Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CISSP > Governance > Flashcards

Governance Flashcards

1
Q

What is defense in depth?

A

Layering of security measures to provide “overlapped” security.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What is the difference in series and parallel when layering?

A

Parallel leaves gaps that can be exploited.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What is abstraction when securing data?

A

Grouping things together for efficiency.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What is used when hiding data?

A

Preventing discovery by unauthorized subjects. Can be done by positioning data in containers not accessible by certain subjects.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What is the definition of encryption?

A

Art or Science of hiding the meaning or intent of an Object from unintended Subjects.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Name some elements of Privacy.

A

Prevention of unauthorized access to information that is PII.
Freedom from unauthorized access to information deemed personal or confidential.
Freedom from being observed, monitored, or examined without consent/ knowledge.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What does COBIT stand for?

A

Control Objectives for

Information and Related Technology

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What are the 5 elements of COBIT?

A
  1. Meet stakeholder needs
  2. Covering Enterprise E2E
  3. Apply single, integrated framework
  4. Enable holistic approach & principle.
  5. Separate governance from management.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What is Due Care?

A

Use of reasonable care to protect interests.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What is Due Diligence?

A

The practices required to maintain Due Care.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What is the CIA Triad?

A

Confidentiality
Integrity
Accountability

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What does Confidentiality mean?

A

High level of assurance that objects and/ or resources are restricted from unauthorized Subjects.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What can cause a loss of confidentiality?

A

Failure to encrypt transmissions
Failure to properly authenticate Subjects.
Failure of an end user or administrator.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What is Integrity?

A

The ability to ensure that only authorized Subjects can intentionally modify and Object

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What can be done to ensure integrity?

A

Logging & Monitoring

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What are some risks to integrity?

A

Viruses, worms, and back doors.

17
Q

What is the definition of availability?

A

Availability means that authorized Subjects can access an Object in a timely and uninterrupted manner.

18
Q

What are some example of a loss of availability?

A

hardware failure, power loss, or DDOS attack.

19
Q

Name other security concepts (non CIA Triad)

A

Identification - Subject professing identity
Authentication - Validating claimed identity
Authorization - allowing a Subject to access an Object.
Auditing - Holding a Subject accountable.
Accountability - Proof of identity

20
Q

What is non repudiation?

A

Ensures the Subject cannot deny an event or the occurrence of an event.

21
Q

What is essential for accountability?

A

non repudiation

22
Q

What is a security policy?

A

Document(s) that define the scope of security needed by an organization.

23
Q

What should be included in a security policy?

A

Assign responsibilities, define roles, specify audit requirements, and outline enforcement processes.

24
Q

What are some different security “sub” policies?

A

Organizational - Org centric
Issue - lower level areas (networks, servers…)
Regulatory - Legal, statutory
Advisory - What is acceptable and unacceptable.

25
Q

What is a security baseline?

A

basic level of compliance.

26
Q

What is the ITSEC

A 
Information
Technology
Security 
Evaluation
Criteria
27
Q

What is a security procedure?

A

Step by step guide to implement a security policy.

28
Q

What is the objective of change management?

A

Ensure that a change does not reduce or compromise security.

29
Q

What are some elements of change control?

A
  • Implement changes in a controlled and monitored fashion.
  • Formalized testing.
  • Changes can be reversed
  • Users are informed of changes in advance.
  • Effects of changes are analyzed.
  • Minimize negative effects.
30
Q

What is data classification?

A

Protection of data based on its sensitivity, secrecy, or confidentiality.

31
Q

What are some criteria used to classify data?

A

Usefulness, timeliness, value or cost, maturity, lifespan, data disclosure damage, national security.

32
Q

What are the major steps to implement data classification?

A
  1. Identify custodian.
  2. Specify evaluation criteria.
  3. Classify and label each element
  4. Document exceptions
  5. Select controls to implement
  6. Specify the de-classification process
  7. Create an enterprise wide awareness
33
Q

What are the 5 levels of government/ military data classification from highest to lowest.

A
  1. Top Secret
  2. Secret
  3. Confidential
  4. Sensitive but unclassified
  5. unclassified
34
Q

What are the levels of commercial data privacy from highest to lowest?

A
  1. Confidential
  2. Private
  3. Sensitive
  4. Public

CISSP (9 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions