Brainscape's Knowledge GenomeTM


Top Flashcards (Certified)
All Flashcards

Exam Revision > ISM First Half > Flashcards

ISM First Half Flashcards

(63 cards)

Start Studying
1
Q

What is Information Security Management

A

Defines + manages controls that an organisation implements to protect confidentiality, availability and integrity of assets from threats

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What is an Information Security Management System

A

Procedure for managing information security

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Name some ISO standards

A

IS0 27000, 27001, 27002

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What is an asset in ISM

A

Anything with value to an organisation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What is a threat in ISM

A

Potential cause of an unwanted incident

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What is a vulnerability in ISM

A

Weakness of an asset or control that can be exploited

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What is a risk in ISM

A

Effect of uncretainty on objectives

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What is impact in ISM

A

Result of an incident

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What are security controls in Information security management?

A

Activites that are taken to manage risks

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Name the four purposes of security controls (ERTA)

A

Eliminate, Reduce, Transfer, Accept

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What is identity in ISM?

A

Information that distinguishes one entity from another.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What is authentication in ISM?

A

Assurance of an entities’ identity

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What is authorisation in ISM?

A

Permission granted to an entity to access a resource

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What is accountability in ISM?

A

Ensures actions of an entity can be traced

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What is an audit in ISM?

A

Review of a party’s ability to meet approval agreements

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What is compliance in ISM?

A

Meeting requirements of a standard.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What is an ISMS?

A

Information Security Management System

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

How is an ISMS implemented?

A

Socio-technical system, staff via training, ongoing evaluation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What is the ISO27001?

A

Contains requirements for establishing, implementing, maintaining and improving an ISMS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

How does the ISO27001 protect information?

A

Focused on information assets. Protects people, then facilities, then business activity, then information technology.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

What is ISO27001 driven by?

A

Security Risk Management.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Outline the process of continuous security improvement.

A

Leadership - Planning - Support - Operation - Performance - Improvement

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

What is the ISO 27002?

A

List of Security Controls

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

What is the ISO27004

A

Evaluates security performance and effectiveness.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
What is ISO27005
Outlines the security Risk Management Process.
26
Name some control clauses in ISO27002.
Access Control, Comms secuirty, Supplier relationships, Cryptography.
27
Outline the process for ISO27004 secuirty performance evaluation.
Identify needs - Maintain - Establish procedures - Monitor + measure - Analyse results - Evaluate information security
28
Give some examples of secuirty measures
Output of various logs, statistics on training, Internal audits, Disaster recovery exercises, Reports from management reviews Mean time to Detect, Contain, Recovery
29
What is the starting point of ISO27005
Identifying assets that are at risk.
30
What are the phases of risk management
Preperation - Establish scope of risk, Risk Identification - Identifying assets, vulnerability, Risk Analysis - Assess/Measure/Estimate risks, Risk Evaluation - Evaluate risk level against evaluation, Risk Treatment - Identify treatment options
31
What are potential issues with ISO27001?
Its a tick box exercise, cannot scale to large companies, too ambiguous to be of practical use.
32
What is Business Continuity Management
Wholistic management programme that identifies potential events that threaten an organisation and provides a framework for resilience - capability for effective response
33
What can a Business Continuity Management help avoid?
Events that threaten an organisation, develop resiliency
34
What are the objectives of BCM?
Safeguard human life - contain business loss - Repetition - Protect assets
35
What are the stages of BCM?
Implementation - Maintenance - Development
36
What is Business Impact Analysis?
Determines the importance of an organisations activities by assessing the impact over time of their interruption and establish recovery objectives
37
What are the 4 concepts of BIA
Resource - Asset used to conduct operations Outage - The unavailability of a resource Disruption - An interruption of operations Impact - The effect of an event
38
What are the objectives of BIA
Verify organisational priorities Determine critical operations/deliverables Determine impact of disruptions Identify required resources Establish resumption times
39
Name the critical operations and deliverables outline in BIA
Must remain operational or quickly recover Time sensitivity of the operation Time sensitivity of the operation
40
What are operational dependencies? (single points of failure)
Opertaion that relies on one and only one Mitigation - Identify alternatives and define the potential impact
41
What are counter-measures to single points of failure
Resilience - Ensure no single points of failure, deploy extra facilities Redundancy - Standby system that can take over if the active system fails , Typically involves a duplicate of the activtity system
42
What are the details of the Recovery Time Objective?
Prospective point in time when an operation must be resumed for the organisation to achieve its objectives Multiple recovery time objectives BIA can help determine the resource requirement
43
What is the recovery point objective?
Restrospective point in time to which information is restored to ensure objectives are met Balances the value of information and the cost of controls
44
How do we identify resources needed to recover?
Variety of resources may be required, examples include: employees, inventory, technology, utilities, third party services
45
How does BIA provide direction?
Rationale for Business Continuity Planning Identifies assets requiring protection Determine recovery time objectives Determines resource requirements
46
What is business continuity management?
Developing strategies and plans
47
What is Strategy in business continuity management? (Continuity, Recovery)
Apporach to address an event and any associated impacts Continuity strategies - Enahance the organisation's ability to respond to events to continue operations Recovery Strategies - return to stable operations
48
How is Maintenance upheld in BCM?
Training, Testing, Maintenance and Updating/
49
Outline the flow chart of BCM Plans.
BIA - Recovery Strategies - Plan Development - Testing
50
What is Security Risk Management?
The combination of Business Continuity Management and Risk Management. They form a comprehensive approach for contingency planning. Risk Management can be considered as preventative BCM focuses on consequences and quick recovery.
51
How do we define security risk?
Mathematical probability of occurence of a threatening event. Qualitative evaluation of the combination of threat and vulnerability Quantitative - Threat x Probability x Business Impact = Risk
52
Outline the Security Risk Management LifeCycle
Identify - Analyse - Treat - Monitor
53
What is meant by the identify section of the Security Risk Management LifeCycle
What assets are important, what threats they may face, what vulnerabilities may be exploited
54
What is meant by the analyse section of the Security Risk Management LifeCycle
Define impact/loss Determine probability of occurence
55
What is organisational Cyber Harm?
Physical, Economic, Psychological, Reputational, Social
56
How is probability of attack estimated?
Organisational experience, Published reports, Cost of attack, Attractiveness of target, Vulnerability exposure
57
What is the Treat element of the Security Risk Management Lifecycle
COsider Risks and Identify response approaches Avoid Mitigate Transfer Accept Secuirty Controls - Mitigate attacks or threats Types: Preventative, Detective, Reactive
58
What is the monitor element of the Security Risk Management LifeCycle
Monitoring Security risk aspects is a continuous process. Log + audit network activity and security appliance Monitor Trends in threat Monitor attack surface + vulnerability posture
59
What is IoT?
Internet of things - Netwokr of physical objects or sensors, softwares and connectivity to enable objects to exchange data with other devices.
60
Outline the IoT System model
Applications (APIs) - Cloud Environment (APIs) - Thing Environment
61
What is an example of Cyber Secuirty challenges in new environments?
Remote Working.
62
How are cyber criminals exploiting the work from home paradigm?
Exploiting the fear and uncertainity of the unstable social + economic situation created by COVID-19
63
What are home workers more likely to fall victim to?
Cyberattacks such as phishing that can represent an security risk as employee's details are an asset.

Exam Revision (10 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2025 Bold Learning Solutions. Terms and Conditions