S1 Flashcards
1
Q
NIST
A
National Institute of Standards and Technology Framework (1901) (1995 - Info Security). Here to protect us
2
Q
Why do we need IT?
A
Organizations adopt technology to enhance or support business operations; protect digital records and assets; safeguards physical assets
3
Q
NIST Cybersecurity Framework
A
Voluntary framework that includes three components to manage cybersecurity risk:
1. Framework
2. Framework Implementation
3. Framework Profile
4
Q
CS Framework Core ComponentsDRRIP
A
Identify
Protect
Detect
Respond
Recover
5
Q
Identify ID
Privancy Core
A
Keep records of: assets of the organization, system users internal/external, information process operations and all system used
6
Q
Protect
Privancy Core
A
Focus on deploying safeguards and access controls to networks, applications, and devices.
Performing regular updates to security software
Performing data backups, developing plans for disposing of files or unused devices and user training
7
Q
Detect
A
Deploy tools to: Detect cyber security attacks.
Monitor network access points, user devices, unauthorized personnel access.
8
Q
Respond
A
Develop response polices addressing how to:
Contain a cybersecurity event
React using planned responses that mitigate losses
Notify
9
Q
Recover
Privacy Core
A
Focuses on:
Supporting the restoration of a company’s network to normal operations
Restoring backed up files or environments
10
Q
Implementation Tiers
A
How sophisticated is a company’s security infrastructure?
Inform an organization as to the effectiveness of those profiles.
Tiers act as a benchmark, identifying the degree to which information security practices are integrated throughout an organization.
11
Q
CSF Framework Profiles
A
Determine success or failure of information security implementation. Implementation guides with insight specific to a particular industry
12
Q
Tier Levels
A
Tier 1 (partial)
Tier 2 (risk informed)
Tier 3 (Repeatable)
Tier 4 (Adaptive)
13
Q
Tier Categories
A
Risk management process
Integrated risk management program
External participation
14
Q
Tier 1 (partial)
A
Risk management Process: Ad hoc and reactive
Integrated Risk Management: Not integrated into organization processes
External Participation: does not evaluate external risks, cybersecurity is isolated
15
Q
Tier 2 (Risk Informed)
A
Risk Management Process: CS prioritization is based on org risk, and management approves CS efforts
Integrated Risk Management: org is aware of CS but not managing securely
External Participation: there is awareness but inconsistent actions are taken to respond to those risks
16
Q
Tier 3 (Repeatable)
A
Risk Management Process: org utilizes CS in planning and has enshrined CS practices in formal policies
Integrated Risk Management: a org risk approach to CS where CS is integrated into planning and regularly communicated
External Participation: org collabs w/ and contributes to security community at large. Has gov structures internally to manage cyber risk
17
Q
Tier 4 (Adaptive)
A
Risk Management Process: org CS is based on iterative improvements based on internal/external cyber incidents
Integrated Risk Management: managing CS is a org wide affair, cyber risk is prioritized
External Participation: org robustly participates in external info sharing activities
18
Q
Current Profile
A
Current state of the org risk managment
19
Q
Target profile
A
Desired future state of org risk management
20
Q
Gap Analysis
A
Identifies differences between the current and desired state
21
Q
NIST Privacy Framework
A
Protect individuals data as used in data processing applications. Developed to be industry agnostic and to account for cultural and individual constructs around privacy
22
Q
Privacy Framework Core Components (PICCG)
A
Identify
Govern
Control
Communicate
Protect
23
Q
Govern
Privacy Core
A
What is the best governance structure for privacy risks related to the company’s data processing activities?
24
Q
Control
Privacy Framework Core
A
What is the best management structure for privacy risks related to data processing activities
25
Communicate
| Privacy Framework Core
How should the org drive dialogue around privacy risks related to data processing activities
26
NIST SP 800-53 Framework
Set of security and privacy controls applicable to all info systems and now the standard for federal info security systems. Designed for protecting, care about effectiveness not cost
27
SP 800-53 Security and Privacy Requirements
OMB - requires the controls for federal information systems
FISMA - requires the implementation of minimum controls to protect federal info and info systems
28
Common (Inheritable) Control
| NIST SP 800-53
Implement controls at the org level, which are adopted by info systems
29
System Specific Control
| NIST SP 800-53
Implement controls at the information system level
30
Hybrid Control
| NIST SP 800-53
Implement controls at the org level where appropriate and the rest at the info system level
31
Data Breach Costs
Detection and escalation: Cost to detect
Notification: costs to notify parties
Post-breach Response: Cost to rectify effects
Loss of Business and Revenue: temp lost do to down time
32
HIPAA
Health Insurance Portability and Accountability Act required the department of health and human services to adopt national standards promoting health care privacy and security
33
HIPAA Security Rule
Specifically governs electronic PHI. Under the security Rule all covered entities must:
ensure the confidentiality, integrity, and availability of all electronic PHI;
Protect against reasonably anticipated threats;
Ensure compliance
34
HITECH
Amended HIPPA:
Increased penalties for HIPPA violations
Required that patients receive the option to obtain records in electronic form
Breach rule to notify within 60 days of discovery
35
GDPR (Data Protection) Principals
European Unions general applicability law regulating the privacy of data
36
Lawfulness, Fairness, Transparency
| GDPR
Data must be processed lawfully, fairly, and in a transparent manner
37
Purpose Limitation
| GDPR
Data must be processed for specified, explicate, and legitimate purposes
38
Data Minimization
| GDPR
Data processing must be adequate, relevant, and limited to what is necessary
39
Accuracy
| GDPR
Data must be accurate and kept updated
40
Storage Limitation
| GDPR
Data must be stored only for as long as necessary. storing it for longer periods is permitted for public interest archiving, scientific or historical research, or statistical purposes.
41
Integrity and Confidentiality
| GDPR
Data must be processed securely and protected against unauthorized access, accidental loss, destruction, or damage
42
Payment Card Industry Data Security Standard
A framework to apply to promote data security when processing payments
43
Build and Maintain a Secure Network and System
| PCI DSS
1. Install and maintain a firewall configuration to protect cardholder data
2. Do not use vendor supplied defaults for system passwords
44
Protect cardholder Data
| PCI DSS
3. Protect stored cardholder data
4. Encrypt transmission of cardholder data across open networks
45
Maintain a Vulnerability Management Program
| PCI DSS
5. Protect all systems against malware and regularly update anti-virus software programs
6. Develop and maintain secure system applications
46
Implement Strong Access Control Measures
| PCI DSS
7. Restrict access to cardholder data through need to know restrictions
8. Identify and authenticate access to system components
47
Regularly Monitor and Test Networks
| PCI DSS
10. Track and monitor all access to network resources and cardholder data
11. Regularly test security systems and processes
48
CIS
The Center for Internet Security. Controls are a recommended set of actions, processes, and best practices that can be adopted and implemented by organizations to strengthen their cybersecurity defenses.
49
CIS Control Principles OFFAM
Offense Informs Defense
Focus
Feasible
Align
Measurable
50
Align
| CIS Principle
Controls should map to other top cybersecurity standards like NIST VS, COBIT, HIPPA
51
Measurable
| CIS Principle
Controls should be simple and measurable, avoiding vague language
52
Offense Informs Defense
| CIS Prinicple
Controls are drafted based on data from actual CS attacker behavior and how to defend against it
53
Focus
| CIS Principle
Controls should help prioritize the most critical problems and avoid resolving every CS issue
54
Feasible
| CIS Principle
All recommendations should be practical
55
IG1
| CIS Impletmentation Group
Group is for small or mid sized orgs that have limited CS defense mechanisms in place
56
IG2 (includes IG1)
| CIS Impletmentation Group
Group is for companies that have IT staff who support multiple departments that have various risk profiles and typically handle sensitive client data
57
IG3 (Includes IG1 and IG2)
| CIS Impletmentation Group
Group for companies that have security experts in all domains within CS such as penetration testing, risk management, and application security.
58
CIS Control 01
| Inventory and Control of Enterprise Assets
Inventory and Control of Enterprise Assets: Helps orgs actively track and manage all IT assets connected to a company's IT infrastructure physically or virtually with a cloud environment
59
CIS Control 2
| Inventory and Control of Software Assets
Provides recommendations for orgs to track and actively manage all software applications so that only authorized software can be installed
60
CIS Control 3
| Data Protection
Helps orgs develop ways to securely manage the entire life cycle of their data
61
CIS Control 4
| Configuration of Enterprise Assets and Software
this control helps orgs establish and maintain secure baseline configurations for their enterprise assets
62
CIS Control 5
| Account Management
Outlines best practices for companies to manage credentials and authorization for user accounts, privileged user accounts, and service accounts for company hardware and software applications
63
CIS Control 6
| Access Control Management
Control expands on 5 by specifying the type of access that user accounts should have
64
CIS Control 7
| Continuous Vulnerability Management
Control assists org in continuously identifying and tracking vulnerabilities within its infrastructure so that it can remediate and eliminate weak points or windows
65
CIS Control 8
| Audit Log Management
Control establishes an enterprise log management process so that organizations can be alerted and recover from an attack in real time
66
CIS Control 10
| Malware Defense
assists companies in preventing the installation and propagation of malware onto company assets and its network
67
CIS Control 9
| Email and Web Browser Protections:
Provides recommendations on how to detect and protect against cybercrime attempted through email or the internet
68
CIS Control 11
| Data Recovery
Establishes data backup, testing, and restoration processes that allow organizations to effectively recover company assets
69
CIS Control 12
| Network Infrastructure Management:
This control establishes procedures and tools for managing and securing a company's network infrastructure. Network infrastrucutre is up to date, maintain a secure network architecture
70
CIS Control 13
| Network Monitoring and Defense
Establishes processes for monitoring and defending a company's network infrastructure against internal and external security threats
71
CIS Control 14
| Security Awareness and Skill Training:
Guides organizations in establishing a security awareness and training program to reduce cybersecurity risk
72
CIS Control 15
| Service Provider Management
helps organizations develop processes to evaluate third party service providers that have access to sensitive data or that are responsible for managing some or all of a company's IT functions
73
CIS Control 16
| Application Software Security
establishes safeguards that manage the entire life cycle of software that is acquired, hosted, or developed in house to detect, deter and resolve CS weaknesses before they are exploited
74
CIS Control 17
| Incident Response Management:
Provides the recommendations necessary to establish an incident response management program to detect, respond, and prepare for potential CS attacks
75
CIS Control 18
| Penetration Testing
Control helps organizations test the sophistication of their CS defense system in place by simulating actual attacks in effort to find and exploit weakness.
76
COBIT
Control Objectives for Information and Related Technologies
provides a road map that organizations can use to implement best practices for IT governance and management.
77
COBIT Principles for Governance System GETPHD
Governance Distinct from Management (Distinct)
End to end governance system (End to end)
Tailored to enterprise needs (Tailored)
Provide stakeholder Value (Value)
Holistic approach (Holistic)
Dynamic governance system (Dynamic)
78
COBIT Principles for a Governance Framework BOA
Based on conceptual model
Open and flexible
Aligned to major standards
79
Provide stakeholder Value (Value)
| COBIT
gov system should create value for the company's stakeholders by balancing benefits, risks, and resources
80
Holistic approach (Holistic)
| COBIT
gov systems for IT can comprise diverse components, collectively providing a holistic model.
81
Dynamic governance system (Dynamic)
| COBIT
When a change in one gov system occurs, the impact on all others should be considered so that the system continues to meet the demands of the organization. continue to be relevant while adjusting as a new challenge arises
82
Governance Distinct from Management (Distinct)
| COBIT
Management activities and governance systems should be clearly distinguished from each other because they have different functions
83
Tailored to enterprise needs (Tailored)
| COBIT
gov models should be customized to each individual company, using design factors to prioritize and tailor the system
84
End to end governance system (End to end)
| COBIT
All processes in the org involving info and tech should be factored into an end to end approach
85
COBIT Governance Objectives
One domain: evaluate, direct, and monitor (EDM): those charged with governance evaluate strategic objectives, direct management to achieve those objectives, and monitor whether they are being met
86
COBIT Management Objectives
Four domains
Align, plan and organize (APO)
Build, acquire, and implement (BAI)
Deliver, service, and support (DSS)
Monitor, evaluate, and assess (MEA)
87
EDM Domain
Those charged with governance evaluate strategic objectives, direct managment to achieve those objectives, and monitor wheather objectives are being met. 5 objectives:
ensuring business delivery, governance framwork setting, risk optimization, resouce optimization, and stakeholder engagment
88
APO Domain
Focuses on aligning information tech overall strategy, planning how to utilize technology in business operation of the organization, and organizing the resources for their most effective and efficient usage. 14 objectives - managed data is most significant
89
BAI Domain
Addresses the building, acquiring, and implementation of information technology solutions in the organizations business processes. 11 objectives, offering guidance on requirements definition, identifying solutions, managing capacity, availability, org change...
90
DSS Domain
Addresses the delivery, service, and support of IT services. 6 objectives - service request is most important
91
MEA Domain
Addresses information tech conformance to the company's performance targets and control objectives along with external requirements. Accomplished through continuous monitoring, evaluation, and assessment of info tech systems. 4 objectives - managed system of internal control is most important
92
COBIT Components to Satisfy Objectives
Components are factors that either collectively or individually contribute to the successful execution of a company's governance system over information technology and systems.
93
COBIT Design Factors
Influence the design of a companys IT goverance system, with a total of 11 factors to consider
94
COBIT Publications
Designed so that companies could adopt its recommendations in a way that is customized to their own needs
95
COBIT 2019 Framework: Introduction and Methodology
Introduces the core concepts of the framework
96
COBIT 2019 Framework: Governance and Management Objectives
Provides a outline of the 40 management and governance objectives, components and references
97
COBIT 2019 Design Guide: Designing an Information and Technology Governance Solution
Covers design topics that influence governance as well as a guideline for designing a customized gov system
98
COBIT 2019 Implementation Guide: Implementing and Optimizing an Information nd Technology Governance Solution
Provides a road map for continuous improvements when designing information tech gov systems -used in conjunction with design guide
99
Processes COBIT Component
activities to achieve goals
100
Organizational Structures
decision making entities
101
Principals, Policies and Frameworks
| COBIT Compenent
These serve as the guide for turning desired behavior into practice
102
Information
| COBIT Compenent
info needed for gov system to work
103
Culture, Ethic, and Behavior
| COBIT Component
These factors influence the success of all management and governance activities
104
People, Skills, and Competencies
| COBIT Component
These are needed so that sound decisions are made, corrective actions are taken when necessary, and critical objectives are complete
105
Services, Infrastructure, and Applications
| COBIT Component
gov system tools and resources needed for info tech processing
106
Enterprise Strategy
| COBIT Design Factor
IT governance strategies generally include a primary strategy and a secondary strategy. Examples include growth/acquisition, innovations/differentiation, cost leadership
107
Enterprise Goals
| COBIT Design Factor
Goals support the strategy and are structured based on the balanced scorecard dimensions, which are financial, customer, internal, and growth
108
Risk Profile
| COBIT Design Factor
Addresses current risk exposure for the organization and maps out which risks exceed the orgz risk appetite
109
Information and Tech Issues
| COBIT Design Factor
Common issues include regular IT audit findings of poor IT quality or control, insufficient IT resources, frustration between IT and different departments, hidden IT spending, problems with data quality, and non compliance with applicable regulations.
110
Threat Landscape
| COBIT Design Factor
the environment in which the company operates. The threat landscape may be classified as normal or high because of geopolitical threats or issues, the industry sector, or economic issues.
111
Compliance Requirements
| COBIT Design Factor
Compliance demands on the company can be classified as low, normal, or high. Classifications are intuitive, with low requirements implying minimal compliance demands, normal compliance indicating that the organization is typical of its industry
112
Role of IT
| COBIT Design Factor
Categorized as:
Support - system that is not critical for operating a business or maintaining continuity
Factory - system that will have an immediate impact in business operations and continuity if it fails
Turnaround - system that drives innovation for the business but s not required for critical business operations
Strategic - system that is crucial for both innovation and business operations
113
Sourcing model for IT
| COBIT Design Factor
Sourcing is the type of IT procurement model the company adopts, ranging from outsourcing, to cloud based, built in house, or a hybrid of any of these sources
114
Technology Adoption Strategy
| COBIT Design Factor
First mover strategy - emerging technologies are adopted as soon as possible to gain an edge
Follower strategy - emerging technologies are adopted after they are prove
Slow-adopter strategy - very late to adopt new tech
115
Enterprise Size
| COBIT Design Factor
Two enterprise sizes are defined - large companies with total full-time employee count of more than 250, and small/mid companies with 50 to 250 full time employees
116
Govern Function
| NIST Privacy Framework Core
governance policies, process, and procedures
-risk management strategy
-awareness and training
-monitoring review
117
What is are examples of admin safeguards?
| HIPPA
-security and awareness training
-information access management
-Contingency plans
118
