Security Domain Flashcards
What are the two primary purposes of the Health Insurance Portability and Accountability Act (HIPPA)?
Security and Privacy
What exists to alleviate the risk of certain threats by providing monetary compensation in the event those threats occur?
Insurance
What does the acronym SLE denote?
Single Loss Expectancy
Which element of the CIA triad ensures that transferred data is not altered in transmission?
Integrity
Of which control is enforcing mandatory vacation an example?
Administrative Control
What the purpose of a preventative control?
To prevent security incidents before they occur
Which type of control is required for detecting occurrences of risks?
Detective Control
Which organization has developed an ethics-related statement concerning the use of the Internet?
Internet Architecture Board
What is the term for the process of identifying information assets and their associated threats, vulnerabilities, and potential risks?
Risk Analysis
Which formula should you use to determine the Single Loss Expectancy (SLE) of an asset
Asset Value (AV) * Exposure Factor (EF)
Who should oversee the development of the information security policy?
An organization’s business operations manager
Which term refers to the processes and procedures that are followed to minimize the problems affecting the information systems?
Problem Management
What is meant by the term enrollment time in a biometric system? pg 571
the time it takes to register the system by providing samples of a biometric characteristic (biometric factor)
What is Third-Party governance?
It is a system of oversight that may be mandated by law, regulation, industry standard, contractual obligation, or licensing requirements.
What does Third-party governance focus on?
verifying compliance with stated security objectives, requirements, and regulations, and contractual obligations.
The possibility that something could happen to damage, destroy, or disclose data or other resources is known as
Risk
What is the primary goal of risk management?
reduce risk to an acceptable level
The process by which the goals of risk management are achieved is known as
Risk analysis
Prioritizing and comparing risk to losses require ___
Asset valuation
What is the risk formula?
= threat * vulnerability
What is Qualitative Risk Analysis?
is based on scenarios than calculations. Exact dollar figures are not assigned to possible losses; instead threats are ranked on a scale to evaluate their risks, costs, and effects. Such an analysis assists those responsible in creating proper risk management policies.
Quantitative Risk Analysis
Results in concrete probability percentages.
The end result is a report that has dollar figures for levels of risk, potential loss, cost of countermeasures, and value of safeguards.
What are the six steps of the risk management framework? (Figure 2.7 page 80)
Categorize, Select, Implement, Assess, Authorize, and Monitor
What is the prerequisite to security training?
Awareness
