Vocabulary Part 1 Flashcards
Risk mitigation
is the practice of the elimination of, or the significant decrease in the level of risk presented.
A risk assessment, which is a tool for risk management, is
a method of identifying vulnerabilities and threats and assessing the possible impacts to determine where to implement security controls.
A risk assessment is carried out, and the results
are analyzed.
Risk analysis is used
to ensure that security is cost-effective, relevant, timely, and responsive to threats.
Security can be quite complex, even for well-versed security professionals, and it is easy to apply
too much security, not enough security, or the wrong security controls, and to spend too much money in the process without attaining the necessary objectives.
Risk analysis helps companies
prioritize their risks and shows management the amount of resources that should be applied to protecting against those risks in a sensible manner.
What are the four main goals of risk analysis?
(1) Identify assets and their value to the organization.
(2) Identify vulnerabilities and threats.
(3) Quantify the probability and business impact of these potential threats.
(4) Provide an economic balance between the impact of the threat and the cost of the countermeasure.
Analyzing resources of a system is one standard for locating covert channels because the basis of a covert channel is a shared resource. What are the four properties that must hold true for a storage channel to exist?
- Both sending and receiving process must have access to the same attribute of a shared object.
- The sending process must be able to modify the attribute of the shared object.
- The receiving process must be able to reference that attribute of the shared object.
- A mechanism for initiating both processes and properly sequencing their respective accesses to the shared resource must exist.
The Urgent Pointer is used
when some information has to reach the server ASAP.
The Urgent Pointer is usually used in Telnet,
where an immediate response (e.g. the echoing of characters) is desirable.
When a packet is plucked out of the processing queue and acted upon immediately,
it is known as an Out Of Band (OOB) packet and the data is called Out Of Band (OOB) data.
Covert Channels are NOT
directly synonymous with backdoors.
A covert channel is simply using a communication protocol in a way
it was NOT intended to be used or sending data without going through the proper access control mechanisms or channels.
An example of a covert channel in a Mandatory Access Control systems is a user secretly that has found a way to communicate confidential information to another user without going through the normal channels.
In this case, how could the Urgent bit be used:
- It could be to attempt a Denial of service where the host receiving a packet with the Urgent bit set will give immediate attention to the request and will be in wait state until the urgent message is receive, if the sender does not send the urgent message then it will simply sit there doing nothing until it times out. Some of the
TCP/IP stacks used to have a 600 seconds time out, which means that for 10 minutes nobody could use the port. By sending thousands of packet with the
URGENT flag set, it would create a very effective denial of service attack. - It could be used as a client server application to transmit data back and forward without going through the proper channels. It would be slow but it is possible to use reserved fields and bits to transmit data outside the normal communication channels.
Risk mitigation is the practice of
the elimination of, or the significant decrease in the level of risk presented.
Risk Mitigation involves
applying appropriate control to reduce risk.
List recommendations that an IS auditor could provide to lessen the risk of exposing personal and financial information that is highly sensitive and confidential in an organization?
Put countermeasures in place, such as:
(1) firewalls,
(2) Intrusion detection/prevention systems, and
(3) other mechanisms to deter malicious outsiders from accessing this highly sensitive information
In underage drivers, risk mitigation could take the form of
(1) driver education for the youth
(2) establishing a policy not allowing the young driver to use a cell phone while driving,
(3) not letting youth of a certain age have more than one friend in the car as a passenger at any given time.
Risk transfer is the practice of
passing on the risk in question to another entity, such as an insurance company.
Risk acceptance is the practice of
accepting certain risk(s), typically based on a business decision that may also weigh the cost versus the benefit of dealing with the risk in another way.
Risk avoidance is the practice of
coming up with alternatives so that the risk in question is not realized.
Deterrent Control are intended:
to discourage a potential attacker.
Access controls can act as a deterrent to threats and attacks
bc the existence of the control is enough to keep some potential attackers from attempting to circumvent the control.
The examination of proposed test plans is
part of the testing phase.
Items to be addressed during the design and development phase include:
(1) studying flowcharts;
(2) evaluating input, output, and process controls;
(3) examining proposed audit trails; and
(4) reviewing how the system will deal with erroneous input.
Business continuity planning is
an ongoing process that should be revisited each time there is a change to the environment.
Blind testing describes a situation
where only one party knows
Double-blind testing describes a situation
where neither party knows
Implementation is the stage at which
user acceptance is usually performed.
A direct changeover requires the establishment of
a cut-off date so that all users must switch to the new system by then.
A pilot scenario is used
when an entire new system is used at one location.
A phased changeover is
a gradual process.
A parallel changeover
brings the new system online while the old is still in operation.
A SAS 70 report
verifies that the outsourcing or business partner has had its control objectives and activities examined by an independent accounting and auditing firm.
A privacy shield is used for
EU protection of data.
COBIT is a good-practice framework created by the international professional association:
ISACA for information technology (IT) management and IT governance.
COBIT is a
good-practice framework.
COBIT is
for information technology (IT) management and IT governance
ITIL is a
set of detailed practices for IT service management.
ITIL seeks to
align IT services with the needs of the business.
Kerberos is
an example of single sign-on
