Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

PAVI > Terms > Flashcards

Terms Flashcards

1
Q

ACAS: Assured Compliance Assessment

A

Solution. Includes a suite of products to include the Security Center, Nessus Scanner and the Nessus Network Monitor (formerly the Passive Vulnerability Scanner) which is provided by DISA to DoD Customers at no cost. DISA’s Cyber Development (CD) provides program management for the Enterprise ACAS offering as well as help desk support and training.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

AOA

A

Analysis of Alternatives

an analytical comparison of the operational effectiveness, suitability, and life-cycle cost of alternatives that satisfy established capability needs.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

ATHENA

A

Advanced Threat Hunt & Enterprise Network Analysis (Greek God of wisdom and war)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

BIP

A

Budget prepared using a previous period budget or actual performance as a basis with incremental amounts added for the new budget period.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

CAGE Code

A

Commercial and Government Entity is five-character ID number used extensively within the U.S. federal government, assigned by the DoD Logistics Agency. The code provides a standardized method of identifying a given facility at a specific location.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

CCE

A

Collaborative Capture Environment

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

CCI

A

Control Correlation Identifier. Provides a standard identifier and description for each of the singular, actionable statements that comprise an IA control. Described how a control is implemented, i.e., what settings need to be validated. 1602 for DCSA systems at moderate, low, low

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

CCRI

A

Command Cyber Readiness Inspection. Describes IA control or IA best practice.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

CDRL

A

Contract Data Requirements List DD Form 1423

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

CISSP

A

Certified Information Systems Security Professional. Approved by DoD through DoDD 8570 Information Assurance Workforce Improvement Program

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

CSIRC

A

Cybersecurity Intelligence and Response Center (CSIRC)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

CAISWG

A

Community Association of Information Systems Security Working Group

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Cloudbank

A

CloudBank will help NSF by bundling multiple small requests that come directly to NSF into a bulk request to cloud providers, dis-incentivizing more costly direct connections. Through this aggregation and innovative financial contract types, CloudBank will pass along savings to researchers that would otherwise be unavailable to them.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

CNDSP

A

Computer Network Defense Service Provider

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

CNSSI 1253

A

Committee on National Security Systems Instruction 1253, Security Categorization and Control Selection for National Security Systems

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

COTR

A

Contracting Officer’s Technical Representative

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

CSSP

A

Cybersecurity CSSP: Cybersecurity service provider

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

CTTA

A

Certified TEMPEST Technical Authority

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

CVE

A

Common vulnerability exploit

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

DAAPM

A

DCSA Assessment and Authorization Process Manual

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

DCSA

A

Defense Counterintelligence and Security Agency

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

DD From 254

A

DoD Contract Security Specification

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

DFARS

A

Defense Federal Acquisition Regulation Supplement

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

DISS

A

Defense Information System for Security. Replacement for Joint Personnel Adjudication System (JPAS) effective 22 February 2021

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

EDR

A

Endpoint Detection and Response

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

eMASS

A

Enterprise Mission Assurance Support Service

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

FAR

A

Federal Acquisition Regulation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

FEDRAMP

A

Federal Risk and Authorization Management Program

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

HBSS

A

Host Based Security System. DoD mandated tool used to provide intrusion prevention services with behavioral and signature protection. Also provides firewall protections.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

HIPAA

A

Health Insurance Portability and Accountability Act

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

HPCMP

A

High performance Computing Modernization Program

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

IPA MSP

A

Industry Partner Access Managed Service Provider

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

ISOO

A

Information Security Oversight Office

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

ISR

A

Intelligence Surveillance and Reconnaissance

35
Q

ISSP

A

DCSA Information Systems Security Professional

36
Q

ISWG

A

Industrial Security Working Group

37
Q

JSIG

A

Joint Special Access Program Implementation Guide (Army, Navy, Air Force)

38
Q

MAG

A

Microsoft Azure Government

39
Q

MPOE

A

Minimum point of entry. The closest point where the wires of a telecommunications provider (e.g., a cable company) enter or pass through a property/building. The MPOE can be underground, in the air, in a box in the basement, or outside the building.

40
Q

MUSA

A

Multi-user Standalone

41
Q

NESSUS

A

Proprietary vulnerability scanner developed by Tenable

42
Q

NIAP

A

National Information Assurance Partnership

43
Q

NICE Framework

A

National Initiative for Cybersecurity Education, NIST 800-181 rev 1 Workforce Framework for Cybersecurity

44
Q

NISP

A

National Industrial Security Program is a partnership between the federal government and private industry to safeguard classified information. Executive Order 12829 “National Industrial Security Program”, amended by Section 6 of E.O. 13691 was established to achieve cost savings and ensure that industry safeguards the classified information with which it is entrusted while performing work on contracts, programs, bids or R&D efforts working for the U.S. government.

45
Q

NISPPAC

A

National Industrial Security Program Policy Advisory Committee. Created under section 103 of E.O. 12829, to ensure the partnership between the government and industry. The committee advised the ISOO on all matters related to NISP policies.

46
Q

NIST

A

Nation Institute of Standards and Technology

47
Q

NISA WG

A

NISPPAC Information Systems Authorization Working Group

48
Q

NSF

A

National Science Foundation

49
Q

ODAA

A

Office of the Designated Authorization Authority

50
Q

ODC

A

Other Direct Costs in budget

51
Q

POA&M

A

Plan of action and milestones

52
Q

PowerShell

A

PowerShell or Microsoft PowerShell is a task automation and configuration management program from Microsoft, consisting of a command-line shell and the associated scripting

53
Q

PQS

A

Personnel Qualification Standards

54
Q

RACI

A

Responsible, accountable, consulted, and informed

55
Q

RMF

A

The Risk Management Framework (RMF) provides a process that integrates security, privacy, and cyber supply chain risk management activities into the system development life cycle. The risk-based approach to control selection and specification considers effectiveness, efficiency, and constraints due to applicable laws, directives, Executive Orders, policies, standards, or regulations. Managing organizational risk is paramount to effective information security and privacy programs; the RMF approach can be applied to new and legacy systems, any type of system or technology (e.g., IoT, control systems), and within any type of organization regardless of size or sector.

NIST SP 800-30, entitled Guide for Conducting Risk Assessments, provides an overview of how risk management fits into the system development life cycle (SDLC) and describes how to conduct risk assessments and how to mitigate risks.
NIST SP 800-37 discusses the risk management framework itself and contains much of the information we’ll cover in the remainder of this guide.
Finally, NIST SP 800-39, titled Managing Information Security Risk, defines the multi-tiered, organization-wide approach to risk management crucial for reaching compliance with the RMF.

56
Q

RMF Artifacts

A

SSP: System security plan
SCTM: System control traceability matrix
POA&M: Plan of action and milestones
RAR: Risk assessment report
SAR: Security assessment report (from AO)
ATO: Approval to operate (from AO)

57
Q

SCAP

A

Security Content Automation Protocol Validation Program. The Security Content Automation Protocol is a method for using specific standards to enable automated vulnerability management, measurement, and policy compliance evaluation of systems deployed in an organization, including e.g., FISMA compliance.

58
Q

SDP

A

Software defined perimeter

59
Q

SDREN

A

Secret Defense Research and Engineering Network

60
Q

SD-WAN

A

Software-defined wide area network (or networking). A virtual WAN architecture that allows enterprises to leverage any combination of transport services—including MPLS, LTE and broadband internet services—to securely connect users to applications.

61
Q

SEIM

A

Security Event & Incident Management

62
Q

SIPRNet

A

Secret Internet Protocol Router Network. A system of interconnected computer networks used by the U.S. Department of Defense and the U.S. Department of State to transmit classified information by packet switching over the ‘completely secure’ environment

63
Q

SOAR

A

Security Orchestration, Automation, and Response. SOAR platforms are a collection of security software solutions and tools for browsing and collecting data from a variety of sources. … SOAR allows companies to collect threat-related data from a range of sources and automate the responses to the threat.

64
Q

STIG

A

Security Technical Implementation Guides

65
Q

STIG Viewer

A

A GUI java based application provided to open content and create checklists for managing the security setting on your system or network. Many use it to manage and edit their checklists. It is not the greatest tool, but it gets the job done, with a lot of manual labor

66
Q

SWOT analysis

A

Strengths, weaknesses, opportunities, threats

67
Q

TAA

A

Trade agreement acts. Created to foster fair international trade with certain designated countries. Companies who are working with foreign-made products or services need to be aware of what companies are restricted in order to remain compliant with the TAA and GSA.

68
Q

TEMPEST

A

Telecommunications Electronics Material Protected from Emanating Spurious Transmissions

69
Q

TISC

A

Technology & Information Security Committee

70
Q

TSG

A

Telecommunications Security Group, Committee on National Security Systems (CNSS) standards

71
Q

IA Role/Responsibility

A

Establishes and implements standard practices and procedures that protect classified information and classified information systems by assuring availability, integrity, authentication, confidentiality, and non- repudiation. These measures include incorporating security controls, detection, and response capabilities based on government regulations, directives, and standards.

72
Q

IA Activity

A

Establish, document, test, and continuously monitor security controls required for the protection of classified information systems. Maintain government authorizations for continued operation of classified systems supporting contracts. Provide System Development Life Cycle (SDLC) support to include, analysis, planning, design, implementation, maintenance and disposal/re-utilization of hardware and data to support contract requirements.

73
Q

ISO 31000

A

an international standard that provides principles and guidelines for risk management. It outlines a comprehensive approach to identifying, analyzing, evaluating, treating, monitoring and communicating risks across an organization.

74
Q

EU General Data Protection Requirements

A

The GDPR lists the rights of the data subject, meaning the rights of the individuals whose personal data is being processed. These strengthened rights give individuals more control over their personal data, including through: the need for an individual’s clear consent to the processing of his or her personal data.

75
Q

NIST 800-53

A

What is NIST 800-53? NIST SP 800-53 provides a list of controls that support the development of secure and resilient federal information systems. These controls are the operational, technical, and management standards and guidelines information systems use to maintain confidentiality, integrity, and availability.

76
Q

NIST 800-171

A

a codification of the requirements that any non-Federal computer system must follow in order to store, process, or transmit Controlled Unclassified Information (CUI) or provide security protection for such system

77
Q

ICD 705

A

This document is the implementing specification for Intelligence Community Directive (ICD) 705 (Sensitive Compartmented Information Facilities), ICS 705-01, and ICS 705-02 (Standards for Accreditation and Reciprocal Use of Sensitive Compartmented Information Facilities.

78
Q

SMART Goals

A

Specific

Measurable

Attainable

Relevant

Time-bound

79
Q

ICD 703

A

Protection of Classified National Intelligence, Including SCI. ICD 704 - Personnel Security. ICD 705 - Sensitive Compartmented Information Facilities. ICD 706 - Security Standards for Protecting Domestic IC Facilities. ICD 707 - Counterintelligence and Security Support for U.S. Diplomatic Facilities Abroad.

80
Q

Technical core competencies

A

Digital modernization
Cyber operations
Missions software systems
Integrated systems
Mission operations

81
Q

SDREN

A
82
Q

NISPOM (National Industrial Security Program Operating Manual),

A

sets comprehensive standards to establish requirements for protecting classified information disclosed to or developed by: contractors, licensees, grantees, or certificate holders to prevent prohibited disclosure.

final rule on December 21, 2020 (85 FR 83300–83364) National Industrial Security Program Operating Manual (NISPOM) to add 32 CFR part 117 to the Code of Federal Regulations (CFR). The rule was effective on February 24, 2021.

83
Q

FISMA

A

FISMA is the Federal Information Security Modernization Act of 2014, 44 U.S.C. § 3551 et seq., Public Law (P.L.) 113-283. FISMA requires each federal agency to develop, document, and implement an agency-wide program to provide information security for the information and information systems that support the operations and assets of the agency, including those provided or managed by another agency, contractor, or other source.

84
Q

FEDRAMP

A

The Federal Risk and Authorization Management Program (FedRAMP) is a United States federal government-wide compliance program that provides a standardized approach to security assessment, authorization, and continuous monitoring for cloud products and services.[1]

There are two ways to authorize a cloud service through FedRAMP: a Joint Authorization Board (JAB) provisional authorization (P-ATO),[5] and through individual agencies.[6]
Before the introduction of FedRAMP, individual federal agencies managed their own assessment methodologies following guidance set by the Federal Information Security Management Act of 2002.[7]
FedRAMP provides accreditation for cloud services for the various cloud offering models which are Infrastructure as a Service (IaaS), Platform as a Service (PaaS), and Software as a Service, (SaaS).

PAVI (7 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions