3. Information Security Program Development & Management Flashcards
(45 cards)
Name the two common Enterprise Architecture Framework
The Open Group Architecture Framework (TOGAF) and the Zachman Framework
What are the key elements of TOGAF
Business-driven, life-cycle management framework for enterprise architecture
Multiple phases starting with Preliminary, Vision Business Architecture, Technology Architecture, Oppurtunites and solutions, migration planning, governance, etc.
What is unique about Zachman Framwork
Similar to office building architecture. Starts with high-level and then increasingly detail.
Does not convey the relationship between IT Systems. Data Flow diagrams are used instead.
What are the components of ISACA’s Risk-IT Framework
Risk Governance - includes integrating with organizations ERM
Risk Evaluation
Risk Response
T or F a vulnerability ranking is influenced by probability of that threat will be realized and the asset value
False - a vulnerability ranking should depend on whether the threat will actually bring about harm to the asset.
T or F that Asset Value is always the replacement value
False - usually but now always
What is the financial loss that results from the realization of a threat expressed in percentage of the assets totals value
Exposure Factor (EF)
Most threats do not completely eliminate the asset value but instead reduce it.
SLE represents what?
Single loss expectancy is the value when the threat is realized one time.
AV X EF - SLE
What is the term for the estimate of the number of times that a threat will occur per year
Annual Rate of Occurrence
1 in 10 is 10%
1 in 50 is 2%
ALE is ?
Annualized loss expectancy
SLE X ARO = ALE
What is some Risk Analysis Standards
NIST 800-30
ISO/IEC 27005
Who is the best person (s) to make a decision on risk treatment
Security steering commitee
T or F being compliant is the same as being secure
False
Compliance is a checkbox starting point
What is another name for span port
Network Tap
What are the 3 types of controls
Physical
Technical
Administrative
What are some examples of Preventative Controls
Login Screens
Keycard screens
Encryption
What are some examples of Detective Controls
Video Surveillance
Event Logs
What are some examples of Deterrent Controls
Guard Dogs
Warning Signs
Visible Video Surveillance
Note: Deterrent controls only work if they are known by potential vioalator
What are some examples of corrective controls
any act of improving an process when found defective
An example of a compensating control
Guest Sign in register when there is no stronger detective control such as surveillance
An example of a recovery control
use of a tool to remove malware or backup software to recover lost or corrupted files
What is the purpose of Security Governance
Provide management with visibility and control of security program
What is a key difference between IPS and Firewalls from an inspection standpoint?
IPS inspect full packet while firewalls inspect headers
What should be developed first:
Procedures
Standards
Processes
or Policies
Policies since they govern behavior in an organization and should be developed first. Then process and procedures that align with policies can be developed. Standards which specific how policies can be implemented can be developed in conjunction
