Cissp - Domain 5 - Information Security And Risk Management

Front 1

A _______ _______ is to look at a model, data and assumptions for validity. (looking at a risk model)

Back 1

Uncertainty analysis-

Front 2

A tool is being used to determine whether attackers have altered system files or executables.

Back 2

File Integrity Checker

Front 3

- means to ignore or segregate details in order to focus on what is important for some purpose. This helps remove complexity and helps make designs and specifications easier to understand.

Back 3

Abstraction

Front 4

- Ideally, each component reveals to other components only its external properties, the implementation and data are hidden. This is also called encapsulation, as there are barriers that prevent the access to the procedures and data of the component.

Back 4

Data hiding

Front 5

- abstractions may be used for a layered structure, where each layer uses abstractions provided by the layer below to create its own abstractions, which in turn are used by the layer above.

Back 5

Layering

Front 6

There are four general areas for risk management:

Back 6

Risk assignment and transfer- Transferring the risk to others, this would include buying insurance or co-insurance. Risk Rejection- ignoring the risks altogether. Risk reduction- installing the necessary precautions to guard against a risk. Risk acceptance- accepts the risk as the cost to protect that risk would outweigh or cost more, than the risk itself.

Front 7

An ______ is an instance of being exposed to losses from a threat.

Back 7

exposure

Front 8

_______ planning is long term, _______ planning is midterm,
_______ planning is day to day.
They make up a planning ________.

Back 8

Strategic planning is long term,
Tactical planning is midterm,
Operational planning is day to day.
They make up a planning Horizon.

Front 9

ISO ________ is a comprehensive set of controls comprising best practices in information security and provides guidelines on how to set up and maintain security programs.

Back 9

ISO 17799

Front 10

Project sizing should be done before __________ is performed.

Back 10

risk analysis

Front 11

______ is a degree of confidence that a certain security level is being provided.

Back 11

assurance

Front 12

Risk can be _____, ______, ______, or _______.

Back 12

Risk can be transferred, rejected (ignored), reduced, or accepted.

Front 13

CIA not = to DAD, what does each stand for?

Back 13

Confidentiality not = disclosure
Integrity not = alteration
Availability not = destruction