Sybex Chps 1-7 Flashcards
Integrity is dependent on what?
Confidentiality
Availability
Confidentiality
Without confidentiality then integrity cannot be maintained.
Availability depends on what?
Confidentiality
Integrity
Both.
Without Integrity and Confidentiality, Availability cannot be maintained.
True / False
Identification and authentication are always used together as a single two-step process
True
Should layers be used in serial or in parallel?
Serial - these are very narrow but deep configurations
__________ simplifies security by enabling you to assign controls to a group of objects collected by type or function.
Abstraction
True or False
Security governance is the implementation of a security solution and a management method that are loosely connected.
False
Security governance is the implementation of a security solution and a management method that are TIGHTLY connected.
It is the responsibility of __________ to flesh out the security policy into standards, baselines, guidelines, and procedures.
Middle Management
Security management is a responsibility of
Upper Management
Developing and implementing a security plan is evidence of __________ on the part of senior management.
Due Care
Due Diligence
Both Due Care and Due Diligence
Long term plan that is fairly stable (5 years of so)
Strategic Plan
Tactical Plan
Operational Plan
Strategic Plan
Short-term plan, highly detailed
Strategic Plan
Tactical Plan
Operational Plan
Operational Plan
midterm plan (about a year)
Strategic Plan
Tactical Plan
Operational Plan
Tactical Plan
Change Management is a requirement for systems complying with what classifications of ITSEC?
B2, B3, A1
True of False
Change Management requires:
1) Detailed inventory of every component and configuration
2) collection and maintenance of complete documentation for every system component
True
True or False
Data Classification is used to determine how much effort, money, and resources are allocated to protect data and control access to it.
True
What are the seven major steps to implement a classification scheme?
- Identify the custodian
- Specify the evaluation material
- Classify and label each resource
- Document any exceptions
- Select the security controls
- Specify procedures for declassifying resources / transferring custody
- Create an enterprise-wide awareness program
Will cause significant effects / critical damage
Top Secret Secret Confidential Sensitive but Unclassified Unclassified
Secret
Will cause drastic effects / grave damage
Top Secret Secret Confidential Sensitive but Unclassified Unclassified
Top Secret
Will cause noticeable effects / serious damage
Top Secret Secret Confidential Sensitive but Unclassified Unclassified
Confidential
Does not compromise or cause any noticeable effects
Top Secret Secret Confidential Sensitive but Unclassified Unclassified
Unclassified
In the private sector classification levels, which level is used for private or personal nature?
Confidential
Private
Sensitive
Public
Private
In the private sector classification levels, which level is sometimes labeled proprietary?
Confidential
Private
Sensitive
Public
Confidential
In the private sector classification levels, which level may contain medical information or PHI?
Confidential
Private
Sensitive
Public
Private
Responsible for understanding and upholding the security policy by following the prescribed operational procedures and operating within defined security parameters.
Security Professional Data Owner Data Custodian User Auditor
User
Ultimately responsible for data protection
Security Professional Data Owner Data Custodian User Auditor
Data Owner
Performs all activities necessary to provide adequate protection to CIA of data to fulfill requirements
Security Professional Data Owner Data Custodian User Auditor
Data Custodian
Responsible for implementing security policy
Security Professional
True / False
COBIT is used not only to plan the IT security of an organization but also as a guideline for auditors.
True
What is STRIDE used for?
Assessing threats against applications or operating systems.
What does STRIDE stand for?
Used in Threat Modeling
Spoofing Tampering Repudiation Information disclosure DoS Elevation of privledge
What three things do company’s face threats from?
Nature
Technology
People
What are the basics of Threat Modeling?
Threat Modeling is the security process where potential threats are identified, categorized, and analyzed.
Key concepts include:
- -assets / attackers / software
- -STRIDE
- -Diagramming
- -Reduction analysis
- -Rate threats (DREAD)
What is DREAD stand for?
Used in Threat Modeling
Damage Potential Reproducibility Exploitability Affected Users (% number) Discoverability
What needs to happen before actual security training can take place?
Security awareness needs to be created first.
What is the primary purpose of the exit interview?
to review the liabilities and restrictions placed on the former employee based on the employment agreement, NDA, and other security documents.
What is the primary goal of risk management?
To reduce risk to an acceptable level
How is risk management achieved?
Primarily achieved through risk analysis (qualitative and quantitative)
The absence or the weakness of a safeguard or countermeasure
Vulnerability Risk Safeguard Exposure Attack Breach Penetration
Vulnerability
The possibility that a vulnerability can or will be exploited by a threat agent or event
Vulnerability Risk Safeguard Exposure Attack Breach Penetration
Exposure
Threat * Vulnerability =
Vulnerability Risk Safeguard Exposure Attack Breach Penetration
Risk
Anything that removes or reduces a vulnerability
Vulnerability Risk Safeguard Exposure Attack Breach Penetration
Safeguard
The exploitation of a vulnerability by a threat agent
Vulnerability Risk Safeguard Exposure Attack Breach Penetration
Attack
The occurrence of a safety mechanism being bypassed by a threat agent
Vulnerability Risk Safeguard Exposure Attack Breach Penetration
Breach
When a breach is combined with an attack this can result
Vulnerability Risk Safeguard Exposure Attack Breach Penetration
penetration or intrusion
AV * EF =
SLE
SLE * ARO =
ALE
What is the whole point of a safeguard?
The whole point of a safeguard is to reduce the Annualized Rate of Occurrence (ARO).
Even if the EF stays the same, a safeguard should change the ARO
Should you accept the risk if:
The cost of the countermeasure is greater than the value of the asset?
Yes, accept the risk if the cost of the countermeasure is greater than the value of the asset
