CISSP ch 15 Flashcards
(105 cards)
Security tests
verify that a control is functioning properly
Security assessments
comprehensive reviews of the security of a system, application or other tested environment
Identifies vulnerabilities in the tested environment. does not usually include actual mitigation of those vulnerabilities
Thoughtful review of the threat environment, current and future risks, and the value of the targeted environment
hould be addressed to the organization’s management
NIST SP 800-53A
Assessing Security and Privacy Controls in Federal Information Systems and Organizations: Building Effective Assessment Plans = best practices in conduct security and privacy assessments
Specifications (NIST SP 800-53A)
documents associated with the system being audited (e.g., policies, procedures, requirements and designs)
Mechanisms (NIST SP 800-53A)
controls used within an information system to meet the specifications
Activities (NIST SP 800-53A)
actions carried out by people within an information system
Individuals (NIST SP 800-53A)
people who implement specifications, mechanisms and activities
Security audits
use many of the same techniques followed during security assessments but must be performed by independent auditors
Less routine than tests or assessments
Purpose of demonstrating the effectiveness of controls to a third party (as opposed to purely internal distribution)
Internal audits
performed by an organization’s internal audit staff and are typically intended for internal audiences
Reporting line that is completely independent of the functions they evaluate
CAE
Chief Auditing Executive = may have reporting responsibility directly to the organization’s governing board
SSAE 18
Statement on Standards for Attestation Engagements, document 18 ‘Reporting on Controls’ (produced by the American Institute of Certified Public Accountants / AICPA)
Provides a common standard to be used by auditors performing assessments of service organizations with the intent of allowing the organization to conduct an external assessment instead of multiple third-party assessments and then sharing the resulting report with cutomers and potential customers
ISAE 3402
International Standard for Attestation Engagements 3402 ‘Assurance Reports on Controls at a Service Organization’ = SSAE 18 equivalent used outside of U.S.
SOC aduits
Service organization controls audit = SSAE 18 and ISAE 3402
SOC 1 engagements
asses the organization’s controls that might impact the accuracy of financial reporting
SOC 2 engagements
Assess the organization’s controls that affect the security (confidentiality, integrity and availability) and privacy of information stored in a system
SOC 2 audit results are confidential and normally are only shared outside the organization under and NDA
SOC 3 Engagements
Assess the organization’s controls that affect the security (confidentiality, integrity and availability) and privacy of information stored in a system
SOC 3 audit results are intended for public disclosure
Type I Reports
provide the auditor’s opinion on the description provided by management and the suitability of the design of the controls
Cover only a specific point in time, rather than an extended period
More of a documentation review
Type II reports
provide the auditor’s opinion on the operating effectiveness of the controls
The auditor actually confirms that the controls are functioning properly
Covers an extended period of time, at least six months of operation
COBIT
Control Objectives for Information and Related Technologies, maintained by ISACA
Common framework for conducting audits and assessments
Describes the common requirements that organizations should have in place surrounding their information systems
ISO 27001
standard approach for setting up an information security management system
ISO 27002
goes into more detail on the specifics of information security controls
SCAP
NIST’s Security Content Automation Protocol = common framework for describing and evaluating vulnerabilities, and facilitates the automation of interactions between different security systems
CVE (SCAP)
Common Vulnerabilities and Exposures = naming system for describing security vulnerabilities
CVSS (SCAP)
Common Vulnerability Scoring System = standardized scoring system for describing the severity of security vulnerabilities
