Chapter 2 - Governance and Risk Flashcards
(133 cards)
0
Q
Availability?
A
Uptime and timeliness
1
Q
What is AIC or CIA?
A
Availability Integrity Confidentiality
Used to define security platform and threat surfaces
2
Q
Integrity?
A
Unaltered information accuracy
3
Q
Confidentiality?
A
Authorized disclosure
4
Q
Shoulder surfing
A
Looking over the shoulder to view screen data or passwords
5
Q
Social engineering
A
Tricking someone into divulging information
6
Q
Vulnerability?
A
Lack of or weakness in a countermeasure that is exploitable
7
Q
Threat?
A
The potential danger if a vulnerability is exploited
8
Q
Threat Agent?
A
The entity that takes action on the threat and vulnerability
9
Q
Risk?
A
The likelihood a threat agent will exploit a vulnerability and the impact that could cause to the business
10
Q
Exposure?
A
This is the damage caused by a successful attack
11
Q
Control?
A
Countermeasure to reduce risk a vulnerability may cause
Also known as safeguard
12
Q
Deterrent control?
A
Discourage attacker
13
Q
What three categories make for defense in depth ?
A
Administrative
Technical
Physical controls
14
Q
Preventive control?
A
Avoid an incident entirely
15
Q
Corrective control?
A
Fixes after an incident
16
Q
Recovery control?
A
Intended to bring the environment back
17
Q
Detective control?
A
Detect what occurred and who did it
18
Q
Compensating control?
A
Alternative controls (a proxy server instead of a port block)
19
Q
What three controls commonly make up a security policy?
A
Preventative, detective, and recovery
20
Q
Why is security by obscurity a bad thing?
A
It assumes you are smarter than the attacker and in most cases lowers productivity
21
Q
What cycle does the ISO standards follow?
A
Plan-Do-Check-Act (PDCA)
22
Q
What is the BS7799? What did it become?
A
BS7799 was a British security defacto standard that was adopted by ISO 27000 it also goes by the name ISO 17799
23
Q
What is the difference between framework and architecture?
A
Framework is an outline blueprint and architecture is the blueprint that fits the specific need
24
Define a view in terms of an enterprise architecture..
A view is how an individual element of a business supports the architectural integrity of a business
25
What is the benefit of having an architecture?
It shows the company as an organism and how each part has a role
26
An architecture is to a human body as views are to what?
A circulatory system
A bone structure
A digestive track
Etc.
27
What is the zachman framework best at illustrating?
A two dimensional view of each view in an architecture asking the 5 w's for each
28
TOGAF is a comprised of what views of architecture?
In order:
Business
Data
Applications
Technology
29
What framework uses ADM as part of its definition?
TOGAF
30
What is the primary benefit of the complex DoD architectures like DODAF and MODAF?
Synchronous data types and standard communication channel so everyone is quickly on the same page
31
When do stakeholders become important?
When choosing an architecture that fits the business model. There concerns will help guide that decision.
32
What does tactical, strategic, and operational mean?
Strategic - the long term goals..(a retirement)
Tactical - the medium goals (a security plan in place)
Operational - short term (lock down that port)
33
ISMS
Information security management system
34
SABSA
It is a 2 dimension model like Zachman, using the 5 w's to define security in increasing detail
35
What is a methodology?
A step by step process to implement and architecture
36
Strategic alignment?
The alignment of the business within an enterprise architecture
37
Business enablement?
Business needs and productivity come before security
38
Process enhancement?
Architecture planning will force diagnostics of business process and give a rich opportunity to fine tune the business process
39
Security effectiveness?
Use of tools like ROI SLA or baselines to see security efficiency
40
CobiT?
Controls oriented private business framework with 32 domains and complete checklist of it governance policies
41
NIST 800-53
Government version of a cobit like framework with specific steps
42
What is unique about the NIST categories?
Management
Technical
Operational
Instead of the standard:
Administrative
Technical
Physical
43
COSO
Architecture model focused on corporate governance instead of IT governance
44
What common law is built on COSO?
SOX
45
What is the primary focus of ITIL?
SLA
46
Six Sigma?
Process methodology architecture
47
CMMI?
Capability Maturity Model Integration
Used to help define maturity level of process, similar to cobit maturity model
48
Top-Down approach vs bottom-up approach
Top down is starting from senior management and working down. Bottom up is the other way around starting from the janitor up
49
What are the 4 domains of a security program life cycle?
Plan and organize
Implement
Operate and maintain
Monitor and evaluate
50
What is a blueprint?
Specific roles, outlines, responsibilities, or guidelines within the architecture
51
What is the first thing you do when securing and environment?
Find out how the business works down to the user and client experiences and up to the board members day to day
52
What is IRM?
Information Risk Management
53
What are the types of risk?
```
Physical damage (fire)
Human interaction (disruptive interaction)
Equipment failure
Attacks (hacking)
Misuse of data (sharing trade secrets)
Loss of data (format /s /f)
Application error (bad loops)
```
54
What allows a company to pick and choose vulnerabilities?
Risk management
55
What does risk effect in a company?
Everything in an organization.
56
What is the key thing for management to contribute to risk management?
A definition of what is considered and acceptable level of risk
57
What are the goals of a risk assessment?
Identify assets and value
Identify vulnerabilities and threats
Quantify the probability and business impact of threats
Provide an economic balance between impact and cost of control
Cost/Benefit
58
Finally got that risk assessment done? Now what?
React to it and make adjustments to reduce risk
59
What level of a department should be working with the risk assessment team?
The top level, far too often it is delegated to the lower people due to time, but they don't know the amswers
60
What 4 questions should be asked in a risk assessment?
Threat event?
Risk?
Frequency?
Certainty of the last 3 questions?
61
How does the value of an object or piece of information dictate risk assessment?
More value, more risk
62
What is an intangible risk assessment?
Something not physical.
Reputation
Data
Intellectual property
It is critical to be able to assign a cost to these
63
Loss potential?
What would the company lose of the threat agent exploited the vulnerability
64
Delayed loss?
```
Damage reputation
Loss of market share
Late penalties
Civil suits
Etc.
```
This happens long after the exploit took place.
65
What is SP 800-30?
NIST methodology guide focused only on it security
66
What is FRAP?
This is a to the point risk methodology that focuses only on the most critical risks for cost and time efficiency
67
OCTAVE?
This a high level it security methodology focused on allowing the upper people within each department to make the risk assessment
68
AS/NZS 4360
This is a methodology focused on business health particularly financially and economically
69
FMEA ?
Failure modes and effect analysis
Used in development and operations to find flaws and potentially failures before they happen
70
Failure mode?
How a system can break?
71
Effect analysis
Impact of a failure
72
Fault Tree Analysis
Used for complex failure modes with multiple dependencies.
This model starts from what can go wrong and diagrams everything that can cause that to happen
73
Logic diagrams are used in what methodology?
Failure tree analysis
74
CRAMM
A UK methology that is fully automated with Siemens products
75
Risk assessment vs risk analysis?
Assessment is gathering information
Analysis is using and acting on the assessment
76
What 4 things can be done with a risk?
Accept
Mitigate
Transfer
Avoid
77
Qualitative analysis ?
Financial estimate of a risk
78
Quantitative analysis?
Assigning rating to risk like red, yellow, green.
79
Single loss expectancy ?
Dollar amount assigned to a single event if a threat took place
Asset value * exposure factor
80
Exposure factor
% of an asset lost
81
Annual loss expectancy
SLE * ARO = ALE
82
ARO?
Annualized rate of occurrence
83
Uncertainty?
This is the amount of guessing put into a risk analysis. This should be tracked.
84
Delphi?
A group discussion technique designed to anonymously give opinions
85
Cost/benefit analysis?
Prevent spending more money than the threat would cost annually (ALE)
86
Safeguard considerations?
Must be visible to evildoer but non discoverable
87
Residual risk?
No countermeasure is fully affective. The remainder is the residual risk.
Mitigation not prevention
88
Total risk?
The entire risk quotient .. Companies will accept this only if the cost/benefit supports that action
89
How can one deal with risk?
Accept it
Avoid it
Mitigate it
Transfer it
90
Transfer risk?
"It's not my risk anymore, it's his"
91
Risk avoidance
We will discontinue using that product.due to the risk
92
Mitigated risk
I implemented a new security device to reduce risk
93
Acceptable risk
I'm okay with that!
94
Security policy
General statement of security by senior management that dictates the role of security
95
Organizational security policy
Shows the tactical and strategic value of a security policy and a defined acceptable level of risk
96
Issue specific policies or functional policies
Specific security policy to one segment of the master organizational policy
97
System specific policy
This is an IT specific acceptable use policy defining roles access system security
98
Regulatory policy
Very detailed and specific standards used by industry, medical, and government
Ie. HIPPA, SOX
99
Advisory policy
Strongly shows exactly what is acceptable and unacceptable with consequences
100
Informative policy
Non-enforceable policy telling people relevant information
101
What is a baseline?
Clean data at a point on time to reference against
102
Guidelines
Recommended actions and operational guides
103
Procedure
Very detailed step-by-step task list
104
Data classification
Level of confidentiality of stored data
105
Board of directors?
Shareholder elected individuals in a public traded company used for steering a company from the shareholder side
106
CPO
Chief privacy officer - business legal advisor
107
Privacy impact analysis
Risk assessment specifically for the protection of sensitive data
108
Privacy
Controlled and expected release of sensitive data
109
PII
Personal identifiable information
110
Convergence
The combination of all security realms
111
Security steering committee
Everyone who is personally responsible or in charge of directing security in an organization
112
Audit committee
Independent auditing among the board of directors
113
Data owner
The person responsible for a subset of data and it's business access and defined sensitivity
114
Data custodian
This is the person who manages where the data is stored .. Typically the IT person
115
System owner
The person to call when xyz application had a problem
116
Security administrator
Controls network security devices like IDS , IPS , firewalls , anti malware, etc
117
Security analyst
Works at a higher level and analyses the environment for security flaws. Works with risk analysis
118
Application owner
The person directly responsible for the security of an application
119
Supervisor
This is someone who is responsible for the users themself
120
Change control analyst
Ensure change control happens and stays secure
121
Data analyst
Ensures data is placed where it needs to be and is secured correctly
122
Solution provider
An external provider of a solution to a business ailment
123
Product line manager
Similar to a systems analyst, more specifically targeting products and licensing
124
Separation of duties
When multiple people are necessary to enable a control or process
125
Collision
This means working together.
separation of duties implies collusion occurred if the process became fraudulent
126
Split-knowledge
Two people required for a task, each knowing how to do half the task
127
Dual control
Both people understand the entire process but no one person can accomplish the task
128
Rotation of duties
Changing roles and shifts and handing them to others in order to encourage employee auditing
129
Mandatory vacation
Forcing people to take vacation and relinquish their role to someone else who could potentially find fraud
130
Non disclosure agreements
Used to link employees to a policy stating you cannot share sensitive data
131
Security Governance
This is how well the security is integrated into the organization as a whole
132
ISO 27004:2009 / NIST 800-55
Tells how to measure a security program
