Brainscape's Knowledge GenomeTM


Top Flashcards (Certified)
All Flashcards

Security Plus > Domain 5 > Flashcards

Domain 5 Flashcards

(85 cards)

Start Studying
1
Q

Security Policy

A

Sets overall vision and goals for Information Security. Defines Why behind security measures. General statements. Policies are major input to standards

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Security Standards

A

Translate the Policy into specific technical requirements and best practices. What and When for security goals. Mandatory

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Security Procedure

A

Provide detailed instructions on how to implement standards. Defines How

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Security Guidelines

A

Offer additional recommendations and best practices that can be adopted to further enhance security. They are not mandatory. Least specific.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Acceptable Use Policy (AUP)

A

Allowed/Appropriate Uses of the organisations IT resources

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Information Security Policy

A

Sets overall direction for information security

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Business Continuity Policy

A

Defines organisations overall strategy for business continuity

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Disaster Recover Policy

A

Focuses on recover from disasters

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Incident Response Policy

A

Sets high-level direction for how organisations will identify, contain, eradicate and recover from security incidents

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Software Development Lifecycle (SDLC)

A

Guidance that Software development teams must follow in creating software

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

FIPS 140-2/3

A

Mandatory standard for protection of sensitive data within federal systems

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Board

A

Highest level of authority

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Committees

A

Subgroups that focus on specific areas or tasks, reporting to the Board

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Government Entities

A

Eg NIST - These entities issue security regulations, standards and Best practices that organisations must comply

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Centralized

A

Decisions are managed by central security team

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Decentralized

A

Delegates security decisions and controls to some extent to business units and departments

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Data Owner

A

Legal rights and complete control over a single piece of data. Member of senior Management. Can delegate day-to-day activities. Cannot delegate total responsibility

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Data Custodian

A

Responsible for safe custody, transport, and storage of data. IT Department

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Data Processor

A

Legal person, public authority, agency or other body which processes personal data solely on behalf of data controller

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Data Controller

A

Person or entity that controls that controls processing of the data

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Data Subject

A

Person who can be identified

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Data Steward

A

Data’s context and meaning are understood and business rules governing the data usage are known and followed

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Risk Identification

A

Process of identifying the threats and vulnerabilities that exist in operating environment

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Risk Assessment

A

Process of Identifying, analysing, evaluating and prioritizing potential risks

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Ad hoc Risk Assessment
One time assessments in response to a specific event
26
Recurring Risk Assessment
Assessments conducted periodically
27
One-Time Risk Assessment
One time assessment - In response to security incident or management request
28
Continuous Risk Assessment
Automated such as recurring system scan integrated into daily operations
29
Quantitative Risk Analysis
Assigns dollar Value to evaluate effectiveness of countermeasures
30
Qualitative Risk Analysis
Scoring System to rank effectiveness of countermeasures. Low/Medium/high
31
Impact
Potential consequences or negative effects that could occur if the risk materializes
32
Asset Value
Monetary value of the asset
33
Exposure Factor (EF)
Percentage of loss if a specific asset were violated by a realised risk
34
Single Loss Expectancy (SLE)
Cost associated with a single realized risk against a specific asset. SLE == Asset Value X Exposure Factor (%)
35
Annualized Rate of Occurrence (ARO)
Expected frequency with which a specific threat or risk will occur within a single year. Example risk occurs every 5 years = 1/5 =0.2
36
Annualized Loss Expectancy
SLE XARO = ALE - How much will you loose per year. ALE = Asset value X Exposure Factor X ARO
37
Risk Register
Track Potential Issues
38
Risk Matrix
Heat map . Visual Representation of risks affecting a company
39
Key Risk Indicators (KRIs)
Measurable metrics that signal potential changes
40
Risk Owner
Assigned designated owner
41
Risk Threshold
Level of risk tolerance established by the organisation
42
Risk Appetite
Risk an organisation is willing to accept without mitigating
43
Risk Tolerance
Ability to take on risk
44
Risk Exception
Temporary deviation for a defined period
45
Risk Exemption
Permanent deviation
46
Risk Reporting
Risk discovered and includes recommendations as well
47
Business Impact Analysis (BIA)
Includes 2 benefits Cost Benefit Analysis and Return on Investment
48
Recovery Point Objective (RPO)
Max tolerable data loss between last backup and disaster
49
Recovery Time Objective (RTO)
Duration or time within which a business process must be restored
50
Mean time between Fails (MTBF)
Time for how long IT infrastructure will continue to work before it fails
51
Mean time to Repair (MTTR)
Time how long it will take to get hardware/software back online
52
Right to Audit Clause
Written into supply chain contracts allow auditor can visit the premises to inspect
53
Service Level Agreements
Stipulate Performance Expectation
54
Memorandum of Understanding
Formal agreement between 2 parties intention to work together towards common goal. Lacks binding contract
55
Memorandum of Agreement
Serves as a legal document and describes terms and details of the agreement. MOA is legal contract
56
Master Service Agreement
Agreement for vendors that you will work with repeatedly. Has compliance and process requirements
57
Statement of Work
SOW is legal document created after MSA . SOW has requirements, expectations and deliverables
58
Business Partner Agreement
2 companies or individual who want to participate in a business venture to make a profit
59
Right to be forgotten
Deletion of their personal data
60
Attestation
Independent Verification of an organisation adherence to specific controls or standards
61
Penetration Testing
Actively assesses deployed security controls, trying to exploit vulnerabilities by simulating or performing an attack
62
Offensive Pentest
Focuses on technical security of computer systems and networks attempting to exploit vulnerabilities to gain unauthorised access
63
Defensive Pentest
Focuses on evaluating the effectiveness of existing security controls to withstand attacks
64
Integrated Pentest
Combines Physical, Offensive and Defensive techniques
65
Known Environment
White box test - Substantial/ Full Information
66
Unknown Environment
Black box test - Completely Blind
67
Partially Known Environment
Grey Box Test - Limited Information
68
Rules of Engagement
Purpose and Scope of Pentesting
69
Passive Reconnaissance
Not interacting with the target - Involves gathering data from publicly available sources ( Searching Internet, Reviewing Media, Analysing DNS records, Using Search Engines) - Google Dorking
70
Active Reconnaissance
Interacts Directly with Target (Using Port Scanners, Sending Ping sweeps, Utilizing vulnerability scanners, Employing social engineering techniques)
71
Authority
Position, Responsibility or Affiliation that grants the attacker the authority to make the request
72
Intimidation
Suggesting you may face negative outcomes
73
Scarcity
Similar to Urgency - Limited Opportunity, diminishing Availability
74
Consensus
Claiming that someone in a similar position or peer has carried out the same task
75
Familiarity
Liking - Attempting to establish a personal connection
76
Urgency -
Time Sensitivity to demand action
77
Trust
Citing Knowledge and experience
78
SPAM
Unsolicited Email
79
SPIM
SPAM over Instant Messaging
80
Dumpster Diving
Gathering important details (Intelligence ) from things people have thrown in the Trash
81
Tailgaiting
Unauthorised individual follow you without badging in themselves
82
Eliciting Information
Casual Conversation to extract information
83
Shoulder Surfing
Criminal Practice steal your personal data by spying over your shoulder
84
Pharming
Online Scan where website traffic is manipulated thru DNS, redirects a user to different website
85

Security Plus (4 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2025 Bold Learning Solutions. Terms and Conditions