Week 2 Flashcards
Core of any business Security structure?
Security Management
What serves as foundation of a corporations security program?
Core Components
Potential loss or harm related to technical infrastructure, use of technology, or reputation of an organization.
Risk
What are the 3 main security objectives?
Confidentiality, Integrity, Availability
Weakness that may provide an entry point for an attacker leading to unauthorized access?
Vulnerability
Any potential danger to information or systems?
Threat
Someone or something who will take advantage of a known vulnerability
Threat Agent
Likelihood of a threat agent taking advantage of a vulnerability to cause harm to an asset
Risk
Instance of being exposed to losses from a threat agent
Exposure
Parameters, safeguards, or countermeasures implemented to protect data ,infrastructure, and people in an organization
Security Controls
a documented set of your organization’s information security policies, procedures, guidelines, and standards.
Security Program
True or False. Security Administration can be single individual or teams?
True, based on size and requirement of company
3 Types of Control
Administrative, Technical, Physical
What type of control are these included?
Developing and publishing of policies, standards, procedures and guidelines
Risk Management
Screening personnel
Administrative controls
Also called Logical controls; This includes configuration of security devices & infrastructure, implement and maintain access control mechanisms
Technical Controls
Tangible Mechanisms, Protecting perimeter of data center.
Physical Controls
Lack of understanding typically leads to believing your opponent (attacker) is less intelligent that you
Security Through Obscurity
3 areas of Security Planning
Operational (Short Term), Tactical (mid term), strategic (long term)
all of the tools, personnel and business processes that ensure that security is carried out to meet an organization’s specific needs”
Information security governance
structures, systems, and practices an organization has in place
Governance
What is the meaning of CobIT
Control Objectives for Information Technology
From what framework was cobIT derived?
COSO framework
First Latest version of CobIT
1996 and 2019, respectively
Six principles of CobIT
- Meet stakeholder needs,
- Holistic approach,
- Dynamic governance system,
- Distinct governance from management,
- Tailored to enterprise needs,
6.End-to-end governance system
Defines goals for the controls that should be used to properly manage IT
CobIT
4 domains of CobIT
- Plan and Organize
- Acquire and Implement
- Deliver and Support
- Monitor and Evaluate
5 COSO Areas
Control Environment
Risk Assessment
Control Activities
Information and Communication
Monitoring
What does CobIT and COSO identify?
What is to be achieved?
De facto standard of best practices for IT
Information Technology Infrastructure Library (ITIL)
