Brainscape's Knowledge GenomeTM


Top Flashcards (Certified)
All Flashcards

CISSP > Security and Risk Management > Flashcards

Security and Risk Management Flashcards

(118 cards)

Start Studying
1
Q

5 Pillars of information security

A
  1. Confidentiality: Secure read access
  2. Integrity: Secure write access
  3. Availability: Systems are available for normal business use
  4. Authenticity: Proving an identity claim
  5. Nonrepudiation: The combination of integrity and authenticity
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

CIA Opposite

A

Disclosure, Alteration, Destruction

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Confidentiality (opp Disclosure)

A

Aims to prevent the unauthorized disclosure of information

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Integrity ( Opp Alteration)

A

Focuses on the prevention of unauthorized modification of assets.

Applies to both data and systems

Malware installation would be a violation of a system’s integrity

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Availability (Opp Destruction)

A

Ensures that required access to resources remains possible

Ransomware and denial of service(DoS) attacks represent breaches of availability

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Privacy

A

defined as confidentiality and protection of PII

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Identification

A

Provides a weak and unproven claim of identity

providing a username - an example of identification

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Authenticity

A

serves as proof a user’s identity claim is legitimate

strong authentication implies higher integrity means of proof

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Nonrepudiation

A

Combination of integrity and authenticity

Eg: proving a user signed a contract, while also proving that the contract was not subsequently altered

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Authorization

A

proceeds after successful authentication and determines what the authenticated user can do

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Accounting

A

details the interactions performed by individuals

Audit logs could be generated for accountability / documented actions

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

4 main categories of authentication

A

something you know
something you have
something you are
someplace you are (GPS ) - SANS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Two-factor or multi-factor authentication

A

using 2 of the categories

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

PoLP

A

Principle of least privilege(PoLP) known as Min necessary access

fundamental principle of security

Any additional rights, permissions, privileges, or entitlements violate this principle

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Separation of Duties (SoD)

A

Goal of SoD is to limit risk associated with critical functions/transactions

Risk is mitigated by requireing two parties to perform what one person could

Eg: Requiring multiple individuals to sign a check (financial transactions)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Rotation of duties

A

Another policy for fraud deterrence/detection
- force other people to be in charge of key tasks

eg: printing payroll checks

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Due Care and Due Deligence

A

Due Care: acting as any reasonable person would (referred to as prudent man rule)

Due diligence: practices to processes that ensure the decided upon standard of care is maintained

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

types of controls

A

preventive :deny unauthorised access to resources
detective: tries to detect that ther eis a pbm after an attack
corrective: reacts to an attack
deterrent: discourages security violations
recovery : restores after an attack/failure
compensating: used to shore up existing controls deficiencies

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

controls implemented across

A

Administrative : Background checks, policies n procedures
Technical: Encryption, smart cards
Physical: Locks, security laptops n magnetic media, protection of cable

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

detective control eg

A

eg: Auditing and IDS (Intrusion detection system)

CCTV, Motion sensors

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

preventive n deterrent control difference

A

eg: preventive control will not allow a user to violate the security policy

deterrent control will present a banner indicating not legal to use , but not orevent: eg: no trespassing sign

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

NIST SP 800-30

A

Risk mgmt guide for information technology systems

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Asset Identification and Evaluation

A

understanding assets is key to effective risk analysis
inventory assets and assess their role in the org

Evaluate the asset value
understand how uncertain the data obtained is

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Risk

A

Risk = Threat * Vulnerability

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Threat
Threat: anything that can cause harm to an infosystem threat agents / threat sources are who (Adversary) Threat agent: organised crime threat: sys compromise thru server-side attack
24
Vulenrabilities
a weakness in a system that could potentially be exploited
25
zero-day vulnerabilities
are those not publicly known (targeted with zero-day exploits)
26
Exploits & the payload
Exploitation is the process of a threat taking advantage of a vulnerability the actions triggered by the exploit are called the payload
27
Risk Analysis - Quantitative and Qualitative risk analysis
28
Quantitative formulas (SLE,ARO,ALE) TCO , ROI, Cost/Benefit Analysis
SLE- Single loss expectancy ARO -Annualised rate of occurrence ALE - Annualised loss expectancy SLE = EF (Exposure factor) * AV (Asset value) ALE = SLE * ARO TCO - Total cost of ownership ROI - Return on investment
29
Risk Management Key Formulas Quantitative
Asset Value(AV) : The value os the asset ARO: Frequency of threat occurrence per year Exposure Factor (EF) : % of asset value at risk due to a threat SLE = AV *EF ALE : SLE*ARO
30
Qualitative risk analysis
Likehood and impact
31
Excessive Risk
level of risk is unacceptable to the decision makers eg: Injury or loss of life
32
Risk mitigation
taking actions that decreases the risk mitigation can come in flavours: 1. threat oriented : focused on reducing motivation of the threat agents 2.vulnerability oriented : reducing vulns 3.Impact oriented : reducing the impact 4. likelihood oriented : reducing likelihood
33
Risk avoidance
not to move fwd with a new project that introduces risk
34
transferring risk
eg:purchase of insurance outsource risky systems to a third party Eg:data breach insurance
35
Accepting risk
accept residual risk accept a certain level of risk
36
controls identification and assessment
after identification, assess TCO ROI
37
Security architecture: mergers n acquisitions divestitures (demergers or deacquisitions)
acquisitions - challenge deacquisitions - nightmare
38
RFI / RFP/ / RFQ
Request for information / proposal / quote
39
BPA (Business process agreement)
typically addresses things like ownership, profit/losses, partner contributions
40
MOU / MOA
Memorandum of understanding or agreement - goal is to establish the basic roles, responsibilities, and requirements for interconnection
41
NIST 800-47
Security guide for interconnecting info technology systems
42
SLA / OLA /ELA
OLA is an internal agreement that supports SLA SLA: Expectations customer has for their service provider ELA : Enterprise license agreement
43
FedRAMP
Federal risk and authorization management program
44
SCRM - Supply chain risk management
45
46
SBOM ( Software bill of materials)
SBOM Minimums: Supplier name component name version of the component other unique identifiers dependency relationship author of SBOM data timestamp
47
SOC Reports - System and organisation controls
created/validated by auditors provide insight into 3rd party service providers
48
SOC Reports : SOC 1, SOC 2, SOC 3
SOC1: Internal control over financial reporting (ICFR) Focus on financial stmts SOC2: Trust services criteria emphasis on controls related to security SOC3: Trust services criteria for general use report / public report
49
SOC Type 1 / SOC Type 2
Type 1: Description / suitability of controls design Type 2: Description/suitability/effectiveness of controls design Note: SOC3 can be created as type 2 report
49
SOC for cybersecurity SOC for supply chain
49
Threat modelling
50
Microsoft STRIDE
Spoofing ID Tampering with data Repudiation Information disclosure DoS Elevation of privilege
50
Threat Identification Vulnerability identification
identify various threats that could exeercise vulns - understand various threats -
50
Attack Surface
A systems attack surface represents all the ways in which an attacker could attempt to introduce data to exploit a vuln reducing attack surface --- is by disabling unneeded services or - not listening on unnecessary ports
50
Scoring vulnerabilities CVSS
5 to 1 CVSS - Common vulnerability scoring system Developed by a consortium of US Govt orgs and vendors
51
Threat Vectors
are methods attackers use to touch or exercise vulns
52
Laws
Laws, directives, regulations do not normally provide detailed instructions for protecting computer related assets instead they specify requirements such as restricting the availability of PII
53
Types of laws Statutes Administrative Civil Common law Religious
Constitution Statutes - criminal proceedings - civil proceedings Administrative : Regulations : HIPAA Common law:case law or judicial precedent Legal systems: Civil law: - Statutory - Most common Common law ( case law) eg: UK, US, Canada Religious law: Sharia : Islamic law Customary law
54
Criminal Law
society has been harmed criminal charges are the only laws in which someone can get jail time successful prosecution can warrant being removed from society
55
Civil Law
Deals with civil actions initiated by individual or orgs Eg: torts, contracts, property and loss by business/individual takes less time in courtroom person can be ordered to pay monetary damages
56
Computer crime challenges
difficult to keep pace with rapidly changing tech
57
Types of damages
Compensatory : monetary award --- rel to actual loss/harm Statutory: Monetary damages designated by law Punitive: award meant to punish the defendant, not tied to actual losses Legal fees:
58
International difficulties , international cooperation
59
IP - Intellectual Property
Patent Copyright Trademark Servicemark Trade secret
60
Patent
protects inventions for 20 years from date of filing invention must: have utility novelty be non-obvious must reduce the invention to practice and cover single idea
61
Copyright
form of expression provided to the authors of original works recorded thought on - paper, vinyl, plastic, magnetic media, or other
62
Trademark
is a word , name, symbol or device that is used in trade with goods servicemark - a trademark for a service instead of a product
62
Trade secret
protects critical IP that is not publicly available
63
IP enforcement and attacks
Trademark attacks : 1. counterfeiting : products intended to be mistakenly associated with brand 2. Dilution: widespread use of brand names Copyright attacks: Piracy: unauthorised use or reproduction of material Trade secrets: economic/industrial espionage
64
Counterfeit products
eg: cisco fiber transceiver
65
Product implants and tampering
hardware supply chain attack 1. seeding: modify the product in the facotry itself 2. interdiction: intercept products that move between factories
66
Software licensing issues
licensing can serve as a form of IP Protection site license per-user/per-device license concurrent users license
67
Workplace privacy
employee privacy management responsibilities
68
European Union
Data protection directive
69
International privacy considerations
OECD : Org for economic co-operation and development EU GDPR
70
GDPR - General data protection regulation
Supersedes EU data protection directive
71
OECD Guidelines
key provisions - limitations on collection lawful collection accuracy of data ensured collected for legitimate purposes no data disclosure accountable for data controller
72
GDPR principles
lawfulness, fairness, transparency purpose limitation data minimization accuracy storage limitation integrity n confidentiality accountability
73
Enforcement of GDPR began in may 2018
eg: Google LLC , Amazon europe - 60,34 million euros for pushing advertising cookies without consent
74
GDPR: Data breach
breach notification to supervisory authority within 72hrs of discsovery communication of data breach to those affected eg: british airways - 20million euros - 400k customers Marriot : 18.4m - 339 million customers
75
GDRP - DPIA - Data protection impact assessment
Designate a DPO Data protection officer
76
PIPL - Personal information protection law (China) - 2021
SPI - Sensitive personal info PIPIA - personal information protection impact assessment
77
PoPIA - enforce 2021 - South Africa Protection of personal information act
78
CCPA - California consumer privacy act
2018 state-level law
78
US - FIPPs (Fair information practice principles )
79
Databreach - minimization
- insure against the loss with data breach insurance - plan comms in advanceof a breach
80
PCI DSS
developed by major credit card companies to reduce fraud associated with credit card companies
81
Ethics bodies IAB (Internet activities board)
what not to do - seek to gain unauthorized access on internet disrupt intended use of internet waste resources destroy the integrity of computer based info
81
Code of Ethics:
1. Protect society 2. Act honorably, honestly, justly, responsibly, and legally 3. provide diligent and competent service to principals 4. Advance and protect the profession
82
Security Policies
provide high level guidance regarding expected conditions eg: password s must be changed every 90 days
83
Policy components
Purpose Related docs Cancellation background scope/exceptions policy statement responsibility ownership effective date / expiration date
84
Scope : Levels of policy
Policies can exist on differnet levels with a hierarchy that can determine scope - enterprise-wide / corporate policy - division-wide policy - local policy - Issue - specific policy
85
Security procedures
are more detailed than security policies - focussed on how to achieve what security policies mandate eg: follow these step-by-step instructions to build the server
86
policies vs procedures
policies are high level, procedures are detailed guidance
87
Security standard
organizational, compulsory eg: admins must use windows server 2019 as the base OS Baseline: is a more specific implementation of a standard
88
Security Guideline
suggestions not compulsory
89
Personnel Security
prior to hiring, during employment, during the separation
90
Background checks
pre-employment background checks and screenings are a common way of vetting candidates
91
Cross-training Job rotation
92
Mandatory vacation
helps to force job rotation
92
AUP - Acceptable use policy
establishes expectations of employees
93
Personnel Monitoring
94
Non-Disclosure Agreement (NDA)
- Company data should not be shared with competitors
95
Non-compete agreement
purpose is to establish that an employe who leaves the org agrees not to work for a competitor Hiring, training, grooming employees can be costly for an org
96
non-solicitation agreement
if an employee leaves the company, agreement prohibits an employee from --- soliciting other employees to also leave --soliciting customers of the employer for business
97
Termination
Mishandling access revocation poses significant risk ensuring all access has been removed in a timely basis can decrease the likelihood of compromise imp with disgruntled individuals
98
Controlling your env : key principles
Policy : tells a user what to do Training: provides the skillset Awareness: changes user behaviour Key threat: social engineering - manipulation - people need to be made aware of the dangers
99
Audit Standards: SSAE
Statement on Standards for Attestation Engagements (SSAE),
100
Audit Standards: AICPA
American institute of certified public accountants
101
Audit Standards: ISAE
International standard on assurance engagements
102
Audit Standards: IAASB
International Auditing and Assurance Standards Board
103
global digital forensics standards:
1.ISO/IEC 27037:2012: Guide for collecting, identifying, and preserving electronic evidence 2. ISO/IEC 27041:2015: Guide for incident investigations 3. ISO/IEC 27042:2015: Guide for digital evidence analysis 4.ISO/IEC 27043:2015: Incident investigation principles and processes 5.ISO/IEC 27050-1:2016: Overview and principles for eDiscovery
104
ISO 27001
ISO 27001 is the standard for international information security management. ISMS - Information security management system
105
ISO 27002
ISO 27002 is a supporting standard that guides how the information security controls can be implemented.
106
ISO/IEC 27017:2015
A set of standards regarding the guidelines for information security controls applicable to the provision and use of cloud services and cloud service customers
107

CISSP (9 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2025 Bold Learning Solutions. Terms and Conditions