Security and Risk Management Flashcards
(94 cards)
CIA Triad
Confidentiality
Integrity
Availability
ISO 27001/27002
“The International Standards Organization (ISO) is recognized globally, and it is probably the most pervasive and used source of security standards outside the United States (American organizations often use standards from other sources). ISO 27001 is known as the information security management system (ISMS) and is a comprehensive, holistic view of security governance within an organization, mostly focused on policy. “
COBIT
Created and maintained by ISACA, the COBIT framework (currently COBIT 5) is designed as a way to manage and document enterprise IT and IT security functions for an organization. COBIT widely uses a governance and process perspective for resource management and is intended to address:
IT performance,
security operations,
risk management,
and regulatory compliance
ITIL
IT Infrastructure Library - Best practices for IT core operational processes, not technologies to business customers
ITIL v3 has 5 Phases
- Service Strategy
- Service Design
- Service Transition
- Service Operation
- Continuous service improvement
RMF
RISK MANAGEMENT FRAMEWORK
“NIST, the U.S. National Institute of Standards and Technology, publishes two methods that work in concert (similar to how ISO 27001 and 27002 function); the Risk Management ““Framework (RMF), and the applicable list of security and privacy controls that goes along with it (respectively, these documents are Special Publications (SPs) 800-37 and 800-53). While the NIST SP series is only required to be followed by federal agencies in the United States, it can easily be applied to any kind of organization as the methods and concepts are universal. Also, like all American government documents, it is in the public domain; private organizations do not have to pay to adopt and use this framework. However, there is no private certification for the NIST framework.”
CSA STAR
“The Cloud Security Alliance (CSA)
is a volunteer organization with participant members from both public and private sectors, concentrating—as the name suggests—on security aspects of cloud computing. The CSA publishes standards and tools for industry and practitioners, at no charge. The CSA also hosts the Security, Trust, and Assurance Registry (STAR), which is a voluntary list of all cloud service providers who comply with the STAR program framework and agree to publish documentation on the STAR website attesting to compliance. Customers and potential customers can review and consider cloud vendors at no cost by accessing the STAR website. The STAR framework is a composite of various standards, regulations, and statutory requirements from around the world, covering a variety of subjects related to IT and data security; entities that choose to subscribe to the STAR program are required to complete and publish a questionnaire (the Consensus Assessments Initiative Questionnaire (CAIQ), colloquially pronounced “cake”) published by CSA. The STAR program has three tiers, 1–3, in ascending order of complexity. Tier 1 only requires the vendor self-assessment, using the CAIQ. Tier 2 is an assessment of the organization by an external auditor certified by CSA to perform CAIQ audits. Tier 3 is in draft form as of the time of publication of this CBK; it will require continuous monitoring of the target organization by independent, certified entities.”
DUE CARE
Obligation
(looking out for safety of others)
“due” = required or legally required
“is a legal concept pertaining to the duty owed by a provider to a customer. In essence, a vendor has to engage in a reasonable manner so as not to endanger the customer: the vendor’s products/services should deliver what the customer expects, without putting the customer at risk of undue harm”
DUE DILIGENCE
Action that support “due care”
- verifying background checks
- information security assessments
- risk assessment of physical security systems
- threat intelligence services
RISK
The possibility of damage or harm and likelihood that damage or harm will be realized.
ACCEPTABLE RISK
The level of risk that is suitable relative to the rewards offered by conducting operations.
Business Impact Analysis (BIA)
Measures the value of an asset, the threats and risks posed by the asset, and the impact to the organization if the asset were affected.
Intellectual Property Laws
Intellectual Property
Patent
Copyright
Trademark Laws
Trade Secrets
THREATS
Any aspects that create a risk to the organization, its function or assets:
Natural
Criminal
User error
VULNERABILITIES
Any aspect of the organization’s operation that could enhance a risk or the possibility of a risk being realized:
Software
Physical
Personnel
VULNERABILITY
An inherent weakness in an information system, security procedures, internal controls, or implementation that could be exploited by a threat source.
Tends to focus on technology aspects
DATA BREACH TECHNOLOGY
Incident
Breach
Data disclosure
RISK AVOIDANCE
The practice of coming up with alternatives so the risk in question is not realized.
RISK TRANSFERENCE
The practice of passing on the risk to another entity.
RISK MITIGATION
The decrease in the level of risk through implementation of controls.
RISK ACCEPTANCE
The practice of accepting certain risks based on a business decision that weighs the cost vs. the benefit of a risk.
RESIDUAL RISK
The risk that remains after controls are put in place.
Who is responsible for security at company
Security is responsibility of everyone at a company.
SECURITY CONTROLS
Methods, tools, mechanisms, and processes used in risk mitigation.
Safeguards - before risk is realized
Countermeasures - after the risk is realized
All security controls have detrimental effects on operations; control selection must entail cost/benefit analysis.
ANNUAL LOSS EXPECTANCY
QUANTITATIVE RISK ANALYSIS
Single Loss Expectancy (SLE) X Annual Rate of Occurance (ARO)
Cost of countermeasures must be smaller than ALE
