Cap Class (Cs)

Front 1

Back 1

Front 2

Appendix III to OMB Circular No.A-130 Clinger-Cohen Act aka:

Back 2

Appendix III to OMB Circular No.A-130 Clinger-Cohen Act aka Security of Federal Automated Information Resources

Front 3

The purpose of Appendix III to OMB Circular No. A-130 Clinger-Cohen Act is to

Back 3

Purpose: •establishes a minimum set of controls to be included in Federal automated information security programs; •assigns Federal agency responsibilities for the security of automated information; and •links agency automated information security programs and agency management control systems ((1)minimum, (2) responsibility (3) link)

Front 4

Application means

Back 4

Application means the use of information resources (information and information technology) to satisfy a specific set of user requirements

Front 5

General Support System or system means

Back 5

General Support System or system means an interconnected set of information resources under the same direct management control which shares common functionality. A system normally includes hardware,software, information, data, applications, communications, and people

Front 6

Major Application means

Back 6

Major Application meansan application that requires special attention to security due to the risk andmagnitude of the harm resulting from the loss, misuse, or unauthorized accessto or modification of the information in the application.

Front 7

•Asset–

Back 7

•Asset– People, property, and information. •An asset is what we’re trying toprotect.

Front 8

•Threat–

Back 8

•Threat– Anything that can exploit avulnerability, intentionally or accidentally, and obtain, damage, or destroy anasset. •A threat is what we’re trying toprotect against.

Front 9

•Vulnerability–

Back 9

•Vulnerability– Weaknesses or gaps in a securityprogram that can be exploited by threats to gain unauthorized access to anasset. •A vulnerability is a weakness orgap in our protection efforts.

Front 10

•Likelihood–

Back 10

•Likelihood– The probabilitythat a potential vulnerabilitymay be exploited within the construct of the associated threatenvironment. •Determined by analyzing thethreats to an information system in conjunction with the potentialvulnerabilities and the controls in place.

Front 11

•Risk–

Back 11

•Risk– The potential for loss, damage ordestruction of an asset as a result of a threat exploiting a vulnerability. •Risk is the intersection ofassets, threats, and vulnerabilities.

Front 12

•Risk Formula:

Back 12

•Risk Formula: R = A + T + V

Front 13

______is a function of threats exploiting vulnerabilities to obtain, damage or destroy assets. Thus, threats (actual, conceptual, or inherent) may exist, but if there are no vulnerabilities then there is little/no risk. Similarly, you can have a vulnerability, but if you have no threat, then you have little/no risk. .

Back 13

Risk

Front 14

•Impact–

Back 14

•Impact– The magnitude of harm that can be expected to result from the consequences of unauthorized disclosure, modification, and destruction of information, or the loss of information or the system availability.

Front 15

Adequate Security means

Back 15

Adequate Security means security commensurate with the risk and magnitude of the harm resulting from the loss, misuse, or unauthorized access to or modification of information.

Front 16

•Confidentiality –

Back 16

•Confidentiality –prevents the disclosure of information to unauthorized individuals or systems. •Loss of confidentiality is the unauthorized disclosure ofinformation.

Front 17

•Integrity -

Back 17

•Integrity -prevents the unauthorized modification or destruction of information. •Loss of integrity is the unauthorized modification ofinformation.

Front 18

•Availability -

Back 18

•Availability -ensures timely and reliable access to and use of information. •Loss of availability is the disruption of access to or use ofinformation or an information system.

Front 19

____ levels of impact should there be a breach of security (a loss of C.I.A)

Back 19

3 levels of impact should there be a breach of security (a loss of C.I.A)

Front 20

•Low –

Back 20

•Low –event has a limited adverse effect on organizational operations, assets, or individuals. Minor •Minor harm to individuals •

Front 21

•Moderate– event has a serious adverse effect on organizational operations, assets, or individuals. Significant •No loss of life or serious lifethreatening injuries

Back 21

•Moderate– event has a serious adverse effect on organizational operations, assets, or individuals. Significant •No loss of life or serious lifethreatening injuries

Front 22

•High–

Back 22

•High– event has a severe or catastrophic adverse effect on organizational operations, assets, or individuals. Major •Loss of life or serious lifethreatening injuries

Front 23

Security controls:

Back 23

Security controls: Safeguards or countermeasures to avoid, counteract or minimize security risks.

Front 24

Security Controls are classified by time of occurrence, relative to a security incident:

Back 24

Security Controls are classified by time of occurrence, relative to a security incident: 1.Before the event - Preventive controls are intended to prevent an incident from occurring e.g. by locking out unauthorized intruders 2.During the event - Detective controls are intended to identify and characterize an incident in progress e.g. by sounding an alarm and alerting the security guards or police 3.Afterthe event - Correctivecontrols are intended to limit the extent of anydamage caused by the incident e.g. by recovering the organization to normal working status as efficiently as possible

Front 25

Other Controls: 1.deterrent controls :2.Compensating controls:

Back 25

Other Controls: 1.deterrent controls are controls that discourage security violations. For instance, the presence of security cameras might deter an employee from stealing equipment●2.Compensating controls are intended to reduce the risk of an existing or potential control weakness; or in place of a missing control. •Used frequently in real-world situations.

Front 26

Data Classification is

Back 26

Data Classification is the process of assigning a level of sensitivity to data as it is being created, amended, enhanced, stored, or transmitted.

Front 27

In data classification, the________ determines the extent to which the data needs to be controlled/ secured and is also indicative of its value in terms of Business Assets. •Typical sensitivity levels include: ØTopSecret ØSecret(Highly Confidential) ØConfidential(Proprietary) ØInternal Use Only ØPublic

Back 27

•The sensitivity level determines the extent to which the data needs to be controlled/ secured and is also indicative of its value in terms of Business Assets. •Typical sensitivity levels include: ØTopSecret ØSecret(Highly Confidential) ØConfidential(Proprietary) ØInternal Use Only ØPublic

Front 28

What is System Development Lifecycle(SDLC) ?

Back 28

A typical SDLC includes 5 phases with a minimum set of security tasks needed to effectively incorporate security in the system development process.

Front 29

A typical SDLC includes ______phases

Back 29

A typical SDLC includes 5 phases with a minimum set of security tasks needed to effectively incorporate security in the system development process.

Front 30

What are the benefits of Integrating Security into SDLC

Back 30

•Early identification and mitigation of issues •Security vulnerabilities

•Lower cost of control implementation •Maximize security program ROI

•Awareness of potential challenges •Mandatory security requirements •Identification of common and inherited items •Shared security services

•Reuse of security strategies and tools •Facilitationof executive decision making •Comprehensive,timely risk management

Front 31

NIST Risk Management Framework NIST 800-37 rev 1. RMF-Based Characteristics ·Promotes:

Back 31

RMF-Based Characteristics ·Promotes ◦Near real-time risk management and ongoing authorization using robust continuous monitoring processes ◦Use of automated support tools for decision making

•Integrates security with Enterprise Architecture and SDLC

•Provides equal emphasis on phases of the RMF

•Links risk management to all organization levels

•Establishes Responsibility and Accountability

Front 32

What are the benefits of Tiers of Risk Management

Back 32

•Multi-tier Organization-Wide Risk Management

•Implemented by the Risk Executive Function•

Tightly coupled to Enterprise Architecture and Information Security Architecture

•SystemDevelopment Lifecycle Focus

•Discipline and Structure Process

•Flexibleand Agile Implementation

Front 33

Back 33

Front 34

Risk management is a holistic activity that is fully integrated into

(A)Part of the organization

(B)every aspect ofthe organization

Back 34

(B) Riskmanagement is a holistic activity that is fully integrated into every aspect ofthe organization

Front 35

Back 35

Front 36

Tier 1

Back 36

Tier 1 •Addresses risk from the organizational perspective. •Develops a comprehensive governance structure and enterprise-wide risk management strategy

Front 37

TIER 2

Back 37

TIER 2 ·Addresses risk from a mission and business process perspective. ·It is guided by the risk management related decisions taken at Tier 1.

Front 38

Tier 3

Back 38

•Addresses risk from an information system perspective •Itis guided by the risk management decisions taken at Tier 2 •Definesystem-specific, hybrid, or common controls

Front 39

NIST Risk Management Framework NISTRMF Steps include (only list 1st 3 steps):

Back 39

•Step1 – Categorize Information System •Categorizethe system and identify security objectives

•Step2 – Select Security Controls

•Selecta baseline of security controls based on the Security Categorization

•Tailorand supplement the control baseline based on a risk assessment

•Step3 – Implement Security Controls •Implementand describe how the controls are used within the system

Front 40

NIST Risk Management Framework what are steps 4 through 6 of the NIST RMF Steps

Back 40

•Step4 – Assess Security Controls •Assess the controls to determine the extent to which they are implemented correctly,operating as intended and producing the desired outcome •Step5 – Authorize Information System •Authorizethe system based on the determination of acceptable risk to the organization •Step 6 – Monitor Security Controls •Continuously monitor system controls assessing effectiveness, documenting changes, andreporting the security posture to officials

Front 41

NISTRisk Management Framework

Back 41

Front 42

Back 42