GoConqr has a new look! Let us know what you think.

Sign up free

Flashcards

Certified Security Compliance Specialist

jnkdmls Dalia CSCS Certification English 60 cards

Cards in this deck (60)

  1. 1Points of VulnerabilityMan-in-the-Middle
    Rogue Access Points
    Session Hijacking
    Denial of Service (DoS)
  2. 2Wireless ChallengesLack of user authentication
    Weak Encryption
    Poor Network Management
  3. 3IntrusionsKnown Vulnerabilities
    Configuration Errors
    Fix:
    Patch in a timely manner
    (effective cyber security strategy)
  4. 4Japan - PIP (Personal Information Protection Act) Effective: May 2003 Compliance: May 2005Applies to:
    National & Local Gov't
    Private Companies
    Protects against:
    Loss of personal data
    Unauthorized Access
    Unauthorized Disclosure
  5. 5Canada - PIPEDA (Personal Information Protection & Electronic Document Act) Effective: April 2000 Compliance: January 2004Rules for:
    Collection
    Use
    Disclosure
    10 FIPs
  6. 610 FIPs (Fair Information Principles)1. Accountability
    2. Identifying Purposes
    3. Consent
    4. Limiting Collection
    5. Limiting Use, Disclosure, Retention
    6. Accuracy
    7. Safeguards
    8. Openness
    9. Individual Access
    10. Challenging Compliance
  7. 7Australia - FPA (Federal Privacy Act) Effective: December 2001Protect the privacy of individuals
    Regulate credit providers & credit reporting agencies
    11 IPPs
    10 NPPs
  8. 811 IPPs (Information Privacy Principles)1. Manner & purpose of collection
    2. Collecting directly from individuals
    3. Collecting information generally
    4. Storage & Security
    5-7. Access & Amendment
    8-10: Information Use
    11: Disclosure
  9. 910 NPPs (National Privacy Principles)1. Collection
    2. Use & Disclosure
    3. Info Quality
    4. Info Security
    5. Openness
    6. Access & Correction
    7. Identifiers
    8. Anonymity
    9. Transborder Data Flow
    10. Sensitive Information
  10. 10European Union - DPD (Data Protection Directive) Effective: October 1995Covers processing of personal data, automatically processed, & manual data in a filing system
    95/46
  11. 11United Kingdom The Turnbull Guidance (Internal Control: Guidance for Directors on the Combined Code) Effective: December 2000Companies to manage identified internal & external risk within the organization
  12. 12United Kingdom - DPA (Data Protection Act) Effective: 1998Prevent:
    Unauthorized or unlawful processing
    Accidental loss or damage to data
  13. 13United Kingdom F of IA (Freedom of Information Act) Compliance: January 2005Prevent:
    Altering or corruption of public authority information
    Ensure:
    Uptime
  14. 14United States - GLB Act (Gramm-Leach-Bliley Act) Effective: November 1999Provisions for:
    Confidentiality, Integrity, Availability
    in the areas of:
    Admin, Physical, & Tech Safeguards
    Applies to:
    Banks, Security firms, Insurance companies, & sellers of financial products
  15. 15United States - 21 CFR Part 11 (Title 21 of the US Code of Federal Regulations Part 11) Published: August 2003Ensure authenticity, integrity, confidentiality, & non-repudiation of electronic records
    (part of the FDA)
  16. 16NERC's - CSS North American Electric Reliability Council Cyber Security StandardsRequires power utilities to assess and enhance their security environments
    (Critical Infrastructure Protection - CIP)
  17. 17Critical Infrastructure Protection (CIP)CIP-002: Critical Cyber Assets
    CIP-003: Security Management Controls
    CIP-004 Personnel & Training
    CIP-005: Electronic Security
    CIP-006: Physical Security
    CIP-007: Systems Security Management
  18. 18Deter and Detect AttacksFirewalls
    Intrusion Detection Systems (IDS)
    Intrusion Prevention Systems (IPS)
  19. 19SOX Penalties (for knowingly signing a false financial report)A corporate officer
    $1 million
    up to 10 years in prison
  20. 20SOX Titles and Sections11 Titles
    4 Sections
  21. 21Title IPublic Company Accounting Oversight Board
  22. 22Title IIAuditor Independence
  23. 23Title IIICorporate Responsibility
    Section 302
    Corporate Responsibility for Financial Reports
  24. 24Title IVEnhanced Financial Disclosures
    Section 404:
    Mgmt Assessment of internal Controls
    Section 409:
    Real Time Issuer Disclosures
  25. 25Title VAnalyst Conflicts of Interest
  26. 26Title VICommission Resources and Authority
  27. 27Title VIIStudies and Reports
  28. 28Title VIIICorporate and Criminal Fraud Accountability
    Section 802: Criminal Penalties for Altering Documents
  29. 29Title IXWhite-Collar Crime Penalty Enhancements
  30. 30Title XCorporate Tax Returns
  31. 31Title XICorporate Fraud and Accountability
  32. 32Section 302Corporate Responsibility for Financial Reports
    Company's mgmt must ensure & demonstrate that financial data is accurate and complete - quarterly and annually
    Effective:
    July 2002
  33. 33Section 404Mgmt Assessment of Internal Controls
    Corporate mgmt, executives, and financial officers implement controls to protect and annually monitor and report of the effectiveness of the controls
  34. 34Section 409Real Time Disclosure of Issues
    Real-time reporting of material events that could impact a company's financial performance
  35. 35Public Company Accounting Oversight Board (PCAOB)An audit of internal control over financial reporting performed in conjunction with an audit of financial statements
  36. 36The Securities and Exchange Commission (SEC)indicated that the
    Committee of Sponsoring Organizations Internal Control
    (COSO)
    is acceptable to define internal controls for financial reporting systems
  37. 37COSO 5 Aspects of effective internal controls1. The Control Environment
    2. Risk Assessment
    3. Control Activities
    4. Information & Communications
    5. Monitoring
  38. 38Complementary to COSOControl Objectives for Information and Related Technology (COBIT) established by IT Governance Institute (ITGI)
    ISO 27000 for Information Security Mgmt Systems
  39. 39COBIT 5 Domains1. Align, Plan, & Organize (APO)
    2. Build, Acquire, & Implement (BAI)
    3. Deliver, Service, & Support (DSS)
    4. Monitor, Evaluate, & Assess (MEA)
    5. Evaluate, Direct, & Monitor (EDM)
  40. 40COBIT (1) Align, Plan, & Organize (APO)1. Mng IT Mgmt Framework
    2. Mng Strategy
    3. Mng Enterprise Architecture
    4. Mng Innovation
    5. Mng Portfolio
    6. Mng Budget & Costs
    7. Mng HR
    8. Mng Relationships
    9. Mng Service Agreements
    10. Mng Suppliers
    11. Mng Quality
    12. Mng Risk
    13. Mng Security
  41. 41COBIT (2) Build, Acquire, & Implement (BAI)1. Mng Programs & Projects
    2. Mng Requirements Definition
    3. Mng Solutions Identification & Build
    4. Mng Availability & Capacity
    5. Mng Organizational Change Enablement
    6. Mng Changes
    7. Mng Change Acceptance & Transitioning
    8. Mng Knowledge
    9. Mng Assets
    10. Mng Configurations
  42. 42COBIT (3) Deliver, Service, & Support (DSS)1. Mng Operations
    2. Mng Service Requests & Incidents
    3. Mng Problems
    4. Mng Continuity
    5. Mng Security Services
    6. Mng Business Process Controls
  43. 43COBIT (4) Monitor, Evaluate, & Assess (MEA)1. MEA Performance and Conformance
    2. MEA System of Internal Controls
    3. MEA Compliance with External Req'ts
  44. 44COBIT (5) Evaluate, Direct, & Monitor (EDM)1. Ensure Governance Framework Setting & Maintenance
    2. Ensure Benefits Delivery
    3. Ensure Risk Optimization
    4. Ensure Resource Optimization
    5. Ensure Stakeholder Transparency
  45. 45COBIT Security Objectives 37 StepsRead Chapter 2
    Slides 27 to 41
  46. 46Payment Card Industry (PCI) Data Security Standard (DSS)Applies to all who store, process, or transmit cardholder data
  47. 47PCI Penalties2006: over $5Mil
    $5K/mth increasing to $25K/mth
    Compromised cards: $25 per card
    up to $500K
  48. 4812 PCI DSS Requirements 6 Control Objectives1. Build & Maintain a Secure Network
    2. Protect Cardholder Data
    3. Maintain a Vulnerability Mgmt Program
    4. Implement Strong Access Control Measures
    5. Regularly Monitor & Test Networks
    6. Maintain an Information Security Policy
  49. 49(1) Build & Maintain a Secure NetworkA . Firewall Configuration
    B. No Vendor Defaults
  50. 50(2) Protect Cardholder DataA. Protect Stored Cardholder Data
    (mask Primary Account Number PAN)
    B. Encrypt Transmission
    (SSL/TLS and IPSEC)
  51. 51(3) Maintain a Vulnerability Mgmt ProgramA. Update Anti-Virus Software
    B. Maintain Secure Systems & Applications
    (patches, separate environments)
  52. 52(4) Implement Strong Access Control MeasuresA. Restrict Access (need to know)
    B. Assign Unique IDs
    C. Restrict Physical Access
  53. 53(5) Regularly Monitor & test NetworksA. Track & Monitor All Access
    B. Regularly Test Security Processes
    (Pen tests; Network-Layer and Application-Layer)
  54. 54(6) Maintain an Information Security PolicyA. Maintain Policy
    (awareness program)
  55. 55PCI Next StepsPre-Assessment & Gap Analysis
  56. 56HITECH Meaningful Use (Health Information Technology for Economic and Clinical Health) Effective: February 17, 2009Ensure adequate privacy and security protections for PHI through use of policies, procedures, & technologies over EHR
  57. 57Meaningful PenaltiesCMS will withhold payment until violations are resolved
  58. 58HIPAA Mandate 164.308(a)(1)(ii)(A)Organizations need to conduct an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity, & availability of EPHI held by the organization
  59. 59HIPAA Audit Evidence1. Entity-wide Security Plan
    2. Risk Analysis & Mgmt Plan
    3. Security Violation Monitoring Rpts
    4. Vulnerability Scanning Plans
    5. Network Pen Testing Policy and Procs
    6. Access Control Lists
    7. Patch Mgmt Plans
    8. Encryption Measures
  60. 60Personal Identifiable Information (PII)

Information

Description
CSCS Certification Dalia Flashcards on Certified Security Compliance Specialist, created by jnkdmls on 04/12/2015.
Created by
jnkdmls
Views
139
Tags
cscs
Rating

Feedback

What is it about?

What do you think of the new look?

How do you like it?