Security And risk Management Flashcards
(144 cards)
1
Q
Need to know access
A
Confidentiality
2
Q
Information processed correctly and not modified by unauthorized persons and protecting data in transit
A
Integrity
3
Q
Ensuring systems are up and running so that persons can use them when they need them
A
Availability
4
Q
Who get access- who is authorized to speak behave access to the system
A
Availability
5
Q
Lashes, digital signatures, parity bits, separation of duties
A
Integrity
6
Q
Remote sites, backups, high availability, RAID levels,
A
Availability
7
Q
Validates appropriate policies, procedures and standards and guidelines are implemented to ensure business operations
A
Information Security Management
8
Q
Things measured on a long-term trends and illustrate the day-to-day workload
A
Metrics
9
Q
Who is responsible for Security
A
Everyone
10
Q
Who is ultimately responsible for Security
A
Executive Management/Executive Level
11
Q
Who does security report too?
A
Chain of command
12
Q
Detecting- pre-emptive measure made to avoid harm to other persons or their property
A
Due Diligence
13
Q
Caring is correcting
A
Due Care
14
Q
Legal term used to describe the care a “reasonable person” would exercise under given circumstances
A
Due Care
15
Q
Examples: Background checks of employee credit checks of business partners Information security assessments Penetration testing Contingency testing of backup systems
A
Due Diligence
16
Q
Dual use goods
A
Wassenaar Arrangement
17
Q
3 types of access control
A
Administrative
Physical
Technical
18
Q
Name 2 types of Risk
A
Likelihood
Impact
19
Q
What is C.I.A?
A
Confidentiality; Availability and Integrity
20
Q
idea that is certified and made public
A
Patent
21
Q
Expression of an idea
A
Copyright
22
Q
What organization concisely defines intellectual property?
A
World Intellectual Property Organization (WIPO)
23
Q
What laws explain what is an export?
A
International Traffic in Arms Regulations Act (ITAR:1976)
24
Q
What laws explain What is deemed export?
A
Export Administration Regulations Act Security (EAR:1979)
25
What is the most common Dual-Use goods?
Cryptography
26
Right and Obligations of individuals and Organizations with respect to the collection, use, retention and disclosure of personal information
Privacy
27
Limits collection of personal data
Collection Limitation Principle
28
data that should be relevant to the purposes for which they are to be used and to the extent necessary for those purpose
Data Quality Principle
29
Personal data collected is specified not later than at the time of data collection and the subsequent use is limited to the fulfillment
Purpose Specification Principle
30
data should not be disclosed , made available or used for purpose other than those specified except; with consent of the data subject
use Limitation Principle
31
Personal data protected by Security Safeguards
Security Safeguard Principle
32
openness of general policy about developments, practices and policies respect to personal data
Openness Principle
33
An event that has the potential to do harm
Incident
34
An event that is measurable or observable occurrence that involves any asset
Incident
35
An incident that results in the disclosure or potential exposure of data
Breach
36
Unauthorized acquisition of personal information maintained in computerized form by a person that compromises the security, confidentiality, or integrity of the personal information
Data Disclosure
37
provides a common language for describing security incidents in a structured and repeatable manner
VERIS (The Vocabulary for Event Recording and Incident Sharing)
38
Regulates the handling of personal information about individuals
Privacy Act
39
sets national standards for the security of electronically protected health information
Health Insurance Portability and Accountability Act (HIPPA)
40
certify the accuracy of financial information and penalties for fraudulent activity by providing outside auditors to review accuracy of financial statements
Sarbanes-Oxley Act
41
standard that requires notice of data breaches of personal data breach to the competent national authority no later than 24 hours after detection
Regulation for Electronic Communications Service
42
Ethical Standard that protects country
Global responsibilities
43
Ethical Standard Protect State
National standard
44
Ethical Standard Protect Company
Organizational standard
45
What you do when no one is there to navigate what you do legally or illegal
Personal Standard
46
Code of Ethic Canons
Protect Society (people)
Act Honorably (Honor)
Provide diligent and competent service to principals (Boss)
Advance and protect the profession (profession)
47
components that support the implementation of security policy
Procedure, standards, guidelines, and baselines
48
4 Steps in a BIA
Gather information, perform a vulnerability assessment, analyzing the information, Document the results
49
An event or situation that if occurred, would prevent the organization from operating in its normal manner, if at all
Threat
50
The amount of time the organization can function without that application before significant impact occurs
Recovery Time Objective (RTO) or Maximum Tolerable Downtime (MTD)
51
How quickly you need to have that application information available after downtime has occurred
Recovery Time Objective (RTO)
52
Refers to the point in time which data must be restored in order to successfully resume processing between the last backup and when the event occured
Recovery Point Objective (RPO)
53
Reduce Risk of Collusion between individuals
Job Rotation
54
to not have the same capability to execute all of the steps of a particular process
Separation of Duties
55
access to sensitive data to do there job
Need to know
56
Guidance that analyze risks and manage mitigation in alignment with business and compliance objective
GRC- Governance Risk Management and Compliance
57
Data Protection Directive (DPD), Personal Information Protection and Electronic Documents Acts (PIPEDA), Personally Identifiable Information (PII), HIPAA and Gramm-Leach Bliley ACt (GLBA), Payment Card Industry (PCI) are all examples of what?
Privacy Requirements Compliance
58
Idea that is certified and made public
Patent
59
Contribute to regional and international security and stability by promoting transparency and greater responsibility in transfers of conventional arms and dual-goods and technolgies
The Wassenaar Arrangement (AR)
60
Regulates the handling of personal information about individuals
The Privacy Act
61
sets national standards for the security of electronically protected health information
Health insurance Portability and Accountability ACt (HIPPA)
62
Top management must individually certify the accuracy of financial information and penalties for fraudulent financial activity are greater.
Sarbanes-Oxley Act
63
European Electronic Communication Service providers are required to provide notice of data breaches of a personal data breach to the competent national authority no later than 24 hours after the detection of the personal data breach, when feasible
Regulation for Electronic Communication Service (EU)
64
Procedures, standards, guidelines, and baselines are components that support the implementation of what?
Security Policy
65
1st step in building the BC program
Project initiation and management
66
Before the project can even start, it must have who's support?
Senior/executive Management
67
Procedures implanted to define the roles, responsibilities, policies and administrative functions needed to manage the control environment
Administrative Controls
68
An estimate of how often a threat will be successful in exploiting a vulnerability over the period of a year
Annualized Rate of Occurrence (ARO)
69
The principle that ensures that information is available and accessible to users
Availability
70
An incident that results in the disclosure or potential exposure of data
Breach
71
Controls and hat substitute for the loss of primary controls and mitigate risk down to an acceptable level
Compensating Controls
72
Actions that ensure behavior that complies with established rules
Compliance
73
Covers the expression of ideas rather than the ideas themselves; it usually protects artistic property such as writing, recordings, database, and computer programs.
Copyright
74
Supports the principle of "Least Privilege" by providing that only authorized individuals, processes, or systems should have access to information on a need to know basis
Confidentiality
75
Covers the expression of ideas rather than the ideas themselves, usually protected artistic property such as writings, recording, databases, and computer programs
Copyright
76
Controls implemented to remedy circumstance, mitigate damage, or restore controls
Corrective Controls
77
A breach for which it was confirmed that data was actually disclosed(not just exposed) to an unauthorized party
Data Disclosure
78
Controls designed to signal warning when a security control has been breached
Detective Controls
79
Controls designed to discourage people from violating security directives
Deterrent Controls
80
Controls designed to specify acceptable rules of behavior within an organization
Directive Controls
81
Is similar to Due care with the exception that it is a pre-preemptive measure made to avoid harm to other persons or their property
Due Diligence
82
A process designed to identify potential events that may affect the entity, manage risk so it is within its risk appetite, and provide reasonable assurance regarding the achievement of entity objectives
Enterprise Risk Management
83
Authorized the President to regulate export of civilian goods and technologies that have military applications
Export Administration Act
84
Ensures the business focuses on core activities clarifies who in the organization has the authority to make decisions, determines accountability for actions and responsibility for outcomes, and addresses how expected performance will be evaulated
Governance
85
A Security Event that compromises the confidentiality, integrity, or availability of an information asset
Incident
86
Comes in two forms making sure that information is processed correctly and not modified by unauthorized persons and protecting information as it transits a network.
Integrity
87
Accountable for ensuring the protection of all of the business information assets from intentional and unintentional loss, disclosure, alteration, destruction and unavailabilty
Information Security Officer
88
Granting users only the accesses that are required to perform their job functions
Least Privilege
89
Electronic hardware and software solutions implemented to control access to information and information networks
Logical (Technical) Controls
90
Protects novel, useful, and non-obvious inventions
Patent
91
Controls to protect the organizations people and physical environment, such as locks, fire management, gates, and guards
Physical controls
92
Controls implemented to prevent a security incident
Preventive Controls
93
Controls implemented to restore conditions to normal after a security incident
Recovery Controls
94
How quickly you need to have that applications information available after downtime has occured
Recovery Time Objective (RTO)
95
The point in time to which data must be restored in order to successfully resume processing
Recovery Point Objective (RPO)
96
A Combination of the probability of an event and its consequences (ISO 27000)
Risk
97
An expectation of loss expressed as the probability that a particular threat will exploit a particular vulnerability with a particular harmful result (RFC 2828)
Risk
98
The practice of accepting certain risk, typically based on business direction that may also weigh the cost versus the benefit of dealing with the risk in another way
Risk Acceptance
99
The practice of coming up with alternatives so that the risk in question is not realized
Risk Avoidance
100
The practice of the elimination of or the significant decrease in the level of risk presented
Risk Mitigation
101
The practice of passion on the risk in question to another entity, such as an insurance company
Risk Transfer
102
A systematic process for identifying, analyzing, evaluation, remedying, and monitoring risk
Risk Management
103
Defined as the difference between the original value and the remaining value of an asset after a single exploit
Single Loss Expectancy (SLE)
104
An word, name, symbol, color, sound, product shape, device, or combination of these that is used to identify goods and distinguish them from those made or sold by others
Trademark
105
Proprietary business or technical information, processes, designs, practices, etc. that are confidential and critical to the business
Trade Secret
106
Determines the potential impact of disruptive events on the organizations business processes
Vulnerability Assessment
107
Established to contribute to regional and international security and stability by promoting transparency and greater responsibility in transfers of conventional arms and dual-use goods and technologies, this preventing destabilizing accumulations
Wassenaar Arrangement
108
Within the realm of IT Security, which of the following combinations best define risk:
A. Threat coupled with a breach
B. Threat coupled with a vulnerability
C. Vulnerability coupled with an attack
D. Threat coupled with a breach of security
B. Threat coupled with a vulnerability
(A vulnerability is a lack of countermeasure or a weakness in a countermeasure that is in place. A threat is any potential danger that is associated with the exploitation of a vulnerability)
109
When determining the value of an intagible asset which is the BEST approach:
A. Determine the physical storage cost and multiply by the expected life of the company
B. With the assistance of finance of accounting professional determine how much profit the asset has returned
C. Review the depreciation of intangible asset over the past three years
D. Use the historical acquisition or development cost of the intangible asset.
B.-
110
Qualitative risk assessment is ear marked by which of the following?
A. Ease of implementation and it can be completed by personnel with a limited understanding of the risk assessment process
B. Can be completed by personnel with a limited understanding of the risk assessment process and uses detailed metrics used for calculation of risk
C. Detailed metrics used for calculation of risk and ease of implementation
D. Can be completed by personnel with a limited understanding of the risk assessment process and detailed metrics used for the calculation of risk
A
111
Single Loss expectancy (SLE) is calulated by using:
A. Asset Value and annualized rate of occurence (ARO)
B. Asset Value, local annual frequency estimate (LAFE) and standard annual frequency estimate (SAFE)
C. Asset value and exposure factor
D. Local annual frequency estimate and annualized reate of occurence
C
112
Consideration for which type of risk assessment to perform includes all of the following:
A. Culture of the organization likelihood of exposure and budget
B. Budget, capabilities of resources and likelihood of exposure
C. Capabilities of resources, likelihood of exposure and budget
D. Culture of the organization, budget, capabilities and resources
D
113
Security Awareness training includes:
A. Legislated security compliance objectives
B. Security roles and responsibilities for staff
C. The high-level outcome of vulnerability assessments
D. Specialized curriculum assignments, coursework and an accredited institution.
B
114
```
What is the minimum and customary practice of responsible protection of assets that affects a community or societal norm?
A. Due diligence
B. Risk Mitigation
C. Asset Protection
D. Due Care
```
D
115
```
Effective Security Management
A. Achieved security at the lowest cost
B. Reduces risk to an acceptable level
C. Prioritizes security for new products
D. installs patches in a timely manner
```
B
116
Availability makes information accessible by protecting from:
A. Denial of services, fires, floods, hurricanes, and unauthorized transactions
B. Fire, floods, hurricanes, unauthorized transactions and unreadable backup tapes
C. unauthorized transactions fires, floods, hurricanes and unreadable backup tapes
D. Denial services, fires, floods, and hurricanes and unreadable backup tapes
D
117
Which phrase best defines a business continuity/disaster recovery plan?
A. A set of plans for preventing a disaster
B. An approved set of preparations and sufficient procedures for responding to a disaster
C. A set of preparations and procedures for responding to a disaster without management approval
D. The adequate preparations and procedures for the continuation of all organization functions
D
118
Which of the following steps should be performed first in a business impact analysis (BIA)?
A. Identify all business units within an organization
B. Evaluate the impact of disruptive events
C. Estimate the Recovery Time Objectives (RTO)
D. Evaluate the criticality of business functions
A
119
Tactical security plans are BEST used to:
A. Establish high-level security policies
B. Enable enterprise/entity-wide security management
C.Reduce downtime
D. Deploy new security technology
D
120
```
Who is accountable for implementing information security?
A. Everyone
B. Senior Management
C. Security Officer
D. Data Owners
```
C
121
```
Security is likely to be most expensive when addressed in which phase?
A. Design
B. Rapid Prototyping
C. Testing
D. Implementation
```
D
122
Information systems auditors help the organization?
A. Mitigate compliance issues
B. Establish and effective control environment
C. Identify control gaps
D. Address information technology for financial statements
C
123
The Facilitated Risk Analysis Process (FRAP)
A. Makes a base assumption that a broad risk assessment is the most effective way to determine risk in a system, business segment, application or process
B. Makes a base assumption that a narrow risk assessment is the most efficient way to determine risk in a system, business segment, application or process
C. Makes a base assumption that a narrow risk assessment is the least efficient way to determine risk in a system, business segment, application or process
D. makes a base assumption that a broad risk assessment is the least efficient way to determine risk in a system, business segments, application or process
B
124
Setting clear security roles has the following benefits:
A. Establishes personnel accountability, reduces cross-training requirements and reduced departmental turf battle
B. Enables continuous improvement, reduces cross-training requirements and reduced departmental turf battle
C. Established personal accountability, establishes continuous improvement and reduces turf battles
D. Reduced departmental turf battles, Reduces cross-training requirements and establishes personal accountability
C
125
Well-written security program policies are BEST reviewed:
A. At least annually or at pre-determined organization changes
B. After major project implementations
C. When applications or operating systems are updated
D. When procedures need to be modified
A
126
An organization will conduct a risk assessment to evaluate:
A. Threat to its assets, vulnerabilities not present in the environment, the likelihood that a threat will be realized by taking advantage of an exposure, the impact that the exposure being realized will have on the organization, the residual risk
B. Threat to its assets, vulnerabilities present int he environment, the likelihood that a threat will be realized by taking advantage of an exposure, the impact that the exposure being realized will have on another organization, the residual risk
C. Threat to its assets, vulnerabilities present int he environment, the likelihood that a threat will be realized by taking advantage of an exposure, the impact that the exposure being realized will have on organization, the residual risk
D.Threat to its assets, vulnerabilities present int he environment, the likelihood that a threat will be realized by taking advantage of an exposure, the impact that the exposure being realized will have on the organization, the total risk
C
127
A security policy which will remain relevant and meaningful over time includes the following:
A. Directive words such as shall, must, or will, technical specifications and is short in length
B. Defined policy development process, short in length and contains directive words such as shall, must or will
C. Short in length, technical specifications and contains directive words such as shall, must or will
D. Directive words such as shall, must, or will, defined policy development process and is short in length.
D
128
```
The ability of one person in the finance department to add vendors to the vendor database and subsequently pay the vendor violates which concept?
A. A well-formed transaction
B. Separation of duties
C. Least Privilege
D. Data sensitivity level
```
B
129
```
Collusion is best mitigated by:
A. Job rotation
B. Data Classification
C. Defining job sensitivity level
D. Least privilege
```
A
130
```
Data Access decisions are best made by:
A. user managers
B. Data Owners
C. Senior Management
D. Application developer
```
B
131
Which of the following statements BEST described the extent to which an organization should address business continuity or disaster recovery planning?
A. Continuity Planning is significant organizational issue and should include all parts or functions of the company
B. Continuity planning is a significant technology issue and the recovery of technology should be its primary focus
C. Continuity planning is required only where there is complexity in voice and data communications
D. Continuity planning is a significant management issue and should include the primary functions specified by managemen
A
132
Business impact analysis is performed to BEST identify:
A. The impacts of a threat to the organization operations
B. The exposure to loss to the organization
C. The impacts of a risk on the organization
D. The cost efficient way to eliminate threats
B
133
During the risk analysis phase of the planning, which of the following actions could BEST manage threats or mitigate the effects of an event?
A. Modifying the exercise scenario
B. Developing recovery procedures
C. Increasing reliance on key individuals
D. Implementing procedural controls
D
134
```
The BEST reason to implement additional controls or safeguards is to:
A. deter or remove the risk
B. Identify and eliminate the threat
C. Reduce the impact of the threat
D. identify the risk and the threat
```
C
135
Which of the following statements BEST describes organization impact analysis?
A. Risk analysis and organization impact analysis are two different terms describing the same project effort
B. A organization impact analysis calculates the probability of disruptions to the organizations
C. A organization impact analysis is critical to development of a business continuity plan
D. A organization impact analysis establishes the effect of disruptions on the organization
D
136
```
The term "disaster recovery" refers to the recovery of:
A. organization operations
B. Technology environment
C. manufacturing environment
D. personnel environments
```
B
137
```
Which if the following terms BEST described the effort to determine the consequences of disruption that could result from a disaster?\
A. Business Impact Analysis
B. Risk Analysis
C. Risk Assessment
D. Project problem definition
```
A
138
the elements of risk are as follows:
A. natural Disasters and man-made disasters
B. Threats, assets and mitigating controls
C. Risk and business impact analysis
D. Business Impact analysis and mitigating controls
B
139
Which if the following methods is not acceptable for exercising the business continuity plan?
A. Table-top exercise
B. Call exercise
C. Simulated exercise
D. Halting a production application or function
D
140
Which of the following is the primary desired result of any well-planned business continuity exercise?
A. Identifies plan strengths and weaknesses
B. Satisfies management requirements
C. Complies with auditors requirements
D. Maintains shareholder confidence
A
141
A business continuity plan is best updated and maintained:
A. Annually or when requested by auditors
B. Only when new versions of software are deployed
C. Only when new hardware is deployed
D. During the configuration and change management process
D
142
```
Which of the following is MOST important for successful business continuity>
A. Senior leadership support
B. Strong technical support staff
C. Extensive wide are network
D. An integrated incident response team
```
A
143
```
A Service's recovery point objective is zero. Which approach BEST ensures the requirement is met?
A. RAID 6 with a hot site alternative
B. RAID 0 with a warm site alternative
C. RAID 0 with a cold site alternative
D. RAID 6 with a reciprocal agreement
```
A
144
The (ISC)2 code of ethics resolves conflicts between canons by:
A. there can never be conflicts between canons
B. Working through adjuducation
C. The order of the canons
D. Vetting all canon conflicts through the board of directives
C
