ISC Flashcards
What is the key difference in controls when changing from a manual system to a computer system?
Methodologies for implementing controls change. The controls almost always are different. Objectives and principles remain the same. Implementation of the principles are different.
What is the purpose of an organization’s company-wide acceptable use policy (AUP)?
An acceptable use policy (AUP) is a control document that is created by an organization to regulated and protect technology resources by assigning varying levels of responsibilities to job roles, listing acceptable behaviors by employees and vendors, and specifying consequences of those who violate the AUP. Users are often asked to sign and agree to the terms of an AUP prior to being granted access to systems, applications, and devices issued by the organization.
Define an Access Control List (ACL)
Is a list of rules that outlines which users have permission to access certain resources, such as a file, folder, directory, or other IT resources. Also administers account restrictions, which govern what type of action the user can execute using those resources, such as the ability to edit a file, apply read-only status, or execute a program. Access and account restrictions are enforced by controlling network traffic based on the rules defined in the ACL.
What are the two types of ACLs
Filesystem ACL:
These ACLs grant or deny privileges in an operating system by restricting access to certain files, folders, and directories.
Networking ACL:
These ACLs are used to regulate the type of network traffic that is allowed to flow across a network by configuring routers, switches, and other network devices with an array of lists to enforce. Networking ACLs are not only used for controlling access, but also for improving network performance by restricting or channeling the flow of data.
Define a Adverse Event
Is any event with a negative consequence. System crashes, packet floods, unauthorized use of system privileges, and unauthorized access to sensitive data would all be examples that best describe an adverse event.
What is the difference between Confidentiality and Privacy
Independent terms when it comes to cybersecurity.
Privacy:
Protects the rights of an individual and gives the individual control over what information they are willing to share with others.
Confidentiality:
Protects unauthorized access to information gathered by the company.
What are the System Conversion Methods in Change Management?
Direct:
Involves the organization ceasing the use of the old system and starting the new one immediately.
Parallel:
The new system is implemented while the old system is still in use for an extended period of time.
Pilot:
An organization performs a conversion on a small scale within a test environment while continuing to use the older system. Allows for validation and testing before rolling it out to the entire organization so adjustments can be made.
Phased:
Also referred to as gradual or modular conversion, this transition plan gradually adds volume to the new system while still operating the old system. Useful for businesses with distributed locations as it allows them to implement one site at a time.
Hybrid:
These are custom combinations of the above approaches, tailored to the unique needs of an organization.
What are the types of Data Storage?
Operational Data Store (ODS):
Is a repository of transactional data from multiple sources and is often an interim aria between an data source and data warehouses.
Data Warehouse:
Very large data repositories that are centralized and used for reporting and analysis rather than for transactional purposes.
Data Mart:
Is much like a data warehouse but is more focused on a specific purpose such as marketing or logistics and is often a subset of a data warehouse.
Data Lake:
Is a repository similar to a data warehouse, but it contains both structured and unstructured data, with data mostly being in its natural or raw format.
How is a document encrypted?
A sender used an algorithm to convert cleartext to ciphertext.
Cybersecurity Event vs Incident
Cybersecurity Event:
Is a change in the normal behavior of a given system, process, environment or workflow.
In other words: When something happens, it’s an event.
Occurs within a network or information system.
Examples: Employee flags a suspicious email. Someone downloads software (authorized or unauthorized) to a company device. A security lapse occurs due to a server outage.
Cybersecurity Incident:
Is a change in a system that negatively impacts the organization, municipality, or business. Might take place when a cyber attack occurs.
Examples: Employee replies to a phishing email, divulging confidential information. Equipment with stored sensitive data is stolen. A password is compromised through a brute force attack on your system.
Network Security
Media Access Control (MAC) Filtering
Is a way to control which devices can connect to your WiFi network based on their physical addresses.
This is a form of filtering in which an access point blocks access to unauthorized devices using a list of approved MAC addresses. A MAC address, also referred to as a physical or hardware address, is a unique identifier found on devices in a network that is used as an address for communication with other devices on that network.
What should service auditors do when it comes to Reporting Failures, System Incidents, and Concerns
They should gain an understanding of processes in place to report system failures, system incidents, and complaints by either external or internal system users by inquiring of management about the controls in place.
Who is responsible for identifying the nature, extent, and timing of system incidents in the service organization’s system description?
Management.
What are the ways to delete confidential information?
Physical destruction = involves the physical act of disassembling or changing the chemical construct of the data (i.e. through heat, pressure, or shredding).
Erasing = Performance of a delete operation of a file or its data.
Overwriting (Clearing) = Involves preparing media for reuse by replacing the old data with unclassified data.
Purging = Repeats the clearing process various times and may combine that process with another method, such as degaussing, which involves creating a strong magnetic field used to erase data on storage devices that use magnetism, such as magnetic tapes.
Which deletion of confidential data method has the least risk?
Physical destruction of data.
Whaat is the biggest risk to confidential information when deleting/purging confidential information from storage devices?
When data is removed, a residual magnetic flux or imprint may remain on storage devices where tools can reverse the effects of wiping.
What is the difference between Denial-of-Service (DoS) and Distributed Denial-of-Service (DDoS)?
DoS = An attacker floods a system’s network by congesting it with large volumes of traffic that are greater than the bandwidth it was designed to handle.
DDoS = These occur when multiple attackers or compromised devices are working in unison to flood an organization’s network with traffic. These attacks manipulate the operation of network equipment and services in such a way that they may be more powerful than a traditional DoS attack.
What is Data Obfuscation and what are the three most common obfuscation applications?
Obfuscation = is the process of replacing production data or sensitive information with data that is less valuable to unauthorized users.
Encryption = Scrambles unencrypted data using cryptography so that it can generally only be deciphered with a key.
Tokenization = Removes production data and replaces it with a surrogate value or token. Uses mathematical algorithms.
Masking = Swaps data with other like data so that the original identifying characteristics are disguised, or masked, while maintaining a similar structure to the unmodified data set.
What is a complementary user entity controls (CUECs)?
Are controls that are necessary to be implemented by the user entity, in combination with the service organization’s controls, to provide reasonable assurance that the control objectives stated in management’s description of the service organization’s system (SOC 1) or the service organization’s service commitments and system requirements (SOC 2) were achieved.
Who is responsible for determining whether to carve out or include a subservice organization?
Management.
What is the Carve-Out Method?
This method is most common and means that the subservice organization’s controls are NOT included in the scope of the SOC report.
The vendor has CARVED OUT all the controls that the subservice is responsible for and essentially make them not applicable.
What is the Inclusive Method?
In this method, the controls from the subservice organization that support normal operations are included in the SOC report and will be reviewed by the auditor.
When complementary user entity controls are identified, which sections of the service auditor’s SOC report will be amended to include language that references the complementary user entity controls?
Both the scope and opinion sections of the service auditor’s report will refer to the identified complementary user entity controls.
Describe Patch Management
Is an important part of minimizing security threats that works in conjunction with vulnerability management solutions. Keeps devices up to date and secure.
