Flashcards
Risks
Cards in this deck (22)
- 1CONTROL TYPE - Technical1) Technical security controls
2) Access control, audit and accountability,
identification and authentication,
system and communications protection - 2CONTROL TYPE - Management security control1) Security assessment and authorization, planning, risk assessment, system and services acquisition, program management
- 3CONTROL TYPE - Operational security control1) Awareness and training, configuration management,
contingency planning, incident response, maintenance, media protection, physical and environmental protection, personnel security, system and
information integrity - 4False Postitives1) A report that isn’t true - a false alarm or mistaken identity
2) IDS/IPS information - only as good as the signatures
3) Workstation anti-virus - False positives can remove legit files - 5False Negative1) Not alerted to a legitimate issue when you should have been aleted
- 6Privacy Policies1) Define what controls are required to implement and maintain the sanctity of data privacy
- 7Acceptable Use Policies (AUP)1) Describes how the employees in an organization can use company systems and resources, both software and hardware.
- 8Security Policies1) Defines what controls are required to implement and maintain the security of systems, users, and networks
2) Guide in system implementations and evaluations - 9Mandatory Vacations1) Provides an opportunity to discover fraud
- 10Job rotation policy1) Company doesn't get dependent on one person
2) Used to uncover possible fraud - 11Succession Planning1) Outlines those employees who have the ability to step into positions with open
- 12Least Privilege1) Give users only the permissions that they need to do their work and no more. For example, a temporary employee should never have the right to install soft
- 13Threat Vector1) the way in which an attacker poses a threat
- 14Mean Time Between Failures (MTBF)measure of the anticipated incidence of failure for a system or component.
- 15Mean Time to Failure1) The average time to failure for a nonrepairable system
2) If the system can be repaired, the MTBF is the measurement to focus on, but if it cannot, then MTTF is the number to look at - 16Mean Time to Restore1) Is the measurement of how long it takes to repair a system or component once a failure occurs
- 17Recovery Time Objective (RTO)1) is the maximum amount of time that a process or service is allowed to be down and the consequences still be consid- ered acceptable
2) RTO is agreed on during BIA creation - 18Recovery point objective (RPO)1) Defines the point at which the system needs to be restored TO (2 days ago or a week)
- 19Service-Level Agreement (SLA)The SLA defines the level of service to be provided.
- 20Blanket Purchase Order (BPO)1) Agreement between a government agency and a private company for ongoing purchases of goods or services.
- 21Memorandum of Understanding (MOU)1) brief summary of which party is responsible for what portion of the work.
- 22Interconnection Security Agreement (ISA)This is an agreement between two organizations that have connected systems
Information
- Description
- Flashcards on Risks, created by Obi Davis on 05/02/2015.
- Created by
- Obi Davis
- Views
- 0
- Rating