Need2Know Flashcards
Change Management (steps)
RRATSID
- request the change
- review the change
- approve / reject the change
- test the change.
- schedule the change.
- implement the change.
- document the change
Static Packet Filtering firewall
filters by message header: source, destination and port.
first gen - easily fooled.
layer 3 (network)
Levels of Gov / Military security classification
Top Secret Secret Confidential Sensitive but Unclassified Unclassified
Business / Private Sector security classificaiton
Confidential (company data) // Private (eg: medical records)
Sensitive
Public
Explain Data Encapsulation –> Protocol Data Unit (PDU)
Transport layer = segments
Network layer = packets
Data Link layer = frames
Physical layer = bits
Encapsulation…..
Segments –> Packets
Packet –> Frames
Frames –> Bits
Administrative Controls used to secure personnel
job descriptions principle of least privilege separation of duties job responsibilities, job rotation performance reviews background checks job training exit interview
Application-level gateway firewall
aka Proxy Firewall
Layer 7 (application)
Circuit-level gateway firewall
Works at layer 5 (session)
e.g., SOCKS
manage traffic based on the circuit, not the content of traffic.
Stateful inspection firewalls
aka Dynamic Packet Filtering
Network & Transport layers
processes based on source and destination ports, addresses, etc.
Deep-packet inspection firewalls
DPI
application layer
filters payload content - complete packet inspection
works in tandem wit application firewall
Next gen firewalls
multifunction device (MFD)
IDS, Proxy, QoS, VPN, etc.
Baseline
establishes a common foundation upon which all more security measures can be built
Trusted Computer System Evaluation Criteria (TCSEC)
Information Tech Security Evaluation Criteria (ITSEC)
National Institute of Standards and Tech (NIST)
Security Marking vs Security Labeling
Security Marking = human-readable security attributes.
Security Labeling = security attributes for internal data structures within IT
Change Management
the process of understanding, communicating, and documenting changes to a system so that negative effects from change can be avoided.
Typcial process:
- request the change
- review the change
- approve / reject change
- test
- schedule
- implement
- document.
Baselining
config management that involves monitoring of security changes over time.
Risk Transference
buying insurance.
What are the two common data classification schemes?
Military
Private Sector
Lighter Than Air Industries expects that it would lose $10 million if a tornado struck its aircraft operations facility. It expects that a tornado might strike the facility once every 100 years.
Referring to the scenario, what is the annualized loss expectancy?
The annualized loss expectancy (ALE) is computed by taking the product of the single loss expectancy (SLE), which was $10 million in this scenario, and the annualized rate of occurrence (ARO), which was 0.01 in this example. These figures yield an ALE of $100,000.
The absence or weakness of a safeguard or countermeasure?
When a safeguard or a countermeasure is not present or is not sufficient, what remains?
Vulnerability
What law protects the right of citizens to privacy by placing restrictions on the authority granted to government agencies to search private residences and facilities?
Fourth Ammendment.
You are concerned about the risk that an avalanche poses to your $3 million shipping facility. Based on expert opinion, you determine that there is a 5 percent chance that an avalanche will occur each year. Experts advise you that an avalanche would completely destroy your building and require you to rebuild on the same land. Ninety percent of the $3 million value of the facility is attributed to the building, and 10 percent is attributed to the land itself.
1) What is the single loss expectancy of your shipping facility to avalanches?
2) What is the annualized loss expectancy?
1) The SLE is the product of the AV and the EF. From the scenario, you know that the AV is $3,000,000 and the EF is 90 percent, based on that the same land can be used to rebuild the facility. This yields an SLE of $2,700,000.
2) This problem requires you to compute the ALE, which is the product of the SLE and the ARO. From the scenario, you know that the ARO is 0.05 (or 5 percent). From question 8, you know that the SLE is $2,700,000. This yields an SLE of $135,000.
What element of data categorization management can override all other forms of access control?
Taking Ownership
NOT:
Physical Access
Classification
Custodian
Ownership grants an entity full capabilities and privileges over the object they own. The ability to take ownership is often granted to the most powerful accounts in an operating system because it can be used to overstep any access control limitations otherwise implemented.
You are concerned about the risk that an avalanche poses to your $3 million shipping facility. Based on expert opinion, you determine that there is a 5 percent chance that an avalanche will occur each year. Experts advise you that an avalanche would completely destroy your building and require you to rebuild on the same land. Ninety percent of the $3 million value of the facility is attributed to the building, and 10 percent is attributed to the land itself. What is the single loss expectancy of your shipping facility to avalanches?
A: $3,000,000
B: $2,700,000
C: $270,000
D: $135,000
Government Data Classificaiton
Top Secret
Secret
Confidential
Unclassified
