Untitled Deck Flashcards
CIA - Confidentiality - ISO/IEC 27000
Confidentiality: The property that information is not made available or disclosed to unauthorized individuals, entities, or processes (ISO/IEC 27000)
CIA - Integrity - ISO/IEC 27000
Integrity: The property of accuracy and completeness (ISO/IEC 27000)
CIA - Availability - ISO/IEC 27000
Availability: The property of being accessible and usable upon demand by an authorized entity (ISO/IEC 27000)
Asset: Anything of Value to an organization - ISO/IEC 13335
3 Types of Assets are?
- Pure Information (in whatever format)
- Physical assets such as buildings or computer systems
- Software used to process or otherwise manage information
Threat, Vulnerability, Risk, and Impact -
Threat - ISO/IEC 27000
Threat: A potential cause of an unwanted incident, which may result in harm to a system or organization (ISO/IEC 27000)
Example - Storm clouds in sky - threat of rain
Threat, Vulnerability, Risk, and Impact
Vulnerability - ISO/IEC 27000
Vulnerability: A weakness of an asset or control that can be exploited by one or more threats (ISO/IEC 27000)
Example - Leave house without a coat or umbrella
Threat, Vulnerability, Risk, and Impact
Risk - ISO/IEC 27000
Risk: The effect of uncertainty on objectives (ISO/IEC 27000)
Example - You could risk getting wet
Threat, Vulnerability, Risk, and Impact
Impact - ISO/IEC 13335
Impact: The result of an information security incident, caused by a threat, which affects assets (ISO/IEC 13335)
What are the purpose of Controls?
Controls in the IA sense are those activities that are taken to manage the risks identified: There are 4 main types of STRATEGIC controls (controls high-level made at executive level)
Strategic Controls - Eliminate - Risk Avoidance - ISO Guide 73
Eliminate. Risk Avoidance - Informed decision not to be involved in, or to withdraw from, an activity in order not to be exposed to a particular risk (ISO Guide 73)
Strategic Controls - Reduce - Risk Reduction - ISO 22300:2018
Reduce. Risk Reduction - Action taken to lesson the probability, negative consequences, or both, associated with a risk (ISO 22300:2018)
Strategic Controls - Transfer - Risk Transfer - ISO Guide 73
Transfer. Risk Transfer - A form of risk treatment involving the agreed distribution of risk with other parties (ISO Guide 73)
Strategic Controls - Accept - Risk Acceptance - ISO Guide 73
Accept. Risk Acceptance - The decision to accept the risk (ISO Guide 73)
Identity, Authentication, and Authorization
Identity - ISO/IEC 24760-1
Identity. Information that unambiguously distinguishes one entity from another one in a given domain (ISO/IEC 24760-1)
Identity, Authentication, and Authorization
Authentication - ISO/IEC 15944-6
Authentication. The provision of assurance of the claimed identity of an entity (ISO/IEC 15944-6)
Identity, Authentication, and Authorization
Authorisation - ISO/TR 22100-4
Authorisation. The right or permission that is granted to a system entity to access a system resource (ISO/TR 22100-4)
Accountability, audit, and compliance
Accountability - ISO/IEC 21827
Accountability. The property that ensures that the actions of an entity can be traced uniquely to the entity (ISO/IEC 21827)
Accountability, audit, and compliance
Audit - ISO 15638-5
Audit. The review of a party’s capacity to meet, or continue to meet, the initial and ongoing approval agreements as a service provider (ISO 15638-5)
Accountability, audit, and compliance
Compliance - ISO/TR 19591
Compliance. Meeting or exceeding all applicable requirements of a standard or other published set of requirements (ISO/TR 19591)
Information Security Management System (ISMS) - ISO 12812-2
Information Security Management System (ISMS). Part of the overall management system, based on a business risk approach, used to establish, implement, operate, monitor, review, maintain and improve information security (ISO 12812-2)
What is Information Security - ISO 19092
Information Security - Preservation of confidentiality, integrity, and availability of information; in addition, other properties such as authenticity, accountability, no-repudiation and reliability can also be involved (ISO 19092)
What is Information Assurance
Information Assurance (IA) - The confidence that information systems will protect the information they carry and will function as they need to, when they need to, under the control of legitimate users.
What is Defense in Breadth
Defense in Breadth - All connected systems must now be taken into account when considering how an attack might materialize and the effect it might have.
What is Defense in Depth
Defense in Depth - Layer of security which may start off as relatively low level, but which increase in complexity, cost and effectiveness as the information and systems being protected get more sensitive and important.
