Final Exam Flashcards
(107 cards)
1
Q
What is Risk Management
A
a process for identifying, minimizing and monitoring the risks for organizations
2
Q
Assess risk
A
Risk management activities:
Estimate the impact of the risk.
3
Q
Plan for risk management
A
Risk management activities:
After assessing the risk – creation of a plan of action / acceptance
4
Q
Manage / Mitigate risk
A
Risk management activities:
executing and tracking the risk mitigation plan to completion.
5
Q
Purpose of Risk Management
A
Ensure overall business and business assets are safe
6
Q
Purpose of Risk Management
A
Protect against competitive disadvantage
7
Q
Purpose of Risk Management
A
Compliance with Laws Rules and Regulations
8
Q
Purpose of Risk Management
A
Maintain a good public reputation
9
Q
Goal of Risk Management
A
Manage risks across business to acceptable level
10
Q
Goal of Risk Assessment
A
Identify and prioritize risks
11
Q
Cycle of Risk Management
A
Continuous
12
Q
Cycle of Risk Assessment
A
Typically have a start and finish
13
Q
Schedule of Risk Management
A
Ongoing
14
Q
Schedule of Risk Assessment
A
As needed
15
Q
Alignment of Risk Management
A
Aligned with budgeting cycles
16
Q
Alignment of Risk Assessment
A
At execution with budget cycles
17
Q
Executive Sponsor
A
What’s important
18
Q
Information Security
A
Prioritize risks
19
Q
IT Group
A
Best control solution
20
Q
Step 1
A
Identify Risk
21
Q
Step 2
A
Assess Risk
22
Q
Step 3
A
Control Risk
23
Q
Technical risk
A
Includes gap with technology
24
Q
Management risk
A
It includes lack of management experience and lack of planning.
25
Financial risk
Includes cash flow, capital and budget issues.
26
Project Risks
affect project schedule or resources.
27
Product Risks
affect product quality or performance of software.
28
Personnel risk
Includes staffing, inexperience and training problems.
29
Risk Control Strategy: Defense
Prevent the exploitation of the system via application of policy, training/education, and technology. Preferably layered security (defense in depth)
Counter threats
Remove vulnerabilities from assets
Limit access to assets
Add protective safeguards
30
Risk Control Strategy: Transferal
Shift risks to other areas or outside entities to handle
Can include:
Purchasing insurance
Outsourcing to other organizations
Implementing service contracts with providers
Involve Third Parties for risk monitoring and control
31
Risk Control Strategy: Mitigation
Creating plans and preparations to reduce the damage of threat actualization
Preparation should include a:
Incident Response Plan
Disaster Recovery Plan
Business Continuity Plan
32
Risk Control Strategy: Acceptance
Properly identifying and acknowledging risks, and choosing to not control them
Appropriate when:
The cost to protect an asset or assets exceeds the cost to replace it/them
When the probability of risk is very low and the asset is of low priority
33
Risk Control Strategy: Termination
Removing or discontinuing the information asset from the organization
Examples include:
Equipment disposal
Discontinuing a provided service
Firing an employee
34
Organizational
Examines the management control over IT and related programs, policies, and processes
35
Compliance
Pertains to ensuring that specific guidelines, laws, or requirements have been met
36
Application
Involves the applications that are strategic to the organization, for example those typically used by finance and operations
37
Technical
Examines the IT infrastructure and data communications
38
IT Security Audit Program Goals
Provide an objective and independent review of an organization’s policies, information systems, and controls.
39
IT Security Audit Program Goals
Provide reasonable assurance that appropriate and effective IT controls are in place.
40
IT Security Audit Program Goals
Provide audit recommendations for both corrective actions and improvement to controls.
41
Risk Analysis
Where is the risk?
How significant is the risk?
42
Threat profile
what threats or risks will affect the asset?
43
Threat probability
what is the likelihood of the threats happening?
44
Threat consequence
what impact or effect would the loss of the asset have on the operation of the organization or its personnel?
45
Computer and network passwords
Is there a log of all people with passwords (and what type). How secure is this ACL list, and how strong are the passwords currently in use?
46
Physical assets
Can computers or laptops be picked up and removed from the premises by visitors or even employees?
47
Data backups.
What backups of virtual assets exist, how are they backed up, where are the backups kept, and who conducts the backups?
48
Logging of data access.
Each time someone accesses some data, is this logged, along with who, what, when, where, etc.?
49
Access to sensitive customer data,
e.g., credit card info. Who has access? How can access be controlled? Can this information be accessed from outside the company premises?
50
Access to client lists.
Does the website allow backdoor access into the client database? Can it be hacked?
51
Emails.
Are spam filters in place? Do employees need to be educated on how to spot potential spam and phishing s? Is there a company policy that outgoing s to clients not have certain types of hyperlinks in them?
52
Preparing To Be Audited
Keep the fishing expedition at bay
to prevent or avoid an overly broad or invasive search for information, especially in legal or investigative contexts. It implies that someone is trying to gather information without specific evidence or grounds.
53
Technology Audit
Independent assessment of an organization’s internal policies, controls, and activities.
54
Technology Audit
You use an audit to assess the presence and effectiveness of IT controls and to ensure that those controls are compliant with stated policies.
55
What is Quality Assurance?
process oriented and focuses on Defect Prevention
a set of activities for ensuring quality in the holistic processes by which end results are created
Planned system of review, and sometimes audit, procedures conducted by personnel not involved in process execution
56
What is Quality Control?
end product oriented and focuses on Defect Identification
a set of activities for ensuring quality in process, products, or services
The activities focus on identifying defects in the end products
System of routine, planned technical activities implemented to measure and control the quality as execution occurs.
57
Application to Cybersecurity Governance Execution
focus of processes / controls in relation so standards & expectations
58
Application to Cybersecurity Governance Process Adherence
Allows for an analytical view on process adherence.
59
Application to Cybersecurity Governance
Process Improvement
Aides in identifying areas of improvement within programs.
60
Cloud Computing
the on-demand availability of computer system resources, especially data storage and computing power, without direct active management by the user.
61
Components of NIST definition of Cloud Computing
Five essential cloud characteristics
62
Components of NIST definition of Cloud Computing
Three cloud service models
63
Components of NIST definition of Cloud Computing
Four cloud deployment models.
64
Broad network access
Capabilities are available over the network and accessed through standard mechanisms.
65
Rapid elasticity
Cloud computing gives you the ability to expand and reduce resources according to your specific service requirement.
66
Measured service
Cloud systems automatically control and optimize resource use by leveraging a metering capability at some level of abstraction appropriate to the type of service
67
On-demand self-service
A cloud service consumer (CSC) can unilaterally provision computing capabilities, such as server time and network storage, as needed
68
Resource pooling
The provider’s computing resources are pooled to serve multiple customers using a multitenant model, with different physical and virtual resources dynamically assigned and reassigned according to consumer demand.
69
Infrastructure as a Service (IaaS)
To provision processing, storage, networks, and other fundamental computing resources
70
Platform as a Service (PaaS)
To deploy customer-created and acquired applications
71
Software as a Service (SaaS)
To use the provider’s applications
72
Private Cloud Pros
– Control / Security
– Availability
– Speed of Access
73
Private Cloud Cons
– Scalability
– Maintenance
74
Community Cloud Pros
– Security
– Legal/compliance
– Same Policy and Concerns
75
Community Cloud Cons
– Development
– Cost
76
Hybrid Cloud Pros
– High performance:
– Expanded capacity
– Scalability
– Security
– Low cost
77
Hybrid Clouds Cons
– Complex SLAs
– Complex networking
78
If cloud computing is so great, why isn’t everyone doing it?Uncertainty:
The cloud acts as a big black box, nothing inside the cloud is visible to the clients
Clients have no idea or control over what happens inside a cloud
79
If cloud computing is so great, why isn’t everyone doing it?Malicious Actors:
Even if the cloud provider is honest, it can have malicious system admins who can tamper with the VMs and violate confidentiality and integrity
80
If cloud computing is so great, why isn’t everyone doing it?Threats:
Clouds are still subject to traditional data confidentiality, integrity, availability, and privacy issues, plus some additional attacks
81
Consumer relies on provider to ensure
Data security and privacy
82
Consumer relies on provider to ensure
Resource availability
83
Consumer relies on provider to ensure
Monitoring and repairing of services/resources
84
Taxonomy of Fear Confidentiality
Fear of loss of control over data
Will the sensitive data stored on a cloud remain confidential?
Will cloud compromises leak confidential client data
Will the cloud provider itself be honest and won’t peek into the data?
85
Taxonomy of Fear Integrity
How do I know that the cloud provider is doing the computations correctly?
How do I ensure that the cloud provider really stored my data without tampering with it?
86
Taxonomy of Fear Availability
Will critical systems go down at the client, if the provider is attacked in a Denial of Service attack?
What happens if cloud provider goes out of business?
Would cloud scale well-enough?
87
Taxonomy of Fear Privacy issues raised via massive data mining
Cloud now stores data from a lot of clients, and can run data mining algorithms to get large amounts of information on clients
88
Taxonomy of Fear
Increased attack surface
Entity outside the organization now stores and computes data, and so
Attackers can now target the communication link between cloud provider and client
Cloud provider employees can be phished
89
Taxonomy of Fear Auditability and forensics (out of control of data)
Difficult to audit data held outside organization in a cloud
Forensics also made difficult since now clients don’t maintain data locally
90
Cloud Computing: who should use it?
the cloud provider’s security people are “better” than yours (and leveraged at least as efficiently),
91
Cloud Computing: who should use it?
the web-services interfaces don’t introduce too many new vulnerabilities, and
92
Cloud Computing: who should use it?
the cloud provider aims at least as high as you do, at security goals,
93
Account, Service and Traffic Hijacking Threat:
If an attacker gains access to the credentials, they can eavesdrop on your activities and transactions, manipulate data, return falsified information, and redirect your clients to illegitimate sites.
Using the credentials and passwords for longer time without changing and reusing the same for different accounts makes this type of attack easy.
94
Account, Service and Traffic Hijacking Remediation
Following the password rules to create strong passwords
Changing the passwords timely
Prohibiting the use of passwords on unknown machines and sharing of the passwords with other users
Multi Factor Authentication
95
Insecure APIs Threat
The security of the cloud services is dependent on how secure is their Application Programming Interface API’s
Accidental and malicious attempts must be taken into consideration when designing the APIs
Organizations are facing a variety of authenticity, confidentiality, and integrity, issues due to their dependence on a weak set of APIs
96
Insecure APIs
Analyze the security model of cloud provider interfaces.
Ensure strong authentication and access controls are implemented in concert with encrypted transmission
97
Denial of Service Threat
Distributed Denial of Service (DDoS) Attacks
Preventing users from accessing cloud services.
Using resource exhaustion attacks or software vulnerability attacks.
The cloud becomes irresponsive or legal users will pay more for using more resources
98
Denial of Service Remediation
Anomalous Behavior Analysis (ABA)
Intrusion Tolerance by using diversity and redundancy
99
Malicious Insiders Threat
Malicious insider threat is well-known to most organizations.
A provider may not reveal how it grants employees access to physical and virtual assets, how it monitors these employees, or how it analyzes and reports on policy compliance.
This kind of situation clearly creates an attractive opportunity for hobbyist hacker.
100
Malicious Insiders Remediation
Human resource required specifications should be part of legal contract.
Cloud Service Provider should provide transparently all security and management
practices
101
Abuse of Cloud Services Threat
The registration process for cloud resources has become so easy that anyone with a valid credit card can register and immediately begin using services.
Thus, spammers, malicious code authors, and other criminals have been able to conduct their activities with relative impunity
Thus PaaS and IaaS providers are suffering from these kind of attacks.
102
Abuse of Cloud Services Remediation
Strict initial registration and validation
Enhanced credit card fraud monitoring and coordination
Constant monitoring of customer network traffic.
Monitoring public blacklists for one’s own network blocks
103
Insufficient Due Diligence Threat
Organizations moving fast toward the cloud for its cost reductions, operational
efficiencies and improved security.
However, without a full understanding of the cloud service provider environment
and responsibilities, they are increasing their risk.
104
Insufficient Due Diligence Remediation
Organizations need to understand the risk of moving to the cloud.
24/7 Continuous Monitoring, Analysis, and Mitigation
105
Shared Technology Vulnerabilities Threat
Cloud Service Providers deliver their services in a scalable way by sharing infrastructure.
Cloud services depend on utilizing virtualization.
Virtualization Hypervisors, like any other software, have flaws that allow attackers with access to the guest operating system to attack the host.
This impacts the operations of other cloud customers and allow attackers to gain access to unauthorized data.
106
Shared Technology Vulnerabilities Remediation
Implementing and applying security best practices for both the installation and configuration processes
Continuously monitoring for the environment to detect unauthorized activities.
Enforcing strict access control and strong authentication for all critical operations.
Continuously searching for vulnerabilities and threats
107
