ISC Flashcards
(36 cards)
Replication
A technique used in data storage and computing to create and maintain copies of data, systems, or applications across multiple devises, servers or data centers
Replication involves creating and maintaining one or more copies of data from a primary storage device, server, or application to one or more secondary devises, servers or applications.
Can be done with synchronously (In real-time) or asynchronously (with a delay)
CRM
A software tool that helps businesses manage their interactions with customer and prospects. It is used to manage customer data, sales, marketing and customer service activities
Expert Systems
Computerized systems that are designed to mimic the decision-making abilities of a human expert in a specific field.
Private Networks
Owned and operated by a single organization
Advantages
- Increased security
- Flexibility
- Better performance
Disadvantages
- Higher costs
- Limited access
- Limited scalability
NIST SP 800-53
Provides guidelines for selecting and implementing security and privacy controls for federal information systems and organizations. Mandatory for agency or contractor of agency that processes, stores or transmits data for a U.S. federal information system, unless the system involves national security. May also be used voluntarily by any organization for risk management. SECURITY AND PRIVACY
Types of Cloud
Private Cloud - dedicated to a single organization. Most expensive.
Community Cloud - shared by a specific group of organizations with similar requirements and concerns. Scale at a lower pace than Public cloud.
Public Cloud - resources such as servers, storage and applications are made available to the general public via the internet. Owned and operated by third-parties. Lowers costs but higher risk of data leak.
Hybrid Cloud - Combines benefits of public and private clouds.
Worm
Malware, similar to a virus, that replicates itself and spreads to other computers. Does not need to attach itself to legitimate program or file to do so.
NIST Privacy Framework
National Institute of Standards and Technology developed this voluntary tool to help organizations manage privacy risks and protect individual’s privacy rights.
3 parts - Core, Profiles & Implementation Tiers (see next cards)
NIST Privacy Framework - Core
5 Functions
- Identify - Governance, risk assessment & data processing eco system.
- Govern - Laws and norms, strategy and priorities.
- Control - Data processing control, data minimization.
- Communicate - Transparency and individual participation
- Protect - Emphasis on data privacy
NIST Privacy Framework - Profiles
Current Profile - Privacy outcomes already achieved.
Target Profile - The Org’s desired privacy outcome.
By comparing current vs. target the Org can determine gaps and prioritize areas for improvement.
NIST Privacy Framework - Implementation Tiers
4 Tiers
- Partial - Ad-hoc and not formalized. Org may be unaware of privacy risks.
- Risk-Informed - Aware of privacy risks, some practices approved my management, lack Org-wide approach.
- Repeatable - Consistent Org-wide approach, regularly renew and update risk practices.
- Adaptive - Adapts privacy practices based on lessons learned and predictive indicators. Part of Org culture.
Machine Learning
Subfield of AI where computers or machines have the ability to learn from data and improve their performance on a specific task without being explicitly programmed to do so.
Executive Support System
A system that assists senior management with making non-routine decisions, helps analyze competitor activity, and identifies activities and acquisitions that might protect the company from cyclical business swings
Data Warehouse
A large, centralized repository for storing structured and semi- structured data from different sources within an organization.
Tokenization
Replaces sensitive data with non-sensitive tokens, maintaining the data’s structure while protecting its actual value.
Suitable for handling credit card data while preserving its format.
Access Levels
Least-Privilege: Limits the access rights and permissions of users, processes or systems to the minimum necessary to perform their intended tasks.
Zero-Trust: Assumes that all users, devices and systems are untrusted until verified otherwise.
Whitelisting: Created a list of trusted or approved applications , processes or systems and denies access to all others.
Need to Know: Sensitive info is only disclosed to those who need it to perform their job duties.
Data Lake
Central repository that stores structured and unstructured data at any scale. Data is stored in raw format and it not transformed or cleaned before being loaded into the Data Lake.
Systems Development Life Cycle
Steps in SDLC
- Planning
- Analysis
- Design
- Development
- Testing
- Implementation
- Maintenance
Complier
Software that converts source code written in a programming language into machine code that can be executed by a computer
Value Added Network (VAN)
Network that provides value-added services such as data storage and secure transmission to business and organizations
Router
A connection point between a home or office network and the internet.
MIS
Management Information Systems - computerized systems that provide managers with the information needed to make informed decisions.
Flowcharting
Used to document an organization’s information system and related control procedures.
Visually depicts the flow of transactions through the process from initiation to storage of data. Specific shapes are used to represent physical media used for files and processes
Decision Support Systems
Used for semi-structured problems that require the exercise of judgment. Provides access to relevant data and analysis tools.
