Week 1 Flashcards
What is Information Security Management (ISM)?
It defines and manages controls to protect the confidentiality, integrity, and availability (CIA) of assets from threats and vulnerabilities.
What are the key standards in the ISO 27000 series?
-ISO 27001 (ISMS requirements)
-ISO 27002 (security controls guidance)
-ISO 27005 (incident management).
What is an Information Security Management System (ISMS)?
A business risk-based system that manages information security through policies, procedures, and controls.
What are the three core elements of the CIA triad in ISM?
Confidentiality, Integrity, Availability.
Define the term “Asset” in information security.
Anything valuable to an organization, such as information, infrastructure, or software.
What is a threat?
A potential cause of an incident that may harm the organization.
What is a vulnerability?
A weakness that can be exploited by a threat.
What are the four risk treatment options?
-Eliminate (avoid)
-Reduce (mitigate)
-Transfer
-Accept.
What are “Authentication” and “Authorization”?
-Authentication verifies identity
-Authorization grants permission to access resources.
What is the purpose of an audit in ISM?
To evaluate compliance with security requirements.
What are the characteristics of ISO 27001?
Asset-focused, risk-driven, and process-oriented.
What is the purpose of ISO 27001?
To establish, implement, maintain, and improve an ISMS.
What types of information should be protected under ISO 27001?
Printed, electronic, verbal, visual, web-based, and intangible (e.g., expertise).
What is the process approach in ISO 27001?
Security management is a continuous cycle that adapts to emerging threats.
What are some sources of security requirements?
Business needs, organizational factors, legal/regulatory compliance, stakeholder expectations.
What are the four related ISO standards and their focus?
SO 27001: ISMS requirements
ISO 27002: Security controls
ISO 27004: Performance measurement
ISO 27005: Risk management
What does ISO 27002 provide?
A list of 114 security controls across 14 clauses with implementation guidelines.
Give an example of ISO 27002 Clause 9 – Access Control.
9.1.1 Access Control Policy: Define/enforce policies;
9.1.2: Restrict access to authorized users.
What is ISO 27004 about?
Measuring the effectiveness of ISMS through performance indicators like log analysis, incident stats, and audit results.
What are key cybersecurity metrics used in ISO 27004?
-Unpatched devices, intrusion attempts
-Mean Time to Detect (MTTD)
-Mean Time to Contain (MTTC)
-Days to Patch.
What is the focus of ISO 27005?
Asset-driven security risk management through preparation, identification, analysis, evaluation, and treatment.
Name one criticism of ISO 27001.
It’s sometimes used as a checkbox exercise for certification rather than genuine security improvement.
