GoConqr has a new look! Let us know what you think.

Sign up free

Flashcards

Security and Risk Management

Alex Proctor Information Security CISSP English 150 cards

Cards in this deck (150)

  1. 1Security - 3 Core GoalsProvide availability, integrity, and confidentiality protection for critical assets.
  2. 2AvailabilityUpheld when authorized individuals have reliable and timely access to data.
  3. 3IntegrityUpheld when assurance of accuracy and reliability is provided, and unauthorized modification is prevented.
  4. 4ConfidentialityUpheld when the necessary level of secrecy is enforced at each junction of data processing, and unauthorized disclosure is prevented.
  5. 5VulnerabilityWeakness in a system that allows a threat source to compromise its security.
  6. 6ThreatThe possibility that someone or something would exploit a vulnerability and cause harm to an asset
  7. 7Threat AgentThe entity that takes advantage of a vulnerability.
  8. 8RiskThe probability of a threat agent exploiting a vulnerability, and the loss potential from that action.
  9. 9ExposureAn instance of being exposed to losses.
  10. 10ControlAlso called a safeguard or countermeasure, mitigates potential risk
  11. 11Controls - 3 TypesAdministrative, technical, physical
  12. 12Administrative ControlsManagement-orientated controls.
  13. 13Technical ControlsSoftware or hardware controls.
  14. 14Physical ControlsControls intended to protect facility, personnel, and resources.
  15. 15Defense-In-DepthCoordinated use of multiple security controls in a layered approach.
  16. 16Controls - 5 FunctionsDeterrent, preventive, detective, corrective, recovery
  17. 17Preventive ControlIntended to avoid an incident from occurring
  18. 18Detective ControlHelps identify an incident's activities and potentially an intruder.
  19. 19Corrective ControlFixes components or systems after an incident has occurred.
  20. 20Deterrent ControlIntended to discourage a potential attacker.
  21. 21Recovery ControlIntended to bring the environment back to regular operations.
  22. 22Compensating ControlAlternate control put in place because of financial or business functionality reasons
  23. 23Security Through ObscurityAssuming that your enemies are not as smart as you are and that they cannot figure out something that is tricky or confusing. Not a good practice.
  24. 24Framework vs. ArchitectureA framework is a guideline on how to build a "customized" architecture
  25. 25Enterprise Architecture vs. System ArchitectureEnterprise architecture addresses the structure of an organization. System architecture addresses the structure of software and computing components.
  26. 26COBITFramework of control objectives, allows for IT governance. Based on a series of cascading goals, ultimately tied to stakeholders. Developed by Information Systems Audit and Control Association (ISACA)
  27. 27COBIT - Governance vs. ManagementCOBIT differentiates governance and management. Government is a set of higher-level processes aimed at balancing the stakeholder value proposition. Management is the set of activities that achieve enterprise objectives.
  28. 28ISO/IEC 27001Standard for the establishment, implementation, control, and improvement of the information security management system
  29. 29ISO/IEC 27000International best-practices on how to develop and maintain an ISMS. Originally derived from BS 7799.
  30. 30Enterprise Architecture FrameworksUsed to develop individual architectures for specific stakeholders and present information in views.
  31. 31Information Security Management System (ISMS)Coherent set of policies, processes, and systems to manage risks to information assets as outlined in ISO/IEC 27001.
  32. 32Enterprise Security ArchitectureSubset of business architecture, and a way to describe current and future security processes, systems, and subunits to ensure strategic alignment.
  33. 33BlueprintsFunctional definitions for the integration of technology into business processes.
  34. 34Zachman FrameworkModel for the development of enterprise architectures. Intersects interrogatives (what, how, where, who, when, why) with different perspectives. Goal is to be able to see organization from different viewpoints. Developed by John Zachman.
  35. 35TOGAFModel and methodology for the development of enterprise architectures (Business, data, application, or technology). Utilizes cyclical Architecture Development Method (ADM). Developed by The Open Group.
  36. 36DoDAFU.S. Department of Defense architecture framework. Ensures interoperability of systems to meet military mission goals.
  37. 37MODAFArchitecture framework used mainly in military support missions. Based on the necessity to get data in the right format to the right people as soon as possible. Developed by the British Ministry of Defence.
  38. 38SABSAModel and methodology for the development of enterprise security architectures. Similar to Zachman Framework.
  39. 39ISMS vs. Security Enterprise ArchitectureISMS specifies general standards, and how they be taken followed. The enterprise security architecture illustrates how these components are integrated into the different layers of the business environment.
  40. 40COSO Internal Control-Integrated FrameworkGovernance model used to help prevent fraud within a corporate environment
  41. 41COBIT vs. COSOCOSO IC is a strategically-focused model for corporate governance, COBIT is an operationally-focused model for IT governance.
  42. 42Business EnablementCore business practices are integrated into the security operating model.
  43. 43ITILDe facto standard of best practices for IT service management. Created by UK's Central Computer and Telecommunications Agency.
  44. 44Six SigmaProcess improvement methodology. Used to identify defects in processes so that the processes can be improved upon.
  45. 45CMMIMaturity model that allows for processes to improve in an incremented and standard approach. Developed by Carnegie Mellon University.
  46. 46Enterprise Security ArchitectureSubset of an enterprise architecture. Describes the structure and behavior of all the components that make up an ISMS. Should tie in strategic alignment, business enablement, process enhancement, and security effectiveness.
  47. 47NIST SP 800-53Set of controls to protect U.S. federal systems. Developed by the National Institute of Standards and Technology. Uses the following control categories: technical, management, operational
  48. 48NIST SP 800-53 - 3 Control TypesTechnical, management, operational
  49. 49Computer-Assisted CrimeComputer used as a tool to help carry out a crime
  50. 50Computer-Targeted CrimeComputer is a victim of an attack crafted to harm it or its owners.
  51. 51Computer Is IncidentalComputer is not the attacker or attacked, but is involved in a crime.
  52. 52Script KiddiesHackers who do not have the skill to carry out attacks without readily-available tools.
  53. 53Advanced Persistent Threat (APT)Highly advanced threat, involving high degree of knowledge, capability, and skill. Often well-funded and organized with human involvement.
  54. 54Council of Europe (CoE) Convention on CybercrimeFirst international treaty seeking to address computer crimes by coordinating national laws, improving investigative techniques, and international cooperation.
  55. 55Organization for Economic Co-operation and Development (OECD)International organization that helps different governments come together and tackle economic, social, and governance challenges of a globalized economy.
  56. 56Guidelines on the Protection and Privacy of Transborder Flows of Personal DataDeveloped by OECD. Defines several core principles to ensure data is properly protected, and that all countries follow the same rules.
  57. 57European Union Principles on PrivacySet of principles addresses using and transmitting information considered private in nature, contained within the EU's Data Protection Directive.
  58. 58Safe Harbor Privacy PrinciplesDefines requirements for how non-European organizations must interact with European entities when conducting business and transferring data.
  59. 59Wassenaar ArrangementArrangement made up of 41 countries. Implements export controls for "Conventional Arms and Dual-Use Goods and Technologies". Designed to prevent buildup of military capabilities.
  60. 60Civil Law SystemUses pre-written rules and is not based on precedence. Most widespread legal system in the world. Used in continental European countries (France, Spain, etc.)
  61. 61Common Law SystemBased on precedence. Developed in England. Used in the United States. Made up of criminal, civil, and administrative laws.
  62. 62Common Law System - Criminal LawDeals with an individual's conduct that violates government laws developed to protect the public
  63. 63Common Law System - Civil LawDeals with wrongs committed against individuals or companies that result in injury or damages. Does not use prison time as a punishment, but often requires financial restitution.
  64. 64Common Law System - Administrative LawAlso known as regulatory law. Covers standards of performance or conduct expected by government agencies from companies, industries, and certain officials.
  65. 65Customary Law SystemAddresses mainly personal conduct and uses religious traditions and customs as the foundations of the laws. Usually mixed with another legal system.
  66. 66Religious Law SystemLaws are derived from religious beliefs and address an individual's religious responsibilities.
  67. 67Mixed Law SystemUses two or more legal systems.
  68. 68PatentGrants ownership and enables owner to legally enforce his rights to exclude others from using the covered invention.
  69. 69CopyrightProtects the right of the creator of an original work. Protects the expression of ideas rather than the ideas themselves.
  70. 70TrademarkProtects words, names, product shapes, symbols, colors, or a combination of these used to identify products or a company. Used to distinguish products from competitors.
  71. 71Trade SecretsDeemed proprietary to a company and often include information that provides a competitive edge. The information is protected as long as the owner takes necessary protective actions (NDA agreements, etc.)
  72. 72Internet CrimeHas brought about jurisdiction problems for law enforcement and the courts.
  73. 73Privacy LawsIndividual's right to determine what data they would like others to know about themselves, which people are permitted to know that tdata, and when those people can access it.
  74. 74Privacy LawsDictate that data collected by government agencies must be collected faithfully and lawfully, must be used only for the purpose for which it was collected, must only be held for a reasonable amount of time, and must be accurate and timely
  75. 75Personally Identifiable Information (PII)Data that can be used to uniquely identify, contact, or locate a single person - or can be used with other sources to uniquely identify an individual.
  76. 76Federal Information Security Management Act (FISMA)U.S. law that requires every federal agency to create, document, and implement an agency-wide security program. NIST SP-800-52 controls are used to ensure compliance.
  77. 77Health Insurance Portability and Accountability Act (HIPAA)U.S. federal regulation, mandated to provide national standards and procedures for the storage, use, and transmission of medical and healthcare data.
  78. 78Health Information Technology for Economic and Clinical Health (HITECH) ActServes as an add-on to HIPAA. Intended to promote the adoption and meaningful use of health information technology.
  79. 79USA PATRIOT ActDeals with many issues in one act, strengthen government's ability to perform searches and intelligence-gathering to combat terrorism. Enacted after 9/11/2001.
  80. 80Gramm-Leach-Bliley Act (GLBA)Requires financial institutions to develop privacy notices and give their customers the option to prohibit institutions from sharing their information with nonaffiliated third parties.
  81. 81Choosing the Right Safeguard to Reduce a Risk - Basic StepsEvaluate cost, functionality, and effectiveness. Perform a cost/benefit analysis.
  82. 82Personal Information Protection And Electronic Documents Act (PIPEDA)Canadian law that deals with the protection of personal information.
  83. 83Payment Card Industry Standard (PCI DSS)Created by Visa, MasterCard, Discover, and American Express. Applies to any entity that processes, stores, transmits, or accepts credit cards. Various levels of compliance and penalties exist.
  84. 84Data BreachSecurity event that results in the actual or potential compromise of the confidentiality or integrity of protected information by unauthorized actors.
  85. 85Security PolicyGeneral statement by management dictating the role security plays in the organization
  86. 86Organizational Security PolicyManagement establishes how a security program will be set up, lays out the program's goals, assigns responsibilities, shows the strategic/tactical value of security, and outlines how law enforcement should be carried out.
  87. 87Security Policy - 3 TypesRegulatory, advisory, informative
  88. 88ProceduresStep-by-step actions that should be followed to achieve a certain task
  89. 89StandardsOutline rules that are mandatory in nature and support the organization's security policies.
  90. 90BaselineRefers to a point in time that is used as a comparison for future changes. Defines the minimum level of security required.
  91. 91GuidelinesRecommendations and general approaches that provide advice and flexibility, when a standard does not apply.
  92. 92NIST - Risk Assessment MethodologyPublished in SP 800-30, Revision 1. Steps include: Prepare for assessment, Conduct assessment, communicate results, maintain assessment. Focused on computer systems and IT security issues.
  93. 93Facilitated Risk Analysis Process (FRAP)Quantitative methodology - focuses only on systems that really need assessing, to reduce time and cost. Stresses pre-screening. Intended to analyze one system, application, or business process at a time.
  94. 94Operationally Critical Threat, Asset, and Vulnerability Evaluation (OCTAVE)Team-orientated risk management methodology that employs workshops. Is commonly used in the commercial sector. Intended to assess all systems, applications, or business processes within an organization. Created by Carnegie Mellon's Software Engineering Institute.
  95. 95Risk ManagementProcess of identifying and assessing risk, reducing it to an acceptable level, and ensuring it remains at that level.
  96. 96Risk - 3 Tiers (From NIST SP 800-39)Organizational (risk to business as a whole), business process (risk to major functions of the organization), information systems (risk from an information systems perspective).
  97. 97Risk - 4 Process Components (From NIST SP 800-39)Frame risk, assess risk, respond to risk, monitor risk
  98. 98Threat ModelingThe process of describing possible adverse effects on assets which are caused by threat sources.
  99. 99Humans - 3 Primary Exploitation VectorsSocial engineering, social networks, passwords
  100. 100Risk Handling - 4 StrategiesTransfer, avoid, reduce, accept
  101. 101Total RiskRisk prior to the implementation of control(s). Total Risk = Threats * Vulnerability * Asset Value
  102. 102Risk Analysis - Main GoalsIdentify assets and assign values to them, identify vulnerabilities and threats, quantify the impact of potential threats, and provide an economic balance between the impact of the risk and the cost of the safeguards.
  103. 103Failure Modes and Effect Analysis (FMEA)Method for determining functions, identifying functional failures, and assessing the causes of failure and their failure effects through a structured process.
  104. 104Fault Tree AnalysisUseful approach to detect failures that can take place within complex environments and systems. Undesired effect is taken as the "top" event, and potential causes are added to tree as a series of expressions.
  105. 105Quantitative Risk AnalysisAttempts to assign monetary and numeric values to components within a risk analysis. Not 100% possible because qualitative items cannot be quantified with precision
  106. 106Risk Analysis - UncertaintyIndicates the level of confidence the team and management should have in calculations
  107. 107Automated Risk Analysis ToolsReduce the amount of manual work involved in the risk analysis. Can be used to estimate future expected losses and the benefits of different security measures.
  108. 108Single Loss Expectancy (SLE)Dollar amount that is assigned to a single event that represents a company's potential loss amount if a specific threat were to take place. SLE = Asset Value * Exposure Factor (EF)
  109. 109Exposure Factor (EF)Represents the percentage of loss a realized threat could have on a certain asset. Measured as a percentage of loss.
  110. 110Annualized Rate of Occurrence (ARO)Value that represents the estimated frequency of a specific threat taking place within a 12-month timeframe.
  111. 111Annualized Loss Expectancy (ALE)Dollar amount that represents annualized SLE value. ALE = SLE * ARO
  112. 112Cost / Benefit AnalysisDetermines if a control makes business sense. Control Value = ALE (Before Control) - Alex (After Control) - Annual Cost of Control
  113. 113Total RiskRisk prior to the implementation of control(s). Total Risk = Threats * Vulnerability * Asset Value
  114. 114Residual RiskRisk left over after the implementation of control(s). Residual Risk = (Threats * Vulnerability * Asset Value) * Controls Gap. Alternatively, Residual Risk = Total Risk - Controls
  115. 115Qualitative Risk AnalysisUses judgement and intuition instead of numbers. Requires evaluators with experience and education.
  116. 116Delphi TechniqueGroup decision method where each group member can communicate anonymously.
  117. 117Job RotationDetective administrative control, often used to detect fraud.
  118. 118Mandatory VacationsDetective administrative control, often used to detect fraud.
  119. 119Separation of DutiesPreventive administrative control. Ensures no single person has total control over a critical activity or task.
  120. 120Separation of Duties - 2 SubsetsSplit knowledge, dual control
  121. 121Split KnowledgeNo one person knows or has all the details to perform a task.
  122. 122Dual ControlTwo individuals must be available and active to perform a task
  123. 123CollusionMultiple people work together to cause some type of destruction or fraud.
  124. 124Non-Disclosure Agreements (NDA's)Must be developed and signed by new employees to protect the company and its sensitive information.
  125. 125Risk Management Framework (RMF)Structured approach to risk management that allows an organization to identify and assess risk, reduce it to acceptable levels, and ensure that it remains at that level.
  126. 126NIST RMF (SP 800-37r1)Risk management framework. Implementation required for U.S. federal government agencies. Focuses on systems life cycle approach to risk management, as well as system certification/accreditation.
  127. 127ISO 31000:2009Risk management framework. International standard. Focuses on uncertainty that leads to unanticipated effects. Focused broadly on organizations, not just information systems.
  128. 128ISACA Risk ITRisk management framework. Developed by ISACA. Aims at bridging gap between generic frameworks and IT-centric ones. Well-integrated with COBIT.
  129. 129COCO Enterprise Risk Management - Integrated FrameworkRisk management framework. Subset of COSO Internal Control-Integrated Framework. Generic, not IT-centric, used by management with a top-down approach.
  130. 130Risk Management - Management RoleDefine the scope and purpose, provide support, appoint a security team, delegate responsibility, and review the team's findings
  131. 131Risk Management - Team MakeupShould include individuals from different departments within the organization, not just technical personal.
  132. 132Social EngineeringNon-technical attack carried out to manipulate a person into providing sensitive data to an unauthorized individual.
  133. 133Personally Identifiable Information (PII)Collection of identity-based data that can be used in identity theft and financial fraud, and must be highly protected.
  134. 134Security GovernanceFramework that allows for security goals of organization to be set and expressed by senior management. Communicates provides oversight, accountability, and compliance.
  135. 135ISO/IEC 27004:2009International standard for information security measurement management. Used to assess the effectiveness of an ISMS
  136. 136ISO/IEC 27004:2009 vs. ISO/IEC 27001ISO/IEC 27001 tells you how to build a security program, and ISO/IEC 27004 tells you how to measure it.
  137. 137NIST SP 800-55Standard for performance measurement for information security, with a U.S. government slant.
  138. 138ISO/IEC 27004 vs. NIST SP 800-55ISO breaks down individual metrics into base measures, derived measures, and indicator values. NIST breaks down metrics into implementation, effectiveness, and impact.
  139. 139Business Continuity Management (BCM)Overarching approach to managing all aspects of BCP and DRP.
  140. 140Business Continuity Plan (BCP)Contains strategy documents that provide detailed procedures that ensure that critical business functions are maintained and that help minimize losses of life, operations, and systems.
  141. 141Disaster Recovery - GoalMinimize the effects of disaster or disruption.
  142. 142Disaster Recovery Plan (DRP) - GoalHandle the disaster and it's ramifications after the disaster hits. Usually very IT focused.
  143. 143Disaster Recovery Planning vs. Continuity PlanningDRP is focused on handling disaster immediately when they arise, BCP provides methods and procedures for dealing with longer-term disasters.
  144. 144ISO/IEC 27031:2011Guidelines for information and communications technology readiness for business continuity. Part of the overall ISO/IEC 27000 series.
  145. 145ISO/IEC 22301:2012International standard for business continuity management systems. Documentation against which organizations seek certification. Replaces BS 25999-2.
  146. 146Due DiligenceDoing everything within one's power to prevent a bad thing from happening. Normally applicable to leaders, laws, and regulations.
  147. 147Due CareTaking precautions that a reasonable and competent person would take in a similar situation. Applicable to everyone and can be used to show negligence.
  148. 148Business Impact AnalysisFunctional analysis in which a team collects data through interviews and documentary sources, documents business functions, develops a hierarchy of business functions, and applies a classification scheme to each function's criticality level.
  149. 149Maximum Tolerable Downtime (MTD)Outage time which can be endured by a company. Also known as Maximum Period Time of Disruption (MPTD).
  150. 150Internet Architecture Board (IAB)Coordinating committee for Internet design, engineering, and management. Responsible for IETF activities, Internet Standards Process oversight and appeal, and editing RFC's.

Information

Description
CISSP Information Security Flashcards on Security and Risk Management, created by Alex Proctor on 21/10/2016.
Created by
Alex Proctor
Views
10
Rating

Feedback

What is it about?

What do you think of the new look?

How do you like it?