FITSP-M Flashcards
(100 cards)
1
Q
SP 800-30, rev 1
A
Conducting Risk Assessments
2
Q
SP 800-34
A
Contingency Planning Guide for Federal IT Systems
3
Q
SP 800-37, rev 2
A
Applying RMF
4
Q
SP 800-39
A
Managing Information Security Risk
5
Q
SP 800-40 rev 3
A
Patch and Vulnerability Management Program
6
Q
SP 800-41 rev 1
A
Firewalls and Firewall Policy
7
Q
SP 800-45 rev 2
A
Guidelines on e-mail security
8
Q
SP 800-47
A
Interconnecting IT systems
9
Q
SP 800-50
A
IT Security Awareness and Training Program
10
Q
SP 800-53, rev 4
A
Security Controls for Federal IT Systems
11
Q
SP 800-53A, rev 4
A
Assessing Security Controls
12
Q
SP 800-55, rev 1
A
Performance Measurement Guide for Information Systems
13
Q
SP 800-60
A
Mapping Information types to Security Categories
14
Q
SP 800-61, rev 2
A
Computer Security Incident Handling Guide
15
Q
SP 800-66, rev 1
A
HIPAA
16
Q
SP 800-70, rev 2
A
National Checklist Program
17
Q
SP 800-83
A
Malware Incident Prevention and Handling
18
Q
SP 800-92
A
Computer Security Log Management
19
Q
SP 800-94
A
IDS/IPS (IDPS)
20
Q
SP 800-100
A
Information Security Handbook: Managers
21
Q
SP 800-115
A
Technical Guide Information Security Testing and Assessments
22
Q
SP 800-122
A
Guide to Protecting Confidentiality of PII
23
Q
SP 800-128
A
Configuration Management
24
Q
SP 800-137
A
Continuous Monitoring (ISCM)
25
SP 800-144
Security and Privacy in Public Cloud Computing
26
FIPS 140-2
Cryptography
27
FIPS 180-4
Secure Hash Standard
28
FIPS 181
Automated Password Generator
29
FIPS 186-4
Digital Signature Standard
30
FIPS 190
Advanced Authentication
31
FIPS 191
LAN Security (Confidentiality, Integrity and Availability of the data)
32
FIPS 197
AES
33
FIPS 198-1
HMAC (Keyed-Hash Message Authentication Code)
34
FIPS 199
Security Categorization based on impact levels (low, moderate, or high)
35
FIPS 200
Minimum Security Requirements (Baselines)
36
FIPS 201-2
Personal Identity Verification PIV (smart cards)
37
HSPD-1
Creates Homeland Security Council and functions
38
HSPD-3
Homeland Security Advisory Team
39
HSPD-5
Management of Domestic Incidents
40
HSPD-7
(Replaced with PDD-21) Critical Infrastructure Identification/Priority/Protection
41
HSPD-8
National Preparedness
42
HSPD-12
Common Identification Standard for Federal Employees
43
HSPD-20
NSPD-51 National Continuity Policy / Continuity of government/operation.
44
HSPD 24
Biometrics for Identification for National Security
45
BOD 20-01
Develop and Publish a Vulnerability Disclosure Policy
46
BOD 19-02
Vulnerability Remediation Requirements for Internet-Accessible Systems
47
BOD 18-02
Securing High Value Assets
48
BOD 18-01
Enhance Email and Web Security
49
BOD 17-01
Removal of Kaspersky-branded Products
50
BOD 16-03
2016 Agency Cybersecurity Reporting Requirements
51
BOD 16-02
Threat to Network Infrastructure Devices
52
When a message is input to a hash algorithm, the output result is called a ____
Massage digest
53
FIPS 199 = Standards for security categorization of federal systems puts systems into what 3 categories?
Low- Limited damage
Moderate- Serious damage
High- Severe / Catastrophic damage
54
SP800-60 established security impact levels for loss of what 3 information types?
Confidentiality (encryption, Access control)
Integrity (unauthorized modification = Hashing)
Availability (add redundancy, power, weather)
55
SP800-____ is a dictionary of all controls to choose from for your system.
SP800-60 Mapping information types to security categories.
56
___ and ____ provide a disciplined and standard process that integrates information security and risk management activities into the system development life cycle.
Risk Management Framework (RMF)
| NIST SP800-37
57
Who is responsible for the information system?
Information System Owner
58
Who is responsible for the data on the system?
Information Owner
59
Who is responsible for the overall procurement of the system?
Program Manager
60
What does FedRAMP stand for?
Federal Risk Authorization Management Program
61
What are the 2 control documents?
SP800-53, SP800-53A
62
PII - the confidentiality impact level generally falls into the _____ range.
Moderate
63
What does SDLC stand for?
System Development Life Cycle
64
Risk Management is a process that requires organizations to do what 4 things?
FARM
| Frame Risk, Assess Risk, Respond to Risk, Monitor Risk
65
NIST Control Families
There are how many control families?
What are the 3 categories the control families are put in?
18
| 4 Technical, 9 Operational, 5 Managerial
66
NIST SP
| FIPS 200 mandates the use of SP800-_____
SP800-53
Organizations must employ all security controls in the respective security control baselines unless specific exceptions are allowed based on the tailoring guidance provided in NIST Special Publication
800-53.
67
A Security Control Assessment can only be _____ or ______.
satisfactory or other
68
_______ is a suite of specifications for organizing and expressing security-related in standard ways as well as related reference data, such as identifiers for software laws and security configuration issues.
SCAP Security Control Automation Protocol
69
FedRAMP is the automation tool for bringing ______ and ____ into the accreditation process.
Cloud and Virtualization
70
RMF Step 1 Categorize Information System
| The security categorization process is carried out by the _____ and ____.
Information System Owner and Information Owner/steward
71
What are the 3 levels of impact on organizations, operations, assets, or individuals?
Low- Limited
Moderate- Serious
High- Severe/Catastrophic
72
Continuous Monitoring Vocabulary
| What does CAESARS stand for?
Continous asset Evaluation, Situational awareness, and Risk Scoring = CAESARS
73
What is a dictionary of weaknesses that can lead to exploitable vulnerabilities?
Common Weakness Enumeration (CWE)
74
What complies with the National Vulnerability Database (NVD) and is the basis for automating all FISMA reporting?
SCAP - Security Control Automation Protocol
75
What are the 3 ways monitoring activities are recorded and reported?
Event driven
Time driven
Both
76
What are the five basic areas of the NIST Cybersecurity Framework?
```
Identify
Protect
Detect
Respond
Recover
```
77
The Security Assessment Report (SAR) contains a list of _____.
Vulnerability findings
78
Name the 3 types of authorizations.
Authority to Operate (ATO)
Denial of Authority of Operate (DATO)
Interim Authorization to Test (IATT)
79
RMF Assess Security Controls
| What are the 3 methods of assessment?
Testing
Interviewing
Examination
80
Name 3 roles that are assigned to government personal only.
CIO
Risk Executive
Senior Informational Security Officer
81
What are the 3 risk documents?
SP800-30
SP800-37
SP800-39
82
What are the 3 documents in a Security Authorization Package?
System Security Plan (SSP)
Security Assessment Report (SAR)
Plan of Action Milestones (POAM)
83
Security Categorization
| {(Confidentiality), (Integrity), (Availability)}
Security Categorization
| {(Confidentiality), (Integrity), (Availability)}
84
What are the 7 RMF steps?
```
1 Prepare
2 Categorize
3 Select
4 Implement
5 Assess
6 Authorize
7 Monitor
```
85
Cyberscope = FISMA Compliance reporting
Agencies must send security data about their system how often?
Monthy
86
DHS operates ____ for computer-related incidents.
DHS oversees the implementation of the ____ initiative.
US-CERT - US Computer Emergency Readiness Team
Trusted Internet Connection (TIC)
87
OMB is the ____ agency and
| DHS is the ____ agency for Cybersecurity Data and events.
```
OMB= reporting agency
DHS= Gathering agency
```
88
3 steps to address security at a higher level.
Prevention
Reaction
Correction
89
The Information Technology Management Reform Act of ____ is also called __________.
What are the 4 requirements?
1996, Clinger-Cohen Act
CIO
OMB oversite
Enterprise Archetecture
CPIC (Capital Planning and Investment Control)
90
What is FEA
Federal Enterprise Architecture
91
What is FISMA? When/how enacted?
Federal Information Security Management Act
| enacted 2002 as Title 3 of E-Government Act of 2002
92
What are FIPS?
Federal Information Processing Standard
FISMA requires federal agencies to comply with the standards
93
What are SPs?
Special Publications
| recommendations and guidance documents
94
What is NIST? and what does NIST issue?
National Institute of Standards and Technology
| FIPS and SPs
95
OMB issues what 2 types of documents?
Circulars - good for 2 years
| Memorandums - provide further explanations and guidance.
96
How long does OMB give you to report a PII breach? and who do you report it to?
1 hour
| CERT (Computer Emergency Readiness Team)
97
What type of encryption is EAS?
Symetric
98
SP800-64
Security in SDLC
99
SP800-18
Developing System Security Plan
100
SP800-65
Integration of IT Security into the Capital Planning and Investment Control Process / Asset Management
