Security And risk Management Flashcards by Dee-Janeen Bailey

Need to know access

Confidentiality

How well did you know this?

Not at all

Perfectly

Information processed correctly and not modified by unauthorized persons and protecting data in transit

Integrity

How well did you know this?

Not at all

Perfectly

Ensuring systems are up and running so that persons can use them when they need them

Availability

How well did you know this?

Not at all

Perfectly

Who get access- who is authorized to speak behave access to the system

Availability

How well did you know this?

Not at all

Perfectly

Lashes, digital signatures, parity bits, separation of duties

Integrity

How well did you know this?

Not at all

Perfectly

Remote sites, backups, high availability, RAID levels,

Availability

How well did you know this?

Not at all

Perfectly

Validates appropriate policies, procedures and standards and guidelines are implemented to ensure business operations

Information Security Management

How well did you know this?

Not at all

Perfectly

Things measured on a long-term trends and illustrate the day-to-day workload

Metrics

How well did you know this?

Not at all

Perfectly

Who is responsible for Security

Everyone

How well did you know this?

Not at all

Perfectly

Who is ultimately responsible for Security

Executive Management/Executive Level

How well did you know this?

Not at all

Perfectly

Who does security report too?

Chain of command

How well did you know this?

Not at all

Perfectly

Detecting- pre-emptive measure made to avoid harm to other persons or their property

Due Diligence

How well did you know this?

Not at all

Perfectly

Caring is correcting

Due Care

How well did you know this?

Not at all

Perfectly

Legal term used to describe the care a “reasonable person” would exercise under given circumstances

Due Care

How well did you know this?

Not at all

Perfectly

Examples:
Background checks of employee credit checks of business partners 
Information security assessments 
Penetration testing
Contingency testing of backup systems

Due Diligence

How well did you know this?

Not at all

Perfectly

Dual use goods

Wassenaar Arrangement

How well did you know this?

Not at all

Perfectly

3 types of access control

Administrative
Physical
Technical

How well did you know this?

Not at all

Perfectly

Name 2 types of Risk

Likelihood

Impact

How well did you know this?

Not at all

Perfectly

What is C.I.A?

Confidentiality; Availability and Integrity

How well did you know this?

Not at all

Perfectly

idea that is certified and made public

Patent

How well did you know this?

Not at all

Perfectly

Expression of an idea

How well did you know this?

Not at all

Perfectly

What organization concisely defines intellectual property?

World Intellectual Property Organization (WIPO)

How well did you know this?

Not at all

Perfectly

What laws explain what is an export?

International Traffic in Arms Regulations Act (ITAR:1976)

How well did you know this?

Not at all

Perfectly

What laws explain What is deemed export?

Export Administration Regulations Act Security (EAR:1979)

How well did you know this?

Not at all

Perfectly

What is the most common Dual-Use goods?

Cryptography

How well did you know this?

Not at all

Perfectly

Right and Obligations of individuals and Organizations with respect to the collection, use, retention and disclosure of personal information

Privacy

How well did you know this?

Not at all

Perfectly

Limits collection of personal data

Collection Limitation Principle

How well did you know this?

Not at all

Perfectly

data that should be relevant to the purposes for which they are to be used and to the extent necessary for those purpose

Data Quality Principle

How well did you know this?

Not at all

Perfectly

Personal data collected is specified not later than at the time of data collection and the subsequent use is limited to the fulfillment

Purpose Specification Principle

How well did you know this?

Not at all

Perfectly

data should not be disclosed , made available or used for purpose other than those specified except; with consent of the data subject

use Limitation Principle

How well did you know this?

Not at all

Perfectly

Personal data protected by Security Safeguards

Security Safeguard Principle

How well did you know this?

Not at all

Perfectly

openness of general policy about developments, practices and policies respect to personal data

Openness Principle

How well did you know this?

Not at all

Perfectly

An event that has the potential to do harm

Incident

How well did you know this?

Not at all

Perfectly

An event that is measurable or observable occurrence that involves any asset

Incident

How well did you know this?

Not at all

Perfectly

An incident that results in the disclosure or potential exposure of data

Breach

How well did you know this?

Not at all

Perfectly

Unauthorized acquisition of personal information maintained in computerized form by a person that compromises the security, confidentiality, or integrity of the personal information

Data Disclosure

How well did you know this?

Not at all

Perfectly

provides a common language for describing security incidents in a structured and repeatable manner

VERIS (The Vocabulary for Event Recording and Incident Sharing)

How well did you know this?

Not at all

Perfectly

Regulates the handling of personal information about individuals

Privacy Act

How well did you know this?

Not at all

Perfectly

sets national standards for the security of electronically protected health information

Health Insurance Portability and Accountability Act (HIPPA)

How well did you know this?

Not at all

Perfectly

certify the accuracy of financial information and penalties for fraudulent activity by providing outside auditors to review accuracy of financial statements

Sarbanes-Oxley Act

How well did you know this?

Not at all

Perfectly

standard that requires notice of data breaches of personal data breach to the competent national authority no later than 24 hours after detection

Regulation for Electronic Communications Service

How well did you know this?

Not at all

Perfectly

Ethical Standard that protects country

Global responsibilities

How well did you know this?

Not at all

Perfectly

Ethical Standard Protect State

National standard

How well did you know this?

Not at all

Perfectly

Ethical Standard Protect Company

Organizational standard

How well did you know this?

Not at all

Perfectly

What you do when no one is there to navigate what you do legally or illegal

Personal Standard

How well did you know this?

Not at all

Perfectly

Code of Ethic Canons

Protect Society (people)
Act Honorably (Honor)
Provide diligent and competent service to principals (Boss)
Advance and protect the profession (profession)

How well did you know this?

Not at all

Perfectly

components that support the implementation of security policy

Procedure, standards, guidelines, and baselines

How well did you know this?

Not at all

Perfectly

4 Steps in a BIA

Gather information, perform a vulnerability assessment, analyzing the information, Document the results

How well did you know this?

Not at all

Perfectly

An event or situation that if occurred, would prevent the organization from operating in its normal manner, if at all

Threat

How well did you know this?

Not at all

Perfectly

The amount of time the organization can function without that application before significant impact occurs

Recovery Time Objective (RTO) or Maximum Tolerable Downtime (MTD)

How well did you know this?

Not at all

Perfectly

How quickly you need to have that application information available after downtime has occurred

Recovery Time Objective (RTO)

How well did you know this?

Not at all

Perfectly

Refers to the point in time which data must be restored in order to successfully resume processing between the last backup and when the event occured

Recovery Point Objective (RPO)

How well did you know this?

Not at all

Perfectly

Reduce Risk of Collusion between individuals

Job Rotation

How well did you know this?

Not at all

Perfectly

to not have the same capability to execute all of the steps of a particular process

Separation of Duties

How well did you know this?

Not at all

Perfectly

access to sensitive data to do there job

Need to know

How well did you know this?

Not at all

Perfectly

Guidance that analyze risks and manage mitigation in alignment with business and compliance objective

GRC- Governance Risk Management and Compliance

How well did you know this?

Not at all

Perfectly

Data Protection Directive (DPD), Personal Information Protection and Electronic Documents Acts (PIPEDA), Personally Identifiable Information (PII), HIPAA and Gramm-Leach Bliley ACt (GLBA), Payment Card Industry (PCI) are all examples of what?

Privacy Requirements Compliance

How well did you know this?

Not at all

Perfectly

Idea that is certified and made public

Patent

Contribute to regional and international security and stability by promoting transparency and greater responsibility in transfers of conventional arms and dual-goods and technolgies

The Wassenaar Arrangement (AR)

Regulates the handling of personal information about individuals

The Privacy Act

sets national standards for the security of electronically protected health information

Health insurance Portability and Accountability ACt (HIPPA)

Top management must individually certify the accuracy of financial information and penalties for fraudulent financial activity are greater.

Sarbanes-Oxley Act

European Electronic Communication Service providers are required to provide notice of data breaches of a personal data breach to the competent national authority no later than 24 hours after the detection of the personal data breach, when feasible

Regulation for Electronic Communication Service (EU)

Procedures, standards, guidelines, and baselines are components that support the implementation of what?

Security Policy

1st step in building the BC program

Project initiation and management

Before the project can even start, it must have who’s support?

Senior/executive Management

Procedures implanted to define the roles, responsibilities, policies and administrative functions needed to manage the control environment

Administrative Controls

An estimate of how often a threat will be successful in exploiting a vulnerability over the period of a year

Annualized Rate of Occurrence (ARO)

The principle that ensures that information is available and accessible to users

Availability

An incident that results in the disclosure or potential exposure of data

Breach

Controls and hat substitute for the loss of primary controls and mitigate risk down to an acceptable level

Compensating Controls

Actions that ensure behavior that complies with established rules

Compliance

Covers the expression of ideas rather than the ideas themselves; it usually protects artistic property such as writing, recordings, database, and computer programs.

Supports the principle of “Least Privilege” by providing that only authorized individuals, processes, or systems should have access to information on a need to know basis

Confidentiality

Covers the expression of ideas rather than the ideas themselves, usually protected artistic property such as writings, recording, databases, and computer programs

Controls implemented to remedy circumstance, mitigate damage, or restore controls

Corrective Controls

A breach for which it was confirmed that data was actually disclosed(not just exposed) to an unauthorized party

Data Disclosure

Controls designed to signal warning when a security control has been breached

Detective Controls

Controls designed to discourage people from violating security directives

Deterrent Controls

Controls designed to specify acceptable rules of behavior within an organization

Directive Controls

Is similar to Due care with the exception that it is a pre-preemptive measure made to avoid harm to other persons or their property

Due Diligence

A process designed to identify potential events that may affect the entity, manage risk so it is within its risk appetite, and provide reasonable assurance regarding the achievement of entity objectives

Enterprise Risk Management

Authorized the President to regulate export of civilian goods and technologies that have military applications

Export Administration Act

Ensures the business focuses on core activities clarifies who in the organization has the authority to make decisions, determines accountability for actions and responsibility for outcomes, and addresses how expected performance will be evaulated

Governance

A Security Event that compromises the confidentiality, integrity, or availability of an information asset

Incident

Comes in two forms making sure that information is processed correctly and not modified by unauthorized persons and protecting information as it transits a network.

Integrity

Accountable for ensuring the protection of all of the business information assets from intentional and unintentional loss, disclosure, alteration, destruction and unavailabilty

Information Security Officer

Granting users only the accesses that are required to perform their job functions

Least Privilege

Electronic hardware and software solutions implemented to control access to information and information networks

Logical (Technical) Controls

Protects novel, useful, and non-obvious inventions

Patent

Controls to protect the organizations people and physical environment, such as locks, fire management, gates, and guards

Physical controls

Controls implemented to prevent a security incident

Preventive Controls

Controls implemented to restore conditions to normal after a security incident

Recovery Controls

How quickly you need to have that applications information available after downtime has occured

Recovery Time Objective (RTO)

The point in time to which data must be restored in order to successfully resume processing

Recovery Point Objective (RPO)

A Combination of the probability of an event and its consequences (ISO 27000)

Risk

An expectation of loss expressed as the probability that a particular threat will exploit a particular vulnerability with a particular harmful result (RFC 2828)

Risk

The practice of accepting certain risk, typically based on business direction that may also weigh the cost versus the benefit of dealing with the risk in another way

Risk Acceptance

The practice of coming up with alternatives so that the risk in question is not realized

Risk Avoidance

The practice of the elimination of or the significant decrease in the level of risk presented

Risk Mitigation

The practice of passion on the risk in question to another entity, such as an insurance company

Risk Transfer

A systematic process for identifying, analyzing, evaluation, remedying, and monitoring risk

Risk Management

Defined as the difference between the original value and the remaining value of an asset after a single exploit

Single Loss Expectancy (SLE)

An word, name, symbol, color, sound, product shape, device, or combination of these that is used to identify goods and distinguish them from those made or sold by others

Trademark

Proprietary business or technical information, processes, designs, practices, etc. that are confidential and critical to the business

Trade Secret

Determines the potential impact of disruptive events on the organizations business processes

Vulnerability Assessment

Established to contribute to regional and international security and stability by promoting transparency and greater responsibility in transfers of conventional arms and dual-use goods and technologies, this preventing destabilizing accumulations

Wassenaar Arrangement

Within the realm of IT Security, which of the following combinations best define risk:
A. Threat coupled with a breach
B. Threat coupled with a vulnerability
C. Vulnerability coupled with an attack
D. Threat coupled with a breach of security

B. Threat coupled with a vulnerability
(A vulnerability is a lack of countermeasure or a weakness in a countermeasure that is in place. A threat is any potential danger that is associated with the exploitation of a vulnerability)

When determining the value of an intagible asset which is the BEST approach:
A. Determine the physical storage cost and multiply by the expected life of the company
B. With the assistance of finance of accounting professional determine how much profit the asset has returned
C. Review the depreciation of intangible asset over the past three years
D. Use the historical acquisition or development cost of the intangible asset.

B.-

Qualitative risk assessment is ear marked by which of the following?
A. Ease of implementation and it can be completed by personnel with a limited understanding of the risk assessment process
B. Can be completed by personnel with a limited understanding of the risk assessment process and uses detailed metrics used for calculation of risk
C. Detailed metrics used for calculation of risk and ease of implementation
D. Can be completed by personnel with a limited understanding of the risk assessment process and detailed metrics used for the calculation of risk

Single Loss expectancy (SLE) is calulated by using:
A. Asset Value and annualized rate of occurence (ARO)
B. Asset Value, local annual frequency estimate (LAFE) and standard annual frequency estimate (SAFE)
C. Asset value and exposure factor
D. Local annual frequency estimate and annualized reate of occurence

Consideration for which type of risk assessment to perform includes all of the following:
A. Culture of the organization likelihood of exposure and budget
B. Budget, capabilities of resources and likelihood of exposure
C. Capabilities of resources, likelihood of exposure and budget
D. Culture of the organization, budget, capabilities and resources

Security Awareness training includes:
A. Legislated security compliance objectives
B. Security roles and responsibilities for staff
C. The high-level outcome of vulnerability assessments
D. Specialized curriculum assignments, coursework and an accredited institution.

What is the minimum and customary practice of responsible protection of assets that affects a community or societal norm?
A. Due diligence
B. Risk Mitigation
C. Asset Protection
D. Due Care

Effective Security Management
A. Achieved security at the lowest cost
B. Reduces risk to an acceptable level
C. Prioritizes security for new products
D. installs patches in a timely manner

Availability makes information accessible by protecting from:
A. Denial of services, fires, floods, hurricanes, and unauthorized transactions
B. Fire, floods, hurricanes, unauthorized transactions and unreadable backup tapes
C. unauthorized transactions fires, floods, hurricanes and unreadable backup tapes
D. Denial services, fires, floods, and hurricanes and unreadable backup tapes

Which phrase best defines a business continuity/disaster recovery plan?
A. A set of plans for preventing a disaster
B. An approved set of preparations and sufficient procedures for responding to a disaster
C. A set of preparations and procedures for responding to a disaster without management approval
D. The adequate preparations and procedures for the continuation of all organization functions

Which of the following steps should be performed first in a business impact analysis (BIA)?
A. Identify all business units within an organization
B. Evaluate the impact of disruptive events
C. Estimate the Recovery Time Objectives (RTO)
D. Evaluate the criticality of business functions

Tactical security plans are BEST used to:
A. Establish high-level security policies
B. Enable enterprise/entity-wide security management
C.Reduce downtime
D. Deploy new security technology

Who is accountable for implementing information security?
A. Everyone
B. Senior Management
C. Security Officer
D. Data Owners

Security is likely to be most expensive when addressed in which phase?
A. Design
B. Rapid Prototyping
C. Testing
D. Implementation

Information systems auditors help the organization?
A. Mitigate compliance issues
B. Establish and effective control environment
C. Identify control gaps
D. Address information technology for financial statements

The Facilitated Risk Analysis Process (FRAP)
A. Makes a base assumption that a broad risk assessment is the most effective way to determine risk in a system, business segment, application or process
B. Makes a base assumption that a narrow risk assessment is the most efficient way to determine risk in a system, business segment, application or process
C. Makes a base assumption that a narrow risk assessment is the least efficient way to determine risk in a system, business segment, application or process
D. makes a base assumption that a broad risk assessment is the least efficient way to determine risk in a system, business segments, application or process

Setting clear security roles has the following benefits:
A. Establishes personnel accountability, reduces cross-training requirements and reduced departmental turf battle
B. Enables continuous improvement, reduces cross-training requirements and reduced departmental turf battle
C. Established personal accountability, establishes continuous improvement and reduces turf battles
D. Reduced departmental turf battles, Reduces cross-training requirements and establishes personal accountability

Well-written security program policies are BEST reviewed:
A. At least annually or at pre-determined organization changes
B. After major project implementations
C. When applications or operating systems are updated
D. When procedures need to be modified

An organization will conduct a risk assessment to evaluate:
A. Threat to its assets, vulnerabilities not present in the environment, the likelihood that a threat will be realized by taking advantage of an exposure, the impact that the exposure being realized will have on the organization, the residual risk
B. Threat to its assets, vulnerabilities present int he environment, the likelihood that a threat will be realized by taking advantage of an exposure, the impact that the exposure being realized will have on another organization, the residual risk
C. Threat to its assets, vulnerabilities present int he environment, the likelihood that a threat will be realized by taking advantage of an exposure, the impact that the exposure being realized will have on organization, the residual risk
D.Threat to its assets, vulnerabilities present int he environment, the likelihood that a threat will be realized by taking advantage of an exposure, the impact that the exposure being realized will have on the organization, the total risk

A security policy which will remain relevant and meaningful over time includes the following:
A. Directive words such as shall, must, or will, technical specifications and is short in length
B. Defined policy development process, short in length and contains directive words such as shall, must or will
C. Short in length, technical specifications and contains directive words such as shall, must or will
D. Directive words such as shall, must, or will, defined policy development process and is short in length.

The ability of one person in the finance department to add vendors to the vendor database and subsequently pay the vendor violates which concept?
A. A well-formed transaction
B. Separation of duties
C. Least Privilege
D. Data sensitivity level

Collusion is best mitigated by:
A.  Job rotation
B. Data Classification
C. Defining job sensitivity level
D. Least privilege

Data Access decisions are best made by:
A. user managers
B. Data Owners
C. Senior Management
D. Application developer

Which of the following statements BEST described the extent to which an organization should address business continuity or disaster recovery planning?
A. Continuity Planning is significant organizational issue and should include all parts or functions of the company
B. Continuity planning is a significant technology issue and the recovery of technology should be its primary focus
C. Continuity planning is required only where there is complexity in voice and data communications
D. Continuity planning is a significant management issue and should include the primary functions specified by managemen

Business impact analysis is performed to BEST identify:
A. The impacts of a threat to the organization operations
B. The exposure to loss to the organization
C. The impacts of a risk on the organization
D. The cost efficient way to eliminate threats

During the risk analysis phase of the planning, which of the following actions could BEST manage threats or mitigate the effects of an event?
A. Modifying the exercise scenario
B. Developing recovery procedures
C. Increasing reliance on key individuals
D. Implementing procedural controls

The BEST reason to implement additional controls or safeguards is to:
A. deter or remove the risk
B. Identify and eliminate the threat
C. Reduce the impact of the threat
D. identify the risk and the threat

Which of the following statements BEST describes organization impact analysis?
A. Risk analysis and organization impact analysis are two different terms describing the same project effort
B. A organization impact analysis calculates the probability of disruptions to the organizations
C. A organization impact analysis is critical to development of a business continuity plan
D. A organization impact analysis establishes the effect of disruptions on the organization

The term "disaster recovery" refers to the recovery of:
A. organization operations
B. Technology environment
C. manufacturing environment
D. personnel environments

Which if the following terms BEST described the effort to determine the consequences of disruption that could result from a disaster?\
A. Business Impact Analysis
B. Risk Analysis
C. Risk Assessment
D. Project problem definition

the elements of risk are as follows:
A. natural Disasters and man-made disasters
B. Threats, assets and mitigating controls
C. Risk and business impact analysis
D. Business Impact analysis and mitigating controls

Which if the following methods is not acceptable for exercising the business continuity plan?
A. Table-top exercise
B. Call exercise
C. Simulated exercise
D. Halting a production application or function

Which of the following is the primary desired result of any well-planned business continuity exercise?
A. Identifies plan strengths and weaknesses
B. Satisfies management requirements
C. Complies with auditors requirements
D. Maintains shareholder confidence

A business continuity plan is best updated and maintained:
A. Annually or when requested by auditors
B. Only when new versions of software are deployed
C. Only when new hardware is deployed
D. During the configuration and change management process

Which of the following is MOST important for successful business continuity>
A. Senior leadership support
B. Strong technical support staff
C. Extensive wide are network
D. An integrated incident response team

A Service's recovery point objective is zero. Which approach BEST ensures the requirement is met?
A. RAID 6 with a hot site alternative
B. RAID 0 with a warm site alternative
C. RAID 0 with a cold site alternative
D. RAID 6 with a reciprocal agreement

The (ISC)2 code of ethics resolves conflicts between canons by:
A. there can never be conflicts between canons
B. Working through adjuducation
C. The order of the canons
D. Vetting all canon conflicts through the board of directives

Brainscape's Knowledge GenomeTM

Security And risk Management Flashcards

Brainscape's Knowledge Genome^TM