Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Play it safe: Manage Security Risks > Terms > Flashcards

Terms Flashcards

1
Q

What is an organization’s Security Posture?

A

Security posture is an organization’s ability to manage its defense of critical assets and data and react to change

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Goals of the Security and Risk Management Domain

A

Security goals and objectives

Risk mitigation processes

Compliance

Business continuity plans

Legal regulations

Professional and organizational ethics

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What is Asset security?

A

Asset security involves managing the cybersecurity processes of organizational assets, including the storage, maintenance, retention, and destruction of physical and virtual data.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What is the concept of shared responsibility?

A

Shared responsibility is part of the Security Architecture and Engineering domain. It means all individuals involved take an active role in lowering risk during the design of a security system

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What is the Security architecture and engineering Domain?

A

This domain focuses on managing data security. Ensuring effective tools, systems, and processes are in place helps protect an organization’s assets and data. Security architects and engineers create these processes.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What is the Communication and network security Domain?

A

This domain focuses on managing and securing physical networks and wireless communications. This includes on-site, remote, and cloud communications.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What is the Identity and access management Domain?

A

The identity and access management (IAM) domain focuses on keeping data secure. It does this by ensuring user identities are trusted and authenticated and that access to physical and logical assets is authorized. This helps prevent unauthorized users while allowing authorized users to perform their tasks.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What is the principle of least privilege?

A

Identity and Access Management Domain uses what is referred to as the principle of least privilege, which is the concept of granting only the minimal access and authorization required to complete a task.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What is the Security assessment and testing Domain?

A

The security assessment and testing domain focuses on identifying and mitigating risks, threats, and vulnerabilities.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What are Security Assessments?

A

Security assessments help organizations determine whether their internal systems are secure or at risk.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What is the Security operations Domain?

A

The security operations domain focuses on the investigation of a potential data breach and the implementation of preventative measures after a security incident has occurred

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What is the Software development security Domain?

A

The software development security domain is focused on using secure programming practices and guidelines to create secure applications. Having secure applications helps deliver secure and reliable services, which helps protect organizations and their users.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What is an asset?

A

An asset is an item perceived as having value to an organization.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What is a threat?

A

A threat is any circumstance or event that can negatively impact assets.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What is a risk?

A

A risk is anything that can impact the confidentiality, integrity, or availability of an asset.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What is a vulnerability?

A

A vulnerability is a weakness that can be exploited by a threat.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What are the 3 key Impacts of Threats, Risks, and Vulnerabilities?

A

Financial
Identity theft
Reputation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Elaborate on Step One of the RMF

A

Prepare refers to activities that are necessary to manage security and privacy risks before a breach occurs.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What are the 3 layers of the Web?

A

They are the
Surface web - accessed by a normal browser and required nothing else.
Deep Web - requires Authorization to access such as an organization’s intranet.
Dark Web - Requires special software to access.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What are the 7 steps of the Risk Management Framework?

A

prepare, categorize, select, implement, assess, authorize, and monitor.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Elaborate on Step Two of the RMF

A

Step two is categorize, which is used to develop risk management processes and tasks.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Elaborate on Step Three of the RMF

A

Step three is select. Select means to choose, customize, and capture documentation of the controls that protect an organization.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Elaborate on Step Five of the RMF

A

Step five is - Assess. Assess means to determine if established controls are implemented correctly.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Elaborate on Step Four of the RMF

A

Step four is to implement security and privacy plans for the organization.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Elaborate on Step Seven of the RMF

A

Step seven is Monitor. Monitor means to be aware of how systems are operating.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Elaborate on Step Six of the RMF

A

Step six is Authorize. Authorize means being accountable for the security and privacy risks that may exist in an organization.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

What are Security Frameworks?

A

Security frameworks are guidelines used for building plans to help mitigate risks and threats to data and privacy. Frameworks support organizations’ ability to adhere to compliance laws and regulations.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

What are Security Controls?

A

Security controls are safeguards designed to reduce specific security risks. Security controls are the measures organizations use to lower risk and threats to data and privacy.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

What is the CIA triad?

A

The CIA triad is a model that helps inform how organizations consider risk when setting up systems and security policies. It is made up of three elements that cybersecurity analysts and organizations work toward upholding: confidentiality, integrity, and availability. Maintaining an acceptable level of risk and ensuring systems and policies are designed with these elements in mind helps establish a successful security posture

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

CIA triad - Confidentiality

A

Confidentiality is the idea that only authorized users can access specific assets or data.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

CIA triad - Integrity

A

Integrity is the idea that the data is verifiably correct, authentic, and reliable.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

CIA triad - Availability

A

Availability is the idea that data is accessible to those who are authorized to use it.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

What is the NIST Cybersecurity Framework?

A

The CSF is a voluntary framework that consists of standards, guidelines, and best practices to manage cybersecurity risk.

31
Q

What are the 5 steps of the NIST CSF?

A

identify, protect, detect, respond, and recover.

32
Q

Elaborate on the First step of the NIST CSF

A

The first core function is Identify, which is related to the management of cybersecurity risk and its effect on an organization’s people and assets.

33
Q

Elaborate on the Second step of the NIST CSF

A

The second core function is Protect, which is the strategy used to protect an organization through the implementation of policies, procedures, training, and tools that help mitigate cybersecurity threats.

33
Q

Elaborate on the Third step of the NIST CSF

A

The third core function is Detect, which means identifying potential security incidents and improving monitoring capabilities to increase the speed and efficiency of detections.

34
Q

What are OWASP Security Principles?

A

They are principles and guidelines that can be used, along with NIST frameworks and the CIA triad, to help security teams minimize threats and risks.

34
Q

Elaborate on the Fourth step of the NIST CSF

A

The fourth function is Respond, which means making sure that the proper procedures are used to contain, neutralize, and analyze security incidents, and implement improvements to the security process.

35
Q

Elaborate on the Fifth step of the NIST CSF

A

The fifth core function is Recover, which is the process of returning affected systems back to normal operation.

36
Q

Elaborate on OWASP First Security Principle

A

The first OWASP principle is to minimize the attack surface area. An attack surface refers to all the potential vulnerabilities that a threat actor could exploit, like attack vectors, which are pathways attackers use to penetrate security defenses.

37
Q

Elaborate on OWASP Second Security Principle

A

The second OWASP principle is the principle of least privilege means making sure that users have the least amount of access required to perform their everyday tasks

38
Q

Elaborate on OWASP Third Security Principle

A

The third OWASP principle is defense in depth. Defense in depth means that an organization should have multiple security controls that address risks and threats in different ways.

39
Q

Elaborate on OWASP Fourth Security Principle

A

The fourth principle is separation of duties, which can be used to prevent individuals from carrying out fraudulent or illegal activities. This principle means that no one should be given so many privileges that they can misuse the system.

40
Q

Elaborate on OWASP Fifth Security Principle

A

The fifth principle is Keep security simple. As the name suggests, when implementing security controls, unnecessarily complicated solutions should be avoided because they can become unmanageable.

41
Q

What is a Security Audit?

A

A security audit is a review of an organization’s security controls, policies, and procedures against a set of expectations.

41
Q

Elaborate on OWASP Sixth Security Principle

A

the sixth principle is to fix security issues correctly. When security incidents occur, identify the root cause, contain the impact, identify vulnerabilities, and conduct tests to ensure that remediation is successful.

42
Q

Elaborate on the First area of focus in a Security Audit

A

Identify the scope of the audit - List assets that will be assessed (e.g., firewalls are configured correctly, PII is secure, physical assets are locked, etc.)

Note how the audit will help the organization achieve its desired goals

Indicate how often an audit should be performed

Include an evaluation of organizational policies, protocols, and procedures to make sure they are working as intended and being implemented by employees

43
Q

Elaborate on the Second area of focus in a Security Audit

A

Complete a risk assessment.
A risk assessment is used to evaluate identified organizational risks related to budget, controls, internal processes, and external standards (i.e., regulations).

43
Q

Elaborate on the Third area of focus in a Security Audit

A

Conduct the audit.
When conducting an internal audit, you will assess the security of the identified assets listed in the audit scope.

44
Q

Elaborate on the Fourth area of focus in a Security Audit

A

Create a mitigation plan
A mitigation plan is a strategy established to lower the level of risk and potential costs, penalties, or other issues that can negatively affect the organization’s security posture.

45
Q

Elaborate on the Fifth area of focus in a Security Audit

A

Communicate results to stakeholders.
The end result of this process is providing a detailed report of findings, suggested improvements needed to lower the organization’s level of risk, and compliance regulations and standards the organization needs to adhere to.

46
Q

What is a SIEM tool?

A

A SIEM tool is an application that collects and analyzes log data to monitor critical activities in an organization.

46
Q

What’s a Cloud-Hosted SIEM tool?

A

Cloud-hosted SIEM tools are operated by vendors who are responsible for maintaining and managing the infrastructure required to use the tools. Cloud-hosted tools are simply accessed through the internet and are an ideal solution for organizations that don’t want to invest in creating and maintaining their own infrastructure.

47
Q

What are Open Source tools?

A

Open-source tools are often free to use and can be user-friendly. The objective of open-source tools is to provide users with software that is built by the public in a collaborative way, which can result in the software being more secure.

48
Q

What are Proprietary tools?

A

Proprietary tools are developed and owned by a person or company, and users typically pay a fee for usage and training. The owners of proprietary tools are the only ones who can access and modify the source code.

49
Q

What is an Operating System?

A

An operating system is the interface between computer hardware and the user. It’s used to communicate with the hardware of a computer and manage software applications.

50
Q

What is Linux?

A

Linux is an open-source operating system that is widely used. It allows you to tailor the operating system to your needs using a command-line interface.

50
Q

What is Splunk?

A

Splunk offers different SIEM tool options: Splunk® Enterprise and Splunk® Cloud. Both allow you to review an organization’s data on dashboards. This helps security professionals manage an organization’s internal infrastructure by collecting, searching, monitoring, and analyzing log data from multiple sources to obtain full visibility into an organization’s everyday operations.

51
Q

What is Splunk’s Security posture dashboard?

A

The security posture dashboard is designed for security operations centers (SOCs). It displays the last 24 hours of an organization’s notable security-related events and trends and allows security professionals to determine if security infrastructure and policies are performing as designed. Security analysts can use this dashboard to monitor and investigate potential threats in real-time, such as suspicious network activity originating from a specific IP address.

52
Q

What is Splunk’s Executive summary dashboard?

A

The executive summary dashboard analyzes and monitors the overall health of the organization over time. This helps security teams improve security measures that reduce risk. Security analysts might use this dashboard to provide high-level insights to stakeholders, such as generating a summary of security incidents and trends over a specific period of time.

53
Q

What’s Splunk’s Incident Review dashboard?

A

The incident review dashboard allows analysts to identify suspicious patterns that can occur in the event of an incident. It assists by highlighting higher-risk items that need immediate review by an analyst. This dashboard can be very helpful because it provides a visual timeline of the events leading up to an incident.

54
Q

What’s Splunk’s Risk analysis dashboard?

A

The risk analysis dashboard helps analysts identify risk for each risk object (e.g., a specific user, a computer, or an IP address). It shows changes in risk-related activity or behavior, such as a user logging in outside of normal working hours or unusually high network traffic from a specific computer. A security analyst might use this dashboard to analyze the potential impact of vulnerabilities in critical assets, which helps analysts prioritize their risk mitigation efforts.

55
Q

What is Chronicle?

A

Chronicle is a cloud-native SIEM tool from Google that retains, analyzes, and searches log data to identify potential security threats, risks, and vulnerabilities.

56
Q

What are SIEM Dashboards?

A

SIEM Dasdhboads use visual representations to provide security teams with quick and clear insights into the security posture of an organization.

57
Q

What are Metrics?

A

Metrics are key technical attributes such as response time, availability, and failure rate, which are used to assess the performance of a software application.

58
Q

What is a Log?

A

A log is a record of events that occur within an organization’s systems and networks.

58
Q

What are Security orchestration, automation, and response (SOAR)?

A

A collection of applications, tools, and workflows that use automation to respond to security events

59
Q

What is a Firewall Log?

A

A firewall log is a record of attempted or established connections for incoming traffic from the internet. It also includes outbound requests to the internet from within the network.

60
Q

What is a Network Log?

A

A network log is a record of all computers and devices that enter and leave the network. It also records connections between devices and services on the network.

61
Q

What is a Server Log?

A

a server log is a record of events related to services such as websites, emails, or file shares. It includes actions such as login, password, and username requests.

62
Q

What is a Playbook?

A

A playbook is a manual that provides details about any operational action. Essentially, a playbook provides a predefined and up-to-date list of steps to perform when responding to an incident.

63
Q

What is Incident Response?

A

Incident response is an organization’s quick attempt to identify an attack, contain the damage, and correct the effects of a security breach.

64
Q

Elaborate on the First Phase of an Incident Response Playbook

A

The first phase is preparation. Organizations must prepare to mitigate the likelihood, risk, and impact of a security incident by documenting procedures, establishing staffing plans, and educating users. Preparation sets the foundation for successful incident response.

65
Q

Elaborate on the Second Phase of an Incident Response Playbook

A

The second phase is detection and analysis. The objective of this phase is to detect and analyze events using defined processes and technology. Using appropriate tools and strategies during this phase helps security analysts determine whether a breach has occurred and analyze its possible magnitude.

66
Q

Elaborate on the Third Phase of an Incident Response Playbook

A

The third phase is containment. The goal of containment is to prevent further damage and reduce the immediate impact of a security incident. During this phase, security professionals take actions to contain an incident and minimize damage.

67
Q

Elaborate on the Fourth Phase of an Incident Response Playbook

A

The fourth phase in an incident response playbook is eradication and recovery. This phase involves the complete removal of an incident’s artifacts so that an organization can return to normal operations.

68
Q

Elaborate on the Fifth Phase of an Incident Response Playbook

A

The fifth phase is post-incident activity. This phase includes documenting the incident, informing organizational leadership, and applying lessons learned to ensure that an organization is better prepared to handle future incidents.

69
Q

Elaborate on the Sixth Phase of an Incident Response Playbook

A

The sixth and final phase in an incident response playbook is coordination. Coordination involves reporting incidents and sharing information, throughout the incident response process, based on the organization’s established standards.

70
Q

What is the purpose of a Playbook?

A

Playbooks are used by cybersecurity teams in the event of an incident. Playbooks help security teams respond to incidents by ensuring that a consistent list of actions is followed in a prescribed way, regardless of who is working on the case.

70
Q

What is SOAR?

A

SOAR is a piece of software used to automate repetitive tasks generated by tools such as a SIEM or managed detection and response (MDR).

Play it safe: Manage Security Risks (1 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions