Brainscape's Knowledge GenomeTM


Top Flashcards (Certified)
All Flashcards

Cyber Security > Security Risk Management (SRM) > Flashcards

Security Risk Management (SRM) Flashcards

(101 cards)

Start Studying
1
Q

27001

A

specifies the requirements for establishing, implementing, operating, monitoring, reviewing, maintaining, and improving a documented information security management system within the context of the organization’s overall business risks

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

27002

A

A standard that defines information’s confidentiality, integrity, and availability controls in a comprehensive information security management system

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

ISO/IEC 27011

A

telecommunications organization guidelines

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

ISO/IEC 27015

A

financial organization guidelines

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

ISO/IEC 27037

A

Digital evidence guidelines

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

ISO/IEC 27799

A

health organization guidelines

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

acceptable risk

A

concern that is acceptable to responsible management, due to the cost and magnitude of implementing controls

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

acceptable use policy

A

A policy that establishes an agreement between users and the organization and defines for all parties the ranges of use that are approved before gaining access to a network or the Internet

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

access rights

A

Permissions or privileges granted to users, programs, or workstations to create, change, delete or view data and files within a system as defined by rules established by data owners and the information security policy

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

accountablity

A

The ability to map a given activity or event back to the responsible party

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

administrative controls

A

The rules, procedures, and practices dealing with operational effectiveness, efficiency, and adherence to regulations and management policies

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

advanced threat

A

an attacker repeatedly using multiple different attack vectors repeatedly to generate opportunities

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

application controls

A

Manual or programmed activities intended to ensure the completeness and accuracy of records and the validity of entries made. The objectives of application controls are to ensure the completeness and accuracy of the records and the validity of the entries made therein resulting from manual and programmed processing

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Assurance

A

Grounds for confidence that the other four security controls (integrity, availability, confidentiality, and accountability) have been adequately met by a specific implementation. “Adequately met” includes (1) functionality that performs correctly, (2) sufficient protection against unintentional errors (by users or software), and (3) sufficient resistance to intentional penetration or bypass.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

audit trail

A

A visible trail of evidence enabling one to trace information contained in statements or reports back to the original input source

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Availability

A

Uptime, ready, in a condition to be used

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Chief information security officer

A

An executive position charged with responsibility for managing and protecting information assets

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

CFAA of 1986

A

Computer Fraud and Abuse Act (CFAA)

Affects any entities that may engage in hacking of “protected computers” as defined in the Act

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Computer Security Act of 1987

A

Was the first law written to require a formal computer security plan

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Confidentiality

A

An organization’s protection of data in storage, during processing, and in transit for use by the subjects that are specifically intended to have access to the data or resource

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Control Objectives for Information and related Technology

A

A complete, internationally accepted process framework for IT that supports business and IT executives and IT management in their definition and achievement of business goals and related IT goals by providing a comprehensive IT governance, management, control and assurance model. COBIT describes IT processes and associated control objectives, management guidelines (activities, accountabilities, responsibilities, and performance metrics) and maturity models. COBIT supports enterprise management in the development, implementation, continuous improvement and monitoring of good IT-related practices.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Control gaps

A

The amount of risk reduced by implementing safeguards

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Corporate governance

A

The system by which organizations are directed and controlled. Boards of directors are responsible for the governance of their organizations. It consists of the leadership and organizational structures and processes that ensure the organization sustains and extends strategies and objectives.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Corporate strategy

A

The pattern of decisions in a company that determines and reveals its objectives, purposes or goals; produces the principal policies and plans for achieving those goals; and defines the range of business the company is to pursue, the kind of economic and human organization it is or intends to be, and the nature of the economic and non-economic contribution it intends to make to its shareholders, employees, customers and communities.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Countermeasure
a control after attack
26
Cross training
to know more than one job
27
Custodian
the guardian of asset(s), a maintenance activity
28
Data classification
The assignment of a level of sensitivity to data (or information) that results in the specification of controls for each level of classification. Levels of sensitivity of data are assigned according to predefined categories as data are created, amended, enhanced, stored or transmitted. The classification level is an indication of the value or importance of the data to the organization.
29
Data regrade
Data is transferred from high network users to low network users
30
Decentralization
The process of distributing computer processing to different locations within an organization
31
Denial of Service
The prevention of authorized access to resources or the delaying of time critical operations
32
Dual control
A procedure that uses two or more entities (usually persons) operating in concert to protect a system resource such that no single entity acting alone can access that resource
33
Due care
Managers and their organizations have a duty to provide for information security to ensure that the type of control, the cost of control, and the deployment of control are appropriate for the system being managed. Doing the right action at the right time.
34
Due diligence
Establishing a plan, policy, and process to protect the interests of an organization. Knowing what should be done and planning for it.
35
ECPA of 1986
Electronic Communications Privacy Act Extended government restrictions on wiretaps from telephone calls to include transmissions of electronic data by computer and prohibited access to stored electronic communications
36
Education
long term knowledge building
37
Ethics
the principles a person sets for themselves to follow
38
Exposure
an opportunity for a threat to cause loss. (terminology that encompasses many recent risk terms)
39
Federal Privacy Act of 1974
Affects any computer that contains records used by a federal agency
40
FISA of 1978
Federal Intelligence Surveillance Act (FISA) Affects law enforcement and intelligence agencies
41
Governance
Executive responsibilities of goal setting, delegation, and verification, based upon the mission.
42
Guidelines
written suggestions that direct choice to a few alternatives
43
Information owner
the one person responsible for data, its classification and control setting
44
Information security governance
The set of responsibilities and practices exercised by the board and executive management with the goal of providing strategic direction, ensuring objectives are achieved, ascertaining that risks are managed appropriately and verifying that the enterprise's resources are used responsibly
45
Information security program
The overall combination of technical, operational and procedural measures, and management structures implemented to provide for the confidentiality, integrity and availability of information based on business requirements and risk analysis
46
inherent risk
the amount of risk that exists in the absence of controls
47
IT-Related Risk
The net mission impact considering (1) the probability that a particular threat-source will exercise (accidentally trigger or intentionally exploit) a particular information system vulnerability and (2) the resulting impact if this should occur. IT-related risks arise from legal liability or mission loss due to these 4 items: 1. Unauthorized (malicious or accidental) disclosure, modification, or destruction of information 2. Unintentional errors and omissions 3. IT disruptions due to natural or man-made disasters 4. Failure to exercise due care and diligence in the implementation and operation of the IT system.
48
job rotation
to move from location to location, keeping the same function
49
job training
employment education done one per position or at significant change of function
50
mandatory access control
A means of restricting access to data based on varying degrees of security requirements for information contained in the objects and the corresponding security clearance of users' programs acting on their behalf
51
mandatory vacations
requirement to take time off
52
mitigate
a choice in risk management, to implement a control that limits or lessens negative effects
53
monitoring policy
The rules outlining or delineating the way in which information about the use of computers, networks, applications and information is captured
54
objects
Data or systems, passive
55
operational
intermediate level, pertaining to planning
56
PASTA
Threat modeling focusing on developing countermeasures based on asset value Stage 1 - Definition of Objectives Stage 2 - Definition of Technical Scope Stage 3 - App Decomposition and Analysis Stage 4 - Threat Analysis Stage 5 - Weakness and Vulnerability analysis Stage 6 - Attack modeling and simulation Stage 7 - Risk Analysis and Management
57
policy
written core statements that rarely change
58
privacy
Freedom from unauthorized intrusion or disclosure of information about individuals
59
private/privacy
Individual owned or ownership
60
procedure
written step-by-step actions
61
procedures
The portion of a security policy that states the general process that will be performed to accomplish a security goal
62
qualitative
a risk assessment method, intrinsic value
63
quantitative
a risk assessment method, measurable real money cost
64
residual risk
quantity of risk remaining after a control is applied total risk - controls gap
65
risk
the chance that something negative will occur
66
risk analysis steps
1. Inventory assets and assign a value (asset value or AV) 2. Identify threats. Research each asset and produce a list of all possible threats of each asset. (and calculate EF and SLE) 3. Perform a threat analysis to calculate the likelihood of each threat being realized within a single year (the ARO) 4. Estimate the potential loss by calculating the annualized loss expectancy (ALE) 5. Research the countermeasure for each threat, and then calculate the changes to ARO and ALE based on an applied countermeasure 6. Perform a cost/benefit analysis of each countermeasure for each threat for each asset
67
risk assessment
the collection and summation of risk data relating to a particular asset and controls for that asset
68
risk formula
threat * vulnerability
69
risk management
The total process of identifying, controlling, and mitigating information system-related risks. It includes risk assessment; cost-benefit analysis; and the selection, implementation, test, and security evaluation of safeguards. This overall system security review considers both effectiveness and efficiency, including impact on the mission and constraints due to policy, regulations, and laws.
70
risk management phases
Framing Assessing Responding Alternatives Monitoring
71
safeguard
a control before attack
72
safeguard evaluation
Good security controls mitigate risk, are transparent to users, difficult to bypass, and are cost effective
73
safeguard value
ALE before safeguard - ALE after safeguard - annual cost of safeguard
74
security clearance
the level and label given to an individual for the purpose of compartmentalization
75
security goals
The five security goals are integrity, availability, confidentiality, accountability, and assurance
76
security metrics
Any form of measurement used to determine any aspect of the operation of any security-related activity
77
separation of duties
to break a business process into separate functions and assign to different people
78
standard
written internalized or nationalized norms that are internal to an organization
79
steering committee
A management committee assembled to sponsor and manage various projects, such as an information security program
80
strategic
high level, pertaining to planning
81
STRIDE
Threat modeling Spoofing Tampering Repudiation Information Disclosure Denial of Service Elevation of Privilege
82
subjects
people or groups, active
83
tactical
low level, pertaining to planning
84
threat
The potential for a threat-source to exercise (accidentally trigger or intentionally exploit) a specific vulnerability
85
threat agent
those who initiate the attack
86
threat analysis
The examination of threat-sources against system vulnerabilities to determine the threats for a particular system in a particular operational environment
87
threats
vehicle or tool that exploits a weakness
88
threat-source
Either (1) intent and method targeted at the intentional exploitation of a vulnerability or (2) a situation and method that may accidentally trigger a vulnerability.
89
total risk
the amount of risk an organization would face if no safeguards were implemented
90
total risk formula
calculation encompassing threats, vulnerabilities and assets threats * vulnerabilities * assets
91
transfer
a choice in risk management, to convince another to assume risk, typically by payment
92
user
people who interact with assets
93
VAST
Visual, Agile and Simple Threat model Threat modeling concept that integrates threat and risk management into an Agile programming environment on a scalable basis
94
vulnerability
weakness or flaw in an asset
95
Framing Phase
Tactical/System Operational/Business Process Strategic/Whole business
96
Assessing Phase
Set scope (Tactical/System, Operational/Business Process, Strategic/Whole business from Framing Phase) Identify threat sources Identify threat events Identify vulnerabilities Determine likelihood Determine impacts Determine risks
97
Responding Phase
Developing alternatives Evaluating alternatives (Avoid, Accept, Transfer from Alternatives Phase) Determining course of action Implementing (Mitigate = Control from Alternatives Phase)
98
Alternatives Phase
Avoid = Stop Doing, Accept = Do Nothing, Transfer = Buy Insurance, Mitigate = Control
99
Monitoring Phase
Determining effectiveness of responses, Identifying risk-impacting changes, Verifying controls/compliance
100
NIST 800-37
Risk Management Framework
101
NIST 800-37 steps
People Can See I Am Always Monitoring Prepare to execute RMF Categorize information systems Select security controls Implement security controls Assess the security controls Authorize the system Monitor security controls

Cyber Security (19 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2025 Bold Learning Solutions. Terms and Conditions