Cissp-Domain 1-Information Security And Risk Management

Front 1

Framework and policies, concepts, principles, structures, and standards describes what

Back 1

Domain 1, Information Security & Risk Management

Front 2

three categories of internal control standards

Back 2

1. general standards
2. specific standards, and
3. audit resolution standards

Front 3

Ensures that the appropriate policies, procedures, standards, and guidelines are implemented to provide the proper balance of security controls with business
operations

Back 3

Security Management

Front 4

Who ultimately makes the final decision on the level of security expenditures and the risk they are willing to take?

Back 4

Senior Management

Front 5

Core Information Security Principles:

Back 5

Confidentiality, Integrity and Availability

Front 6

principle that only authorized individuals, processes, or systems should have access to information on a need-to-know basis

Back 6

Confidentiality

Front 7

principle that information should be protected from intentional, unauthorized,
or accidental changes

Back 7

Integrity

Front 8

principle that information is accessible by users when needed

Back 8

Availability

Front 9

Ensures that the department can function without the computer system within a defined period using alternate processes

Back 9

Business Continuity Planning

Front 10

Ensures the recovery of the information technology processing capability at a permanent site to an acceptable operational state

Back 10

Disaster Recovery Planning

Front 11

What guarantees that the appropriate information security activities are being performed to ensure that the risks are appropriately reduced

Back 11

Security Governance

Front 12

What establishes the glue that ensures everyone has a common set of expectations and communicates management's goals and objectives.

Back 12

Policies

Front 13

Name the components that support the implementation of a security policy

Back 13

Procedures, standards, guidelines, and baselines

Front 14

supporting component of a security policy that address specific software and hardware

Back 14

Standards

Front 15

Supporting component of a security policy that provides step by step instructions

Back 15

proceedures

Front 16

Supporting component of a security policy that gives consistent level of security

Back 16

Baselines

Front 17

Supporting component of a security policy that gives recommendations

Back 17

Guidelines

Front 18

Place the following in order (highest to lowest):
1) Functional implementing policies
2) Laws, regulations, reqts, organizational goals and objectives
3) General organizational Policy

Back 18

1) Laws, regulations, reqts, organizational goals and objectives
2) General organizational Policy
3) Functional implementing policies

Front 19

Name two reasons Security policies need to written in collaboration with executive oversight

Back 19

1) distributing them without business input is likely to miss important business considerations
2) organization is also more likely to accept security policies that have
been approved and endorsed by the business leaders versus the security officer or the IT department

Front 20

define what the organization needs to accomplish at a high level and serves as management's intentions to control the operation of the organization to meet business objectives

or

high-level statements of the objectives of the organization

Back 20

Polices

Front 21

Addresses specific technical areas of existing and emerging technologies, such as use of the Internet, e-mail and corporate communication systems, wireless access, or remote system access

Back 21

Functional Security Policy

Front 22

purpose of the program is described, and the
assigned responsibility is defined for carrying out the information security mission

Back 22

Organizational Security Policy

Front 23

- descriptions of how to implement security packages to ensure that these implementationsare consistent throughout the organization

- specific rules necessary to implement the security controls in support of the policy and standards that have
been developed

Back 23

Baselines

Front 24

step-by-step instructions in support of the policies, standards, guidelines, and baselines

Back 24

Proceedures

Front 25

discretionary or optional controls used to enable individuals to make judgments with respect to
security actions

Back 25

Guidelines

Front 26

- hardware and software security mechanisms selected as the organization's method of controlling security risks.

Back 26

Standards

Front 27

Control Objectives for Information and related Technology (COBIT), the Capability Maturity Model
(CMM), ISO 17799, and British Standard 7799, security configuration recommendations such as those from the National Institute of Standards and Technology (NIST) or the National Security Agency (NSA) are examples of?

Back 27

Guidelines

Front 28

ISSO stands for

Back 28

Information Systems Security Officer

Front 29

CISO stands for

Back 29

Chief Information Security Officer

Front 30

5 Job controls implemented to minimize risk of loss

Back 30

Segregation of duties, Job description documentation, mandatory vacations, job/shift rotations and need to know (least privilege)

Front 31

duties, which should not be combined within one person or group

Back 31

incompatible duties

Front 32

who is responsible to Communicate Risks to Executive Management, Budget for Information Security Activities, Ensure Development of Policies, Procedures, Baselines, Standards, and Guidelines, Develop and Provide Security Awareness Program, Understand Business Objectives, Maintain Awareness of Emerging Threats and Vulnerabilities, Evaluate Security Incidents and Response, Develop Security Compliance Program, Establish Security Metrics, Participate in Management Meetings, Ensure Compliance with Government Regulations, Assist Internal and External Auditor, Stay Abreast of Emerging Technologies,

Back 32

Information Security Officer

Front 33

Projects greater than___ are generally considered to be long term and strategic in nature and typically require more funding and resources or are more complex in their implementation.

Back 33

12 to 18 months

Front 34

what are two reasons the security officer should report as high in the organization as possible?

Back 34

(1) maintain visibility of the importance of information security and
(2) limit the distortion or inaccurate translation of messages that can occur due to hierarchical, deep organizations

Front 35

are objectives that support the overall vision, created by the Security Oversight Committee

Back 35

Mission Statement

Front 36

Who chairs the security oversight committee?

Back 36

The security officer

Front 37

Who is responsible for protecting the information assets on a daily basis through adherence to the security policies that have been communicated?

Back 37

End User

Front 38

Who maintains the overall responsibility for protection of the information assets

Back 38

Executive Management

Front 39

Who directs, coordinates, plans, and organizes information security activities throughout the organization

Back 39

The Security officer

Front 40

Who develops the security policies and the supporting procedures, standards, baselines, and guidelines, and subsequent implementation and review?

Back 40

Information System Security Professionals

Front 41

Who is responsible for an information asset, assign the appropriate classification to the asset and ensure that the business information is protected with the
appropriate controls.

Back 41

Data/Information/Business owners

Front 42

Who takes care of the information on behalf of the data owner?
These individuals ensure that the information is available to the end users and is backed up to enable
recovery in the event of data loss or corruption

Back 42

Data custodian

Front 43

Who determines whether systems are in compliance with the security policies, procedures, standards, baselines, designs, architectures, management direction, and other requirements

Back 43

Information Systems Auditor

Front 44

Who is responsible for designing security controls into information systems, testing the controls, and implementing the systems in production environments through agreed upon operating policies and procedures

Back 44

IS/IT professionals

Front 45

manages the user access request process and ensures that privileges are provided to those individuals that have been authorized for access by the proper management.

Back 45

Security Administrator

Front 46

3 types of security planning

Back 46

1) Strategic (3-5yr horizon)
2) Tactical (6-18mo)
3) Operational/Project Planning (short term)

Front 47

Name the activities performed as part of hiring practices

Back 47

1) Developing job descriptions
2) Contacting references
3) screening/investigating background
4) Developing confidentiality agreements
5) Determining policies on vendor, contractor, consultant and temporary staff access

Front 48

Job descriptions should contain:

Back 48

1) responsibilities of the position
2) Education
3) Experience
4) Expertise

Front 49

What is the purpose of employee agreements?

Back 49

To protect the organization while the individual is employed as well as after the employee has left.

Examples (non-disclosure, code of conduct, conflict of interest, gift-handling, ethics)

Front 50

Two types of Terminations

Back 50

Friendly and Unfriendly

Front 51

Aspects of a curriculum in a course on security awarness

Back 51

what is it, why is _ important, how does this _ fit into my role at the organization, Do I have to comply, penalties for non-compliance, Effect of _ on my work, content

Front 52

Method by which organizations can inform employees about their roles, and expectations surrounding their roles, in the observance of information security requirements.

Back 52

Security Awareness Training

Front 53

assists personnel with the development of their skills sets relative to performance of security functions within their roles

Back 53

Security training

Front 54

Who is always ultimately responsible in the organization for information security?

Back 54

Senior Management

Front 55

Provides decision-making and security management skills that are important for the success of an organization's security program

Back 55

Security/Professional Education

Front 56

a discipline for living with the possibility that future events may cause harm

or
The technique or profession of assessing, minimizing and preventing accidental loss to a business, as through the use of insurance, safety measures, etc

Back 56

Risk management

Front 57

reduces risks by defining and controlling threats and vulnerabilities

Back 57

Risk Management

Front 58

What are the two types of risk assessments?

Back 58

1) Qualitative
2) Quantitative

Front 59

Which risk assessment is used when the time frame is short, assessors have limited expertise or the organization does not have a significant amount of data readily?

Back 59

Qualitative

Front 60

Which type of risk assessment is used when the following methods are used; mgmt approval and oversight req'd, documentation is collected, interviews w/ organizational members

Back 60

Qualitative

Front 61

Residual risk is

Back 61

Risk left over after countermeasure application

Front 62

Which risk assessment type uses numbers

Back 62

Quantitative

Front 63

What are the three steps taken in quantitative risk assessment?

Back 63

1) Initial management approval
2) Construction of risk assessment team
3) review of information currently available within the organization

Front 64

SLE

Back 64

Single Loss Expectancy. Calculated to provided an estimate of loss

Front 65

The difference between the original value and the remaining value of an asset after a single exploit

Back 65

SLE

Front 66

SLE (loss in success threat exploit, as %) = ?

Back 66

Asset value ($) * exposure factor

Front 67

ARO

Back 67

Annual Rate of Occurrence. How often a threat will be successful in exploiting a vulonerability over the period of a year

Front 68

ALE

Back 68

Annualized Loss Expectancy. Product of the yearly estimate for the exploit (ARO) and the loss in value of an asses after a single exploitation

Front 69

ALE =

Back 69

ARO * SLE

Front 70

LAFE

Back 70

Localized Annual Frequency Estimate (adjusted for geographical distances)

Front 71

SAFE

Back 71

Standard Annual Frequency Estimate

Front 72

ALE makes it possible for the organization to determine what?

Back 72

what amount, if any, to spend to apply countermeasure for the risk in question. (no countermeasure should be greater in cost than the risk it mitigates, transfers or avoids)

Front 73

self-direction is one of the principles of which public risk assessment Methodologies?

Back 73

OCTAVE

Front 74

Which public risk assessment Methodology is written specifically with HIPAA clients in mind?

Back 74

NIST's 800-66

Front 75

The OCTAVE criteria are a set of

Back 75

principles, attributes and outputs

Front 76

FRAP

Back 76

Facilitated Risk Analysis Process

Front 77

CRAMM

Back 77

CCTA Risk Analysis and Management Method

Front 78

CRAMM is divided into three stages:

Back 78

1) asset identification and valuation
2) threat and vulnerability assessment
3) counter measures selection and recommendation

Front 79

creates a tree of all possible threats to or faults of the system

Back 79

Spanning Tree Analysis

Front 80

What are the four risk management principles?

Back 80

1) Avoidance
2) Transfer
3) Mitigation
4) Acceptance

Front 81

principle described by "practice of comping up with alternatives so that risk in question is not realized"

Back 81

Risk avoidance

Front 82

principle described by "practice of passing on the risk in question to another entity, such as insurance company"

Back 82

Risk Transfer

Front 83

Principle described by "practice of the elimination of or the significant decrease in the level or risk presented"

Back 83

Risk Mitigation

Front 84

Principle described by "accepting the risk that is present"

Back 84

Risk Acceptance

Front 85

Who ultimately owns the risk that are present during operation of the company?

Back 85

Senior Management

Front 86

a flaw or weakness in system security procedures, design, implementation or internal controls" Per NIST SP 800-30

Back 86

Vulnerability (people, process, technology, data, and facilities)

Front 87

the potential to successfully exercise a particular vulnerability

Back 87

Threat

Front 88

Threat categories:

Back 88

Human
Natural
Technical
Physical
Environmental
Operational

Front 89

Likelihood is a component of which type of risk assessment

Back 89

Qualitative

Front 90

Impact is defined by

Back 90

loss of life, dollars, market share, and other facets

Front 91

Risk is determined by the product of

Back 91

Likelihood and impact

Front 92

Consideration for countermeasures

Back 92

Accountability, auditability, publicly available, trusted source, independeence, consistently applied, cost-effective, reliable, distinct from other countermeasures, ease of use, minimum manual intervention, sustainable, secure, protects CIA, can be "backed out", creates no add'l issues during operations, leaves no residual data from its function

Front 93

Process of judging information's cost and its perceived value

Back 93

Information Valuation

Front 94

descriptive is a ___ approach to information valuation

Back 94

subjective

Front 95

metric is a ___ approach to information valuation

Back 95

objective

Front 96

who is credited with beginning the the consideration of computer ethics

Back 96

MIT professor Norbert Wiener

Front 97

Who is credited with coining the phrase "Computer ethics"

Back 97

Walter Maner

Front 98

when the the area of computer ethics really begin to grow/flourish?

Back 98

1990s

Front 99

what provides the basis for a minimal ethical standard upon which an org can expand?

Back 99

regulatory requirements (e.g 1991 Federal Sentencing Guidelines for Orgs and Sarbanes-Oxley 2002)

Front 100

Topics to include in a computer ethics program

Back 100

Computers in the workplace, Computer crime, Privacy and Anonymity, Intellectual Property, Professional Responsibility and Globalization

Front 101

Name three regulations which call for ethic training/program

Back 101

1) US Federal Sentencing Guidelines for Organizations
2) Sarbanes-Oxley 2002
3) New York Stock Exchange

Front 102

Example of code of Ethics

Back 102

Code of Fair Information Practices, Internet Activities Board/RFC 1087, Computer Ethics Institute (CEI)

Front 103

What are the four primary values proposed by the National Conference on Computing and Values?

Back 103

1) Preserve the public trues and confidence in computer
2) Enforce fair information practices
3) Protect the legitimate interestes of the consitituents of the system
4) Resist fraud, waste and abuse

Front 104

who created the End User's basic tenets of Responsible Computing

Back 104

the Working Group on Computer ethics 1991

Front 105

NCERC stands for

Back 105

National Computer Ethics and Responsibilities Campaign

Front 106

Name the steps of organizational Ethics plan of action:

Back 106

1) Develop a corporate guide to computer ethics
2) develop a computer ethics policy to supplement the security policy
3) Add information about computer ethics to the employee handbook
4) Find out whether the org has a business ethics policy and expand it to include computer ethics
5) Learn more about computer ethics and spreading what is learned
6)foster awareness
7) Make sure there's an E-mail privacy policy
8) Make sure employees know what the e-mail privacy is

Front 107

what is "a contract between professionals"

Back 107

Professional code of ethics

Front 108

Donn B Parker's 5 ethical principles:

Back 108

1) Informed consent
2) Choose the higher ethic (least harm)
3) Amplified scale test
4) Owners' conservation of ownership
5) User's conservation of ownership

Front 109

Consideration of computer ethics is recognized to have begun with who?

Back 109

Norbert Wiener

Front 110

Need to input sample q's from book.

Back 110

p.88

Front 111

1) Consideration of computer ethics is recognized to have begun with the work of which of the
following?

Back 111

Norbert Wiener

Front 112

2) Which of the following U.S. laws, regulations, and guidelines does not have a requirement for
organizations to provide ethics training?

Back 112

Health Insurance Portability and Accountability Act

Front 113

According to Peter S. Tippett, which of the following common ethics fallacies is demonstrated by
3) Tthe belief that if a computer application allows an action to occur, the action is allowable because if it was not, the application would have prevented it?

Back 113

The computer game fallacy

Front 114

4) According to Stephen Levy, which of the following is one of the six beliefs he described within the
hacker ethic?

Back 114

Computers can change your life for the better.

Front 115

5) According to Fritz H. Grupe, Timothy Garcia-Jay, and William Kuechler, which of the following
represents the concept behind the "no free lunch" rule ethical basis for IT decision making

Back 115

Assume that all property and information belong to someone.

Front 116

6) The concept of risk management is best described as the following:

Back 116

Risk management reduces risks by defining and controlling threats and vulnerabilities

Front 117

7) Qualitative risk assessment is earmarked by which of the following?

Back 117

Ease of implementation
AND
Can be completed by personnel with a limited understanding of the risk assessment
process

Front 118

8) Single loss expectancy (SLE) is calculated by using

Back 118

Asset value and exposure factor

Front 119

9) Consideration for which type of risk assessment to perform includes all of the following except
a) Cultural org
b) Budget
c) Capabilities of resources
d) likelihood of exposure

Back 119

Likelihood of exposure

Front 120

10. Security awareness training includes:

Back 120

b. Security roles and responsibilities for staff

Front 121

11. A signed user acknowledgment of the corporate security policy:

Back 121

Helps to protect the organization if a user's behavior violates the policy

Front 122

12. Effective security management:

Back 122

b. Reduces risk to an acceptable level

Front 123

13. Identity theft is best mitigated by:

Back 123

b. Implementing authentication controls

Front 124

14. Availability makes information accessible by protecting from each of the following except:

Back 124

d. Unauthorized transactions

Front 125

15. The security officer could report to any of the following except:
a. CEO
b. Chief information officer
c. Risk manager
d. Application development

Back 125

d. Application development

Front 126

16. Tactical security plans:

Back 126

b. Enable entitywide security management

Front 127

17. Who is accountable for information security?

Back 127

Security Officer

Front 128

18. Security is most expensive when addressed in which phase?

Back 128

d. Implementation

Front 129

19. Information systems auditors help the organization:

Back 129

c. Identify control gaps

Front 130

20. Long-duration security projects:

Back 130

d. Increase completion risk

Front 131

21. Setting clear security roles has the following benefits except:

Back 131

c. Reduces cross-training requirements

Front 132

22. Well-written security program policies should be reviewed:

Back 132

a. Annually

Front 133

23. Orally obtaining a password from an employee is the result of:

Back 133

a. Social engineering

Front 134

24. A security policy that will stand the test of time includes the following except:
a. Directive words such as shall, must, or will
b. Defined policy development process
c. Short in length
d. Technical specifications

Back 134

d. Technical specifications

Front 135

25. Consistency in security implementation is achieved through:

Back 135

b. Standards and baselines

Front 136

26. The ability of one person in the finance department to add vendors to the vendor database and subsequently pay the vendor illustrates which concept?

Back 136

b. Separation of duties

Front 137

27. Which function would be most compatible with the security function?

Back 137

c. Change management

Front 138

28. Collusion is best mitigated by:

Back 138

a. Job rotation

Front 139

29. False-positives are primarily a concern during:
a. Drug and substance abuse testing
b. Credit and background checks
c. Reference checks
d. Forensic data analysis

Back 139

a. Drug and substance abuse testing

Front 140

30. Data access decisions are best made by:

Back 140

b. Data owners

Front 141

31. Company directory phone listings would typically be classified as:
a. Public
b. Classified
c. Sensitive information
d. Internal use only

Back 141

d. Internal use only

Front 142

ISC2 ethics cannon in order

Back 142

1) protect society, commonwealth, infrastrucuture
2) Act honorably, honestly, justly, responsible and legally
3) duty to our principles
4) Advance and protect the profession

Front 143

According to Peter S. Tippett, which of the folloing common ethic fallacies is deomonstrated by the believe that if a computer app allows an aciton to occure the action asl allowable becaause if it was not, the app would have prevented it?

Back 143

The computer game fallacy

Front 144

According to Stephen levy, which of the following is one of the six beliefes he describe w/in the hacker ethic

Back 144

Computers can change your life for the better

Front 145

IT system are normally operated by

Back 145

Data Custodians

Front 146

Security Awarness begins when

Back 146

first day of employement

Front 147

What is a primary step in Qualitative Risk Analysis

Back 147

Develop scenarios

Front 148

Which is possible to totally complete quantitative or qualitative risk analysis

Back 148

Qualitative

Front 149

Risk management principles

Back 149

Avoidance, acceptance, mitigation

Front 150

IT governance is comprised of

Back 150

Roles and Responsibilities
Security Planning
Security Administration

Front 151

total risk formula

Back 151

Threats * vulnerability * asset Value

Front 152

residual risk formual

Back 152

(Threats * vulnerability * asset Value) * control gap

Front 153

What are the sections of ISO 17799?

Back 153

1. Info Sec policy
2. Creation of security infrastructure
3. Asset classification and control
4. Personnel Security
5. Physical and environment security
6. Communications and ops mgmt
7. Access Control
8. System development and mx
9. BC management
10. Compliance

Front 154

Why is it important to make safeguards highly visible?

Back 154

To deter attackers

Front 155

What is the difference between the modified and consensus Delphi methods?

Back 155

Modified is for brainstorming and consensus is for solving problems

Front 156

is the Delphi method anonymous

Back 156

yes

Front 157

What do uncertainty values have to do with risk values and calculations?

Back 157

It is a confidence level in the data that has been gatherd

Front 158

Employee Badge-ID policy is an example of what kind of policy

Back 158

Issue-specific

Front 159

A policy written soley to educate and not to enforce action is what type of policy?

Back 159

Informative

Front 160

describes the probability of a theat materializing

Back 160

Risk

Front 161

of Regulatory, Advisory and Informative, which is non-enforceable

Back 161

Informative

Front 162

Value representing the likelihood of an event taking place within the span of a year

Back 162

Annualized rate of occurance

Front 163

Three phases of Risk Mgmt

Back 163

1) Risk assessment (analysis)
2) Risk Mitigation
3) Evaluation and Assurance

Front 164

What statement describes the proper relationship of the words "thread" "exposure" and "risk"

Back 164

A threat is that a threat agent will exploit a vulnerability. The probability of this happening is risk. Once the vulnerability is exploited, there is an exposure.

Front 165

A signed user acknowledge ment of the corporate security policy:

Back 165

ensure that user understand the policy as well as the consequences for not following the policy