Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CISSP EXAM CRAM > Domain 1 > Flashcards

Domain 1 Flashcards

1
Q

Due Diligence (Definition)

A

Practicing the activities that maintain the due care effort

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Due care (Definition)

A

Doing what a reasonable person would do in a given situation. Sometimes called the prudent man rule

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Due Diligence

A

Research
Planning
Evaluation
Increases understanding and reduces risk
Largely done before the decision (Think before you act)
Do Detect

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Due Care

A

Implementation
Operation (upkeep)
Reasonable measures
Doing after the decision
Action speak louder than words
Do Correct

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Due diligence examples

A

Related to knowledge and research
Laws and regulations
Industry standards
Best practices

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Due care examples

A

Related to delivery or execution
Reporting security incidents
Security awareness training
Disabling access in a timely way

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Incident Management Framework

A

Detection
Response
Mitigation
Reporting
Recovery
Remediation
Lessons learned
Mnemonic DRMRRRL

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Confidentiality

A

Access controls help ensure that only authorized subjects can access objects

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Integrity

A

Ensures that data or system configurations are not modified without authorization

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Availability

A

Authorized requests for objects must be granted to subjects within a reasonable amount of time

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

ISC2 Code of Ethics

A
  1. Protect society the commonwealth and the infrastructure
  2. Act honorably honesty justly responsibly and legally
  3. Provide diligent and competent service to principals
  4. Advance and protect the profession
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

4 levels of security policy development

A

Security procedures- detailed step by step
Security guidelines- offer recommendations
Security baselines - define minimum levels
Acceptable use policy- assign roles and responsibilities

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Risk Categories

A

Group of potential causes of risk
Damage- result in physical loss of an asset or the inability to access the assets
Disclosure- disclosing critical information regardless of where or how it was disclosed
Losses- these might be permanent or temporary including altered data or inaccessible data

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Risk Factors

A

Something that increases risk or susceptibility
Physical damage- natural disaster power loss or vandalism
Malfunctions- failure of systems networks or peripherals
Attacks- purposeful acts whether from the inside or outside such as unauthorized disclosure
Human errors- usually considered accidental incidents whereas attacks are purposeful incidents
Application errors- Failures of the application including the operating system

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Strategic

A

Security planning type that is long term stable plan that should include a risk assessment
5 year horizon with annual updates

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Tactical

A

Security planning type that is a midterm plan developed to provide more details on goals of the strategic plan. Usually a 1 horizon

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Operational

A

Security planning type that is a short term highly detailed plan based on the strategic and tactical plans. Usually monthly or quarterly horizon

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Risk acceptance

A

A response to risk where you do nothing and you must accept the risk and potential loss if threat occurs

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Risk Mitigation

A

A response to risk where you implementing a countermeasure and accepting the residual risk

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Risk assignment

A

A response to risk where it is transfer (assign) to 3rd party like by purchasing insurance against damage

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Risk avoidance

A

A response to risk where the costs of mitigating or accepting are higher than benefits of the service

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Risk deterrence

A

Response to risk where implementing deterrents to would be violators of security and policy

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Risk Rejection

A

A response to risk that is unacceptable response to risk. Also known as ignore risk

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

NIST 800-37

A

Risk management framework has 7 steps
1. Prepare to execute the RMF
2. Categorize information systems
3. Select security controls
4. Implement security controls
5. Assess the security controls
6. Authorize the system
7. Monitor security controls
Mnemonic PCSIAAM

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

Operationally critical threat asset and vulnerability evaluation

A

OCTAVE is a risk management framework

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

Factor analysis of information risk

A

FAIR is a risk management framework

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

Threat Agent Risk Assessment

A

TARA is a risk management framework

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

Residual Risk

A

Is a risk type that remains even with all conceivable safeguards in place
Risk management has chosen to accept rather than mitigate
After safeguards

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

Inherent Risk

A

Newly identified risk not yet addressed with risk management strategies
The amount of risk exists in the absence of controls
Before safeguards

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

Total Risk

A

The amount of risk an organization would face if no safeguards were implemented
Without safeguards

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

Total risk calculation

A

Threats * Vulnerabilities * asset value = total risk

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

Risk calculation

A

Risk= threat * vulnerability

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

Quantitative Risk Analysis

A

Assigns a dollar value to evaluate effectiveness of countermeasures
Objective

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

Quantitative risk analysis steps

A
  1. Inventory assets (asset value or AV)
  2. Identify threats (EF and SLE)
  3. Perform a threat analysis (ARO)
  4. Estimate the potential loss (ALE)
  5. Research countermeasures for each threat (calculate changes to ARO and ALE)
  6. Perform a cost/benefit analysis of each countermeasure for each threat for each asset
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

Qualitative risk analysis

A

Uses a scoring system to rank threats and effectiveness of countermeasures
Subjective

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

Delphi Technique

A

An anonymous feedback and response process used to arrive at a consensus
An example of Qualitative Risk Analysis

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

Loss potential

A

What would be lost if the threat agent is successful in exploiting a vulnerability

38
Q

Delayed loss

A

This is the amount of loss that can occur over time

39
Q

Threat Agents

A

What cause the threat by exploiting vulnerabilities

40
Q

Exposure Factor (EF)

A

Percentage of loss that an organization would experience if a specific asset were violated by a realized risk

41
Q

Single Loss Expectancy (SLE)

A

Represents the cost associated with a single realized risk against a specific asset

42
Q

Single Loss Expectancy calculation

A

SLE= Asset Value (AV) * Exposure Factor (EF)

43
Q

Annualized Rate of Occurrence (ARO)

A

The expected frequency with which a specific threat or risk will occur within a single year

44
Q

Annualized Loss Expectancy (ALE)

A

The possible yearly cost of all instances of a specific realized threat against a specific asset

45
Q

Calculation of Annualized Loss Expectancy

A

ALE=single loss expectancy (SLE) * annualized rate of occurrence (ARO)

46
Q

Safeguard Evaluation

A

Good security controls mitigate risk, are transparent to the users, difficult to bypass, and are cost effective

47
Q

Safeguard evaluation calculation

A

ALE before safeguard - ALE after safeguard - annual cost of safeguard= value of safeguard
ALE1-ALE2-ACS=value of safeguard

48
Q

Control Gap

A

The amount of risk reduced by implementing safeguards
Total risk- control gap = residual risk

49
Q

Supply chain

A

Most services are delivered through a chain of multiple entities. A secure supply chain includes vendors who are secure, reliable, trustworthy, reputable

50
Q

Supply Chain Evaluation

A

Onsite Assessment- visit, interview, and observe their operating habits
Document Exchange and Review-Investigate dataset and doc exchange review
Process/Policy Review- request copies of their security policies, processes, procedures
Third Party Audit-Having an independent auditor provide an unbiased review of an entity’s security infrastructure

51
Q

Threat Modeling

A

Can be proactive or reactive but in either case goal is to eliminate or reduce threats

52
Q

3 approaches to threat modeling

A

Focus on Assets- uses asset valuation results to identify threats to the valuable assets
Focused on Attackers- identify potential attackers and identify threats based on the attacker’s goals
Focus on Software- considers potential threats against the software the organization develops

53
Q

STRIDE

A

A threat model developed by Microsoft that focuses on software
Spoofing
Tampering
Repudiation
Information disclosure
Denial of service
Elevation of privilege

54
Q

PASTA

A

Threat model that focuses on developing countermeasures based on asset value
Stage 1- definition of objectives
Stage 2- definition of technical scope
Stage 3- app decomposition and analysis
Stage 4- Threat Analysis
Stage 5- Weakness & Vulnerability Analysis
Stage 6- Attack Modeling & Simulation
Stage 7- Risk Analysis & Management

55
Q

VAST

A

Threat model based on Agile Project Management principles. Diagrams threat from attackers perspective
Visual
Agile
Simple
Threat

56
Q

DREAD

A

Threat model that is based on the answer to 5 questions
Damage Potential
Reproducibility
Exploitability
Affected users
Discoverability

57
Q

TRIKE

A

Focused on acceptable risk therefore it is risk focus.
An open source threat modeling process that implements a requirement model. Ensures the assigned level of risk for each asset is acceptable to stakeholders

58
Q

COBIT

A

A security control framework; framework for IT management and governance framework
Principle 1: Meeting Stakeholders needs
Principle 2: Covering the Enterprise end to end
Principle 3: applying a single integrated framework
Principle 4: Enabling a holistic approach
Principle 5: separating governance from management

59
Q

Diagramming Potential Attacks

A

Determining potential attack concepts is often achieved through diagramming

60
Q

Reduction Analysis

A

Breaks a system down into its parts which makes it much easier to identify the essential components of each element and take notice of there might be vulnerabilities and likely point of attacks

61
Q

Components of Reduction Analysis Diagram

A

Trust Boundaries- any location where the level of trust or security changes
Data Flow Paths- the movement of data between locations
Input Points- location where external input is received
Privileged Operations - Any activity that requires greater privileges than of a standard user account
Details about security stance and approach- declaration of security policy, security foundations and security assumptions

62
Q

Prioritization and Response

A

Treats are ranked or rated using DREAD threat model rate high/medium/low

63
Q

Security Contols

A

Security measures for countering and minimizing loss or unavailability of services or apps due to vulnerabilities

64
Q

Safeguards

A

Are proactive

65
Q

Countermeasures

A

Are reactive

66
Q

Security Control Categories

A

Technical- aka logical, involves the hardware or software mechanisms used to manage access
Administrative- policies and procedures defined by org’s security policy, other regulations and requirements
Physical- are items you can physically touch

67
Q

Security control types

A

Deterrent- deployed to discourage violation of security policies
Preventative- deployed to thwart or stop unwanted or unauthorized activity from occurring
Detective- deployed to discover or detect unwanted or unauthorized activity
Compensating- provides options to other existing controls to aid in enforcement of security policies
Corrective- modifies the environment to return systems to normal after an unwanted or unauthorized activity has occurred
Recovery- an extension of corrective controls but have more advanced or complex abilities
Directive- direct, confine or control the action of subjects to force or encourage compliance with security policies

68
Q

Examples of control types

A

Deterrent- audit policies, security awareness training, locks, fences, security badges
Preventative- firewalls, ids, fence, gate or man trap
Detective-motion detection, cctv, cameras audit trails, honey pot, mandatory vacation, job rotation
Corrective- backup software that t automatically restores missing files
Recovery- server clustering, vm shadowing, hot site, warm site
Directive- security policy requirement, posted notifications

69
Q

Criminal Law

A

Type of law that contains prohibitions against acts such as murder, assault, robbery, and arson

70
Q

Civil law

A

Type of law that includes contract disputes real estate transactions employment estate and probate

71
Q

Administrative law

A

Type of law that government agencies have some leeway to enact administrative law

72
Q

Computer Fraud and Abuse Act

A

A law that was the first piece of US cybercrime specific legislation

73
Q

Federal Sentencing Guidelines

A

Provided punishment guidelines to help federal judges interpret computer crime laws

74
Q

Federal information security management act(FISMA)

A

Required a formal infosec operations for federal gov’t

75
Q

Copyright and the digital millennium copyright act

A

Covers literary, musical, and dramatic works

76
Q

Trademarks

A

Covers words, slogans, and logos used to identify a company and its products or services

77
Q

Patents

A

Protect the intellectual property rights of investors

78
Q

Trade Secrets

A

Intellectual property that is absolutely critical to their business and must not be disclosed

79
Q

Licensing

A

4 types you should know are contractual, shrink wrap, click through, and cloud services.

80
Q

Computer Export Controls

A

US companies can’t export to Cuba, Iran, North Korea, Sudan, and Syria

81
Q

Encryption Export Controls

A

Dept of Commerce details limitations on export of encryption products outside the US

82
Q

Privacy(US)

A

The basis for privacy rights is in the fourth amendment to the US Constitution

83
Q

Privacy(EU)

A

General Data Protection Regulation (GDPR) is not a US law but very likely to be mentioned. Applies to any company with customers in the EU!

84
Q

Health Insurance Portability and Accountability Act (HIPAA)

A

Strict privacy and security rules on handling of PHI (protected health information)

85
Q

Health Information Technology for Economic and Clinical Health(HITECH)

A

Addresses the privacy and security concerns associated with electronic transmission of health information

86
Q

Gramm-Leach Bliley Act

A

Applies to financial institutions driven by federal financial institutions

87
Q

Children’s Online Privacy Protection Act (COPPA)

A

Imposes certain requirements on operators of websites or online services directed to children under 13 years of age

88
Q

Electronic Communication Privacy Act (ECPA)

A

Protection of electronic communications against warrantless wiretapping. Weakened by patriot act

89
Q

Communications Assistance for Law Enforcement Act (CALEA)

A

Requires telecommunication carriers and manufacturers of telecommunications equipment modify and design their equipment, facilities, and services to ensure that they have built in capabilities for for targeted surveillance.

90
Q

Business Continuity Planning

A

Issues that pertain to information security in
1. Strategy development
2. Provisions and processes
3. Plan approval
4. Plan implementation
5. Training and education

91
Q

Security Awareness Training

A

Establish and maintain a security awareness, education, and training program
Methods and techniques to present awareness and training
Periodic content reviews
Program effectiveness evaluation

CISSP EXAM CRAM (2 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions