Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CISSP > Chapter 2: Personnel Security and Risk Management Concepts > Flashcards

Chapter 2: Personnel Security and Risk Management Concepts Flashcards

1
Q

UBA/UEBA

A

User Behavior Analytics/User and Entity Behavior Analytics
Analyzing the behavior of users, subjects, visitors, customers, etc for some specific goal or purpose

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

SLA

A

Service Level Agreement
Ensures that organizations providing services maintain an appropriate level of service agreed upon by both service provider and customer

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

VMS

A

Vendor Management System

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Risk Management

A

Process of identifying factors that could damage or disclose data, evaluating those factors in light of data value and countermeasure cost, and implementing cost-effective solutions for mitigating or reducing risk

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What is the primary goal of risk management?

A

To reduce risk to an acceptable level

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Asset

A

Anything (person, place, or thing) used in a business process or task whether tangible or intangible

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Asset Valuation

A

Value assigned to asset based on multiple factors such as importance to organization, use in critical process, actual cost, etc

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Threats

A

Any potential occurrence that may cause undesirable/unwanted outcome for an organization or specific asset. Could cause damage, destruction, alteration, loss, disclosure

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Threat Events

A

Accidental occurrences and intentional exploitations of vulnerabilities. Can be natural or man-made

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Exposure

A

Being susceptible to asset loss because of a threat. The possibility that a vulnerability can or will be exploited by a threat agent or event

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Risk

A

Possibility or likelihood that a threat will exploit a vulnerability to cause harm to an asset and the severity of damage that could result

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

How is risk calculated?

A

Risk = Threat x Vulnerability
or
Risk = Probability of Harm x Severity of Harm

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What is a primary goal of risk analysis?

A

To ensure that only cost-effective safeguards are deployed

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Hybrid Assessment/Analysis

A

Combines quantitative and qualitative analysis into a final assessment of organizational risk

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Delphi Technique

A

An anonymous feedback-and-response process used to arrive at a consensus. This consensus gives the responsible parties the opportunity to properly evaluate risks and implement solutions.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Quantitative Risk

A

Focuses on hard values and percentages
Complete quantitative analysis is not always possible because of intangible aspects of risk

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

EF

A

Exposure Factor
Represents the percentage of loss that an org would experience if a specific asset were violated by a realized risk. Also called loss potential.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

SLE

A

Single Loss Expectancy
Potential loss associated w/ a single realized threat against an asset. Indicates potential amount of loss org would/could experience if an asset was harmed by a specific threat.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

How is SLE calculated?

A

SLE = AV x EF
AV= Asset Value
EF= Exposure Factor

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

ARO

A

Annualized Rate of Occurrence
Expected frequency with which specific threat or risk will occur

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

ALE

A

Annualized Loss Expectancy
Possible yearly loss of all instances of a specific realized threat against a specific asset

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

How is ALE calculated?

A

ALE = SLE x ARO
SLE = Single Loss Expectancy
ARO = Annual Rate of Occurrence

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Risk appetite

A

Total amount of risk that an org is willing to shoulder across all assets

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Risk capacity

A

Level of risk an org is ABLE to shoulder

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

Risk limit

A

Max level of risk above the risk target that will be tolerated before further risk management actions are taken

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

Risk mitigation

A

Risk reduction via security controls, countermeasures, etc

27
Q

Risk assignment

A

Transferring risk to another entity or org. Purchasing insurance, outsourcing, etc

28
Q

Risk deterrence

A

Goal is to convince threat agent not to attack. Auditing, security cameras, warning banners, etc

29
Q

Risk avoidance

A

Process of selecting alternate options or activities that have less risk

30
Q

Risk acceptance

A

Result of cost/benefit analysis showing countermeasure costs would outweigh possible cost of loss due to a risk

31
Q

Risk rejection

A

Ignoring the risk. Unacceptable response.

32
Q

Residual Risk

A

risk that remains after safeguards, security controls, etc are implemented

33
Q

Total Risk

A

amount of risk an org would face if no safeguards implemented

34
Q

How is total risk calculated?

A

Threats x Vulnerabilities x Asset Value = Total Risk

35
Q

How is residual risk calculated?

A

Total Risk - Controls Gap = Residual Risk

36
Q

Controls Gap

A

Amount of risk reduced by implementing safeguards

37
Q

ACS

A

Annual Cost of Safeguard
Should be less than ALE otherwise not cost effective

38
Q

Cost/Benefit Analysis

A

Determining whether a safeguard actually improves security without costing too much

39
Q

What is the formula for safeguard evaluation?

A

(ALE1 - ALE2) - ACS
ALE1 = ALE Before Safeguard
ALE2 = ALE After Implementing Safeguard
ACS = Annual Cost of Safeguard

40
Q

Directive Control

A

Deployed to direct the actions of subjects to force or encourage compliance with security policies

41
Q

SCA

A

Security Controls Assessment
Formal evaluation of a security infrastructure’s individual mechanisms against a baseline or reliability expectation

42
Q

ERM

A

Enterprise Risk Management program

43
Q

RMM

A

Risk Maturity Model
Means to assess the key indicators and activities of a mature, sustainable, and repeatable risk management process

44
Q

What are the RMM levels?

A

Ad Hoc
Preliminary
Defined
Integrated
Optimized

45
Q

RMM- Ad Hoc

A

Chaotic starting point

46
Q

RMM- Preliminary

A

Loose attempts made to follow risk management process

47
Q

RMM- Defined

A

common or standardized risk framework is adopted organization-wide

48
Q

RMM- Integrated

A

Risk management operations integrated into business processes, metrics used to gather effectiveness data, risk is considered an element in business strategy decisions

49
Q

RMM- Optimized

A

Focuses on achieving objectives rather than just reacting to external threats. Increased strategic planning geared towards business success rather than just avoiding incidents. Lessons learned reintegrated into risk management process

50
Q

What are the differences between NIST RMF and CSF?

A

Both are US Gov guides for establishing and maintaining security
CSF is for critical infrastructure and commercial organizations
RMF establishes mandatory requirements for Federal agencies

51
Q

ISO 31000

A

Risk Management Guidelines
High level overview of risk management

52
Q

Authority

A

Social engineering principle; convince target the attacker is someone with valid internal or external authority

53
Q

Intimidation

A

Social engineering principle; focused on exploiting uncertainty

54
Q

Consensus

A

Social engineering principle; aka social proof. Taking advantage of a person’s natural tendency to mimic what others are doing or have done in the past

55
Q

Scarcity

A

Social engineering principle; convince someone an object has a higher value based on only a few being left or made

56
Q

Familiarity

A

Social engineering principle; impersonating a known entity

57
Q

Trust

A

Social engineering principle; attacker builds relationship with victim then exploits that relationship

58
Q

Urgency

A

Social engineering principle; claims the need to act quickly

59
Q

Pretext

A

False statement crafted to sound believable in order to convince you to act or respond in favor of the attacker

60
Q

Prepending

A

Adding a term, expression, or phrase to the beginning or header of some other communication. Using header modification to fool filters, or adding RE or INTERNAL to an email to make it look legit

61
Q

Drive-By Download

A

Type of malware that installs itself without user knowledge when they visit a website. Takes advantage of vulnerabilities in browsers or plug ins

62
Q

BEC

A

Business Email Compromise
Focused on convincing members of accounting or financial department to transfer funds or pay invoices based on instructions that claim to be from a boss, manager, or executive
AKA CEO Fraud or CEO Spoofing

63
Q

Security Champion

A

Often a member of a group who decides (or is assigned) to take charge of leading the adoption and integration of security concepts into the group’s work activities.
Security champions are often non-security employees who take up the mantle to encourage others to support and adopt more security practices and behaviors.

CISSP (9 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions