Brainscape's Knowledge GenomeTM


Top Flashcards (Certified)
All Flashcards

CC > 1 Security Principles > Flashcards

1 Security Principles Flashcards

(63 cards)

Start Studying
1
Q

5 Domains

A

1 Security Principles 2 Business Continuity, Disaster Recovery, and Incident Response (10%) 3 Access Control Concepts 4 Network Security 5 Security Operations

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

ISC2 Canon 1

A

Protect society, the common good, necessary public trust and confidence, and the infrastructure

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

ISC2 Canon 2

A

Act honorably, honestly, justly, responsibly, and legally

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

ISC2 Canon 3

A

Provide diligent and competent service to principals (employer or client)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

ISC2 Canon 4

A

Advance and protect the profession

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

3 main goals/concerns of information security

A

CIA

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Confidentiality:

A

ensuring only authorized individuals have access to information and resources

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Integrity:

A

protecting information from unauthorized changes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Availability:

A

ensures authorized access to systems and data whenever needed

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Confidentiality concerns/attacks (5):

A

1 Snooping, 2 dumpster diving, 3 eavesdropping, 4 wiretapping (electronic eavesdropping) 5 social engineering

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Integrity attacks (4)

A

1 unauthorized modification 2 impersonation (social engineering) 3 MITM 4 replay

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Availability disruptions (5)

A

1 DoS 2 power outages 3 hardware failure 4 destruction of equipment 5 service outages

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Access Control - 3 steps

A

1 Identification (“i’m Dave” , username) 2 authentication (ID, password) 3 Authorization (permissions)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

AAAs

A

Authentication, Authorization, Accounting

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

An SSO ______

A

shares authenticated sessions across systems

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Privacy concerns/responsibilities (3)

A

1- we are concerned about our own private information
2 - we have a responsibility to educate users in our own organization
3 - we have a responsibility to assist privacy officials

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

2 common forms of private information

A

1 PII 2 PHI

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

A legal principle that privacy programs are based on

A

Reasonable Expectation of Privacy

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

The main responsibility of a cybersecurity professional is to

A

Manage Risk

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Main Risk categories (2)

A

1 Internal
2 External

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Risk shared among different organizations

A

Multiparty Risk (SaaS attack)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Risk assessment =

A
  • the process of identifying and triaging risks (prioritize) based on the likelihood of occurrence and the expected impact
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Threat =

A
  • external forces that jeopardizes the security of your information and systems
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Threat vector

A

the method that an attacker uses to get to your target

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Vulnerabilities
- weaknesses in your security controls that a threat might exploit to undermine the CIA of your information or systems
26
Risk =
Threat * vulnerability (exists when both a vulnerability and a corresponding threat that might exploit that vulnerability are present)
27
Likelihood =
the probability that the event (risk) will actually occur. (low, medium, high)
28
Risk (definition):
- the possibility that the occurrence of an event will adversely affect the achievement of the organization’s objectives
29
Impact =
- the amount of damage that will occur if the risk (event) materializes
30
2 techniques to assess the likelihood and impact of a risk for risk assessment
1 Qualitative 2 Quantitative
31
Risk Treatment/Risk Management =
The process of analyzing potential responses to risks (on your list) and implementing those responses to control each risk appropriately
32
4 basic Risk Treatment Options
1 Risk Avoidance 2 Risk Transference 3 Risk Mitigation 4 Risk Acceptance
33
Risk Profile =
the combination of risks that affect an organization
34
Inherent Risk/Raw Risk =
- the level of risk an organization faces before any internal controls are applied
35
Residual Risk/Net Risk =
- the level of risk an organization faces after internal controls have been applied
36
Control Risk =
new risks introduced by the implementation of controls
37
Risk Tolerance
- the level of risk an organization is willing to accept (before action is required)
38
The goal of risk management is
to make sure that the combination of the residual risk and the control risk is below the organization’s risk tolerance
39
Control objective =
the purpose of a security control
40
Defense in Depth =
- applying multiple overlapping controls to achieve the same (control) objective
41
Security Control categories by purpose (3)
1 Preventative (stops a security issue from occurring) - firewall 2 Detective - IDS 3 Corrective/Recovery (remediates security issues that have already occurred) - backup tapes
42
Security Control categories by mechanism of action (3)
1 Technical/Logical (uses technology to achieve security objectives) 2 Administrative 3 Physical
43
Configuration management purpose =
ensures change occurs when desired and in a controlled manner (ensures a stable operating environment)
44
Baseline purpose =
a configuration snapshot used to assess whether a system has changed
45
2 critical components of change management
Versioning and Version Control (major version of the software.major update.minor update)
46
Security Governance =
- a framework of policies, practices and strategies (from senior management) with the goal of providing direction and ascertaining that risks are managed appropriately to achieve security goals
47
GDPR =
(General Data Protection Regulation) - applies to all EU residents, regardless of where they are located
48
PCI-DSS
Payment Card Industry Data Security Standard
49
Security Policy Framework (4 different types of documents)
1 Policies 2 Standards 3 Guidelines 4 Procedures
50
Policies are
Rules - mandatory bedrock documents from the top level of the organization. “sensitive information must be encrypted using approved technology” (allows for change)
51
Standards are
mandatory (derive their authority from policy) and prescribe the specific details of security controls that the organization must follow (approved encryption algorithms)
52
Guidelines are
Advice. Not mandatory - best practices. “employees should use encrypted wireless networks whenever they are available”
53
Procedures are
step-by-step instructions to perform a specific task. May be mandatory or optional.
54
AUP =
(Acceptable Use Policy) describes authorized uses of technology and what is prohibited
55
Data Handling Policies =
defines what is considered sensitive information and how to protect that sensitive information
56
Password Policies =
documentation of requirements
57
BYOD (Bring Your Own Device) Policies =
the security controls that must be in place and the types of information that may be accessed
58
Privacy Policies =
what PII is retained, and how it will be used (stored, transmitted, etc)
59
Change Management Policies =
describe how changes are made to the organization’s technology infrastructure (approval, rollout and rollback)
60
2 ways to protect for service outages:
1 Resilient systems (backup hard drives, power supplies, etc) and 2 Redundant systems with failover (back up servers, cloud, etc)
61
AAA in IT (3 steps example)
1 username, 2 password (MFA), 3 access control list
62
2 factors used to evaluate (rank/triage) risks:
1 likelihood, 2 impact
63
Common Security Policies Content (6)
AUP, Data Handling, Password, BYOD, Privacy, Change Management

CC (5 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2025 Bold Learning Solutions. Terms and Conditions