Brainscape's Knowledge GenomeTM


Top Flashcards (Certified)
All Flashcards

CISSP > Domain 1: Security and Risk Management > Flashcards

Domain 1: Security and Risk Management Flashcards

(53 cards)

Start Studying
1
Q

CIA

A

Confidentiality, Integrity and Availability

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

States of Data

A

At rest
In process
In transit

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Password Masking CIA principle

A

Condifentiality

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Data in transit basic protection

A

TSL or SSL

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Confidentiality overt and covert techniques

A

Cryptography
Masking
Steganograhy

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Protection against system or software modification

A

Integrity

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Methods to ensure integrity

A 
CRC
Checksum
Message Digest
Hashes
MAC
Input Validation!!!
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Availability description

A

Provide timely access to a resource

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Availability metrics

A

Tolerance for losses: MTD/RTO/RPO
Lega: SLA
Life expectancy: MTBF/MTTR

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

MTBF

A

Mean Time Between Failure: the expected lifespan of the device

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

MTTR

A

Mean Time To Repair: how much time will be required to restore de component to functionality

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

RPO

A

Recovery Point Objective: how much data can be lost after a restoration

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

MTD

A

Maximum Tolerance Downtime: how long can the component/system can be down before our lose is unacceptable.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

SLA

A

Service Legal Agreement

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

IAAA

A

Identification
Authentication
Authorization
Accountability

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

FAR

A

False Accept Rate

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

FRR

A

False Reject Rate

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Access Control Models

A

DAC
MAC
RBAC
RuBAC

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

DAC

A

Discretionary Access Control: Zero knowledge

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

MAC

A

Mandatory Access Control: Labels

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

RBAC

A

Role Based Access Control

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

RuBAC

Study These Flashcards
A

Rule Based Access Control

23
Q

CRUD operations

Study These Flashcards
A

Create
Read
Update
Delete

24
Q

Accountability requirements

Study These Flashcards
A

Time
Action
Subject
Object

25
Tenets or secure architecture and design (16)
1. How much security is enough? 2. Defense in depth 3. Fail-safe 4. Economy of Mechanism (the K.I.S.S principle) 5. Completeness of Design 6. Least Common Mechanism 7. Open Design 8. Consider the Weakest Link 9. Redundancy 10. Psychological acceptability 11. Separation of Duties (SOD) 12. Mandatory Vacations 13. Job Rotation 14. Least privilege 15. Need to know 16. Dual Control
26
Risk
Likelihood that a threat will exploit a vulnerability in an asset
27
Threat (amenaza)
Has the potential to harm an asset
28
Vulnerability
A weakness; lack of a safeward
29
Exploit
Instance of compromise
30
Security Controls
Protective mechanisms to secure vulnerabilities Safeguards: Proactive (Deters and/or Prevents) Countermesures: Reactive (Detects and/or Corrects)
31
Secondary Risk
Risk event that comes as a result of another risk response
32
Residual Risk
The amount of risk left over after a risk response. | Total Risk * Control GAP
33
Fallback Plan
Plan B
34
Workarround
Unplanned response
35
Asset
Something that has value and we need to protect
36
Total Risk
Amount of risk without implementing mitigation. | Threats * Vulnerabilities * Asset Value
37
Risk assessment
Identify an valuate assets; identify threats and vulnerabilities
38
Risk analisys
Value of potential risks
39
Risk mitigation
Respond to risk
40
Risk monitoring
Risk 4 ever
41
Risk Management (AAMM)
Assessment Analisys Mitigation Monitoring
42
Risk assessment methodologies
OCTAVE FRAP NIST 800-30
43
NIST 800-30 9 steps
1. System characterization 2. Threat identification 3. Vulnerability identification 4. Control analisys 5. Likelihood determination 6. Impact analysis 7. Risk determination 8. Control recommendations 9. Results documentations
44
Risk analysis types
Qualitative: Nature. (High, Medium, Low). Objective opinions. Quantitative: Determine money value. More expertise and time
45
Delphi Technique
Qualitative risk analysis technique
46
AV
Asset Value: Money
47
EF
Exposure Factor: Percentage of loss expected when an event happends
48
SLE
Single Loss Expectancy: Cost of a single occurrence of a threat instance. AV * AF
49
ARO
Annual Rate of Occurrence: How often the threat is expected to materialize
50
ALE
Annual Loss Expectancy: Cost per year as a result of a threat. SLE * ARO
51
TCO
Total Cost of Ownership: total cost of implementing safeguards and maintenance.
52
ROI
Return On Investment: Money saved implementing a safeguard. ALE_before - ALE_after - TCO
53
Risk mitigation strategies
Reduce: final step is Avoid (eliminate) Accept: Cost of mitigation > Asset Value. Final step is Reject (not studying the risk) [3 monkeys] Transfer: Insurance or SLA

CISSP (8 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2025 Bold Learning Solutions. Terms and Conditions