Flashcards
CISM Flashcards
Cards in this deck (65)
- 1annualized loss expectancy (ALE)the expected loss of asset value due to threat realization
- 2ALE formulaSLE x ARO
- 3annualized rate of occurrence (ARO)An estimate of the number of times that a threat will occur every year
- 4asset value (AV)The value of an IT asset, which is usually (but not necessarily) the asset's replacement value
- 5asymmetric encryptiona method for encryption, decryption, and digital signatures that uses pairs of encryption keys, consisting of a public key and a private key
- 6Product Developmentgeneric term used to represent software development, programming, integration, software engineering, and other activities all concerned with the development of software for internally or by customers or partners
- 7Security by designrepresents several activities to ensure that all new offering, components, features, and improvements incorporate security as part of the design process
- 8Secure developmentincludes secure coding to ensure that all new and changed software is free of exploitable defects that could result in security incidents
- 9Code reviewsincludes peer reviews of security-related changes to software source code, including security-sensitive functions such as authentication, session management, data validation, and data segragation in mulititenant environments
- 10Security review of open source softwareorganizations perform reviews of various kinds of some or all open source modules to ensure they are not introducing unwanted security defects into the software application
- 11Developer trainingperiodic training for developers includes techniques on secure development, which helps developers avoid the otherwise common mistakes that result in security defects that must be fixed later
- 12Protection of the development processincludes controls to ensure that only authorized developers may access source code, security scans of source code upon check-in, and protection of all source code
- 13Compliancestate of conformance to applicable policies, standards, regulations, and other requirements. The process by which the security manager determines whether the organization's information systems, process, and personnel conform to those things
- 14Compliance RiskA risk that is associated with any general or specific consequences of the failure to be compliant with an applicable law or other legal obligation
- 15Rolea designation that denotes an associated set of responsibilities, knowledge, skills, and attitudes. Example roles include security manager, security engineer, security analyst
- 16Responsibilitya stated expectation of activities and performance. Example responsibilities include running weekly security scans, performing vendor risk assessments and approving access requests
- 17Business Casedocumentation of the rationale for making a business investment used both to support a business decision on whether to proceed with the investment and as an operational tool to support the management of the investment through its full economic life cycle
- 18Plaintextan original message, file, or stream of data that can be read by anyone who has access to it
- 19CiphertextA message, file, or stream of data that has been transformed by an encryption algorithm and rendered unreadable
- 20EncryptionThe process of transforming plaintext into ciphertext
- 21Hash FunctionA cryptographic operation on a block of data that returns a fixed-length string of characters used to verify the integrity of the message
- 22Message DigestThe output of a cryptographic has function
- 23Digital SignatureThe result of encrypting the hash of a message with the originator's private encryption key used to prove the authenticity and integrity of a message
- 24DecryptionThe process of transforming ciphertext into plaintext so that a recipient can read it
- 25CryptanalysisAn attack on a cryptosystem where the attacker is attempting to determine the encryption key that used to encrypt messages
- 26Encryption KeyA block of characters used in combination with an encryption algorithm used to encrypt or decrypt a stream or block of data. Also used to create and verify a digital signature
- 27Key Encrypting KeyAn encryption key that is used to encrypt another encryption key
- 28Key LengthThe size (measured in bits) of an encryption key
- 29Block CipherAn encryption algorithm that operates on blocks of data
- 30Stream CipherA type of encryption algorithm that operates on a continuous stream of data such as a video or audio feed
- 31Initialization VectorA random number that is needed by some encryption algorithms to begin the encryption process
- 32Symmetric EncryptionA method for encryption and decryption where it is necessary for both parties to possess a common encryption key
- 33Asymmetric Encryption, or Public Key CryptographyA method for encryption, decryption, and digital signatures that uses pairs of encryption keys, consisting of a public key and a private key
- 34Key ExchangeA technique that is used by two parties to establish a symmetric encryption key when there is no secure channel available
- 35NonrepudiationThe property of encryption and digital signatures that can make it difficult or impossible for a party to later deny having sent a digitally signed message unless they admit to having lost control of their private encryption key
- 36Segregation of DutiesThe concept that ensures that no single individual will possess privileges that could result in unauthorized activities or the manipulation or exposure of sensitive data
- 37Four techniques for effective endpoint managementImage Management
Configuration Management
Remote Control
Remote Destruction - 38VirusA fragment of an executable file that is able to attach itself to other executable files
- 39TrojanA stand-alone program that must be executed by the end-user to be activated
- 40MacroAn executable file that is embedded with another file such as a document or spreadsheet
- 41SpywareMalware that records one or more surveillance activities on a target system including web sites visited and keystrokes reporting back to the owner
- 42WormA stand-alone program that is able to propagate itself automatically from one computer to another typically using network communications
- 43RootkitMalware that is designed to evade detection by anti-malware and even the operating system itself
- 44FilelessMalware that exists exclusively in a computer's memory instead of in the file system. This type of malware is more difficult for traditional antivirus software to detect, as there is no file to examine for matching signatures
- 45RansomwareMalware that performs some destructive but reversible action such as encrypting files and demands a ransom be paid before the destruction can be recovered
- 46Information Security GovernanceA set of activities that are established so that management has a clear understanding of the state of the organization's security program, its current risks, and its direct activities
- 47ObjectivesThese are desired capabilities or end states ideally expressed in achievable measurable terms
- 48StrategyThis is a plan to achieve one or more objectives
- 49PolicyAt its minimum, security policy should directly reflect the mission, objectives, and goals of the overall organization
- 50PrioritiesThis should flow directly from the organization's mission, objectives, and goals
- 51COBIT 5 Principles1. Meet stakeholders needs
2. Covering the enterprise end-to-end
3. Applying a single integrated framework
4. Enabling a holistic approach
5. Separating governance from management - 52The enterprise exists to create value for its stakeholders by maintaining a balance between the realization of benefits and the optimization of risk and resource utilizationCOBIT Principle 1: Meeting stakeholder needs
- 53Integrates IT governance into enterprise governance, it covers all the functions and processes in the enterpriseCOBIT Principle 2: Covering the enterprise end-to-end
- 54Aligns with other relevant standards and frameworksCOBIT Principle 3: Applying a single integrated framework
- 55Takes into account all interacting components and defines a set of enablers that includes: principles, policies, frameworks, etc.COBIT Principle 4: Enabling a holistic approach
- 56The framework makes a clear distinction between governance and managementCOBIT Principle 5: Separating governance from management
- 57In the balanced scorecard, management defines key measurements in four perspectives:1. Financial
2. Customer
3. Internal processes
4. Innovation and learning - 58An enterprise architecture framework used to describe an IT architecture in increasing levels of detailZachman framework
- 59Name nine control frameworks1. COBIT
2. ISO/IEC 27001
3. ISO/IEC 38500
4. ITIL/ISO/IEC 20000
5. HIPAA
6. NIST SP 800-53
7. NIST Cyber Security Framework
8. CIS 20
9. PCI-DSS - 60COBIT's four domains1. Plan and organize
2. Acquire and implement
3. Deliver and support
4. Monitor and evaluate - 61Not primarily a security control framework but an IT process framework contains 37 processesCOBIT
- 62Nine steps in NIST 800-30 risk assessment methodology1. System characterization
2. Threat identification
3. Vulnerability identification
4. Control analysis
5. Likelihood determination
6. Impact analysis
7. Risk determination
8. Control recommendations
9. Results documentation - 63Which factors need to be considered when assessing risk?1. Threat actor
2. Type of threat
3. Vulnerabilities
4. Impact of exploit
5. Frequency of occurrence
6. Value of asset - 64Provides guidance by performance improvement with five maturity levels1. Initial (level 1)
2. Repeatable (level 2)
3. Defined (level 3)
4. Managed (level 4)
5. Optimizing (level 5) - 65Name the 7 steps in the development of a risk management program1. Define the reason for the program and its context
2. Determine the scope and charter of the program
3. Define the authority, structure, and reporting relationships of the program
4. Identify and classify assets, and determine asset owners
5. Document the objective of the program
6. Determine the methodologies to be used
7. Designate the team responsible for implementing the program
Information
- Description
- CISM Information Security Flashcards on CISM Flashcards, created by Patrick Hazlett on 17/06/2020.
- Created by
- Patrick Hazlett
- Views
- 1
- Rating