Domain 1: Security and Risk Management Flashcards
What does the term annualized loss expectancy (ALE) mean as it relates to a risk management program?
The ALE is a dollar amount that estimates the loss potential from a risk in the span of one year. The ALE is calculated by multiplying the ARO (annual rate of occurrence) multiplied by the SLE (single loss expectancy).
For example, if the SLE = $100 and the ARO = 0.1, the ALE is $100 × 0.1 = $10. This value is used to figure out the amount of money that should be earmarked to protect this asset from this threat.
What is copyright?
Copyright is a form of intellectual property that gives the creator of an original work exclusive rights for a certain time period in relation to that work, including its publication, distribution, and adaptation, after which time the work enters the public domain. Copyright applies to any expressible form of an idea or information that is substantive and discrete.
Why should organizational assets be classified?
Classifying organizational assets ensures that they receive the appropriate level of protection, and classifications indicate the priority of that security protection.
The primary purpose of data classification is to indicate the level of confidentiality, integrity, and availability protection that is required for each type of data set.
Classifying data allows a company to organize it according to its sensitivity to loss, disclosure, or unavailability. Once data is segmented according to its sensitivity level, the company can decide what security controls are necessary to protect different types of data.
Evidence can be categorized into several types. Among these are:
- best evidence
- secondary evidence
- direct evidence
- conclusive evidence
- opinions
- circumstantial evidence
- hearsay evidence
Define opinion evidence.
When a witness testifies, the opinion rule dictates that she must testify to only the facts of the issue and not her opinion of the facts. This is slightly different from when an expert witness is used, because an expert is used primarily for his educated opinion. Most lawyers call in expert witnesses to testify and help the defending or prosecuting sides better understand the subject matter so that they can help the judge and jury better understand the matters of the case.
What is maximum tolerable downtime (MTD)?
MTD is the longest outage time that can be endured by a company. The business impact analysis (BIA) identifies which of the company’s critical systems are needed for survival and estimates the outage time that can be tolerated by the company as a result of various unfortunate events.
Common MTD timeframes include the following:
- Nonessential: 30 days
- Normal: 7 days
- Important: 72 hours
- Urgent: 24 hours
- Critical: Minutes to hours
What are the four objectives of a disaster recovery plan (DRP)?
The objectives of the disaster recovery plan (DRP) usually include the following:
- Protecting an organization from major computer services failure
- Minimizing the risk to the organization from delays in providing services
- Guaranteeing the reliability of standby systems through testing and simulation
- Minimizing the decision making required by personnel during a disaster
The goal of disaster recovery is to minimize the effects of a disaster and take the necessary steps to ensure that the resources, personnel, and business processes resume operation in a timely manner.
What are the three primary components of information security that make up the security triad?
- Availability
- Integrity
- Confidentiality
These three components comprise the AIC triad The level of security required to accomplish these principles differs per company, because each has its own unique combination of business and security goals and requirements. All security controls, mechanisms, and safeguards are implemented to provide one or more of these principles, and all risks, threats, and vulnerabilities are measured for their potential capability to compromise one or all of the AIC principles.
What occurs during the plan design and development phase of the creating a business continuity plan (BCP)?
The team prepares and documents the detailed recovery plan, formulating methods to ensure systems and critical functions can be brought online quickly. They document procedures, recovery solutions, roles and tasks, and emergency responses.
What is a trade secret?
A trade secret is a confidential design, practice, or method that is proprietary. For a trade secret to remain valid, the owner must take certain security precautions. Trade secrets are deemed proprietary to a company and often include information that provides a competitive edge. The information is protected as long as the owner takes the necessary protective actions.
Evidence can be categorized into several types. Among these are:
- best evidence
- secondary evidence
- direct evidence
- conclusive evidence
- opinions
- circumstantial evidence
- hearsay evidence
Please define conclusive evidence.
Conclusive evidence is introduced to prove a fact that is supposed to be so conclusive that there can be no other truth as to the matter—evidence so strong it overpowers contrary evidence, directing a fact-finder to a specific and certain conclusion. Conclusive evidence is irrefutable and cannot be contradicted. Conclusive evidence is strong and does not require corroboration.
What are the roles in a data classification system that a person might take?
- Data owner
- Data custodian
- Data user
- Information systems auditor
The data owner is responsible for the protection of the data. The owner is typically a manager or executive in an organization and is responsible for the following:
- Making the original classification determination
- Reviewing the classification levels periodically
- Delegating the responsibility of the data protection duties to the data custodian
The data custodian is the technical caretaker of the data. Duties include:
- making backups
- restoring data
- implementing and maintaining countermeasures
- administering the access controls.
The data user refers to anyone who uses the data. Users must use “due care” when accessing data. They must ensure that the data is used only in accordance with allowed policy and abide by the rules set for the classification of the data. -
An Information systems auditor is responsible for providing reports to the senior management on the effectiveness of the security controls by conducting regular, independent audits.
What is the difference between quantitative risk analysis and qualitative risk analysis?
Quantitative risk analysis attempts to assign monetary values to assets and the impact of given risks to arrive at a quantifiable dollar value for each risk.
Qualitative risk analysis addresses more intangible values of a data loss and focuses on measures other than the pure hard costs.
Qualitative analysis does not assign numbers and monetary values to components and losses. Quantitative risk analysis attempts to assign real and meaningful numbers to all elements of the risk analysis process. Each element within the analysis (asset value, threat frequency, severity of vulnerability, impact damage, safeguard costs, safeguard effectiveness, uncertainty, and probability items) is quantified and entered into equations to determine total and residual risks. Qualitative methods walk through different scenarios of risk possibilities and rank the seriousness of the threats and the validity of the different possible countermeasures based on opinions.
There are three primary options for backing up data to tape:
- full
- incremental
- differential
Define the incremental backup option.
Incremental backup backs up all the files that have changed since the last full or incremental backup and sets the archive bit to 0. When the data needs to be restored, the full backup data is laid down and then each incremental backup is laid down on top of it in the proper order. If a company experiences a disaster and uses the incremental process, it first needs to restore the full backup on its hard drives and lay down every incremental backup that was carried out before the disaster took place. So, if the full backup was done six months ago and the operations department carried out an incremental backup each month, the restoration team would restore the full backup and start with the older incremental backups and restore each one of them until they were all restored.
What constitutes qualitative criteria evaluated in the vulnerability assessment component of the business impact analysis (BIA)?
Qualitative loss criteria can consist of the following:
- The loss of competitive advantage or market share
- The loss of public confidence or credibility, or incurring public embarrassment
- Employees unable to report to work due to damage to their personal assets (house, car, and so on)
Qualitative and quantitative impact information should be gathered and then properly analyzed and interpreted. The goal is to see exactly how a business will be affected by different threats. The effects can be financial, operational, or both.
In the (ISC)2 model, what step follows after the business impact analysis (BIA)?
Creating a recovery strategy.
The recovery strategy is a process for how to rescue the company after a disaster takes place. Recovery strategy processes integrate mechanisms such as establishing alternate sites for facilities, implementing emergency response procedures, and possibly activating the preventive mechanisms that have already been implemented.
According to the Internet Architecture Board’s (IAB) document “Ethics and the Internet” (RFC 1087), what activities are defined as unacceptable and unethical?
Any activity is defined as unacceptable and unethical that purposely:
- Seeks to gain unauthorized access to the resources of the Internet
- Disrupts the intended use of the Internet
- Wastes resources (people, capacity, computer) through such actions
- Destroys the integrity of computer-based information
- Compromises the privacy of users
A business continuity plan (BCP) needs to be part of all organizations’ security programs. Please describe a BCP and why it is important.
A BCP is a plan an organization develops to respond to unforeseen incidents, accidents, and disasters that can affect the normal operation of the organization’s critical functions. The critical processes of an organization need to be identified, protected, and redundant. The goal of a business continuity plan is to ensure that the organization can survive no matter what happens to it. The plan also involves dealing with customers, partners, and stakeholders through different channels until everything returns to normal.
After a business continuity plan (BCP) is in place, the plan must be continually maintained for it to be effective. What is the best way to maintain a BCP?
One of the simplest and most cost-effective and process-efficient ways to keep a plan up-to-date is to incorporate it within the change management process of the organization. The change management process should be updated to incorporate fields and triggers that alert the BCP team when a significant change will occur and should provide a means to update the recovery documentation. The BCP should also be tested periodically to ensure it still meets the needs of a changing business and technology environment.
Why is digital evidence commonly referred to as hearsay evidence?
It can be very difficult to determine if computer-generated material has been modified before it is presented in court. Since this type of evidence can be altered without being detected, the court cannot put a lot of weight on this evidence. Many times, computer-generated evidence is considered hearsay in that there is no firsthand proof backing it up.
Evidence can be categorized into several types. Among these are
- best evidence
- secondary evidence
- direct evidence
- conclusive evidence
- opinions
- circumstantial evidence
- hearsay evidence
Define direct evidence and show how it differs from circumstantial evidence.
Direct evidence is testimony and other types of proof that expressly or straightforwardly prove the existence of a fact. It is different from circumstantial evidence, which is evidence that, without going directly to prove the existence of a fact, gives rise to a logical inference that such a fact does exist. Direct evidence is evidence which, if believed, proves the existence of the fact in issue without inference or presumption. It is evidence that comes from one who speaks directly of his own knowledge on the main or ultimate fact to be proved, or who saw or heard the factual matters that are the subject of the testimony.
Extranets, VANs, and shared networks with external entities create what type of legal concern?
Downstream liability
Downstream liability can take place when companies that share network access, or other resources, with outside parties does not provide the necessary level of protection. If the company’s negligence affects the other company it is working with, the affected company can sue the upstream company.
What is a BIA?
The business impact analysis (BIA) describes what impact a disaster could potentially have on critical business functions, as well as evaluating the threats to these functions and the costs of a potential outage. Conducting a BIA is a functional analysis in which a team collects data through interviews and documentary sources; documents business functions, activities, and transactions; develops a hierarchy of business functions; and finally applies a classification scheme to indicate each individual function’s criticality level.
How does ISO 17799 relate to British Standard 7799?
ISO 17799 was derived from the British Standard 7799 (BS7799) The most commonly used standard for security program development and maintenance is ISO 17799, which was derived from the de facto standard, British Standard 7799 (BS7799). It is an internationally recognized information security management standard that provides high-level conceptual recommendations on enterprise security.
What are three possible factors that determine the value of an asset?
- Initial and outgoing cost of purchasing, licensing, and supporting the asset
- Value to the organization’s production operations
- Value in the external marketplace
The initial and ongoing cost of purchasing, licensing, and supporting the asset also includes the cost to acquire or develop the asset.
The asset’s value to the organization’s production operations is the determination of cost to an organization if the asset is not available for a certain period of time.
The asset’s value as established in the external marketplace includes the value the asset might have to competitors or what others will to pay for a given asset.
You can categorize evidence by several types. These categories basically determine the strength and usability of a particular piece of evidence. Name all 7 types of evidence.
- Best evidence
- Secondary evidence
- Direct evidence
- Conclusive evidence
- Opinions
- Circumstantial evidence
- Hearsay evidence
Name at least five areas of critical business functionality that must be taken into account when developing a business continuity plan.
The development of a business continuity plan should include all areas that are critical for running the business, which could include (but is not limited to) the following:
- Networks and computer equipment
- Voice and data communications resources
- Human resources and personnel security issues
- Transportation of equipment and personnel
- Environment issues (such as HVAC)
- Data, software, and applications
- Supplies (paper, forms, cabling, and so on)
- Documentation and media
The organization’s current technical environment must be understood. This means the planners have to know the intimate details of the network, communications technologies, computers, network equipment, and software requirements that are necessary to get the critical functions up and running.
One common technique that disrupts access to computer systems is the denial-of-service (DoS) attack. Describe DoS.
Denial of service (DoS) is the act of using so much of the resources of a target system that the system’s services are no longer available to other clients. An example of a DoS attack is flooding a website with so many requests that either the bandwidth is consumed or the maximum number of connections is reached. DoS attacks are commonly initiated through the use of botnets: an army of compromised PCs controlled by the attacker to launch the attack.
Evidence can be categorized as to how good or useful it will be as a tool in a criminal prosecution. What would be considered best evidence?
Best evidence is the primary evidence used in a trial because it provides the most reliability. An example of something that would be categorized as best evidence is an original signed contract. Oral evidence is not considered best evidence because there is no reliable proof that supports its validity, and it therefore does not have as good a standing as legal documents.
The Computer Ethics Institute has developed a “Ten Commandments of Computer Ethics.” Name the ten commandments.
- Thou shalt not use a computer to harm other people.
- Thou shalt not interfere with other people’s computer work.
- Thou shalt not snoop around in other people’s computer files.
- Thou shalt not use a computer to steal.
- Thou shalt not use a computer to bear false witness.
- Thou shalt not copy or use proprietary software for which you have not paid.
- Thou shalt not use other people’s computer resources without authorization or proper compensation.
- Thou shalt not appropriate other people’s intellectual output.
- Thou shalt think about the social consequences of the program you are writing or the system you are designing.
- Thou shalt always use a computer in ways that ensure consideration and respect for your fellow humans.
If a computer crime is investigated by law enforcement agents, what should be done to ensure that the evidence that is confiscated does not hurt the company’s production activities and productivity?
Critical systems and data should be identified and a request should be made to copy all data for future use. Backup copies will not be acceptable to the agents for investigation. In most cases, law enforcement agents will work with a company that reported a computer crime so that the investigation does not negatively affect the company.
What constitutes quantitative criteria evaluated in the vulnerability assessment component of the business impact analysis (BIA)?
Quantitative loss criteria can consist of the following:
- Financial losses from loss of revenue, capital expenditure, or personal liability resolution
- Additional operational expenses due to the disruptive event
- Expenses due to loss of specific number of buildings, equipment, or other assets
- Financial loss from resolution of violation of regulatory or compliance requirements
Qualitative and quantitative impact information should be gathered and then properly analyzed and interpreted. The goal is to see exactly how a business will be affected by different threats. The effects can be financial, operational, or both.
What are the seven prescribed steps to develop a business continuity plan?
- Develop the continuity planning policy statement.
- Conduct the business impact analysis (BIA).
- Identify preventive controls.
- Develop recovery strategies.
- Develop the contingency plan.
- Test the plan and conduct training and exercises.
- Maintain the plan.
Develop the continuity planning policy statement. Write a policy that provides the guidance necessary to develop a BCP and that assigns authority to the necessary roles to carry out their tasks.
Conduct the business impact analysis (BIA). Identify critical functions and systems and allow the organization to prioritize them based on necessity. Identify vulnerabilities and threats, and calculate risks.
Identify preventive controls. After threats are recognized, identify and implement controls and countermeasures to reduce the organization’s risk level in an economical manner.
Develop recovery strategies. Formulate methods to ensure systems and critical functions can be brought back to normal or near normal condition quickly.
Develop the contingency plan. Write procedures and guidelines for how the organization can stay functional in a crippled state.
Test the plan and conduct training and exercises. Test the plan to identify deficiencies in the BCP and conduct training to properly prepare individuals on their expected tasks.
Maintain the plan. Put in place steps to ensure the BCP is a living document that is updated regularly.
Software and data backup are important operations. Backups enable you to recover data when the systems that normally house the data have been destroyed or otherwise made unavailable. Please name the three most common types of data backup.
- Full backup
- Incremental backup
- Differential backup
Full backup is just what it sounds like; all data is backed up and saved to some type of storage media. During a full backup, the archive bit is clear, which means that it is set to 0.
Incremental backup backs up all the files that have changed since the last full or incremental backup and sets the archive bit to 0. When the data needs to be restored, the full backup data is laid down and then each incremental backup is laid down on top of it in the proper order.
Differential backup backs up the files that have been modified since the last full backup. When the data needs to be restored, the full backup is laid down first and then the differential backup is put down on top of it. The differential process does not change the archive bit value.
At times, classified information might be released as authorized. What are instances in which this might occur?
- Management approval: The data owner with appropriate authorizations might approve the release if deemed necessary to carry out approved organizational tasks.
- Contractual requirement: The release of classified data might be required pursuant to a signed contract.
- Court order: Classified information might be released to satisfy a court order.
- Modification in requirements: Data no longer holds the level of protection required in the past.
Data can change in its level of protection requirements based on organizational decisions. It is important to periodically review the classification of data and other organizational assets. The classification level may need to increase or decrease depending upon organizational needs or circumstances. For example, if a government agency classifies a data set as Secret and then the information is announced on a TV news station, it no longer needs to be protected at that level of protection—it has been released and is now Unclassified.
With respect to a risk management program, what is the single loss expectancy (SLE)?
Single loss expectancy (SLE) is a dollar amount assigned to a single occurrence of an event that represents the company’s potential loss amount if a specific threat were to take place. The SLE is calculated by multiplying the EF times the asset value. For example, an asset valued at $1,000 that has an EF of 10 percent would have an SLE of $1,000 × 10 percent = $100.
After a business continuity plan (BCP) is developed and implemented, it is important to test it on a regular basis. Name at least three different types of drills or exercises that can be used.
- Checklist
- Structured walk-through
- Simulation testing
- Parallel testing
- Full-interruption testing
A checklist is usually a paper-based review of the steps in the BCP by management. In this type of test, copies of the BCP are distributed to the different departments and functional areas for review. This is done so each functional manager can review the plan and indicate if anything has been left out or if some approaches should be modified or deleted.
A structured walk-through is a walk-though of the steps of the BCP that introduces disruptive events in an exercise format where key business management discusses the steps taken to remediate the disruption.
A simulation is a test that takes a lot more planning and people. In this situation, all employees who participate in operational and support functions, or their representatives, come together to practice executing the disaster recovery plan based on a specific scenario. The scenario tests the reaction of each operational and support representative. Again, this is done to ensure specific steps were not left out and certain threats were not overlooked. It acts as a catalyst to raise the awareness of the people involved.
A parallel test is done to ensure that the specific systems can actually perform adequately at the alternative offsite facility. Some systems are moved to the alternative site and processing takes place. The results are compared with the regular processing that is done at the original site. This test points out any necessary tweaking, reconfiguring, or steps that need to take place.
Full-interruption testing is the most intrusive to regular operations and business productivity. The original site is actually shut down and processing takes place at the alternative site. The recovery team fulfills its obligations in preparing the systems and environment for the alternative site. All processing is done only on devices at the alternative offsite facility.
What is a patent?
A patent grants the owner a legally enforceable right to exclude others from practicing or using the invention’s design for a defined period of time.
One technique an attacker might use that does not involve a direct attack on a computer system is social engineering. Define social engineering.
Social engineering is much like an old-fashioned con game, in that the attacker uses the art of manipulation to trick a victim into providing private information or improper access. Social engineering predates the computer era. Today it uses many techniques, including phishing emails and website links to get a user to reveal personal or corporate data.
A type of attack a person might employ to collect information that does not involve compromising a computer system directly is dumpster diving. What is dumpster diving?
Dumpster diving involves searching discarded material (trash) for items with important information (documents, CDs, and such). Although not technically a computer crime, dumpster diving can provide the data required to complete a computer crime.
One way an attacker can gain access to sensitive information is through the use of keystroke logging. What is keystroke logging?
Keystroke logging is an attack that is accomplished with software or hardware devices. These devices or software components can record everything a person types, including usernames, passwords, and account information. The hardware version of these devices is usually installed while users are away from their desks. Hardware keystroke loggers are completely undetectable except for their physical presence. Software versions use programming to hook into kernel-level processes to record keyboard-specific data.
An attack in which attackers try to fool a person or system into believing they are something they are not is referred to as spoofing. List some common spoofing techniques.
There are several techniques for spoofing:
- Internet Protocol (IP) address spoofing
- Domain Name System (DNS) spoofing
- Address Resolution Protocol (ARP) spoofing
The term “IP address spoofing” refers to the creation of IP packets with a forged (spoofed) source IP address for the purpose of concealing the identity of the sender or impersonating another computing system.
DNS spoofing is the act of returning the wrong IP address as the result of a DNS query.
ARP spoofing is the act of returning an incorrect MAC address in response to an ARP request.
What is the relationship between a damage assessment and an activation phase?
The damage assessment determines what if any phase of the business continuity plan (BCP) needs to be activated. After a disaster, the coordinator or another identified leader must carry out a disaster assessment so the team can know which phase to go into next. If the damage is extreme and threatens the survivability of the company, then it goes into the first phases of BCP. If the event was smaller and mainly IT related, the team moves into DRP phases.
The damage assessment will indicate what phase to activate, which is formally called the activation phase. After this information is collected and assessed, it will also indicate what teams need to be called to action and whether the BCP actually needs to be activated.
If there is proof that damage was caused and that the damage was a company’s fault, what does this indicate?
Proximate causation. If proximate causation is proved, then a company may be found liable. Conversely, for a company to be found liable, proximate causation must be proven. This means that it can be proven that the company was actually at fault and responsible for a negative activity that took place.
Many things can be lost during a disaster. What is the most devastating resource to production if lost?
Data loss needs to be addressed as a top priority. Today data and information are considered gold to many companies, the loss of which could be devastating. Although this may seem insensitive and one would guess the loss of human life to be the most devastating, a company’s survival is dependent upon critical processes that need to continue. Once the processes are implemented, it is the data that must be restored to ensure that the business functions can continue.
What is the definition of authentication within information security management?
Authentication is a process to verify the identity of a subject requesting the use of a system and access to network resources. Combined with identification and authorization, authentication is one of the three steps necessary for granting a subject access to an object.
To understand the “whys” in crime, it is necessary to understand the MOM. What does MOM stand for?
MOM stands for motive, opportunity, and means.
Motive is the “who” and “why” of a crime. A person might be driven by the excitement, challenge, and adrenaline of committing a crime. Understanding the motive for a crime is an important piece in figuring out who would engage in such an activity.
Opportunity is the “where” and “when” of a crime. Opportunities usually arise when certain vulnerabilities or weaknesses are present. Here’s an example of opportunity: If a company does not have a firewall, hackers and attackers have all types of opportunities within that network.
Means pertains to the abilities a criminal would need to be successful. Suppose a crime fighter was asked to investigate a complex embezzlement that took place within a financial institution. If the suspects were three people who knew how to use a mouse, keyboard, and word processing application, but only one of them was a programmer and system analyst, the crime fighter would realize that this person might have the means to commit this crime much more successfully than the other two individuals.
What is risk analysis (RA)?
A risk analysis identifies assets, discovers the threats that put them at risk, and estimates the possible damage and potential loss a company could endure if any of these threats becomes real. The results of the risk analysis help management construct a budget with the necessary funds to protect the recognized assets from their identified threats and develop applicable security policies that provide direction for security activities.
With respect to a risk management program, what is a safeguard?
A safeguard is a software configuration, hardware, or procedure that eliminates a vulnerability or reduces the risk of a threat agent from exploiting a vulnerability. Safeguards are also called countermeasures or security controls.
Describe the two BS7799 parts and contrast them.
The British Standard has two parts:
- BS7799 Part I, which outlines control objectives and a range of controls that can be used to meet those objectives
- BS7799 Part II, which outlines how a security program can be set up and maintained.
BS7799 Part II also served as a baseline that organizations could be certified against. An organization would choose to be certified against the ISO 17799 standard to provide confidence to their customer base and partners and be used as a marketing tool. To become certified, an authorized third party would evaluate the organization against the requirements in ISO 17799 Part II. The organization could be certified against all of ISO 17799 Part II or just a portion of the standard.
With respect to due diligence, list at least five procedures managers of an organization should implement.
Means to prevent the organization’s computer resources from being used as a source of attack on another organization’s computer system
- Backups
- Scans for malicious code
- Business continuity and disaster recovery plans
- Local and remote access control
- Elimination of unauthorized and unsecured modems
- Organizational security policies, procedures, and guidelines
- Personnel screening procedure
To be admissible, evidence must be sufficient, reliable, and relevant to the case at hand. What does it mean for evidence to be relevant?
For evidence to be relevant, it must have a reasonable and sensible relationship to the findings.
The evidence is related to the crime in that it shows that the crime has been committed; it can provide information describing the crime; it can provide information as to the perpetrator’s motives; it can verify what had occurred; and it can fix the crime’s time of occurrence. For example, if a judge rules that a person’s past traffic tickets cannot be brought up in a murder trial, this means the judge has ruled that the traffic tickets are not relevant to the case at hand. Thus, the prosecuting lawyer cannot even mention them in court.
What is the goal of awareness and training with respect to the BCP?
Training users and making them aware of BCP procedures helps to make sure all employees know what to do and how to do it in case of an emergency. Employees assigned to specific tasks must be trained to carry out needed procedures. Plan for cross-training of teams if possible, so those team members are familiar with a variety of recovery roles and responsibilities.
What is the definition of ARO (annualized rate of occurrence)?
The ARO is a number that represents the estimated possibility of a specific threat taking place within a one-year timeframe. For example, a lightning strike that might occur in a given location once a year would have an ARO of 1 year × 1 event = 1. An area where lightning strikes occur only once every 10 years would have an ARO of 0.1.
When understanding the potential business impact of an outage by conducting a business impact analysis (BIA), the company’s team should try to reduce this impact and mitigate these risks by implementing preventive measures. List at least 8 types of preventive measures that can be taken.
- Preventive mechanisms might include some of the following components:
- Fortification of the facility in its construction materials
- Redundant servers and communications links
- Power lines coming in through different transformers
- Redundant vendor support
- Purchasing of insurance
- Purchasing of UPSs and generators with fuel backup
- Data backup technologies
- Media protection safeguards
- Increased inventory of critical equipment
- Fire detection and suppression systems
- Preparing and testing a calling-tree
- Awareness trainings
Performing various types of tests to identify additional vulnerabilities Instead of just waiting for a disaster to hit to see how the company holds up, countermeasures should be integrated to better fortify the company from the impacts that were recognized. Appropriate and cost-effective preventive methods and proactive measures are more preferable than reactionary methods. Which types of preventive mechanisms need to be put in place depends upon the results of the BIA.
A part of the evidence lifecycle is proper preservation of evidence. What are some recommended procedures for preserving evidence?
To be properly preserved, the evidence must not be subject to damage or destruction. To preserve evidence, it is recommended that one:
- Does not prematurely remove power.
- Backs up the hard disk image using disk imaging hardware or software.
- Avoids placing magnetic media in the proximity of sources of magnetic fields.
- Stores media in a dust- and smoke-free environment at proper temperature and humidity.
- Write-protects media
Authenticate the file system by creating a digital signature based on the contents of a file or disk sector. Preserving the original evidence also prevents inadvertent alteration of original evidence during examination.
Although illegal in the United States without approval from a judge (in most cases), wiretapping is used both legally and illegally. Define wiretapping.
Wiretapping is the monitoring of telephone and Internet conversations by a third party, often by covert means. The wiretap is so named because, historically, the monitoring connection was applied to the wires of the telephone line being monitored and drew off, or tapped, a small amount of the electrical signal carrying the conversation. Wiretapping is illegal in the United States without a court order. Legalized wiretapping by police or other recognized governmental authority is otherwise known as lawful interception.
There are different plans that should be developed for business continuity and disaster recovery. Describe business resumption and continuity of operations plans individually.
The business resumption plan focuses on how to re-create the necessary business processes that need to be reestablished instead of focusing on just IT components.
The continuity of operations plan (COOP) establishes senior management and a headquarters after a disaster. The business resumption plan is process-oriented instead of procedural-oriented. The continuity of operations plan (COOP) outlines the roles, authorities, orders of succession, and individual tasks.
With respect to the business continuity plan (BCP), what is the difference between salvage and recovery?
In a salvage effort, an organization attempts to collect resources that can still be used post-disaster.
In a recovery operation, the focus is on moving services or functions to an alternative location to restore a business process.
- Salvage efforts can include the following:
- Irreplaceable items and related documentation
- Vital information such as employee and accounting records, succession lists, inventories, and data
- Other items that directly support your mission
- Items that are unique, most used, most vital for research, most representative of subject areas, and least replaceable or most valuable
- Items most prone to continued damage
There are three primary options for backing up data to tape:
- full
- incremental
- differential
Define the full backup option.
A full backup option is just what it sounds like: all data is backed up and saved to some type of storage media. During a full backup, the archive bit is clear, which means that it is set to 0. A company can choose to do full backups only, in which case the restoration process is just one step, but the backup and restore processes could take a long time.
If an employee is a suspect in a crime, what group within the organization must be involved?
It is imperative that the company gets human resources involved if an employee is considered a suspect in a computer crime.
The human resources department knows the laws and regulations pertaining to employee treatment and can work to protect the employee and the company at the same time.
What are the four methods for addressing a risk?
- Risk reduction
- Risk transference
- Risk acceptance
- Risk avoidance
Risk reduction involves modifying processes or altering an environment to reduce the risk, or implementing safeguards and security controls to mitigate the risk to an acceptable level.
Risk transference involves assigning or transferring the potential impact of a potential loss to another party (such as an insurance company).
Risk acceptance refers to accepting the risk as it is without attempting to reduce it, with the intent of simply absorbing the loss if there is impact to an asset.
Risk avoidance entails eliminating the vulnerability (application, system, process, technology, etc.) or otherwise discontinuing the activity that is causing the risk.
How does an organization determine what safeguards or controls to implement when using quantitative risk analysis?
When the risk analysis has been completed and the ALE has been computed, the organization must determine the cost of implementing appropriate controls (purchase cost, installation costs, maintenance, and development). The ALE then needs to be computed again given the new control. If the new ALE is less than the old ALE plus the costs of the control, the control is worth implanting from a pure dollar assessment.
In the context of information security, what is a control?
Controls are security features that control how users and systems communicate and interact with other systems and resources.
They protect the systems and resources from unauthorized access and can be components that participate in determining the level of authorization after an authentication procedure has successfully completed. The following controls are examples of the three categories of controls as they pertain to information security to achieve management’s security directives:
Administrative controls: These include the developing and publishing of policies, standards, procedures, and guidelines; risk management; the screening of personnel; conducting security awareness training; and implementing change control procedures.
Technical controls (also called logical controls): These consist of implementing and maintaining access control mechanisms; password and resource management, identification and authentication methods; security devices; and the configuration of the infrastructure.
Physical controls: These entail controlling individual access into the facility and different departments; locking systems and removing unnecessary floppy or CD-ROM drives; protecting the perimeter of the facility; monitoring for intrusion; and environmental controls.
When performing a risk assessment, what is the exposure factor (EF)?
Exposure factor is the percentage of loss a realized threat can have on a certain asset. EF is a subjective value used to assign an impact on an asset for risk assessment purposes. For example, a threat that makes FTP unavailable on a given server might be assessed an exposure factor of 15 percent. The EF value is used in calculating SLE:asset value × exposure factor (EF) = SLE
One option for a backup site is to have a reciprocal agreement for recovery site facilities. What are the disadvantages of a reciprocal agreement for backup sites?
Disasters are difficult to predict, let alone affects that will take place after the disaster. The effects of a disruptive event might impact the partner as well.
Additionally, the agreements are difficult to enforce. Reciprocal agreements have been known to work well in specific businesses, such as newspaper printing. These businesses require specific technology and equipment that isn’t available through any subscription service. These agreements follow a “you scratch my back and I’ll scratch yours” mentality. For most other organizations, they are generally, at best, a secondary option for disaster protection.
What are the four areas that must be assessed to determine risk in a risk management program?
- Threat
- Risk
- Frequency
- Certainty
The identification of risk to an organization entails defining four basic elements: threat, risk, frequency, and certainty. Team members must ask the following:
- What event could occur? (threat)
- What could be the potential impact? (risk)
- How often could it happen? (frequency)
- What level of confidence do we have in the answers to the first three questions? (certainty)
Much of this information is gathered through internal surveys, interviews, or workshops.
What is the level of involvement of senior management in security policies?
The senior and executive management in an organization sets the overall organization emphasis on security. It must be clear to employees that directives come from senior management and that the entire management staff supports the security policies.
Computers and the information processed on them usually have a direct relationship with a company’s critical missions and objectives. Because of this level of importance, senior management should make protecting these items a high priority and provide the necessary support, funds, time, and resources to ensure that systems, networks, and information are protected in the most logical and cost-effective manner possible.
Define software piracy.
Software piracy is a copyright infringement that involves the unauthorized copying of computer software.
Copyright infringement of this kind is extremely common in several parts of the world. Most countries have copyright laws that apply to software, but they are better enforced in some countries than others. In the United States, copyright law protects the right of an author to control the public distribution, reproduction, display, and adaptation of his original work.
As part of a business impact analysis (BIA) an organization might need to conduct a vulnerability assessment. How does a vulnerability assessment contribute to the BIA?
Conducting a vulnerability assessment enables the BIA team to identify the types and severity of vulnerabilities present for a given asset, which can then be used to determine the overall risk to that asset.
A vulnerability assessment is the process of identifying, quantifying, and prioritizing (or ranking) the vulnerabilities in a system or environment. The business impact analysis (BIA) seeks to identify the potential impact of given events on business functions.
Within the scope of information security and risk management, what does the term accountability mean?
Accountability is a security principle indicating that individuals need to be identifiable and must be held responsible for their actions.
Accountability provides the capability to attribute any action on a given system back to the source that initiated that action. Audit trails, logs, and physical security devices like closed-circuit television (CCTV) support accountability.
What is the prudent person rule?
The prudent man rule “requires officers to perform duties with diligence and care that ordinary, prudent people would exercise under similar circumstances.”
Management has the obligation to protect the organization from losses due to natural disasters, malicious code, compromise of proprietary information, and damage to reputation, violation of the law, employee privacy suits, and stockholder suits. Management must follow the prudent man rule, and officers of an organization must exercise due care or reasonable care to carry out their responsibilities to the organization.
Evidence has its own lifecycle, and the individuals involved with the investigation need to understand the phases of the lifecycle and properly follow them. What are the five phases in an evidence lifecycle?
- Collection
- Identification
- Storage
- Preservation and/or transportation
- Presentation in court
- Return to owner.
Collection involves the following:
- Collect all relevant storage media
- Make image of hard disk before removing power
- Print out screen
- Avoid degaussing equipment
- Identification involves tagging and marking all evidence
- Storage in a proper environment protects media from erasure or damage.
When developing a disaster recovery plan (DRP), you might need to include plans for a recovery site. What options are available when considering a plan for an alternative or backup site?
Many options are available to planners, and they vary in cost, reliability, and effectiveness. These options include the following:
- A reciprocal agreement where a business enters into a cooperative arrangement with another business to leverage existing excess capacity to support the other’s operations in an emergency
- Hot, warm, or cold sites
- Multiple service locations
- Hosted services
What are the three specific types of sites are available for backup or recovery sites?
- Cold site
- Warm site
- Hot site
Cold site: An empty room with only rudimentary electrical power and computing capability. It might have a raised floor and some racks, but it is not ready for use. It might take several weeks to get the site operational.
Warm site: An improvement over a cold site; this facility has data equipment and cables and is partially configured. It could be made operational in anywhere from a few hours to a few days.
Hot site: This facility is ready to go. It is fully configured and equipped with the same system as the production network. Although it is capable of taking over operations at a moment’s notice, it is the most expensive option discussed.
Information security policies generally fall into one of three categories. Define the types of policies found in a security plan.
- Advisory: Strongly advises employees as to which types of behaviors and activities should and should not take place within the organization
- Informative: Informs employees of certain topics. It is not an enforceable policy, but rather one that teaches individuals about specific issues relevant to the company
- Regulatory: Ensures that the organization is following standards set by specific industry regulations or legislative requirements. It is detailed and specific to a type of industry.
A security policy is an overall general statement produced by senior management (or a selected policy board or committee) that dictates what role security plays within the organization. It is through these policies that security programs can be set up with a strong foundation and an organized method of response to security issues, as well as expectations for personnel within the organization as to who is in charge during certain kinds of incidents.
Different types of security policies can be implemented in an organization. These policies can be adapted to fit the specific needs of their environment.
What is a failure modes and effects analysis?
Failure Modes and Effects Analysis (FMEA) is a method for determining functions, identifying functional failures, and assessing the causes of failure and its effects through a structured process. The application of this process to a chronic failure enables the determination of where exactly the failure is most likely to occur. This is very helpful in pinpointing where a vulnerability exists, as well as determining exactly what kind of scope the vulnerability entails—meaning, what would be the secondary ramifications of its exploitation?
List at least six criteria parameters an organization may use to determine the sensitivity of data once they have settled on a classification scheme.
- The age of data
- The level of damage that could be caused if the data were disclosed
- The level of damage that could be caused if the data were modified or corrupted
- Legal, regulatory, or contractual responsibility to protect the data
- Effects the data has on national security
- Who should be able to access the data
- Who should maintain the data
- Where the data should be kept
- Who should be able to reproduce the data
- Which data requires labels and special marking
- The usefulness of the data
- Whether encryption is required for the data
- Whether separation of duties is required
- Lost opportunity costs that could be incurred if the data were not available or were corrupted
Once the classification scheme is decided upon, the company or government agency must develop the criteria it will use to decide what information goes into which classification.
Today many types of computer crimes occur, and the list is continually expanding as new exploits are discovered. List as many types of computer crimes as you can.
The most common types of computer crimes today include:
- Denial of service
- Password theft
- Network intrusion
- Wiretapping
- Social engineering
- Illegal content
- Fraud
- Dumpster diving
- Software piracy
- Malicious code
- Spoofing attacks
- Information warfare
- Masquerading
- Keystroke logging
- Man-in-the-middle
- War driving
- Shoulder surfing
- Identity theft
- Phishing
- Spam
- Hacking
When conducting an investigation, care must be taken in many aspects of your work to make a solid legal case against anyone accused of a crime. One aspect that is essential is the chain of custody of evidence. Please describe the chain of custody.
A chain of custody is a history that shows how evidence was collected, analyzed, transported, and preserved in order to be presented as evidence in court. Because electronic evidence can be easily modified, a clearly defined chain of custody demonstrates that the evidence is trustworthy.
There are many phases to business continuity and disaster recovery planning. Describe the reconstitution phase.
When a company needs to move back into its original site or a new site after a disaster, the company is ready to enter into the reconstitution phase. The company is always vulnerable while operating in a backup facility, and is not out of an emergency state until it is back in operation at the original primary site or a new site that was constructed to replace the primary site. Many logistical issues need to be considered as to when a company must return from the alternate site to the original site
What does the term authorization mean as it pertains to security management?
Authorization is the granting of access to a given object when a subject has been properly identified and authenticated.
Authorization is also the collection of rights and privileges an entity (user or process) has on a given system.
In conducting a business impact analysis (BIA), there are eight basic steps. Name the steps in a BIA.
- Select individuals to interview for data gathering.
- Create data-gathering techniques (surveys, questionnaires, and so on).
- Identify the company’s critical business functions.
- Identify the resources these functions depend upon.
- Calculate how long these functions can survive without these resources.
- Identify vulnerabilities and threats to these functions.
- Calculate the risk for each different business function.
- Document findings and report them to management.
What is security governance?
Security governance is the set of responsibilities and practices exercised by the board and executive management of a company or organization with the goal of providing strategic direction, ensuring that objectives are achieved, ascertaining that risks are managed appropriately, and verifying that the enterprise’s resources are used responsibly.
Security governance is all of the tools, personnel, and business processes necessary to ensure that the security implemented meets the organization’s specific needs. It requires organizational structure, roles and responsibilities, performance measurement, defined tasks, and oversight mechanisms.
Define due diligence.
Due diligence means that the company properly investigated all its possible weaknesses and vulnerabilities.
With respect to due diligence, managers should implement the following procedures:
- Means to prevent the organization’s computer resources from being used as a source of attack on another organization’s computer system
- Backups
- Scans for malicious code
- Business continuity and disaster recovery plans
- Local and remote access control
- Elimination of unauthorized and unsecured modems
- Organizational security policies, procedures, and guidelines
- Personnel screening procedure
How does a disaster recovery plan (DRP) differ from a business continuity plan (BCP)? Describe a DRP and how it differs from a BCP.
A disaster recovery plan (DRP) is carried out when everything is still in emergency mode and everyone is scrambling to get all critical systems back online.
Continuity planning provides methods and procedures for dealing with longer-term outages and disasters and is information technology (IT) focused.
The goal of disaster recovery is to minimize the effects of a disaster and take the necessary steps to ensure that the resources, personnel, and business processes can resume operation in a timely manner. This is different from continuity planning, which provides methods and procedures for dealing with longer-term outages and disasters.
There are three primary options for backing up data to tape:
- full
- incremental
- differential
Define the differential backup option.
A differential backup operation backs up only every modified data element since the last time a full backup was completed. This means that if full backups are done every Sunday and differential backups are done nightly, a file modified on Monday will be backed up every day of the week until the next full backup (the following Sunday).
With respect to a risk management program, what is a vulnerability?
A vulnerability is the existence of a flaw or condition that can be exploited in the absence or weakness of sufficient security controls.
