Brainscape's Knowledge GenomeTM


Top Flashcards (Certified)
All Flashcards

Cybersecurity > Play It Safe: Manage Security Risks > Flashcards

Play It Safe: Manage Security Risks Flashcards

(82 cards)

Start Studying
1
Q

Security Posture

A

An organizations ability to manage its defense of critical assets and data, and react to change

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Security And Risk Management

A

Focused on defining security goals and objectives, risk mitigation, compliance, business continuity, and legal regulations

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Risk Mitigation

A

The process of having the right procedures and rules in place to quickly reduce the impact of a risk like a breach

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Compliance

A

The primary method used to develop an organizations internal security policies, regulatory requirements, and independent standards

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Business Continuity

A

An organizations ability to maintain their everyday productivity by establishing risk disaster recovery plans

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Asset Security

A

Focused on securing digital and physical assets. Related to the storage, maintenance, retention and destruction of data

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Security Architecture And Engineering

A

Focused on optimizing data security by ensuring effective tools, systems, and processes are in place to protect an organizations assets and data

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Shared Responsibility

A

All individuals within an organization take an active role in lowering risk and maintaining both physical and virtual security. Associated with Security Architecture and Engineering

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Communication And Network Security

A

Focused on managing and securing physical networks

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Identity And Access Management (IAM)

A

Focused on access and authorization to keep data secure, by making sure users follow established policies to control and manage assets

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Components Of IAM

A

Identification, authentication, authorization, accountability

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Identification

A

User verifies who they are by providing username, access card, or biometric data

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Authentication

A

Verification process to prove a person’s identity by password or PIN

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Authorization

A

Takes place after a user’s identity has been confirmed

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Accountability

A

Monitoring or recording users actions like log-in attempts

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Security Assessment And Testing

A

Focused on conducting security control testing, collecting and analyzing data, and conducting security audits to monitor for risks, threats and vulnerabilities

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Security Operations

A

Focused on conducting investigations and implementing preventative measures

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Software Development Security

A

Focused on using secure coding practices

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Secure Coding Practices

A

Recommended guidelines that are used to create secure applications and services

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Software Development Lifecycle

A

An efficient process used by teams to quickly build software products and features

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Information Security (InfoSec)

A

A set of processes established to secure information

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

InfoSec Design Processes

A

Indecent response, vulnerability management, application security, cloud security, and infrastructure security

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Security Architecture And Engineering Design Principles

A

Threat modeling, least privilege, defense in depth, fail securely, separation of duties, keep it simple, zero trust and trust but verify

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Threat

A

Any circumstance or event that can negatively impact assets

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Risk
Anything that can impact the CIA of an asset
26
Low- Risk Asset
Information that would not harm the organizations reputation or ongoing operations, and would not cause financial damage if compromised. Ex- website content or published research data
27
Medium- Risk Asset
Information that's not available to the public and may cause some damage to the organizations finances, reputation, or ongoing operations. Ex- early release of company's quarterly earnings
28
High- Risk Asset
Information protected by regulations or laws, which if compromised, would have a severe negative impact on an organizations finances, ongoing operations, or reputation. Ex- leaked assets with SPII, PII or intellectual property
29
Vulnerability
A weakness that can be exploited by a threat
30
Layers Of The Web
Surface Web, Deep Web, and Dark Web
31
Surface Web
Generally used for browsing and shopping
32
Deep Web
Requires authorization to access. Ex- workplace intranet
33
Dark Web
Only accessed by certain software, generally used by criminals
34
NIST Risk Management Framework (RMF)
Prepare, categorize, select, implement, assess, authorize, and monitor
35
RMF Step 1: Prepare
Activities that are necessary to manage security and privacy risks before a breach occurs
36
RMF Step 2: Categorize
Used to develop risk management processes and tasks
37
RMF Step 3: Select
Choose, customize, and capture documentation of the controls that protect an organization
38
RMF Step 4: Implement
Implement security and privacy plans for the organization
39
RMF Step 5: Assess
Determine if established controls are implemented correctly
40
RMF Step 6: Authorize
Being accountable for the security and privacy risks that may exist in an organization
41
RMF Step 7: Monitor
Be aware of how systems are operating
42
Common Strategies To Manage Risks
Acceptance, avoidance, transference, and mitigation
43
Multiparty Risk
Outsourcing work to third-party vendors can give them access to intellectual property such as trade secrets, software design and inventions
44
Ciphertext
Raw encoded message that is unreadable to humans and computers
45
Cyber Threat Framework (CSF)
Developed by the US Government to provide "a common language for describing and communicating information about cyber threat activity"
46
Physical Controls
Gates, fences and locks, security guards, CCTV, surveillance cameras, motion detectors, access cards or badges
47
Technical Controls
Firewalls, MFA, Anti-virus Software
48
Administrative Controls
Separation of duties, authorization, asset classification
49
CSF Core Functions
Identify, protect, detect, respond, recover
50
NIST S.P. 800-53
A unified framework for protecting the security of information systems within the federal government
51
Identify
The management of cybersecurity risk and its effect on an organizations people and assets.
52
Protect
The strategy used to protect an organization through the implementation of policies, procedures, training, and tools that help mitigate cybersecurity threats
53
Detect
Identifying potential security incidents and improving monitoring capabilities to increase the speed and efficiency of detections
54
Respond
Making sure that the proper procedures are used to contain, neutralize, and analyze security incidents and implement improvements to the security process
55
Recover
The process of returning affected systems back to normal operation
56
OWASP
Open web applications security project / open worldwide application security project
57
OWASP Security Principles
Minimize attack surface area, principle of least privilege, defense in depth, separation of duties, keep it simple, fix security issues correctly
58
Attack Vectors
Pathways attackers use to penetrate security defenses. Ex- phishing emails, weak passwords
59
Fix Security Issues Correctly
Identify the root cause, contain the impact, identify vulnerabilities, and conduct tests to ensure that remediation is successful
60
Additional OWASP Security Principles
Establish secure defaults, fail securely, don't trust services, avoid security by obscurity
61
Purposes Of Internal Security Audits
Identify organizational risk, assess controls, correct compliance issues
62
Common Elements Of Internal Audits
Establishing the scope and goals, conducting a risk assessment, completing a controls assessment, assessing compliance, communicating results
63
Audit Questions
What is the audit meant to achieve, which assets are most at risk, are current controls sufficient to protect those assets, what controls and compliance regulations need to be implemented
64
Common Log Sources
Firewall log, network log, server log
65
Firewall Log
A record of attempted or established connections for incoming traffic from the internet
66
Network Log
A record of all computers and devices that enter and leave the network
67
Server Log
A record of events related to services, such as websites, emails, or file shares
68
Metrics
Key technical attributes, such as response time, availability, and failure rate, which are used to assess the performance of a software application
69
Security Orchestration, Automation, and Response (SOAR)
A collection of applications, tools, and workflows that uses automation to respond to security events
70
Different Types Of SIEM Tools
Self hosted, cloud hosted, hybrid
71
Self Hosted SIEM Tools
Require organizations to install, operate, and maintain the tool using their own physical infrastructure such as server capacity.
72
Cloud Hosted SIEM Tools
Are maintained and managed by the SIEM providers, making them accessible through the internet
73
Hybrid SIEM Tools
A combination of self hosted and cloud hosted SIEM Tools
74
Splunk
A data analysis platform
75
Splunk Enterprise
A self hosted tool used to retain, analyze, and search an organizations log data to provide security information and alerts in real time
76
Splunk Cloud
A cloud hosted tool used to collect, search, and monitor log data
77
Chronicle
A cloud native tool designed to retain, analyze, and search data (Google)
78
Open Source Tools
Often free to use and can be user friendly. Provides users with software that is built by the public in a collaborative way, which can result in software being more secure
79
Proprietary Tools
Developed and owned by a person or company, and users typically pay a fee for usage and training
80
Linux
An open source operating system
81
Suricata
An open source network analysis and threat detection software
82
Incident Response Playbook Phases
Preparation, detection and analysis, containment, eradication and recovery, post incident activity, coordination

Cybersecurity (3 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2025 Bold Learning Solutions. Terms and Conditions