GoConqr has a new look! Let us know what you think.

Sign up free

Flashcards

Info sec

wendy ayllon tapia Information Technology English 55 cards

Cards in this deck (55)

  1. 1EthicsThe branch of philosophy that considers nature, criteria, sources, logic, and the validity of moral judgment.
  2. 2DetterenceThe act of attempting to prevent an unwanted action by threatening punishment or retaliation on the instigator if the act takes place.
  3. 3Civil LawRelationship Between individuals and Organizations
  4. 4Tort LawPermits redress for personal, financial, or physical injury.
  5. 5Criminal Lawlaws to protect society managed by states.
  6. 6private lawregulations for family, labor laws, etc.
  7. 7public lawsagency, employment, etc.
  8. 8computer fraud and abuse act (CFA)unauthorized access to government information
  9. 9Risk IdentificationThe process of identifying potential risks that may affect an organization's objectives and goals.
  10. 10Risk AnalysisThe process of assessing the likelihood and impact of identified risks on an organization's objectives and goals.
  11. 11Risk EvaluationThe process of comparing the level of risk against predetermined criteria to determine its significance and the need for treatment.
  12. 12Risk Management life cycleThe continuous process of identifying, assessing, evaluating, treating, monitoring, and communicating risks that an organization faces.
  13. 13Governance and supportThe policies, procedures, and structures that an organization uses to manage risks and support risk management activities.
  14. 14Framework DesignThe process of designing a risk management framework that defines the organization's risk management policies, procedures, and structures.
  15. 15ImplementationThe process of putting the risk management framework into practice and applying risk management strategies and controls.
  16. 16Monitor and ReviewThe process of continuously monitoring and reviewing the effectiveness of risk management strategies and controls and making necessary adjustments.
  17. 17Continuous improvementThe process of continuously improving an organization's risk management practices and strategies to increase its ability to manage risks effectively.
  18. 18MitigationThe process of reducing the likelihood and impact of identified risks through the implementation of risk treatment strategies and controls.
  19. 19AggregationThe process of combining individual risks to provide a more comprehensive understanding of an organization's overall risk exposure.
  20. 20UncertaintyThe condition of not knowing with certainty what will happen in the future, which can affect an organization's ability to manage risks effectively.
  21. 21Risk DeterminationThe process of determining the level of risk based on the likelihood and potential impact of identified risks.
  22. 22DocumentationThe process of creating and maintaining records of risk management activities, including risk identification, analysis, evaluation, treatment, monitoring, and review.
  23. 23Risk ToleranceThe level of risk that an organization is willing to accept or tolerate in pursuit of its objectives and goals.
  24. 24TransferenceThe process of transferring the potential impact of a risk to another party, such as an insurance company.
  25. 25AcceptanceThe decision to tolerate or accept the potential impact of a risk without implementing any treatment measures.
  26. 26AvoidanceThe process of eliminating or removing the potential source of a risk or changing the way an organization operates to avoid the risk altogether.
  27. 27Business ContinuityThe process of ensuring that an organization can continue to operate in the event of a disruptive incident, such as a natural disaster or cyber-attack.
  28. 28Patching SystemsThe process of regularly updating and maintaining software systems to address known vulnerabilities and reduce the likelihood of a cyber-attack.
  29. 29Cost-benefit analysisThe process of comparing the costs and benefits of different risk treatment options to determine the most effective and efficient course of action.
  30. 30FeasibilityThe assessment of the practicality and viability of different risk treatment options based on available resources, expertise, and technology.
  31. 31FrameworksA set of guidelines, standards, and best practices that provide a structured approach to managing risk, such as the ISO 31000 or NIST Cybersecurity Framework.
  32. 32Hiring PracticesThe process of selecting and recruiting personnel with the necessary skills, experience, and qualifications to perform their job functions effectively and in compliance with security policies and procedures.
  33. 33Job ExpectationsClear and defined expectations and requirements of an employee's role in relation to information security, including the proper handling of sensitive information and compliance with security policies and procedures.
  34. 34Termination IssuesThe process of managing the departure of employees and ensuring that access to sensitive information and resources is revoked or limited appropriately.
  35. 35Personnel security considerationsMeasures taken to ensure the trustworthiness and reliability of personnel, such as background checks, security clearances, and security awareness training.
  36. 36Temporary workersContingent workers or contractors who are hired for a specific period of time and require appropriate security measures and supervision to prevent unauthorized access or disclosure of sensitive information.
  37. 37Specialty workersEmployees with specialized skills or knowledge who require additional security measures to protect sensitive information, such as data scientists, network engineers, or security analysts.
  38. 38Performance measuresMetrics and indicators used to measure and evaluate the effectiveness of personnel in meeting job expectations and complying with security policies and procedures.
  39. 39Performance life cycleThe process of defining job expectations, setting performance objectives, monitoring performance, providing feedback and coaching, and taking corrective action as necessary.
  40. 40Security MaintenanceThe process of maintaining the security of systems, networks, and information by ensuring that security controls are up to date and effective, and by regularly monitoring for potential security threats.
  41. 41Vulnerability testingThe process of identifying vulnerabilities in systems, networks, and applications by using automated tools, manual testing, or a combination of both.
  42. 42Penetration testingThe process of simulating a cyber-attack to identify vulnerabilities and weaknesses in a system or network. It involves attempting to exploit vulnerabilities to gain unauthorized access or escalate privileges.
  43. 43black boxA type of penetration testing where the tester has no prior knowledge of the system or network being tested, simulating a real-world attack scenario.
  44. 44white boxA type of penetration testing where the tester has full knowledge of the system or network being tested, including access to source code and network diagrams.
  45. 45grey boxA type of penetration testing where the tester has partial knowledge of the system or network being tested, simulating an attack by an insider with limited access.
  46. 46internet assessmentsThe process of evaluating the security of systems and networks that are accessible from the internet, including web applications, email servers, and remote access solutions.
  47. 47local network assessmentThe process of evaluating the security of systems and networks within an organization's local network, including servers, workstations, and network devices.
  48. 48wireless assessmentThe process of evaluating the security of wireless networks, including Wi-Fi and Bluetooth, and identifying potential vulnerabilities and weaknesses.
  49. 49general equipment assessmentThe process of evaluating the security of physical equipment, such as servers, switches, routers, and firewalls, and identifying potential vulnerabilities and weaknesses
  50. 50document assessmentThe process of evaluating the security of documents, such as policies, procedures, and training materials, to ensure that they are up to date, accurate, and aligned with security objectives.
  51. 51trusted computingA set of hardware and software technologies that provide a higher level of security and trust in computing systems, including secure boot, encrypted storage, and trusted platform modules.
  52. 52access controlsSecurity mechanisms that control access to resources, such as information, systems, or physical spaces, based on the identity, role, or permissions of the user.
  53. 53mandatory access controls (MAC)Access controls that are imposed by a system administrator or security policy and cannot be overridden by individual users.
  54. 54nondiscretionary access controlsAccess controls that are based on predefined rules and policies and are not subject to the discretion of individual users.
  55. 55discretionary access controlAccess controls that allow individual users to determine who can access their resources based on their own discretion.

Information

Description
Information Technology Flashcards on Info sec, created by wendy ayllon tapia on 02/05/2023.
Views
1
Rating

Feedback

What is it about?

What do you think of the new look?

How do you like it?