Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Cybersecurity Architecture & Engineering - D488 > Section 1 - Secure Architecture for GRC > Flashcards

Section 1 - Secure Architecture for GRC Flashcards

1
Q

GRC stands for

A

Governance, Risk, Compliance

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Cyclical process of identifying, assessing, analyzing and responding to risks

A

Risk Management

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

The comprehensive process of evaluating, measuring, and mitigating the many risks that pervade an orginization

A

Enterprise Risk Management

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What is NIST Framework for Risk Management

A

RMF ISO 31000
Comprehensive set of standards for enterprise risk management

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What are the 5 phases of Risk Management?

A
  1. Identification of mission critical functions
  2. Identification of known vulnerabilities
  3. Identification of potential threats
  4. Analysis of Business Impacts
  5. Identification of Risk responses
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

How do you measure Risk

A

Risk is a measure of impact or consequence

the variables are likelihood and impact

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

List of Quantitative Risk Variables

A

Single Loss Expectancy - cost of single event

Annual Rate of Occurrence (ARO) # of times in a year that the single loss occurs

Annual Loss Expectancy -
ALE - SLE x ARO

Asset Value (AV) - value of an asset such as a server

Exposure Factor (EF) % of the AV that would be lost. part of a building is damaged

SLE = AV x EF

Also know
TCO, ROI, MTTR, MTBF

Gap Analysis - difference between current state and desired state - for scoping purposes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What is the risk that exists before any type of mitigation has been implemented?

A

Inherent Risk

Website are inherently risky due to attack vectors

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What is the Residual Risk

A

Risk that remains after controls are put in place

Know what Risk appetites is based on tolerance of organization.

also note that acceptance risk and residual risk are not always equivalent

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What is a popular Cybersecurity Framework widely adopted in the US

A

NIST CSF
1. Identify
2. Protect
3. Detect
4. Respond
5. Recover

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What Steps do NIST CSF require when performing risk management

A
  1. Prioritize and Scope
  2. Orient
  3. Create a Current Profile
  4. Conduct a Risk Assessment
  5. Create a Target Profile
  6. Determine, Analyze & Prioritize Gaps
  7. Implement Action Plan
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What are the NIST Risk Management Frameworks steps (RMF)

A
  1. Prepare
  2. Categorize
  3. Select
  4. Implement
  5. Assess
  6. Authorize
  7. Monitor
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Name 3 other RMF and Provide details

A

ISO 3100 or 31K - International and very comprehensive

COBIT maintained by ISACA
5 Major Components
1. Framework 2. Process Descriptions
3. Control Objectives, 4. Management Guidelines 5. Maturity Models

Committe of Sponsoring Organizations of the Treadway Commission (COSO)
initiative of 5 private sector organizations. Enterprise Risk Managment from a strategic leadership point of view

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What is the Risk Management LIfecycle

A

Identify Risk Items
Assess risks and their associated level
Control - minimize risk
Review - periodic re-evaluation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What are key ingredients to understanding control categories

A

People
Process
Technology

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What is a formal mechanism designed to measure performance of a program against a desired goal

A

Key Performance Indicators (KPI)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What is the method by which emerging risks are identified and analyzed so that changes can be adopted to proactively avoid issues from occurring

A

Key Risk Indicators (KRI)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What framework standard did Risk Registers originate from

A

ISO 27001
An effective visualization of identified risks and information about mitigating the controls.

Risk Item, Threat, Impact, Likelihood, Plan, Risk Level

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What is the difference between Risk Appetite and Risk Tolerance

A

Appetite is often prescribed via regulation and addresses how an organization will address risks while Tolerance is the threshold that separate different levels of risks

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Name a Trade Off Analysis developed by a University

A

Architecture Tradeoff Analysis Method (ATAM) developed by SEI at Carnegie Mellon

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What is the term for putting a vendors source does in a 3rd party in case of a cease of business

A

Source Code Escrow

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What is the term for how all vendor hardware, software and services are produced and delivered as well as how they impact an organizations operation or finished products

A

Supply Chain Visability

21
Q

Name the Data Types

A

PII - personally identifiable Information

Protected Health Information (PHI)

Personally Identifiable Financial Information (PIFI)

Intellectual Property (IP)

22
Q

What is a Data Owner within an organization

A

A Senior Executive role with ultimate responsibility for maintaining CIA on an asset

23
Q

What is the process of applying confidential and privacy labels to information and some common levels

A

Data Classification

Public - no negative impact
Sensitive - negative impact
Confidential - considerable harm

24
Q

What type of data destruction technique would be best for cloud data

A

Crypto Erase - type of sanitization of the keys used to perform decryption of data make recovery effectively impossible

25
Q

Type of sanitization of data where you perform multiple block-level overwrite cycles

A

Clear
Clean room can Potentially recover

26
Q

What type of sanitization is effective from all recovery techniques including clean rooms

A

Purge

27
Q

What is the data protection princile where the underlying country or state may impose individual requirements on data collected or stored within their jurisdiction

A

Data Sovereignty

Switzerland is popular due to their unique protective privacy laws

28
Q

What is a set of policies, contracts and standards identified as essential in the agreement between two parties

A

Attestation of Compliance (AOC)

29
Q

Compare Regulations vs Standards in context of compliance

A

Regulations describe legal requirements and ramifications and the details of the of compliance are typically provided in prescriptive/descriptive form within a standard

30
Q

What was the security program that was required for US Federal Agencies detailed in and what agency provides the standards

A

Federal Information and Security Modernization Act (FISMA) - detailed piece of legislation

NIST - 800-53 and FIPS 199

31
Q

T or F COPPA is only enforceable within the US

A

False
Under the age of 13

32
Q

What is the privacly model that has 5 levels

A

Capability Maturity Model Integration (CMMI)
1. Initial
2. Managed
3. Defined
4. Quantitative Managed
5. Optimizing

33
Q

Describe Certification vs Accreditation from who owns the systems

A

Certification can be associated with system builders and documents that their system meets the requirements where Accreditation is for system owners acceptance of this claim which the system can go live.

34
Q

What are the 4 phases of C&A

A

Initiation and Planning
Certification
Accreditation
Continuous Monitoring

35
Q

Who within the organization is responsible for implementing security policies, frameworks, and controls

A

Information System Security Officer

36
Q

What entity can provide accreditation and what do they provide when completed

A

Certifying Authority. - responsible for reviewing the results of a certification and accreditation package

Authority to Operate (ATO)

37
Q

What is the set of standards developed by a group of governments working together to create a baseline of security assurance for Trusted OS

A

Common Criteria
Outlines in ISO Standard 15408

38
Q

When it comes to jurisdiction where should your report an incident first (Local, State, National, International)

A

Local law enforcement first and they will involve other agencies

39
Q

Describe Due Care vs Due Dilligence

A

Due care is demonstrating response to security issues and due diligence is demonstrating awareness of security incidents.

Due care references the prudent man rules - reasonable and expected

Due diligence - legal principle that a subject has used best practices

40
Q

What is the export control that was established in 1996

A

Wassenaar Agreement - weaponry

41
Q

Name the common legally enforceable documents

A

MSA - Umbrella with indiv SOW
NDA
MOU - memo of understanding - non binding

Interconnection Security Agreement (ISA) - share data via an interface

SLA - terms under which a service is provided

Operational-Level Agreement (OLA) - these are internal to meet the SLA

Privacy Level Agreements - between CSP and goes beyond SLA

42
Q

How long should HIPAA Data base stored from compliance

A

6 Years

43
Q

What are the ISO 27K standards for Cloud

A

27017/27018

44
Q

What is the privacy act of Japan

A

Act on Protection of Personal Information (APPI)

45
Q

Which NIST Publication addresses BCP

A

NIST 800-34
1. Develop the continuity planning policy statement
2. Conduct the BIA
3. Identify Preventive Measures
4. Create Contingency Strategies
5. Develop an information system contingency plan
6. Ensure Plan testing, training and exercises
7. Ensure Plan Maintenance

46
Q

T or F a DRP is part of BCP

A

True - just focused on immediate needs of a disaster. Critical Systems only

47
Q

What is the analysis of assessing all of the elements that can have impact on Information Systems

A

Business Impact Analysis

48
Q

What needs to be completed to accurately disclose how privacy data is handled and for it to be in compliance with regulations

A

Privacy Impact Assessment

49
Q

An Analysis of events can provide insight into how to improve response process in the future is called

A

Ater Action Report (AAR) also can be called Lessons Learned

Can be a blueprint for improvement

50
Q

List the BCDR Simulation Tests

A

Checklists - delivered to all departments for review only

Walk-Through - all departements participate to review the plans and analyze their effectiveness

Tabletop - designed to evaluate the procedures in place to responding to an incident. Based on a specific objective

Parallel Test -

Full Interruption Test

51
Q

Which NIST Publication identifies appropriate groups that should be part of an incident response plan

A

NIST 800-61

52
Q
A

Cybersecurity Architecture & Engineering - D488 (4 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions