Cissp

Front 1

DAC Discretionary Access Control (DAC)

Back 1

Allows owners of data to specify what users can access data used most. Access control is based on discretion of data owners. Most common model. Users themselves can assign access to their own data.

Front 2

Role Based Access Control (RBAC):

Back 2

( also called Non-discretionary access control ) Centrally controlled model allows access based on the role the user holds in the organization; often hierarchical. Access is given to a group of users that perform a similar function. Based on the separation of duties.

Front 3

Lattice Based Access Control

Back 3

a security access methodology that assigns access permissions to both users and objects, creating a grid or lattice layout. A user cannot access an object with a security level greater that his/her own on the lattice.

Front 4

Crossover Error Rate (CER)

Back 4

the point at which the false rejection rate equals the false positive rate (this is repeated under biometrics)

Front 5

The False Rejection Rate (FRR)

Back 5

consists of the percentage of cases in which a valid user is incorrectly rejected by the system. This type of mistake is known as a Type I error.

Front 6

False Acceptance Rate (FAR)

Back 6

consists of the percentage of cases in which an invalid user is incorrectly accepted by the system. This type of mistake is known as a Type II error.

Front 7

TCO

Back 7

Total Cost of Ownershiph

Front 8

ROI

Back 8

Return on Investmenthiph

Front 9

The Annualized Loss Expectancy (ALE)

ALE = SLE * ARO

Back 9

is the expected monetary loss that can be expected for an asset due to a risk over a one year period

Front 10

Exposure Factor The Exposure Factor (EF) is the percentage of value an asset lost due to an incident

Back 10

the percentage of value an asset lost due to an incident

Front 11

Single Loss Expectancy (SLE)

Back 11

the cost of a single loss

Asset Value (AV) times the Exposure Factor (EF)

Front 12

Annual Rate of Occurrence

Back 12

the number of losses you suffer per year

Front 13

Annualized Loss Expectancy (ALE)

Back 13

is your yearly cost due to a risk. It is calculated by multiplying the Single Loss Expectancy (SLE) times the Annual Rate of Occurrence (ARO).

Front 14

Bell-laPadula

Back 14

no write down no read up

Front 15

The Simple Security Property -

Back 15

a subject at a given security level may not read an object at a higher security level (no read-up).

Front 16

The *-property (read "star"-property) -

Back 16

a subject at a given security level must not write to any object at a lower security level (no write-down).

Front 17

Biba

Back 17

no write up no read down

Front 18

The Simple Integrity Axiom

Back 18

a subject at a given level of integrity must not read an object at a lower integrity level (no read down).

Front 19

The * (star) Integrity Axiom

Back 19

states that a subject at a given level of integrity must not write to any object at a higher level of integrity (no write up).

Front 20

Clark-Wilson

Back 20

integrity

Front 21

Graham-Denning:

Back 21

securely creating objects

Front 22

SSE-CMM Maturity Model

Level 1: Performed Informally

Back 22

You have to do it before you manage its:

Front 23

SSE-CMM Maturity Model

Level 2: Planned & Tracked

Back 23

Understand what is happening on the project before defining organization wide processes

Front 24

SSE-CMM Maturity Model

Well Defined

Back 24

Use the best of what you have learned from your project to create organization wide processes

Front 25

SSE-CMM Maturity Model

Quantitatively Controlled

Back 25

You can't measure it until you know what It is you want to measure

Front 26

SSE-CMM Maturity Model

Level 5: Continuously Improving

Back 26

Foundation of sound management and awareness

Front 27

Due care

Back 27

doing what a reasonable person would do (i.e. the prudent man rule)

Front 28

Due diligence

Back 28

the management of due care.

Front 29

Gross negligence

Back 29

the opposite of due care.

Front 30

Best practice

Back 30

a consensus of the best way to do some task.

Front 31

Certification

Back 31

a detailed inspection that verifies whether a system meets the documented security requirements.

Front 32

Accreditation

Back 32

the Data Owner’s acceptance of the risk represented by that system

Front 33

PAP

Password Authentication Protocol

Back 33

It isthe most basic form of authentication, in which a user's name and password are transmitted over a network and compared to a table of name-password pairs. Typically, the passwords stored in the table are encrypted, however the transmissions of the passwords are in clear text, unencrypted.

Front 34

SPAP

Shiva Password Authentication Protocol

Back 34

username and password are both encrypted when they are sent, unlike PAP which sends them in clear text

Front 35

Extensible Authentication Protocol

Back 35

Sits inside PPP and provides generalized framework for many different authentication methods.

Front 36

Challenge-Handshake Authentication Protocol

Back 36

After the Link Establishment phase is complete, the authenticator sends a "challenge" message to the peer.The peer responds with a value calculated using a "one-way hash" function.The authenticator checks the response against its own calculation of the expected hash value. If the values match, the authentication is acknowledged; otherwise the connection SHOULD be terminated.At random intervals, the authenticator sends a new challenge to the peer, and repeats steps 1 to 3