Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

1.0 nist frameworks > Cybersecurity Risks and Controls > Flashcards

Cybersecurity Risks and Controls Flashcards

1
Q

What are the phases of an attack?

A

Before, During, After

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What is the risk equation for managed assets?

A

Risk = { Threats * Vulnerabilities * Asset Value } / Strong Controls

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What is the risk equation for unmanaged assets?

A

Risk = { Threats * Vulnerabilities * Asset Value } / Weak Controls

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What are the Business Controls that NIST references?

A

ISO 27002 Code of Practice

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What are the Technical Controls that NIST references?

A

CIS 20 Critical Controls

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What is Critical Infrastructure?

A

Assets, systems and networks, whether physical or virtual, so vital to the United States that their incapacitation or destruction would have a debilitating effect on national security, economic security, national public health or safety, or any combination thereof.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What is EO ?

A

Executive Order

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Who issued EO 13800?

A

Trump

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What is EO 13800?

A

Strengthing Cybersecurity of Federal Networks and Critical Infrastructure

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What is the purpose of EO 13800?

A

To improve the nation’s cyber posture and capabilities in the face of intensifying cybersecurity threats to its digital and physical security.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What are the deliverable for EO 13800 ?

A
  • Cybersecurity

* Workforce development

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What does NIAC stand for?

A

National Infrastructure Advisory Council

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What were the NIAC Report recommendations?

A
  1. Establish separate, secure communication networks for critical cyber control system traffic and reserved spectrum for backup communications.
  2. Facilitate cyber threat sharing.
  3. Identify the best scanning tools and assessment practices.
  4. Strengthen the capabilities of today’s cyber workforce.
  5. Establish outcome based market incentives to encourge owners to upgrade cyber infrastructure.
  6. Streamline security clearance process for owners of the nation’s most critical cyber assets.
  7. Establish protocols to rapidly declassify cyber threat information.
  8. Pilot an operational task force of experts to respond to cyber threats.
  9. Perform the Gridex-IV Exercise to test Federal Authorities during a cyber incident.
  10. Establish a governance approach.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What are the steps to mitigate risks?

A
  1. Strategy -aligned with business strategy
  2. Program - establish the target profile
  3. Controls - should be used to establish the new current profile
  4. Assessment - gap analysis compares current & target profiles
  5. Report - detailed scorecard that identifies current capabilities and an improvement plan for cyber maturity.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What are the NIST CFW Strategic Goals?

A
  1. Protect Information Systems
  2. Reduce Cyber Risk
  3. Best-in-Class Cybersecurity Capabilities
  4. Enterprise Approach to Cybersecurity
  5. A Cyber-Secure Enterprise
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What are the Objectives of NIST CFW Goal #1 ?

A

Objective 1.1 Safeguard Confidential Information from Compromise
Objective 1.2 Protect the Integrity of Information
Objective 1.3 Ensure the Availability of Critical information systems
Objective 1.4 Provide Cyber-Resilient Information Sytstems
Objective 1.5 Maintain a Secure Technology Infrastructure

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What are the Objectives of NIST CFW Goal #2 ?

A

Objective 2.1 Drive cybersecurity Priorities and Initiatives Based on Effective Risk Management
Objective 2.2 Create and Nurture a Culture of Cyber-Risk Awareness
Objective 2.3 Establish Risk Ownership and effectively Communicate Risk

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What are the Objectives of NIST CFW Goal #3 ?

A

Objective 3.1 Align information and Cyber Security Efforts with the Business Needs
Objective 3.2 Deliver Technology Solutions that are Secure
Objective 3.3 Enhance the Ability to Detect Cyber-Attacks
Objective 3.4 Respond Rapidly and Effectively to Security Incidents
Objective 3.5 Build and Maintain a Robust Cyber-Defence Capability
Objective 3.6 Develop and Sustain a capable and Competent Cybersecurity Workforce

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What are the Objectives of NIST CFW Goal #4 ?

A

Objective 4.1 Establish Enterprise Information and Cyber security program
Objective 4.2 Embrace a Common Cyber security Framework
Objective 4.3 Enact Effective Enterprise-Wide Security Policies
Objective 4.4 Improve Cyber security through the Enterprise Technology Transformation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What are the Objectives of NIST CFW Goal #5 ?

A

Objective 5.1 Improve Cyber security through leadership, Partnerships and National Participation.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

What is Strategic Goal #1 ?

A

Protect Information and Systems

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

What is Strategic Goal #2 ?

A

Reduce Cyber Risk

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

What is Strategic Goal #3 ?

A

Best-in-Class Cyber security Capabilities

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

What is Strategic Goal #4 ?

A

Enterprise Approach to Cyber security

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

What is Strategic Goal #5 ?

A

A Cyber-Secure Enterprise

26
Q

What does NCSF mean?

A

NIST Cyber Security Framework

27
Q

What are the functions of the NCSF Framework Core?

A
  1. Identify
  2. Protect
  3. Detect
  4. Respond
  5. Recover
28
Q

What are the Categories of the NCSF Framework Core’s Identify function?

A
  1. Asset Management
  2. Business Environment
  3. Governance
  4. Risk Assessment
  5. Risk Management
  6. Supply Chain
29
Q

What are the Categories of the NCSF Framework Core’s Protect function?

A
  1. Access Control
  2. Awareness and Training
  3. Data Security
  4. Information Protection Procedures
  5. Maintenance
  6. Protective Technology
30
Q

What are the Categories of the NCSF Framework Core’s Detect function?

A
  1. Anomalies and Events
  2. Security Continuous Monitoring
  3. Detection Processes
31
Q

What are the Categories of the NCSF Framework Core’s Respond function?

A
  1. Respond Planning
  2. Communications
  3. Analysis
  4. Mitigation
  5. Improvements
32
Q

What are the Categories of the NCSF Framework Core’s Recover function?

A
  1. Recovery Planning
  2. Improvements
  3. Communications
33
Q

Describe which function Asset Management category belongs to and how many sub-categories it has.

A
  1. It belongs to the Identify function

2. It contains 6 sub-categories

34
Q

Describe which function Business Environment category belongs to and how many sub-categories it has.

A
  1. It belongs to the Identify function

2. It contains 5 sub-categories

35
Q

Describe which function Governance category belongs to and how many sub-categories it has.

A
  1. It belongs to the Identify function

2. It contains 4 sub-categories

36
Q

Describe which function Risk Assessment category belongs to and how many sub-categories it has.

A
  1. It belongs to the Identify function

2. It contains 6 sub-categories

37
Q

Describe which function Risk Management category belongs to and how many sub-categories it has.

A
  1. It belongs to the Identify function

2. It contains 3 sub-categories

38
Q

Describe which function Supply Chain category belongs to and how many sub-categories it has.

A
  1. It belongs to the Identify function

2. It contains 5 sub-categories

39
Q

Describe which function Access Control category belongs to and how many sub-categories it has.

A
  1. It belongs to the Protect function

2. It contains 7 sub-categories

40
Q

Describe which function Awareness and Training category belongs to and how many sub-categories it has.

A
  1. It belongs to the Protect function

2. It contains 5 sub-categories

41
Q

Describe which function Data Security category belongs to and how many sub-categories it has.

A
  1. It belongs to the Protect function

2. It contains 8 sub-categories

42
Q

Describe which function Information Protection Procedures category belongs to and how many sub-categories it has.

A
  1. It belongs to the Protect function

2. It contains 12 sub-categories

43
Q

Describe which function Maintenance category belongs to and how many sub-categories it has.

A
  1. It belongs to the Protect function

2. It contains 2 sub-categories

44
Q

Describe which function Protective Technology category belongs to and how many sub-categories it has.

A
  1. It belongs to the Protect function

2. It contains 5 sub-categories

45
Q

Describe which function Anomalies and Events category belongs to and how many sub-categories it has.

A
  1. It belongs to the Detect function

2. It contains 5 sub-categories

46
Q

Describe which function Security Continuous Monitoring category belongs to and how many sub-categories it has.

A
  1. It belongs to the Detect function

2. It contains 8 sub-categories

47
Q

Describe which function Detection Processes category belongs to and how many sub-categories it has.

A
  1. It belongs to the Detect function

2. It contains 5 sub-categories

48
Q

Describe which function Response Planning category belongs to and how many sub-categories it has.

A
  1. It belongs to the Respond function

2. It contains 1 sub-categories

49
Q

Describe which function Communications category belongs to and how many sub-categories it has.

A
  1. It belongs to the Respond function

2. It contains 5 sub-categories

50
Q

Describe which function Analysis category belongs to and how many sub-categories it has.

A
  1. It belongs to the Respond function

2. It contains 5 sub-categories

51
Q

Describe which function Mitigation category belongs to and how many sub-categories it has.

A
  1. It belongs to the Respond function

2. It contains 3 sub-categories

52
Q

Describe which function Improvements category belongs to and how many sub-categories it has.

A
  1. It belongs to the Respond function

2. It contains 2 sub-categories

53
Q

Describe which function Recovery Planning category belongs to and how many sub-categories it has.

A
  1. It belongs to the Recovery function

2. It contains 1 sub-categories

54
Q

Describe which function Improvements belongs to and how many sub-categories it has.

A
  1. It belongs to the Recovery function

2. It contains 2 sub-categories

55
Q

Describe which function Communications belongs to and how many sub-categories it has.

A
  1. It belongs to the Recovery function

2. It contains 3 sub-categories

56
Q

What are Tiers?

A

Tiers describe the maturity of an organization with regard to management of Cyber security risk.

57
Q

How many Tiers are there?

A

4

58
Q

What are the Tier ratings?

A
  1. Partial
  2. Risk Informed
  3. Repeatable
  4. Adaptive
59
Q

What is a NCSF Framework Profile?

A

A NCSF Framework Profile represents the cyber security outcomes based upon business needs that an organization has selected from the Framework Categories and Subcategories.

60
Q

What is the purpose of NCSF Framework Profiles?

A

To identify opportunities for improving cyber security posture by comparing a “Current” profile to a “Target” profile.

They can be used to conduct self- gap analyses.

61
Q

What is the NCSF Implement or Improvement methodology?

A
  1. Prioritize
  2. Orient
  3. Create Current Profile
  4. Conduct Risk Assessment
  5. Create Target Profile
  6. Determine Analyze & Priortize Caps
  7. Implement Action Plan
62
Q

What is a Controls Factory?

A

A concept used to help organize the engiineering, technical and business functions of a NIST cyber security program.

1.0 nist frameworks (16 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions