Domain 1 - Security and Risk Management Flashcards
Annualized Loss Expectancy, ALE
SLE x ARO, single loss expectancy x annual rate of occurence
Define Privacy
Confidentiality of Personal information, Personally identifiable information, PII
PII
Personally identifiable information
Procurement
Process of aquiring product from 3rd party. Security peeps should be involved early.
Vendor Governance, AKA Vendor managment
Ensures the organization is getting consistently good quality from the vendor
Acquisitions
a. Risk assessment should be conducted on the purchased company before merging networks.
Divesture
Splitting up one existing business into many. Very complex in terms of determining risk and ensuring security.
IAAA
Identity, Authentication, Authorization, Auditing
Information Security Governance
IS at the organizational level, senior management, policies, and processes, and staffing. Organizational priority as defined by leadership.
Policies
Describe the ‘why’ and the ‘when’ of an action.
High level mgmt directives. This is MANDATORY
Example Policies
NIST - 800-12
Procedures
step by step guide for accomplishing a task. Low level and specific. MANDATORY.
Standards
Describe the specific use of a technology. Example “All employess will use an Asus brand XYZ model PC,” or “All PCs will use Microsoft Office version ABC”
MANDATORY
Guidelines
Discretionary, NOT mandatory. Soft recommendations. i.e. “To create a strong password take the first letter of a sentance, and mix in some numbers and symbols.”
The Standard version of this would be - “All passwords must be at least 10 characters long, with upper case letters, lower case letters, numbers, and special characters.” The guideline example above is just suggesting an easy way to meet this standard, and also remember a password.
Baselines
Discretionary, NOT mandatory.
Uniform way of implementing a standard.
Example.
Standard = harden the system for security Baseline = harden the system by applying hte Cneter for Internet Security Linux Benchmarks.
Security Awareness
Awareness changes user behavior, to increase security.
security training
Provides a skillset to increase security.
Employee termination
firing an employee after a ladder of discipline has been exhasted.
Ladder of discipline
- coaching
- formal discusison
- verbal warning meeting w/ HR
- written warning w/ HR
- termination
Vendor, consultant, and contractor security
Vendors/contractors/consultants can introuduce more risk. Should be vetted/risk managed in a simliar way to an acquisition or new hire.
outsourcing/offshoring
thorough and accurate risk analysis must be performed. Again in a similar way to acquisition, vendors, contractors, etc.
Preventive access control
i. Prevent an action from occurring
ii. Examples
1. Limited priveleges of employees
2. Admin preventive control = background checks, drug screening
Detective Access Control
i. Alert someone during or after an attack
1. Intrusion detection system
2. Camera system
3. Door alarms
Corrective AC
i. Corrects a damaged system
1. Antivirus system that detects and quarantines bad files or deletes them
Recovery Access control
Restores functionality of system and organization.
- snapshots
- backups
- restoring files
Deterrent Access control
Scares threat actors away
- guard
- dog
Compensating Access control
Compensates for a weakness in another control
AC Type: Admin
AKA directive. implemented by creating and following organizational policy, procedrue. etc
Technical Controls
Software, hardware, firmware, that restricts logical access
Physical control
lock, fence, guard, dog, etc
Asset
valuable resource to protect.
Threat
potentially harmful occurence.
vulnerability
weakness that allows a threat to take place and/or cause harm.
Risk Formulas
threat x vulnerability =
or
Threat x vulnerability x impact =risk
