Risk Management Flashcards
(118 cards)
1
Q
Looking to define threats specific to your infrastructure
A
Threat Assessment
2
Q
Security Control Function
Recognized an actors threat
A
Detective
3
Q
Security Control Function
Mitigates the impact of manifested threat
A
Corrective
4
Q
CIA
A
Confidentiality
Integrity
Availability
5
Q
Organizing Data
-Limited to authorized viewing as agreed on by the parties involved
A
Confidential Data
6
Q
Differential Backup
A
Everyday you’d make a backup of any changes since the full backup - to do a full system recovery you’d need the original backup plus the last differential backup made
7
Q
Outside company checks your vulnerabilities by trying to get in but not doing anything harmful
A
Penetration(Pen) Testing
8
Q
Security Policies
-Define the importance or nature of the data
A
Data Sensitivity and Classification Policy
9
Q
Control actions towards IT security
- laws
- policies
- guidelines
- best practices
A
Administrative Controls
10
Q
Security Control Function
Deters the actor from attempting the threat
A
Deterrent
11
Q
ARO
A
Annualized Rate of Occurence
12
Q
Data User Roles
-Set policy on data and incident response actions
A
Executive User
13
Q
Control Actions IT systems make toward IT Security
- computer stuff
- firewalls
- password links
- authentication
- encryptions
A
Technical Controls
14
Q
Role Based Data Controls
-Read only access but can look at all business data
A
Executive User
15
Q
Threats x Vulnerability
A
Risk
16
Q
Risk Response - offload some of the impact to 3rd party
A
Risk transference
17
Q
In-house document of how they store data
A
Privacy Threshold Assessment (PTA)
18
Q
Security Policies
-Defines what a person can or can not do when using company assets
A
Acceptable Use Policy
19
Q
Use a variety of physical, administrative, and technical controls to have good…
A
Defense in Depth
20
Q
Data User Roles
-Complete control over data and could delete everything - sets permissions
A
System Administrator
21
Q
Structural threat
A
Physical system failure
22
Q
Defense in Depth
-different types of controls
A
Diversity
23
Q
Organizing Data
-Health Insurance Portability and Accounting Act
HIPAA
A
Private Health Information (PHI)
24
Q
3 Security Controls
A
Administrative/Techincal/Physical
25
Initiates a threat
Threat Agent
26
Data Roles
| -Person who is in charge of ensuring data adheres to privacy policies and procedures
Privacy Officer
27
Security Policies
- How you maintain equipment
- How you borrow equipment
Care and Use of Equipment Policy
28
Apply to infrastructure to protect and remediate current and potential problems
Security Control
29
Data Roles
| -Maintain the accuracy and integrity of the data
Steward/Custodian
30
Incremental Backup
Everyday you'd make a backup of any changes since the last incremental backup - to do a full system recovery you'd need the original backup plus all the incremental backups made since
31
Scan that shows vulnerabilities
NESSUS
32
PIA
Privacy Impact Assessment
33
Data User Roles
| -Assigned standard permissions to complete tasks
User
34
Accidental threat
Someone innocently corrupts or damages something
35
Security Policies
- How you deal with passwords
- Password recovery/retention/reuse/ect.
Password Policy
36
Role Based Data Controls
- Defines the security of the data
- Defines the protection of data
- Works with system owner to protect data
- Defines access to the data
Data Owner
37
PII
Personally Identifiable Information
38
Security Control Function
| Deters the actor from performing the threat
Preventative
39
Security Policies
- How to get access to data or resources
- What kind of data do users have access to
Access Control Policy
40
What does this help with?
| -Separation of duties?
Requires dual execution
41
Data User Roles
| -Increased access and control relative to a user
Privileged User
42
Defense in Depth
| -same type of control but many of them as backups
Redundancy
43
Agreement used by Government and Private Sector...
- Service to be provided
- Minimum up-time
- Response time
- Start and end dates
Service Level Agreement (SLA)
44
Threat Actors - Motivation is intelligence
Nation States/Advanced Persistent Threat(APT)
45
Documents that define how to do something
Policies
46
A Memorandum of Understanding/Agreement is a....
Notice that specifies the responsibilities of each party and defines the terms of the agreement
47
Qualitative likelihood
Perceived
48
```
Mandatory vacation
Job rotation
Multi person control
Separation of duties
Principals of least privilege
```
Interesting Security Controls
49
SLE(Single Loss Expectancy) x ARO(Annualized Rate of Occurence) =
ALE(Annualized Loss Expectancy)
50
Data Roles
| -Legal responsibility for the data
Owner
51
Risk Response - seek to avoid hazards/risk entirely
Risk avoidance
52
Adversarial threat
Hacker/Malware
53
Threat Actors - Intent is motivation
Hacktivist
54
ALE
Annualized Loss Expectancy
55
BPA
Business Partners Agreement
56
Guidelines
Are optional and don't have to be clearly defined
57
1. Categorize
2. Select
3. Implement
4. Assess
5. Authorize
6. Monitor
^Example of a ....
Framework
58
NIST
National Institute of Standards and Technology
59
Role Based Data Controls
- Has special access to data beyond the typical user
- Works closely with system admins to ensure data security
Privileged User
60
Maximum amount of data that can be lost without substantial impact
Recovery Point Objective (RPO)
61
Threat Actors - Motivation is money
Organized Crime
62
MTBF
Mean Time Between Failures
63
-Disable accounts(never delete)
-Return credentials
-Exit interview
^Examples of what?
Offboarding
64
Sandbox
The attacker thinks they're on a real system but it's just a virtual system designed to look like the real one
65
cve.mitre.org
Common vulnerabilities and exposures
66
Interconnections security agreement (ISA) are used in the...
Public Sector (Government)
67
Vulnerability/Threat assesment
Risk Identification/Assesment
68
Which type of agreement is needed when two private-sector people or organizations wish to work together?
Business Partners Agreement (BPA)
69
- Determine mission processes
- Identify critical systems
- Single foint of failure
- Identify resources requirements
- Identify recovery priorities
Business Impact Analysis
70
Role Based Data Controls
- Accesses and uses the assigned data responsibly
- Monitors and reports security breaches
User
71
Security Policies
- Deals with the people dealing with the data
- Backgrounds/Clearances
Personnel Policies
72
Asset Value x Exposure Factor =
Single Loss Expectancy (SLE)
73
PCI-DSS
Payment Card Industry Data Security Standard
74
Organizing Data
| -Private but also specific in identifying someone
Personally Identifiable Information (PII)
75
PTA
Privacy Threshold Assessment
76
Organizing Data
| -Limited to only the individual whom the information is shared
Private Data
77
-Max time system can be down before you're in trouble, or minimum amount of time necessary to restore system to operation
Recovery Time Objective (RTO)
78
Data User Roles
| -Usually corporation that has legal ownership over this data set or system
Data Owner/System Owner
79
MTTF
Mean Time to Failure
80
Buffer overflow attempt
Occurs when a program or process attempts to write more data to a fixed length block of memory (a buffer), than the buffer is allocated to hold. By sending carefully crafted input to an application, an attacker can cause the application to execute arbitrary code, possibly taking over the machine
Identified by an intrusion detection/prevention system
81
Actual harm caused by a threat
Impact
82
APT
Advanced Persistent Threat
83
Risk Response - cost out-ways damage
Risk acceptance
84
Organizing Data
- Like private but at corporate level
ex: formula for coca-cola
Proprietary Data
85
Security Policies
| -These are often for customers
Privacy Policy
86
(Blank) is key for good Defense in Depth
Diversity
87
Things that can be Impacted
- Property
- People
- Finance
- Reputation
88
What is the monetary loss if a single event occurs?
| ex:laptop stolen
Single Loss Expectancy
89
IOS
International Organization of Standardization
90
Set of overarching rules that define how an organization and it's employees conduct themselves
Influences how the organization conducts IT security
Governance
91
Threat Actors - Trivial attack knowledge
Script Kiddies
92
What does this help with?
| -Job Rotation
Backup/Cross Training
93
What does this help with?
| -Mandatory Vacations
Required dependency issues
94
Role Based Data Controls
- Management level
- Maintains security of system
- Defines system Admin
- Works with data owners to ensure data security
System Owner
95
Anything in infrastructure we're worried about getting harmed
- People
- Equipment
- Reputation
- Location/Building
Assets
96
MTTR
Mean Time to Repair
97
Quantitative Risk Calculations
| -Percentage of an asset that's lost as the result of an incident
Exposure Factor
98
Organizing Data
| -No restriction/public domain
Public Data
99
Quantitative Likelihood
Can be measured
100
Control actions in the real world
- gates
- guards
- keys
Physical Controls
101
Discovered action that exploits a vulnerability's potential to do harm to an asset
Threats
102
Environmental threat
Fire/water/earthquake/ect.
103
Step by step process of how to do something
Procedure
104
Weakness that allows an asset to be exploited
Vulnerabilities
105
Level of certainty that something will happen
Likelihood
106
Workflow that helps deal with risk management
| Ex: NIST / ISACA
Framework
107
SLE
Single Loss Expectancy
108
RPO
Recovery Point Objective
109
Defines the acceptable level of performance of policy - more detailed than policy
Organizational Standard
110
-Background check
-NDA non-disclosure agreement
-Standard operating procedures
-Specialized issues
-Rules of behavior(acceptable use policy)
-General security policies
^Examples of what?
Onboarding
111
Threat Actors - Other businesses/not a big problem now a days
Competitors
112
Assessment that tells you what the impact would be to the company if the privacy data they control gets out
Privacy Impact Assessment (PIA)
113
RTO
Recovery Time Objective
114
Security Control Function
| Provides alternative fixes to any of the security control functions
Compensating
115
Threat Actors - Not always an employee/Works within the infrustructure
Insiders
116
Role Based Data Controls
- Day to day admin of system
- Implements system security controls
System Admininstrator
117
Risk Response - effort to reduce impact of risk
Mitigation
118
PHI
Private Health Information
