Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CISSP-27thMarch > Day-5-27th march@Legal > Flashcards

Day-5-27th march@Legal Flashcards

1
Q

In US three types of common LAW

A

> Criminal
Civil (Tort)
Administrative

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

criminal law

A

> crimes committed against society
beyond reasonable doubt
felony serious crime , normally in jail for more than 1 year
misdemeanor less serious crime , jail inprisonment for less than 1 year

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

civil law

A

> Against individual or company that can create injury, loss ,damage, death > based upon the preponderance of evidence

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Criminal vs Civil

A

> both have punishment
civil has compensatory
criminal has deterrence
civil has statutory damages

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

According to federal sentencing guideline

A

Sr corp officer are responsible personally if their org fails to comply with applicable laws .

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Administrative laws are regulatory laws

A

enforced by Govt agencies , penalty financial or imprisonment

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

risk appetite vs risk tolerance

A

Risk appetite: amount and type of risk that an organization is willing to pursue or retain
Risk tolerance: organization’s or stakeholder’s readiness to bear the risk after risk treatment in order to achieve its objectives

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Intellectual Property organizations

A

USPTO ,WIPO, WCO,WTO,TRIP

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

PRIVACY AND DATA PROTECTION LAWS PRINCIPALS

A

> must be collected fairly and lawfully
must only be used for the purposes for which it was collected
must be accurate and kept upto date
must be accessible to individuals who request a report on personal informations about themselves
individuals have the right to correct if there is any error
personal data cant be disclosed to other org
trnamission of personal data to locations is prohibited where equivalent security is not ensured

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

us federal privacy act 1974

A

Personal informations stored by federal agencies cant disclose to any others

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

HIPAA

A

privacy standards for PI health informations

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Hitech vs HIPAA

A

However, there is a difference between HIPAA and HITECH with regards to patients´ rights.

Prior to HITECH, patients were unable to find out who their ePHI had been disclosed to (both authorized and unauthorized where known). In 2011, the Department of Health & Human Services published a HITECH-required Rule that allows patients to request access reports. These reports explain to patients who accessed and viewed their ePHI and under what authority.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

HITRUST and HIPAA

A

hipaa is a framework or compliance law, hitrust is a company which help companies to achieve this law.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

GLBP

A

PII stored in Financial origanization

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

PCI DSS Principles

A 
Credit CARD industry
>build and maintain a secure network
>protect cardholder data
>maintain vulnerability management program
>implement strong access control
>regularly monitor and test network
>maintain an information security policy
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Computer Fraud and abuse act -crime

A

f federal -govt cmputers, f financial informations f foriegn relationship informations

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

electronic communications and privacy act

A

unauthorized monitring or evesdropping wiretapping

>can access email but not voice email

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

us computer security act

A

special security for compuers holding sensitive informations

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

us federal sentencing guideline

A

due care violations for organizations

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

us economic espionage act

A

patent trade secret protection

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

us child pornography act

A

distribution of child pornography

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

us patriot act

A

> wiretap is allowed > voice email access is allowed > mobile tap is allowed

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

pen device

A

to collect outgoing number list from a phone number

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

trap device

A

to collect incoming numbers

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

SOX

A

financial audit of public companies

26
Q

safe harbor

A

agreement between us department of commerce and EU, t handle private data of EU citizens moving from EU to US

27
Q

evidence

A

> real evidence : from witness five sense
direct evidence : tangible objects from actual crime
documentary evidence : computer generated, computer stored , log files etc
demonstrative evidence from expert opinion hearsay rule

28
Q

hearsay documents

A

business records not directly related to crime

29
Q

entrapment or enticement

A

entrapment : someone commits a crime without having any intention, entricement : someone provoked to commit a crime . its legal

30
Q

chain of custody

A

provides accountability and protection for evidence throughout its entire life cycle

31
Q

evidence life cycle

A 
>collection and identification
> analysis
> storage preservation transportation
>presentation in court
>return to victim
32
Q

subopena

A

order to an individual to submit evidence t court

33
Q

search warrant criminal case / writ of possession civil case

A

by court to police to search and seize specific evidence ,

34
Q

US federal sentencing guideline -due care failure

A 
The 1991 U.S. Federal Sentencing Guidelines apply to the following white collar crimes that take place within an
organization:
Antitrust
Federal securities
Mail and wire fraud
Bribery
Contracts
Money laundering
35
Q

Wassenaar Arrangement

A

Established to contribute to regional and international security and stability by promoting transparency and greater responsibility in transfers of conventional arms and dual-use goods and technologies, thus preventing destabilizing accumulations.

36
Q

CSO role

A

The role of the chief security officer (CSO) should be self-governing and independent of all the other departments in the
organization. The CSO should report to the chief information officer (CIO), chief technology officer (CTO), or chief
executive officer (CEO) only to gain management approval for security implementation and to provide feedback on the
security process compliance. In an organization, an Information Technology security function should be led by a Chief
Security Officer.
The information technology function is responsible for carrying out infrastructure implementation based on directives
issued by the CSO. The security responsibilities of a CSO include not only the information technology function, but
extend to all the departments of the organization. The CSO might conduct a periodic meeting with managers from
different departments of the organization and make them aware of the security initiatives flowing in a top-down approach
from the senior managemen

37
Q

NCSC

A

The National Computer Security Center (NCSC) is a centralized agency that evaluates computer security products and
provides technical support to government offices and private firms.

38
Q

hipaa

A

HIPAA is enforced by Office of Civil Rights (OCR) of the Department of Health and Human Services (HHS).

39
Q

Operate and Maintain

A

Ensure that all baselines are met.
Complete internal and external audits.
Complete tasks outlined in the blueprints.
Manage service level agreements as outlined in the blueprints

40
Q

exigent circumstances

A

when evidence might be destroyed

41
Q

IAB considered unethical behaviors

A

Seeking to gain unauthorized access to the resources of the Internet
Destroying the integrity of computer-based information
Disrupting the intended use of the Internet
Wasting resources, including people, capacity, and computers, through such actions
Compromising the privacy of users
Being negligent in the conduct of Internet experiments

42
Q

data haven

A

A data haven either has no laws or poorly enforced laws for information protection.

43
Q

Admin LAw vs Regulatory Law

A

Administrative law is
often called regulatory law. This type of law includes considered standards of performance or conduct expected by
government agencies from companies, industries, and certain officials

44
Q

Which things are covered under trade secret

A

Trade secrets consist of information and can include a formula, pattern, compilation, program, device, method, technique or process. To meet the most common definition of a trade secret, it must be used in business, and give an opportunity to obtain an economic advantage over competitors who do not know or use it.

45
Q

3 types of security controls

A

b. physical controls
c. technical controls
d. administrative controls

46
Q

incident response steps

A
  1. Detection
  2. Response
  3. Reporting
  4. Recovery
  5. Remediation and review rca works here
47
Q

process guide

A

SDLCP-(Info Assurance Is Out Dated)

  1. Initiate
  2. Aquire
  3. Implemet
  4. Operations
  5. Disposal

S-SDLCP (Re Do Damn Test Right)

  1. Req Gather
  2. Design
  3. Develop
  4. Test
  5. Release

CMMI (I Really Defend My Opinion)

  1. Initial
  2. Repeatable
  3. Defined
  4. Managed
  5. Optimized

BCP (IIPRCTM)….Sorry not so fun ;)

  1. Initiation
  2. BIA (Impact)
  3. Preventative
  4. Recovery
  5. Continuity
  6. Test
  7. Manage/Maintain
48
Q

Which phase of the security management life cycle are you engaged if you are completing audits to ensure that your security settings meet baselines? Other activities might include completing tasks in blueprints, managed slas outlined in blueprints, doing audits to ensure baselines.

A

Operate and Maintain

49
Q

Which phase of the security management life cycle are you engaged if you are reviewing the audit results to assess if your organization’s security baselines are maintained? other activities in this phase include review logs, audit results, metrics, and slas. assess accomplishments, complete steering committees, Develop improvement steps for integration into the plan and organize phase.

A

Monitor and Evaluate

50
Q

data aggregator

A

a company that compiles, stores, and sells personal information

51
Q

You are implementing asset identification and change control blueprints. In which phase of the security management life
cycle are you engaged?

A

implement

52
Q

The Basel II Accord

A

The Basel II Accord is built on three main pillars: minimum capital requirements, supervision, and market discipline.
These pillars apply to financial institutions.

53
Q

BCP steps

police bia koreche
preventive recovery hisebe akta contigency plan
dar koriyeche , test ar maintain korte hobe

A
  1. Develop the continuity planning policy statement.
  2. Conduct the BIA.
  3. Identify preventative controls.
  4. Develop recovery strategies.
  5. Develop the contingency plan.
  6. Test the plan, and conduct training and exercises.
  7. Maintain the plan.
54
Q

HIPAA gap analysis

A

HIPAA gap analysis applies to transactions, security, and privacy and does not address either accountability or
availability.

55
Q

Reverse engineering

A

Reverse engineering, in computer programming, is a technique used to analyze software in order to identify and understand the parts it is composed of

56
Q

bcp should be maintained

A 
Infrastructure changes
Environment changes
Organizational changes
Hardware, software, and application changes
Personnel changes
57
Q

Which organization developed P3P

A

World Wide Web Consortium (W3C)

58
Q

privacy notice how to send

A

A privacy notice should be provided via a posted copy, a printed copy at the first service delivery, and a printed copy
available upon request by a covered entity to the patient.

59
Q

covered entities

A

Covered entities are defined in the HIPAA rules as (1) health plans, (2) health care clearinghouses, and (3) health care providers who electronically transmit any health information

60
Q

delayed loss risk

A

that happens after a tangible resource is taken out

CISSP-27thMarch (7 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions