the power to have it removed. Requires the organization to explain their privacy policy.

Question 4

HIPAA

Answer 4

Protecting PHI. Regulates how it’s stored, used, transferred over the network etc.

Question 5

MOU

Answer 5

Memorandum Of Understanding

Both sides agree to the contents of the memorandum. Statements of confidentiality. Informal letter of intent, not a full blown contract.

Question 6

MSA

Answer 6

Measurement System Analysis

Assesses the measurement process. Calculates measurement uncertainty.

Question 7

BPA

Answer 7

Business Partnership Agreement

Provides details about owner stake, financial contract, decision-making agreements, prepare for contingencies.

Question 8

CIS CSC

Answer 8

Center for Internet Security Critical Security Controls for Effective Cyber Defense

FRAMEWORK that identifies twenty key security controls that can be implemented for different organization sizes.

Question 9

NIST RMF

Answer 9

National Institute of Standards and Technology Risk Management Framework

A 6 step FRAMEWORK required by government agencies.
1. Categorize - Define the environment
2. Select - Pick appropriate controls
3. Implement - Define proper implementation
4. Assess - Determine if the controls are working
5. Authorize - Make a decision to authorize a system
6. Monitor - Check for ongoing compliance

Question 10

NIST CSF

Answer 10

National Institute of Standards and Technology Cybersecurity Framework

FRAMEWORK for commercial implementation rather than government.

1. Framework Core - Identify, Protect, Detect, Respond, Recover
2. Framework implementation tiers - Organization’s view of cybersecurity risk and processes to manage the risk
3. Framework Profile - Alignment of standards, guidelines and practices to the framework core

Question 11

ISO/IEC 27001

Answer 11

STANDARD, ISMS (Information Security Management Systems)

Organizations can implement the ISMS requirements. Then they go through a 3 stage process to become ISO 27001 compliant.

Question 12

ISO/IEC 27002

Answer 12

STANDARD

Complement to the ISO 27001. Provides best practice guidelines for organizations relating to implementing the ISMS requirements.

Question 13

ISO/IEC 27701

Answer 13

STANDARD, PIMS (Privacy Information Management System)

Based on ISO 2700. Outlines a framework for managing and protecting PII. Provides guidelines for complying with GDPR.

Question 14

ISO 31000

Answer 14

STANDARD

Related to risk management. Guidelines for organizations to help manage risk.

Question 15

CSA CCM

Answer 15

Cloud Security Alliance Cloud Controls Matrix FRAMEWORK

Cloud-specific security controls.

Question 16

PCI DSS

Answer 16

Payment Card Industry Data Security Standard

A STANDARD for protecting credit cards. Six control objectives.
1. Build and maintain secure network and systems
2. Protect cardholder data
3. Maintain a vulnerability management program
4. Implement strong access controls measures
5. Regularly monitor and test networks
6. Maintain information security policy

Question 17

Non-repudiation

Answer 17

Proof of data integrity and the origin of the data.

Question 18

MAC (Crypto)

Answer 18

Message Authentication Code

Provides non-repudiation.

Question 19

RFC 3227

Answer 19

Guidelines for evidence collection and archiving.

Question 20

MITRE ATT&CK

Answer 20

ATTACK FRAMEWORK, MITRE Adversary Tactics Techniques and Common Knowledge

Gives a bunch of different attack methods that an adversary might use as well as mitigations and detection techniques.

Question 21

Diamond Model of Intrusion Analysis

Answer 21

Adversary, capabilities, victim, infrastructure

Question 22

COOP

Answer 22

Continuity of Operations Planning

Plan that explains how to continue operations with certain systems being unavailable. E.g paper receipts, manual transactions, etc

Question 23

OCSP Stapling

Answer 23

Online Certificate Status Protocol Stapling

Provides scalability for OSCP checks. Lets a client determine if a certificate is revoked on their own without contacting the CA. OSCP status is “stapled” into the SSL/TLS handshake.

Question 24

Pinning

Answer 24

Pin the expected certificate or public key to an application. Complied in the app or added at first run.

Question 25

CSR

Answer 25

Certificate Signing Request.

Request sent to the CA which will validate your identity and create a cert for you. You can then register this cert with your site.

Question 26

SAML

Answer 26

Implements SSO

Question 27

OAuth

Answer 27

Determines what resources a user can access. e.g Google wants to access your files.

Question 28

SWG

Answer 28

Next-Gen secure Web Gateway

Examines JSON strings and API calls. Allows or disallow certain activities.

Question 29

NIST SP800-61

Answer 29

Computer Security Incident Handling Guide

1. Preparation
2. Detection and Analysis
3. Containment, Eradication, and Recovery
4. Post-incident Activity

Question 30

IPSEC Components

Answer 30

1. AH - Authentication Header. A protocol. Does NOT provide encryption. Provides Data integrity, guarantees origin, prevents replay attacks.
2. ESP - Encapsulation Security Payload - Encrypts and authenticates the tunneled data. Integrity checking.
3. Combine them to achieve integrity and authentication.

Question 31

ECC

Answer 31

Elliptic Curve Cryptography - Asymmetric. Less processing power.

Question 32

Block Cipher Mode: CTR

Answer 32

Counter Mode

Block cipher acts like a stream cipher. Encrypts successive values of a counter.

Question 33

NAS

Answer 33

Network Attached Storage

Provides file level access to a large storage array over the network. If you want to modify a file you have to overwrite the entire file. Requires a lot of bandwidth.

Question 34

SAN

Answer 34

Storage Area Network

Provides access to a storage drive over the network. Looks and feels like a local storage device. Block level access. If you want to modify a file you only need to change a few blocks not the entire file. Requires a lot of bandwidth.

Question 35

RAID 0

Answer 35

1. Striping without parity.
2. High performance, NO FAULT TOLERANCE, NO REDUNDANCY
3. 2 Disks

Question 36

RAID 1

Answer 36

1. Mirroring
2. Duplicates data for fault tolerance, requires twice the disk space
3. 2 Disks

Question 37

RAID 5

Answer 37

1. Striping with parity
2. Fault tolerant, only requires an additional disk for redundancy
3. 3 Disks

Question 38

RAID 6

Answer 38

1. Extension of RAID 5
2. 4 Disks

Question 39

RAID 10 or RAID 1+0

Answer 39

1. Combines mirroring (RAID-1) and striping (RAID-0)
2. 4 Disks

Question 40

WPA2-Enterprise

Answer 40

Uses 802.1x. Hence radius

Question 41

SOX

Answer 41

Sarbanes-oxley act. Data governance regulation that requires that executives take individual responsibility for the accuracy of financial reports.

Question 42

Ccmp

Answer 42

Counter mode with cipher block chaining. Used by WPA2. CCMP uses AES for confidentiality and uses CBC-MAC for message integrity

Question 43

GCMP

Answer 43

Block cipher mode used by WPA3. Confidentiality with AES. integrity guaranteed by gmac.

Question 44

WPA3

Answer 44

Does not use PSK instead uses SAE which adds PFS. Also uses GCMP for confidentiality and integrity.

Question 45

PFS

Answer 45

ECC, Diffie Hellman ephemeral. Asymmetric. Generates random public keys for each session.