Domain 1 Flashcards
Study
1
Q
A logical structure used to document and organize processes?
A
Framework
2
Q
Framework for designing, establishing, implementing, maintaining, and monitoring an information security program.
A
ISMS (Information Security Management System)
3
Q
Internationally recognized Information Security Framework
A
ISO 27000
4
Q
Payment card system information security contractually enforced framework
A
PCI DSS (Payment Card Industry Data Security)
5
Q
This type of metric is intended to help an organization compare themselves to peers
A
Benchmark
6
Q
<p>Publisher of the SP800 series.</p>
A
<p>NIST</p>
7
Q
This program is the U.S government repository of publicly available security guidance.
A
NCP (National Checklist Program)
8
Q
This U.S framework is voluntary guidance, based on existing standards, guidelines, and practices, for critical infrastructure organizations to better manage and reduce cybersecurity risk
A
NIST Cybersecurity Framework
9
Q
The U.S government repository of standards-based vulnerability management data.
A
NVD (National Vulnerability Database)
10
Q
Principle that focuses on protection from unintentional accidental, or inadvertent change.
A
Integrity.
11
Q
Process of tracing actions to their source.
A
Accountability.
12
Q
Principle that only authorized subjects have access.
A
Confidentiality
13
Q
Positive identification of a person or a system.
A
Authentication.
14
Q
Process used to develop confidence that security measures are working as intended.
A
Assurance.
15
Q
Principal that relates to operations and accessibility.
A
Availability.
16
Q
Granting users and systems a predetermined level of access
A
Authorization.
17
Q
Confidence that the system will act in a correct and predictable manner in every situation.
A
Trustworthy Computing.
18
Q
Logging of access and use of information resources.
A
Accounting.
19
Q
Expanded view of information security to include external relationships and global threats.
A
Cybersecurity.
20
Q
The standard of care that a prudent person would have exercised under the same or similar conditions:
- Actions taken by an organization to protect its stakeholders, investors, employees, and customers from harm.
A
Due Care.
21
Q
Is an investigation of a business or person generally before entering into a contract:
- Is is the care and caution a reasonable person would take.
A
Due Diligence.
22
Q
Is the potential liability incurred by a company whose computer systems are compromised and becomes the source of harm.
A
Downstream Liability.
23
Q
The board or a board committee duties include:
A
- Promoting effective governance.
- Determining organizational risk tolerance.
- Contributing to and authorizing strategic plans.
- Allocating funds.
- Approving policies and significant projects.
- Ensuring appropriate monitoring.
- Ensure compliance with laws, regulations and contracts.
- Reviewing audit and examination results.
- Honoring the legal constructs of due diligence and due care.
24
Q
Executive management is responsible for:
A
- Strategic Alignment.
- Risk Management.
- Value delivery.
- Performance measurements.
- Resource management.
- Processes assurance.
25
Corporate Governance.
Is the system by which organizations are directed and controlled.
Governance structures are principles identify the distribution of rights and responsibilities.
26
Governance Outcomes.
- Strategic Alignment.
- Risk Management.
- Value Delivery.
- Resource Management.
- Performance Measurements.
- Process Integration.
27
Strategic Alignment.
Aligning departmental strategies with business strategy to support organizational goals.
28
Risk Management.
Mitigate risk to acceptable level.
29
Value Delivery.
Optimize investments in support of business objectives.
30
Resource Management.
Efficient and effective use of resources.
31
Performance Measurements
Monitoring and reporting on achievements.
32
Processes Integration.
Achieve operational synergies and efficiencies.
33
Information Security Management (ISM) personnel.
Generally have the authority to interpret strategic direction and are held accountable for the success of failure of their area.
ISM personnel should report as high as possible to maintain visibility, limit distortion, and minimize conflict of interest.
34
Related infosec or ISM organizational roles, include:
- Chief Risk Officer (CRO)
- Chief Information Security Officer (CISO)
- Information Security Officer (ISO)
- Information Assurance Officer (IAO) or manager (IAM)
- Privacy Officer
- Compliance Officer.
- Physical Security Officer.
- Internal Audit.
35
Information Security Management include:
- Being a subject matter expert and security champion.
- Managing the information security program.
- Communicating with executive management.
- Coordinating the budget for information security activities.
- Ensuring the development and upkeep of governance documents.
36
Functional Roles.
Functional roles are tactical and relate to specific data-sets, information systems, assets, or processes.
37
Information Owner.
Owners are members of management responsible for protection of a subset of information.
38
Custodians.
Custodians are responsible for implementing, managing, and monitoring the protection mechanisms.
39
Data Users.
Users are expected to follow operational security procedures.
40
Jurisdiction.
Is the power or right of a legal or political agency to exercise its authority over a person, subject matter, or territory. Jurisdiction considerations include:
- Privacy and security regulations (or lack of).
- Access of local governments to stored or transmitted data.
- Attitudes toward "foreigners"
- Law Enforcement.
41
GLBA
The Safeguards Rule requires financial institutions to have measures in place to keep customer information secure. In addition to developing their own safeguards, companies covered by the safeguards rules are responsible for taking steps to ensure that their affiliates and service providers safeguards customer information in their care.
42
HIPPA | HITECH
The Security Rule requires covered entities implement appropriate administrative, physical and technical safeguards to ensure the confidentiality, integrity, and security of electronic protected health information in their care and shared with business partners.
43
FISMA
FISMA requires federal agencies to implement a program to provide security for their information and information systems including those provided by or managed by another agency.
44
Data Protection Directive / GDPR (EU)
Data protection for all individuals within the European Union. EU Data Protection Directive (EU DPD) and it's successor the GDPR (General Data Protection Regulations) is based upon the Organization for Economic Cooperation and Development (OECD) Privacy Principles.
45
Cookie Law.
Web cookies inform and consent requirements.
46
PCI DSS
Payment Card Industry Data Security Standard (PCI DSS) is a contractual obligation between merchants and the the payment card brands.
- The PCI DSS framework includes stipulations regarding storage, transmissions, and processing of payment card data.
- Six core principles require technical and operational security controls, testing, requirements, and attestation process.
47
Board of Directors
Group ultimately responsible for the actions of the organization from a fiduciary perspective.
48
Users
Group responsible for interacting with information systems in accordance with organizational policies and standards.
49
Privacy
Privacy is the right of an individual to control the use of their personal information.
50
Information Security.
Information Security is the process by which we safeguard information and systems and ensure confidential, integrity, and availability.
51
Data Compilation
Collection of data for "later use" to be determined.
52
Data Warehousing
Data Warehousing combines data from multiple sources into a large database with the purpose of extensive retrieval and trend analysis
53
Data Mining
Process of analyzing data with tools that look for trends, correlations, or anomalies resulting in metadata.
54
Aggregation
individual pieces of data are combined to create a bigger picture that may have greater sensitivity thank individual parts.
55
Inference
Ability to derive information that is not explicitly available.
56
Family Education Rights and Privacy Act (FERPA)
Student educational records.
57
Federal Privacy Act (U.S.)
Data Collected by the Government.
58
Children's Online Privacy Protection Act (COPPA)
Citizen data privacy protection.
59
Privacy Statement
- Clearly state what information may be collected, how the information will be used, who the information may be shared with and why, how a third-party may use the information, and how to opt out.
- Codify the organization's commitment to data quality and to data security.
60
Computer Crime
Computer Crime is a term broadly applied when a computer is used in the act of computing a crime. Computer crimes are often divided into two categories:
- Computer as the target of a crime.
- Computer as a tool (weapon) used to commit a crime.
61
Computer Fraud and Abuse Act
Unauthorized access to federal government, financial institution system, or any system used for interstate or foreign commerce.
62
National Information Infrastructure Protection Act of 1996
Primary federal anti-hacking statute.
63
Wiretap Act
Unauthorized interception of digital communications.
64
Electronic Communications Privacy Act
Unauthorized access or damage to electronic messages in storage.
65
Cybercrime
Is a broad term given to criminal activity that involves the Internet, a computer system, a computer network, or technology.
66
Cyber Threat Actors
- Hackers / Script Kiddies.
- Organized Crime.
- Hacktivist .
- Nation-State founded.
- Insiders.
- Competitors.
67
Data Breach Disclosure & notification
An incident that is classified as a confirmed or high probability breach may trigger disclosure and notification requirements.
68
Intellectual Property
Intellectual Property (IP) describes a wide variety of property created by musicians, authors, artists, designers, and inventors.
- Intellectual property can be used in commerce or can be artistic or literary works.
- Intellectual property laws protect use and misuse including compensation.
- Intellectual Property law includes patents, trademarks, copyrights, trade secrets and software licensing.
69
Patents
Patents are designed to protect an invention.
- The invention must be novel, not obvious, and provide some utility.
- A patentable invention must be something that can be produced.
- A patent is good for 20 years.
70
Trademarks
A trademark is intended to protect recognizable names, icons, shape, color, sound, or any combination used to represent a brand, product, service, or company.
- Law creates exclusive rights.
71
Copyrights
A copyright covers the expression of an idea rather than the idea itself (which is protected by the patent).
- The intent is not protect artistic property such as a writing, recording, or a computer program.
- The protections are intended to allow the creator to benefit from being credited for the work and to control the distribution, duplication, and use of the work.
- A trademark or service mark can be renewed every 10 years.
72
Trade Secrets
Trade Secrets refer to proprietary business and technical information, processes, designs, or practices that are confidential and critical to a business.
- Trade Secrets don't require any registration.
73
Software Piracy
It is defined as the "unauthorized copying or distribution of copyrighted software".
- Piracy includes copying, downloading, sharing, selling, or installing, or installing multiple copies onto personal or work computers.
- The Digital Millennium Copyright Act (DMCA) makes it illegal to create products that circumvent copyright protections such as a license key.
74
End-user license agreement (EULA)
Legally enforceable software use agreement.
75
Which statement best describes the concept of privacy?
The right of an individual to control the use of their personal information.
76
Hacktivist
The primary motivation of this threat actor us making a political statement.
77
The 4 canons of the ISC2 Code of Ethics
- Protect society, the common good, necessary public trust and confidence, and the infrastructure.
- Act honorably, honestly, justly, responsibly, and legally.
- Provide diligent and competent service to principles.
- Advance and protect the profession.
78
Policies
Policies are high-level statements (governance communications) intended to communicate rules and expectations and to provide direction.
- Standards, baselines, guidelines, and procedures support the implementation of a policy.
- Policies must be approved by executive management.
79
Information Security Policy
The Information Security policies codify the high-level requirements for protection information and information assets and ensuring Confidentiality, Integrity, and Availability.
- Written information security policies may be a regulatory or contractual compliance requirement.
- Each aspect of the information security program should have a corresponding policy documents.
80
Policy Attributes.
- Endorsed
- Relevant
- Realistic
- Attainable
- Adaptable
- Enforceable
- Inclusive
81
Policy Life-cycle.
- Plan
- Write
- Approved
- Publish (Communicate, Disseminate, Educate)
- Adopt (Implement, Monitor, Enforce)
- Review (Solicit Feedback, Reauthorize or Retire)
82
Standards
Standards serve as specifications for the implementation of policy and dictate MANDATORY requirements.
83
Baselines
Baselines are aggregate of standards for a specific category or grouping such as a platform, device type, ownership, or location.
84
Guidelines
Guidelines help people understand and conform to a standard. Guidelines are customized to the intended audience and are NOT mandatory
85
Procedures
```
Procedures are instructions for how a policy, standard, baseline, or guideline is carried out in a given situation. Procedures focus on discrete actions or steps, with a specific starting and ending point.
Four commonly used formats:
- Simple
- Hierarchy
- Graphic
- Flowchart.
```
86
NIST Special Publication Series #
SP-800
87
Business Continuity
Business continuity is the ability for a business to operate in adverse conditions.
- Business continuity may be a contractual obligation.
- Business continuity may be a regulatory requirement.
88
Business Continuity Planning.
The objective of business continuity planning is to prepare for continued operation of ESSENTIAL functions and services during disruption of normal operating conditions. To support this objective:
- Threat scenarios are evaluated.
- Essential services and processes are identified.
- Response, recovery, and contingency plans are developed
- Strategies, plans, and procedures are tested.
89
BCP governance responsibilities include:
- Board of Directors (or equivalent) approval of Business Continuity policies.
- Board of Directors (or equivalent) oversight of BCP strategies, plans and testing.
- Management oversight of BCP preparedness including external parties.
90
Business Continuity Planning Phases
- Project initiation and assignments.
- Business Impact Analysis
- Threat Analysis
- Strategy Development
- Plan Development
- Execution / Procurement
- Training
- Testing
- Auditing
- Monitoring
- Maintenance Review & Update.
91
Business Continuity Planning Resources
- ISO 22301:2012
| - SP 800-34 R1
92
Continuity of Operations Plan (COOP)
Business unit plan and procedures for operational activities.
93
Crisis Communication Plan (CCP)
Plan and procedures for internal and external communications.
94
Disaster Recovery Plan (DRP)
Plan and procedures for recovering technology and facilities.
95
Occupancy Emergency Plan (OEP)
Plan and procedures for minimizing loss of life and property.
96
Cyber Incident Response Plan (CIRP)
Plan and procedures for mitigating a cyber attack
97
Federal emergency management Angency (FEMA)
U.S Federal Agency responsible for responding to and coordinating the response to a disaster that has occurred in the USA
98
Objective of Business Impact Analysis (BIA)
The Objective of Business Impact Analysis (BIA) is to identify the impact of a disruption on mission-essential services, systems, and infrastructure.
99
A Business Impact Analysis (BIA) is used by management to:
- Understand organizational continuity requirements.
- Make investment decisions.
- Guide the development of incidents response, disaster recovery, and business contingency (continuity) plans
100
Maximum Tolerable Downtime (MTD) or Maximum Tolerable Outage (MTO)
Maximum time a process/service can be unavailable without causing significant harm to the business.
101
Recovery Time Objective (RTO)
Amount of time allocated for system recovery. Must be less than the maximum amount of time a system resource can be unavailable before there is an unacceptable impact on other system resources or business processes.
102
Recovery Point Objective (RPO)
Acceptable data loss. The point in time prior to a disruption or system outage that data can be recovered.
103
Business Impact Analysis (BIA) Process
- Identify Essential Services & Dependencies.
- Determine Maximum Tolerable Downtime (MTD).
- Determine Recovery Point Objective (RPO).
- Identify Infrastructure and Dependencies.
- Determine Current RTO & RPO.
- Gap Analysis.
- Report to Management.
104
Background Check
A Background Check is an investigative report. It may include criminal, financial, credit and/or education history, workers compensation claims, and public records.
- The depth and breath of a background check should specifically be related to job roles and responsibilities and level of access.
- The applicant has a right to privacy. Consent should always be requested.
105
On-boarding
Onbarding is the process of integrating a new employee with a company and culture as well as getting the tools and information they need to be successful.
- User orientation is the initial task on completing paperwork.
106
User Provisioning
User Provisioning is the process of creating user accounts and credentials, assigning access rights and permissions.
107
Confidentiality / Non-dis closure Agreement (NDA)
Protects Data from unauthorized disclosure:
- Establish data ownership
- Protect information from disclosure.
- Prevent forfeiture of patent rights
- Define handling standards including disposal.
108
Acceptable Use Policy (AUP) Agreement
Sets forth proper use if information systems, handling standards, monitoring and privacy expectations.
- An AUP should be written in languages that can be easily and unequivocally understood.
- By signing the associated agreement, the user acknowledges, understands, and agrees to the stated rules.
109
Acceptable Use Policy (AUP) Elements
- Data Classifications and handling standards
- Login requirements including password standards and use of tokens an/or biometrics
- Procurement, installation, and licensing
- Written and verbal communication use and limitations (including personal email)
- Use, activity, and engagement (including social media)
- Use, configuration, activity, and device protection
Use, configuration, activity, and physical security
Instructions on how to spot and report suspicius activity.
110
Job Rotation
Rotating assignments (fraud deterrent and detection)
111
Mandatory Vacation
Require employees to take a set amount of vacation time (fraud deterrent and detection)
112
Separation of Duties
Breaking a process into tasks so tat no one subject is in complete control.
(fraud prevention/deterrent - would require collusion)
113
Dual Control
Requiring to never leave confidential data (paper, monitor, whiteboard) unattended or within view of unauthorized personnel.
114
Termination
Termination ends employment. How termination is handled depends upon the specific circumstances (friendly/unfriendly) and transition arrangements that have been made with the employee.
- Tasks include recovering physical and access control assets, deleting or disabling local an remote access, deleting or disabling user accounts and access permissions, archiving documents and email, and reassigning file folder permissions.
- All these tasks should be documented.
115
Off-boarding
Off-boarding is the process for transitioning employees out of an organization. Tasks include:
- Documenting separation details
Tasks and responsibilities prior to departure
- Knowledge transfer
- Exit Interview.
116
Adherence to the (ISC)2 Code of Ethics is a condition of certification. This group males the final decision on ethics violations and decertification.
(ISC)2 Boards of Directors
117
This group is responsible for determining maximum tolerable downtime (MTD).
Business Unit
118
This agreement generally includes a no expectation of privacy and electronic monitoring clauses.
Acceptable Use Policy Agreement.
119
Three factors should inform information security decisions:
- Strategic aliment with the organizatnio's objectives.
- Legal, regulatory, or contractual requirements.
- Level of risk
120
Threat
Potential danger.
121
Threat Agent
Individual or group that can manifest a threat.
122
Threat event
Specific instance of a threat
123
Vulnerability
Weakness.
124
Exploit
When a threat agent successfully takes advantage of a vulnerability.
125
Impact
Magnitude of harm caused by a threat source.
126
Likelihood (of occurrence)
A weighted factor that a given threat agent is capable of exploiting a giving vulnerability.
127
Risk
Risk is the measurement of likelihood and impact of a threat event. Risk is inherently neither good nor bad.
128
Risk appetite
Risk appetite is the level of risk that an entity will accept in pursuit of its mission and objectives.
- Risk appetite can vary by category of risk
- Risk Tolerance is acceptable variation in outcomes related to specific performance measures.
129
Managing Risk
Managing Risk implies that the level of risk is understood, and is either accepted or being actively controlled (treated) and in either case, monitored.
130
Information Security Risk Management Framework
Information Security Risk Management Framework should complement the organization's risk management framework and be in conformance with regulatory requirements.
131
Risk Assessment
A Risk Assessment is used to identify the level of risk:
- Risk is assessed by evaluating, and the impact if the circumstance or event occurs.
- The target of a risk assessment can be internal systems/process or external supply chain.
- The target of a risk assessment can be internal system/process or external supply chain relationships.
132
Risk Treatment
Risk Treatment is how an organization responds to identified risks - generally defined as actions taken to either accepted the level of risk or mitigate the impact of the undesirable or unfavorable outcome and-or enhance the likelihood of a positive outcome.
- Inherent risk is the level of risk before treatment.
- Residual risk is the level of risk after treatment.
133
Ignore Risk
Act if the risk doesn't exist.
134
Avoid Risk
Eliminate the cause or terminate the associated activity.
135
Mitigate Risk
Reduce the impact or likelihood by implementing controls or safeguards.
136
Deter Risk
Discourage the threat action or adversary from taking action.
137
Share Risk
Spread the risk among multiple parties.
138
Transfer Risk
Assign the risk to another party via insurance or contractual agreement (subject to legal and regulatory constraints)
139
Accept Risk
Acknowledge the risk and monitor it.
140
Risk Monitoring
The objective of Risk Monitoring is to track known risks, evaluate treatment effectiveness, identify new risks, and schedule ongoing assessments.
141
Risk Register
A Risk Register is a tool used to document organization risks and ancillary details such as owner, treatment, measures, and monitoring tasks.
142
Risk Assessment
A Risk Assessment is used to identify the level of risk./
- Determining the scope and scheduling of risk assessments is a risk management function; however, it is common for this process to be managed by the audit department.
143
Risk Assessment Approaches
- Qualitative Risk Assessment.
- Quantitative Risk Assessment.
- Semi-Qualitative Risk Assessment.
144
Qualitative Risk Assessment
Qualitative Risk Assessment use descriptive terminology such as high, medium, and low or normal, elevated, and severe.
145
Quantitative Risk Assessment
Quantitative Risk Assessment assign a numeric and monetary values to all elements of the assessment.
146
Semi-Qualitative Risk Assessment.
Semi-Qualitative Risk Assessments assign a numeric weighted scale to the descriptive values (e.g. high=5, medium=3, low=1) and incorporates deterministic formulas.
147
Qualitative Methodologies
- NIST SP 800-30
- Facilitated Risk Analysis Process (FRAP)
- The Operationally Critical Threat, Asset, and Vulnerability Evaluation (OCTAVE)
148
NIST SP 800-30
Federal Government Standard
| - Used extensively in the private sector.
149
Facilitated Risk Analysis Process (FRAP)
Used to analyze one system at a time
| - Stresses screening activities
150
The Operationally Critical Threat, Asset, and Vulnerability Evaluation (OCTAVE)
Can be used to large scopes
- Facilitated workshops involving business process teams
- Developed at the Carnigie Mellon University Software Engineering Institute (CM SEI)
151
ISO/27005
Supports the requirements of an ISO 27000 information security management system
- Does not specify a specific methodology but does detail a structured sequence of iterative processes.
152
Quantitative risk assessment elements include:
- Asset value (AV) expressed in $
- Exposure factor (EF) expressed as a %
- Single Loss expectancy (SLE) expressed in $
- Annualized rate of occurrence (ARO) expressed as a #
- Annualized loss expectancy (ALE) expressed in $
- Cost/Benefit analysis (CBA) expressed in $
153
Single Loss expectancy (SLE) Formula
SLE ($) = AV($) x EF(%)
154
Annualized loss expectancy (ALE)
ALE($) = SLE($) x ARO (#)
155
Residual Risk
Level of Risk after Controls are applied
156
Control
A control (sometimes called the countermeasure or safeguard) is a tactic, mechanism, or strategy that accomplished one or more of the following:
- Reduces or eliminates a vulnerability
- Reduces or eliminates the likelihood that a threat agent will be able to exploit a vulnerability
- Reduces or eliminates the impact of an exploit
157
Types of Controls
- Deterrent
- Preventive
- Detective
- Corrective
- Compensating
158
Deterrent Controls
Deterrent Controls discourage a threat agent from acting.
159
Preventive Controls
Preventive controls stop a threat agent from being successful.
160
Detective Controls
Detective controls identify and report a threat agent, action, or incident.
161
Corrective Controls
Corrective controls minimize the impact of a threat agent, or modify or fix a situation (recovery)
162
Compensating
Compensating controls are alternate controls designed to accomplish the intent of the original controls as closely as possible, when the originally designed controls cannot be used due to limitations of the environment or financial constraints.
163
Administrative Controls
Controls relating to oversight, laws, rules, regulations, and policies.
-Policies, procedures, training, audits, compliance reporting
164
Physical Controls
Controls that can have a material structure (seen, heard, touched).
- gate, alarm, guard, barricade, door, lock, CCTV, ID card.
165
Technical (Logical) Controls
Controls provided through the use of technology and/or a digital device.
- Encryption, ACLs, firewall rules, anti-virus software, bio-metric authentication.
166
Threat Modeling Categorization Models
- Attacker- Centric.
- Architecture-Centric
- Asset Centric.
167
Attacker-Centric Threat Modeling
Attacket-Centric threat models start with identifying an attacker and the evaluate the attacket's goals and potential techniques.
168
Architecture-Centric Threat Modeling
Architecture-Centric threat models focus on system design and potential attacks against each component.
169
Asset-Centric Threat Modeling
Asset-Centric Threat Modeling threat models begin by identifying asset value and motivation of threat agents.
170
Motivation
Motivation is the driving force behind any attack
171
Attack WorkFactor
Workfactor is the time, effort, and resources needed for an attacker to successfully achieve their objective.
172
Threat Intelligence
Threat Intelligence is evidence-based knowledge about an emerging threat that can be used to inform control decisions. The true value of threat intelligence is in its application.
173
Open Source threat intelligence (OSINT)
Open Source threat intelligence (OSINT) is a term used to refer to the data collected from publicly available sources to be used in an intelligence context.
174
ISACs
Information Sharing and Analysis Centers (ISACs) collect, analyze and disseminate actionable sector specific threat information to their members and provide members with tools to mitigate risks and enhance resiliency.
175
Threat Detection
Threat detection is the process of identifying artifacts (e.g. virus signatures, IP address, malicious URL, command and control connection, file changes, unexpected activity, behavioral anomalies) that are indicative of an attack (IOA) or an active exploit (IOC).
176
Indicator of an Attack (IOA)
Indicator of an Attack (IOA) is a proactive early warning sign that an attack may be imminent or already underway underway.
177
Indicator of Compromise (IOC)
Indicator of Compromise (IOC) is a reactive substantive or corroborating evidence that a system or network has been exploited.
178
Resiliency
Resiliency is the capability to continue operating even when there has been a fault, incident, or abnormal operating conditions.
179
Targeted Attack
Attacker Chooses a target for a specific objective
180
Opportunistic Attack
Attacker takes advantage of a vulnerable target (not previously known to them)
181
Amplification
Attacker uses an amplification factor to multiply its power.
182
Priviledge Escalation
Attacker focuses on obtaining elevated access to resources that are normally protected from an application or user.
183
Advanced Persistent Threat (APT)
A sophisticated attack in which an attacker gains access to a network and stays there undetected for a long period of time.
184
Zero-day
A threat that is exploited and was unknown before it was detected.
185
Primary Attack Vectors
- Digital Infrastructure.
- Human
- Physical Infrastructure.
186
Digital Infrastructure Attack Categories
- Spoofing
- Poisoning
- Hijacking
- Denial of Service (DOS)
- Code.
187
Spoofing
Impersonation an address, system or person.
| - Enables an attacker to act as the trusted source and redirect/manipulate actions
188
Poisoning
Manipulating trusted source of data (e.g. DNS)
| - Enables an attacker to act as the trusted source and redirect/manipulate actions.
189
Hijacking
Intercepting communication between two systems
| - Enables an attacker to eavesdrop, capture, manipulate, and or reuse data packets
190
Denial of Service (DOS)
Overwhelming communication between two systems
| - Enables an attacker to take control
191
Code / Firmware
Exploiting weaknesses in a server or client side code, applications or hardware.
- Enables an attacker to take control.
192
Supply Chain
A supply chain is a ecosystem of organizations, process, people and resources involved in providing a product or service.
- The supply chain represents the steps it takes to get the product or service to the consumer.
- The supply chain includes outsourced operations.
- The supply chain includes external providers.
193
Insourcing
Insourcing is when functions are performed by internal personnel
194
Outsourcing
Outsourcing is when functions are performed by third parties.
195
Supply Chain Risk Management (SCRM)
Supply Chain Risk Management (SCRM) is the implementation of strategies to manage uncertainty, identify vulnerabilities, and ensure continuity.
196
SSAE18
Statement on Standards for Attestation Agreements #18 (SSAE18) Service Organization Control (SOC) Reports are internal control report on the services provided by a service organization.
197
NIST SETA Model
- Security Education (Long term)
- Training (Intermediate)
- Awareness (Short-term)
198
Employee Awareness Programs
Employee Awareness Programs should include:
- On-boarding (initial and at 3 months) which includes polices, best practices, social engineering, duress, and reporting suspicious activity.
- Annual compliance and 'hot topic' training (instructor-led, recorded, online)
- Ongoing Awareness program.
- As needed, situational awareness communications.
199
Social Engineering
Social Engineering (SE) describes a class of techniques used to manipulate people by deception, into divulging information or performing an action.
200
Social Engineering Principles
- Authority
- Intimidation
- Consensus / Social Proof
- Scarcity
- Urgency
- Familiarity / liking
- Trust
201
Phishing
Pretexting using email.
202
Spear Phishing
Targeted version of phishing.
203
Whale
High profile phishing target
204
Vishing
Pretexting using voice (phone)
205
Hoax
Warning f a non-existent threat or offer-designed to defraud.
206
Watering Hole
Compromising a website or social media application frequented by the target.
207
Social Engineering - Physical Presence
- Impersonation.
- Shoulder Surfing.
- Piggybacking | Tailgating.
- Dumpster Diving.
208
Impersonation
Impersonation a "trusted" source in order to gain access.
209
Shoulder Surfing
Covert Observation.
210
Piggybacking | Tailgating
When an unauthorized person enters a checkpoint close behind, or in concert with authorized personnel.
211
Dumpster Diving
Rummaging through trash and recycling in search of information.
212
Social Engineering Defense Controls
User education, including general awareness and understanding of the importance of following security procedures and reporting suspicious activity. Supported by:
- Published policies and procedures (caller/visitor identification, document disposal)
- Technical Controls ( SPAM and content filtering)
- Physical Controls (surveillance, mantraps, anti-skimming).
