107 Cyber Security Flashcards
(30 cards)
Define Information Assurance (IA)
Measures that protect and defend information and information systems by ensuring their availability, integrity, authentication, confidentiality, and non-repudiation.
Define Defensive Cyberspace Operations (DCO)
Missions are executed to defend the DODIN, or other cyberspace DOD cyberspace forces have been ordered to defend, from active threats in cyberspace
Define Offensive Cyberspace Operations (OCO)
Missions intended to project power in and through foreign cyberspace through actions taken in support of CCDR or national objectives.
107.2 Define Certification
comprehensive evaluation of the technical and non-technical security safeguards of an information system that establishes the extent to which a particular design and implementation meets a set of specific security requirements.
107.2 Define Accreditation
a process in which certification of competency, authority, or credibility is presented.
107.2 Define DAA
the Designated Approving Authority, is the official with the authority to formally assume responsibility for operating a system at an acceptable level of risk.
107.2 Define System Security Plan
the purpose of the system security plan (SSP) is to provide an overview of the security requirements of the system and describe the controls in place or planned responsibilities and expected behavior of all individuals who access the system.
107.2 Define ATO
Authorization to Operate, the official management decision issued by a DAA or authorize operation of an information system and to explicitly accept the residual risk to agency operations.
107.2 Define IATO
an Interim Authorization to Operate (IATO), is the temporary authorization granted by a DAA for an information system to process information based on preliminary results of a security evaluation of the system.
107.2 Define Configuration Management
management of security features and assurances through control of changes made to hardware, software, firmware, and documentation, test, test fixtures, and test documentation throughout the life cycle of an information system.
107.3 Discuss security procedures involved when performing cross-domain transfers.
In addition to command specified required training, transferring of files from a lower classification to a higher classification requires malware scanning of the source files, but is not limited to the type of file being transferred. From higher classification down however, the files MUST be converted to a .txt document and ran through a buster tool designed to look for key words to enable the user to safely transfer information without leaking potentially classified documents. Also, the user and a subject matter expert need to go through any document being transferred down to ensure that no potentially dangerous material is spilled onto an unclassified host.
107.4 Discuss Risk Management
Process of managing risks to agency operations (including mission, functions, image, or reputation), agency assets, or individuals resulting from the operation of an information system. The process considers effectiveness, efficiency, and constraints due to laws, directives, policies, or regulations.
107.5 Define the five attributes of IA
a. Confidentiality: is assurance that information is not disclosed to unauthorized individuals, processes, or devices.
b. Integrity: is assurance that information is not modified by unauthorized parties or in an unauthorized manner.
c. Availability: is assurance of timely, reliable access to data and Information Systems by authorized users. Availability-focused IA controls protect against degraded capabilities and denial of service conditions.
d. Non-repudiation: is assurance that the sender of data is provided with proof of delivery and the recipient is provided with proof of the sender’s identity, so neither can later deny having processed the data.
e. Authentication: is assurance of the identity of an e-mail message sender or receiver is who they claim they are.
107.7 Describe the DON World Wide Web Security Policy.
Provides primary governing policy for all unclassified DOD WWW sites to prevent the release of classified information.
Define: Information Assurance Vulnerability Alerts (IAVA)
address severe network vulnerabilities resulting in immediate and potentially severe threats to DON systems and information.
Define: Information Assurance Vulnerability Bulletins (IAVB)
address new vulnerabilities that do not pose an immediate risk to DON systems but are significant enough that noncompliance with the corrective action could increase the risk.
Define: Computer Tasking Order (CTO)
a formal tasking order that contains detailed guidance and missions for each component to accomplish.
Define: NTD (Navy Telecommunications Directive)
a formal tasking order that contains guidance for official Navy communication circuits.
Define: NIA/NIB/OIA/OIB
NMCI Information Advisory, NMCI Information Bulletin, Overseas Navy Enterprise Network Advisory, Overseas Navy Enterprise Network Bulletin
Define: Patch
Updates, fixes and/or enhancements to a software program delivered in the form of a single installable package.
107.9 Define vulnerability assessment
Systematic examination of an information system or product to determine the adequacy of security measures, identify security deficiencies, provide data from which to predict the effectiveness of proposed security measures, and confirm the adequacy of such measures after implementation.
107.10 Explain the difference between vulnerability and threat
- Vulnerability: Weakness in an IS, system security procedures, internal controls, or implementation that could be exploited.
- Threat: Any circumstance or event with the potential to adversely impact an IS through unauthorized access, destruction, disclosure, modification of data, and/or denial of service.
107.11 State the duties and responsibilities of the ISSM and ISSO.
The Information Systems Security Manager/Officer: Is the individual responsible to the Commanding Officer for the proper execution of an effective IA program for their system or site. The ISSM is designated in writing by the CO and is overall in charge of and responsible for the network, its security, as well as any training requirements to ensure the safety of the network, its systems, and its users.
107.12 Explain CSWF Specialty Codes and responsibilities
Personnel must meet and maintain the minimum qualification standards of their assigned Specialty Area/Work Role and proficiency level.
