Module 1

Question 1

What are the challenges of Cyber Security?

Answer 1

System availability, data integrity, and privacy

Question 2

What is Information Assurance?

Answer 2

An application that encompasses scientific, technical, and management disciplines that are required to ensure information security and quality

Question 3

What are the forms of information?

Answer 3

Hard copy, soft copy, records of meetings, telephone conversations, video conferences, and personal data

Question 4

What are the states of information?

Answer 4

Transmitted, Processed, and stored

Question 5

What are the components of information security?

Answer 5

Confidentiality, Integrity, and availability

Question 6

What’s a threat?

Answer 6

A potential occurrence that can have undesirable effect on system assets or resources

Question 7

what are the threat categories?

Answer 7

Disclosure, Deception, Disruption, and Usurpation

Question 8

what is vulnerability?

Answer 8

a weakness that makes it possible for a threat to occur

Question 9

what are the Information Characteristics?

Answer 9

Authentication, Non-repudiation, secrecy, and privacy

Question 10

What is Authentication?

Answer 10

Validity of transmission, message, originator, or means of verifying an individuals means of authorization

Question 11

what is Non-repudiation

Answer 11

Assurance that sender of data is provided with proof of delivery to recipient, and recipient is provided with proof of sender Identity

Question 12

what is Secrecy?

Answer 12

Cryptography and computer access control. Limits the number of principals who can access information

Question 13

what is Privacy?

Answer 13

The ability/right to protect private information

Question 14

What is confidentiality?

Answer 14

Determines the secrecy of information

Question 15

what are the confidentiality principles

Answer 15

1. need to know
2. data sep
3. compartmentalization
4. classification
5. encryption

Question 16

what is the weakest link?

Answer 16

Security is only as strong as the weakest link

Question 17

What are the security strategies

Answer 17

obscurity, perimeter defence, defence in depth

Question 18

Defence in depth

Answer 18

A number of IA layers of defence that are operationally interoperable an complementary technical and non-technical

Question 19

enclave

Answer 19

an env under control of a single authority with personal and physical security

Question 20

what is the make up of defence in depth?

Answer 20

1.perimeter def around each enclave
2. multiple complicated connections between an enclave and outside
3. multiple layers and a diff solution req for each connection

Question 21

What is the general layered arch model for defence in depth?

Answer 21

layer 1: IA policies
layer 2: IA management
layer 3: AI architecture (Technical IA infrast)
layer 4-10: non-technical implementation

Question 22

what does layer 3 in layered arch model ensure?

Answer 22

ensures the minimal level of interoperability and services are available to authorized users.

Question 23

How many and what types of levels of security does layer 3 implement?

Answer 23

3. physical ,procedural, and logical security

Question 24

what is L4 in layered arch model

Answer 24

operational security administration

Question 25

what is L5 in layered arch model

Answer 25

config management

Question 26

what is L6 in layered arch model

Answer 26

life-cycle security

Question 27

what is L7 in layered arch model

Answer 27

contingency planning

Question 28

what is L8 in layered arch model

Answer 28

IA education/training

Question 29

what is L9 in layered arch model

Answer 29

policy compliance oversight

Question 30

what is L10 in layered arch model

Answer 30

IA incident responce and reporting

Question 31

what is mission assurance?

Answer 31

to identify and mitigate design, prod, test, and field support deficiencies

Question 32

how does the conflication between IA an mission assurance be averted?

Answer 32

1. by protecting the infra and data 2. securely sharing information with auth individuals

Question 33

what is MAC?

Answer 33

mission assurance categories

Question 34

what is Mac 1?

Answer 34

systems that handle infor most critical to operations

Question 35

what is Mac 2?

Answer 35

systems that handle info that supports most critical operations- loss can be tolerated

Question 36

what is Mac 3?

Answer 36

infor that is necessary for day to day operations

Question 37

what is risk?

Answer 37

something that may happen in the future

Question 38

what are the vulnerability categories?

Answer 38

design, implementation, and deployment

Question 39

what are design vulnerabilities?

Answer 39

flaws in logic -most difficult to identify b/c they require clear understanding of material

Question 40

what are implementation vulnerabilities

Answer 40

incorrectly handled unexpected inputs

Question 41

what are deployment vulnerabilities

Answer 41

incorrect or faulty deployments of application (i.e weak passwords)

Question 42

what is risk management?

Answer 42

dealing with risks in cost effective manner- rather than avoiding risks at all costs

Question 43

what are the 3 risk choices?

Answer 43

Acceptance, reduction, and transfer

Question 44

What is IA policy?

Answer 44

High level statements of goals of procedures for information assurance

Question 45

What are the IA policy enforcement mechanisms?

Answer 45

Inform/explain/document technical procedural (security auditing)

Question 46

What is a security policy

Answer 46

A statment that partitions the states of the system into a set of auth/secure and unath/insecure states

Question 47

Do IA policies include security policies/

Answer 47

yes

Question 48

How to establish IA policies?

Answer 48

1. secure strong management support 2. gather key data 3. define framework 4. structure procedures 5. perform risk assessment