Exam 2 Flashcards
(50 cards)
Service level agreement (SLA)
This type of agreement is a formal contract between your organization and the outside firm that details the specific services the firm will provide
Blanket purchase agreement (BPA)
A streamlined method of meeting recurring needs for supplies or services, a BPA creates preapproved accounts with qualified suppliers to fulfill recurring orders for products or services. BPAs can be very helpful in simplifying the process of recurring purchases
Memorandum of understanding (MOU)
Also called a letter of intent, a MOU is an agreement between two or more parties that expresses areas of common interest that result in shared actions. MOUs are generally less enforceable than a formal agreement but still more formal than an oral agreement.
Interconnection security agreement (ISA)
Often an extension of a MOU, the ISA serves an agreement that documents the technical requirements of interconnected assets. This type of document is most often used to specify technical needs and security responsibilities of connected organizations.
Discretionary access control (DAC)
- Operating systems-based DAC policy considerations (access control method, new user registration, periodic review)
- Application-based DAC
- Permission levels
Waterfall Method
Based on traditional project management practices in which extensive planning precedes any development. Progress through a project moves forward along a well-defined path. stairs going down
Agile Method
A newer family of project management approaches that depend on very short sprints of activity. Agile works well in very dynamic environments where requirements change and are often revisited, blender
SQL injection
A code injection technique used to attack data-driven applications, in which malicious SQL statements are inserted into an entry field for execution
Cross-site scripting
A type of injection in which malicious scripts are injected into otherwise benign and trusted websites, the practice of getting a webpage to do something that is not intended, adding javascript into a request can cause additional requests to other servers which include sensitive information that the other server can record
Indentification
Who is asking to access the asset? Someone claims an identity.
Authentication
Can their identities be verified? Proving identity.
Accountability
How are actions traced to an individual to ensure the person who makes data or system changes can be identified?
Authorization
What, exactly, can the requestor access? And what can they do?
Job rotation
A policy that compels employees to rotate into different jobs, or at least rotate some of their duties to prevent fraud because employees know another person will be soon assuming their duties
Least privilege
Every module (such as a process, a user, or a program) must be able to access only the information and resources that are necessary for its legitimate purpose
Separation of duties
Key concept of internal control, disseminate tasks and associated privileges for a specific security process among multiple people, restricts the amount of power or influence held by any individual
Outsourcing security
Advantages:
- High level of expertise because it focuses on security
Disadvantages:
- The outsourcing firm might not possess internal knowledge
- You won’t develop in-house capability or talent and have to continue to pay for these services indefinitely
Ethics
- Set the example
- Encourage adopting ethical guidelines and standards
- Inform users through security awareness training
- A code of ethics helps ensure professionalism
Information security awareness programs
Planning, implement, operate and maintain, monitor and evaluate
Authorization
What, exactly, can the requestor access? And what can they do?
Rule-based access control
Focused on the rules associated with the data’s access or restrictions, these rules may be parameters such as allowing access only from certain IP addresses or denying access from certain IP addresses
False positive error
When a scanner or intrusion prevention system flags a security vulnerability that you do not have
False negative error
When you’re told you don’t have a vulnerability when in fact you do
Cloud computing (Advantages/Disadvantages)
Advantages:
- No need to maintain a data center
- No need to maintain a disaster recovery site
- Outsourced responsibility for performance and connectivity
- On-demand provisioning
Disadvantages:
- More difficult to keep private data secure
- Greater danger of private data leakage
- Demand for constant network access
- Client needs to trust the outside vendor
