Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CISSP2020 > Domain 1 - Security and Risk Management > Flashcards

Domain 1 - Security and Risk Management Flashcards

1
Q

Administrative, Physical, and Technical controls

A

Three categories of access controls

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Technical Control

A

Protects access to systems, network architecture, control zones, auditing, and encryption and protocols (Access Control categories). AC category that restricts access.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Administrative Control

A

Dictates how security policies are implemented to fulfill the company’s security goals. Includes policies, procedures, personnel controls, supervisory structure, security training, and testing. Includes policies and procedures, personnel controls, supervisory structure, security training, and testing (Access Control category).

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Physical Control

A

Access control category that includes badges, locks, guards, network segregation, perimeter security, computer controls, work area separation, backups, and cabling; used to secure physical access to an object, such as a building, a room, or a computer (access control category).

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Preventive control

A

Prevents security breaches and avoids risks.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Detective control

A

Looks for security breaches as they occur.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Corrective control

A

Restores control and attempts to recover from any damage that was inflicted during a security breach.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Deterrent control

A

Stops potential violations.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Recovery control

A

Restores resources.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Compensative control

A

Provides an alternative control if another control may be too expensive. All controls are generally considered this type of control.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Directive controls

A

Provides mandatory controls based on regulations or environmental requirements.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Recovery-Technical control

A

Restores system capabilities and covers data backups.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Detective-Technical control

A

Detects when a security breach occurs; covers audit logs and intrusion detection systems (IDS).

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Corrective-Technical control

A

Corrects any issue that arises because of security breaches; Antivirus software and server images are included in this category.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Compensative-Technical control

A

Considered an alternative to other controls (example, server isolation).

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Preventative-Technical control

A

A router plus encryption used to improve network security.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Deterrent, Preventive, Detective, Compensative, Corrective, Recovery, and Directive.

A

Access control types (types, not categories).

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Preventative control measures

A

Security awareness training, Firewalls, Anti-virus, security guards, and IPS.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Detective control measures

A

System monitoring, IDS, Anti-Virus, motion detector, IPS.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Corrective control measures

A

OS upgrade, backup data rostral, Anti-virus, vulnerability mitigation.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Compensatory control measures

A

Backup generator, hot site, server isolation.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

To prevent the threat from coming into contact with the weakness.

A

Purpose for Preventative controls.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

To identify that a threat has landed in a system.

A

Purpose for Detective controls.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

To mitigate or lesson the effects of the threat that has manifested.

A

Purpose for Corrective controls.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

ISO/IEC 27000

A

ISO/IEC standard on developing and maintaining information security management systems (ISMS).

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

Zachman Framework

A

An enterprise schema with two dimensional classification: six questions and six views intersecting in a matrix (what, how, where, who, when, why + planner, owner, designer, builder, programmer, users). This framework is NOT security orientated; it is used to relay information for personnel in a common language that is helpful to different groups in understanding each group’s responsibilities.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

TOGAF (The Open Group Architecture Framework)

A

An enterprise framework that helps organizations design, plan, implement, and govern enterprise information architecture. Its four domains are technology, applications, data, and, business.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

DoDAF (Department of Defense Architecture Framework)

A

Architect framework with 8 viewpoints used to ensure DoD technologies integrate correctly with current infrastructures.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

All Viewpoint (AV); Capability Viewpoint (CV); Data and Information Viewpoint (DIV); Operation Viewpoint (OV); Project Viewpoint (PV); Services Viewpoint (SvcV); Standards Viewpoint (STDV); and Systems Viewpoint (SV).

A

The eight views of the DoDAF

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

MODAF (British Ministry of Defense Architecture Framework)

A

An Architecture Framework which divides information into seven views points.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

SABSA (Sherwood Applied Business Security Architecture)

A

An enterprise security architecture, which asks six communication questions that intersect with six layers; it is a a risk-driven architecture. The six layers of questions include: What, Where, When, Why, Who, and How. These question layers intersect with six additional layers: Operational, Component, Physical, Logical, Conceptual, and Contextual.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

CobiT (Control Objectives for Information and Related Technology)

A

A security controls development framework documenting five principles, which drive control objectives of seven enablers: Meeting stakeholder needs; Steering the enterprise end-to-end; Applying a single integrated framework; Enabling a holistic approach; Separating and governance from management. The seven enablers include: Principles; Policies, and frameworks; Processes; Organizational structures; Culture, ethics, and behaviors; Information; Services, infrastructure, and applications; and People, skills, and competencies.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

Meeting stakeholder needs; Steering the enterprise end-to-end; Applying a single integrated framework; Enabling a holistic approach; Separating and governance from management.

A

Five principles of CobiT

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

Principles, Policies, and frameworks; Processes; Organizational structures; Culture, ethics, and behaviors; Information; Services, infrastructure, and applications; and People, skills, and competencies.

A

Seven enablers of Cobit

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

Downstream Liabilities

A

When you outsource a system - you can outsource responsibility but you cannot outsource accountability

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

What is Due Care?

A

Setting and enforcing policy to bring organisation into compliance.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

What does IAAA stand for?

A

Identification, Authentication, Authorization, Accountability

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

What is the difference between Authentication and Authorization?

A

Authentication is using your password to access a file which you have permissions (Authorization) to access.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

What is a control?

A

A control or countermeasure is put into place to mitigate (reduce) the potential risk. It’s PREVENTATIVE.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
40
Q

What is Strategic Alignment?

A

Strategic Alignment means that business drivers and the regulatory and legal requirements are being met by the security enterprise architecture.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
41
Q

What does Security Effectivenes deal with?

A

Security Effectiveness deals with metrics, SLA requirements, achieving ROI, meeting set baselines etc.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
42
Q

What is a Computer Assisted Crime?

A

Computer Assisted Crime is where a computer was used as a tool to help carry out a crime.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
43
Q

What is a Computer Targetted Crime?

A

A Computer Targetted Crime occurs when a computer is the victim of an attack crafted to harm it and its owners specifically.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
44
Q

What is a Computer Incidential Crime?

A

Where a computer happens to have been part of the crime, but did not assist the criminal and was not the victim.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
45
Q

In GDPR, who is the Data Subject?

A

The Individual to whom the data pertains

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
46
Q

In GDPR, what is the Data Controller?

A

Any organization that collects data on EU residents

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
47
Q

In GDPR, what is the Data Processor?

A

Any organization that processes datra for a data controller

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
48
Q

What is the Concent provision for GDPR?

A

Data Collectors and Data Processors cannot use personal data without explicit consent of the data subjects

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
49
Q

What is the Right to be Informed provision for GDPR?

A

Data Controllers and Data Processors must inform data subjects about how their data is, will, or could be used.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
50
Q

What is the Right to Restrict Processing provision for GDPR?

A

Data Subjects can agree to have their data stored by a collector but disallow it to be processed.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
51
Q

What is Right to Be Forgotten provision for in GDPR?

A

Data Subjects can request that their personal data be permanently deleted.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
52
Q

What is the Data Breaches provision for in GDPR?

A

Data Controllers must report a data breach within 72 hours of becoming aware of it.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
53
Q

What is a Trade Secret?

A

A Trade Secret is something that is proprietary to a company and important for it’s survival and profitability.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
54
Q

What is a Copyright?

A

Copyright Law protects the right of the creator of an original work to control the public distribution, reproduction, display and adaptation of that original work.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
55
Q

What is a Trademark?

A

A Trademark is slightly different from a copyright in that it is used to protect a word, name, symbol, sound, shape, color etc.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
56
Q

What is a Patent?

A

Patents are given to individuals or companies to grant them legal ownership of, and enable them to exclude others from using or copying, the invention covered by the patent.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
57
Q

What is the strongest form of intellectual property protection?

A

A patent

58
Q

What is an Issue-spesific policy?

A

Also called a functional policy, addresses spesific security issues that management feel need more detailed explanation and attention.

59
Q

What is a System-Spesific Policy?

A

Spesific to the actual computers, networks, applications.

60
Q

What types of Policies are there?

A

Regulatory, Advisory, Informative

61
Q

What is a Standard?

A

Standard refer to mandatory activities, actions or rules. Standards can give a policy its support and reinforcement in direction.

62
Q

What is a Procedure?

A

Procedures are detailed step-by-step tasks that should be performed to achieve a certain goal.

63
Q

What can declare a Disaster and Emergency?

A

Anyone can declare an emergency, only the BCP coordinator can decalre a disaster. (Anyone can pull the fire alarm or trigger an emergency alarm. Only the BCP coordinator or someone specified in the BCP can declare disaster which will then trigger failover to another facility).

64
Q

Regulatory, Advisory, Informative are examples of

A

Policies

65
Q

MTD/MTO: Maximum Tolerable Downtime/Outage

A

Longest time the function can be inoperable because causing a loss to senior management that is unacceptable

66
Q

RTO Recovery Time Objective

A

This is the amount of time in a which you can easily recover the function in the even of a disruption (must be less than MTD)

67
Q

RPO Recovery Point Objective

A

Tolerance for Data Loss

68
Q

What is the different between Business Impact Assessment and Risk Assessment?

A

Business Impact Assessment is focused on assets and how important they are to the business where as Risk Management is the same but includes vulnerabilities and likelihood.

69
Q

How do you calculate Total Risk?

A

Asset Value * Probability * Impact = Total Risk

70
Q

How do you calculate Residual Risk?

A

Total Risk * Controls Gap = Residual Risk

71
Q

What is a Checklist Test?

A

Copies of plan distributed to different departments. No disruption to the business.

72
Q

What is a Structured Walk-Through (Table Top) Test?

A

Representatives from each department go over the plan. Still paper based.

73
Q

What is a Simulation Test?

A

Going through the disaster scenario. Still does not distrupt business.

74
Q

What is a Parallel Test?

A

Systems moved to alternative site, and processing takes place there. This involves risk.

75
Q

What is a Full-Interruption Test?

A

Original Site shut down and all processing moved to offsite facility.

76
Q

What is Layering?

A

Layering (also known as Defense in Depth), is simply the use of multiple controls in a series.

77
Q

What is Abstraction?

A

Abstraction is used for efficiency. Simular elements are put into groups, classes or roles that are assigned security controls, restrictions, or permissions as a collective.

78
Q

What is Data Hiding?

A

Data Hiding is exactly what it sounds like: preventing data from being discovered or accessed by a subject positioning the data in a logical storage compartment that is not accessible or seen by the subject.

79
Q

What is Security Governance?

A

Security Governance is the collection of practices related to supporting, defining, and directing the security efforts of an organisation.

80
Q

What is a Business Case?

A

A business case is usually a documented argument or stated position in order to define a need to make a decision or take some form of action.

81
Q

What is a Strategic Plan (as opposed to Tactical and Operational)?

A

A strategic plan is a long term plan that is fairly stable.

82
Q

What is a Tactical Plan (as oppsed to Strategic or Operational)?

A

The tactical plan is a midterm plan developed to provide more details on accomplishing the goals set forth in the strategic plan or can be crafted ad hoc based upon unpredicted events.

83
Q

What is a Operational Plan (as opposed to Strategic or Tactical)?

A

An Operational Plan is a short-term, highly detailed plan based on the strategic and tactical plans.

84
Q

What is the goal of Change Management?

A

The goal of change management is to ensure that any change does not lead to reduced to compromised security.

85
Q

Who reviews and approves Changes?

A

The Change Advisory Board (CAB).

86
Q

What does the Change Advisory Board do?

A

Review and Approve changes

87
Q

What is Data Classification?

A

Data Classification, or categorization, is the primary means by which data is protected based on its need for security, sensitivity, or confidentiality.

88
Q

What are the levels of government/military classification?

A

Top Secret, Secret, Confidential, Sensitive but unclassified, Unclassified. TO REMEMBER: US CAN STOP TERRORISM

89
Q

What data is Sensitive but Unclassified?

A

Sensitive but Unclassified (SBU) is used for data that is for internal use or for office use only.

90
Q

What are the levels of data classification for the private sector?

A

Confidential, Private, Sensitive, Public

91
Q

What is the difference between confidential and private data?

A

Confidential Data is company data and Private Data relates to individuals.

92
Q

What is the Data Owners responsibilities?

A

The Data Owner role is assigned to the person who is responsible for classifying information for placement and protection within the security solution.

93
Q

What is the Data Custodians responsibilites?

A

Data Custodian role is assigned to the user who is responsible for the tasks of implementing the prescribed protection defined by the security policy and senior management.

94
Q

What is STRIDE?

A

A threat model designed by Microsoft which stands for Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, Elevation of Privilege.

95
Q

What is PASTA?

A

Process for Attack Simulation and Threat Analysis (PASTA) is a seven step threat model

96
Q

What are the steps of PASTA?

A

1) Definition of Objectives 2) Definitions of Technical Scope 3) Application Decomposition and Analysis 4) Threat Analysis 5) Weakness and Vulnerability Analysis 6) Attack Modeling and Simulation 7) Risk Analyusis and Management

97
Q

What is Reduction Analysis?

A

Reduction Analysis is also known as decomposing the application, system, or environment. The purpose of this task is to gain a greater understanding of the logic of the product as well as its interaction with external elements.

98
Q

What are the five key concepts of Reduction Analysis which must be considered?

A

Trust Boundaries, Data Flow Paths, Input Points, Privilege Operations, Details about Security Stance and Approac.

99
Q

In the decomposition process, what is Trust Boundaries?

A

Trust Boundaries are any location where the level of trust or security changes.

100
Q

In the decomposition process, what is Data Flow Paths?

A

Data Flow Paths is the movement of data between locations

101
Q

In the decomposition process, what is Input Points?

A

Input points are locations where external input is received

102
Q

In the decomposition process, what is Privileged Operations?

A

Privileged Operations are any activity that requires greater privileges than that of a standard user.

103
Q

What is DREAD used for?

A

Prioritization and Response

104
Q

What are the considerations of DREAD?

A

Damage Potential, Reproducibility, Exploitability, Affected Users and Discoverability

105
Q

What is Seperation of Duties?

A

Separation of Duties is the security concept in which critical, significant and sensitive work tasks are divided among several individual administrators or high level operators. Prevents one person from having too much control.

106
Q

What is Onboarding?

A

Onboarding is the process of adding new employees to the identity and access management (IAM) system of an organization.

107
Q

What is a Vulnerability?

A

A vulnerability is the weakness in an asset or the absence or the weakness of a safeguard or countermeasure is a vulnerability.

108
Q

What is Exposure?

A

Exposure is being susceptible to asset loss because of a threat, there is the possibility that a vulnerability can or will be exploited by a threat agent or event.

109
Q

How is Risk calculated?

A

Risk = Threat * Vulnerability

110
Q

What are the six major elements of Quantitative Risk Analysis?

A

Assign Asset Valuation (AV)
Calculate Exposure Factor (EF)
Calculate the Single Loss Expectancy (SLE)
Assess Rate of Occurrence (ARO)
Assess Annualized Loss Expectancy (ALE)
Perform Cost/Benifit analysis of Countermeasures

111
Q

What is Asset Valuation (AV)?

A

The monatory value of an asset

112
Q

What is Exposure Factor (EF)?

A

The exposure factor (EF) represents the percentage of loss that an organization would experience if a specific asset were violated by a realized risk.

113
Q

What is the Annualized Loss Expectancy (ALE)?

A

Possible yearly cost of all instances of a specific realized threat against a specific asset.

114
Q

How is Annualized Loss Expectancy (ALE) calculated?

A

ALE = SLE * ARO. ALE = single loss expectancy (SLE) * annualized rate of occurrence (ARO).

115
Q

What does a Safeguard reduce?

A

To reduce ARO

116
Q

How is Single Loss Expectancy (SLE) calculated?

A

SLE = AV * EF. SLE = Asset Value (AV) * Exposure Factor (EF).

117
Q

How do you calculate the value of a safeguard?

A

(ALE1 - ALE2) - ACS (Annual Cost of Safegaurd)

118
Q

What is the Delphi Technique?

A

The Delphi Technique is simply an anonymous feedback and response process used to enable a group to reach an anonymous consensus.

119
Q

In what situation is the Delphi Technique used?

A

In Qualitative Risk Analysis

120
Q

What is Risk Assignment?

A

Assigning or transferring risk is placement of the cost of a loss that a risk represents to a third party. For example, Insurance.

121
Q

What is Risk Deterrence?

A

Risk Deterrence is the process of implementing deterrents to would-be-violators of security and policy.

122
Q

What is Risk Avoidance?

A

Risk Avoidance is the process of selecting alternate options or activities that have less associated risk than the default.

123
Q

What is Risk Rejection?

A

A final but unacceptable possibile response to risk is to reject risk or ignore risk.

124
Q

How is Total Risk calculated?

A

Threats * Vulnerabilities * Asset Value = Total Risk

125
Q

How is Residual Risk calculated?

A

Total Risk - Control Gaps = Residual Risk

126
Q

What are the Six Steps of the NIST RMF (Risk Management Framework)? **

A 
Step 1) CATEGORIZE Information Systems
Step 2) SELECT Security Controls
Step 3) IMPLEMENT Security Controls
Step 4) ASSESS Security Controls
Step 5) AUTHORIZE Information Systems
Step 6) MONITOR Security Controls
127
Q

Once a Business Continuity Planning (BCP) team is selected, what is their first responsibility?

A

To perform an analysis of the business organization to identify all departments and individuals who have a stake in the BCP process.

128
Q

What does MTD stand for?

A

Maximum torable downtime

129
Q

What does Maximum Tolerable Downtime (MTD) mean?

A

Also known as the MTO Maximum Tolerable Outage. This is the maximum time that a business function can be inoperable before causing irreparable harm.

130
Q

What does RTO stand for?

A

Recovery Time Objective (RTO)

131
Q

What does Recovery Time Objective (RTO) mean?

A

This is the amount of time that you think you can feasibly recover the function in the event of a disruption

132
Q

What is the Computer Fraud and Abuse Act (CFAA)?

A

CFAA was carefully written in 1984 to exclusively cover computer crimes that crossed state boundaries to avoid infringing on states rights and reading on thin constitutional ice. This covers any computer exclusively used by US government or financial institutions.

133
Q

What law woudl you use If you want to protect the Intellectual Property of source code?

A

Copyright, while you can protect the source code you cannot protect the idea.

134
Q

How long is a patent valid for?

A

20 years

135
Q

What is a Contractual License Agreement?

A

A written contract between software vendor and the customer

136
Q

What is Shrink-Wrap license agreements?

A

Shrink-Wrap license agreements are written on the outside of the software packaging. You accept the agreement by opening the packaging.

137
Q

What is Click-Throuh license agreements?

A

A license agreement which you accept if you click next

138
Q

What are Cloud Service license agreements?

A

This simply flashes legal terms on the screen for review

139
Q

Who does the Privacy Act of 1974 apply to?

A

Government Agencies only

140
Q

What agreement is in place in the USA to comply with GDPR?

A

Privacy Shield

CISSP2020 (10 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions