Cissp - Domain 5 - Information Security And Risk Management

Front 1

CIA triad.

Back 1

Confidentiality, integrity, availability

or

Disclosure, alteration, destruction

Front 2

Ensures that private information remains protected from unauthorized disclosure.

Back 2

Confidentiality

Front 3

Ensures that data isn't modified in an unintended manner either through accidental modification by authorized individuals or malicious modification by any individual authorized or unauthorized.

Back 3

Integrity

Front 4

Ensures that data is always available for the use of authorized individuals.

Back 4

Availability

Front 5

The means by which users make an identity claim to the system.

Back 5

Identification

Front 6

The means by which the system validates the users identity.

Back 6

Authentication

Front 7

The systems ability to determine which activities may be permitted to an identified and authenticated user.

Back 7

Authorization

Front 8

The systems ability to determine the actions of users within the system and attribute those actions to individually identifiable users.

Back 8

Accountability

Front 9

The inability of the sender of a message to refute sending the message.

Back 9

Non-repudiation

Front 10

The users level of confidence that their data is safe from unauthorized disclosure.

Back 10

Privacy

Front 11

Five main government classification levels.

Back 11

Unclassified, sensitive but unclassified, confidential, secret, top secret

Front 12

Five main industry classification levels.

Back 12

Public, internal, confidential, restricted, highly restricted

Front 13

Four criteria for determining classification levels.

Back 13

Value to the organization, age and useful life of the information, ability of an outsider to independently develop the same information, the potential harm to the organization

Front 14

Every resource and user is associated with one of an ordered set of classes. Resources of a particular class may only be accessed by those whose associated class is as high or higher than that of the resource.

Back 14

Lattice model

Front 15

Defines relationships between objects and subjects. Subjects are allowed write access to objects as the same or higher level as the subject, read access to objects at the same or higher level as the subject, read access to objects at the same or lower level, and read/write access only to those objects at the same level.

Back 15

Bell Lapadula

Front 16

Four levels of security management hierarchy documents.

Back 16

Policies, standards, guidelines, procedures

Front 17

Broad statements about the organizations commitment to information security and the goals of the program. Mandatory.

Back 17

Policies

Front 18

Provide specific technical requirements for security mechanisms. Mandatory.

Back 18

Standards

Front 19

General guidance in areas of information security where formal policies and standards don't exist. Not mandatory.

Back 19

Guidelines.

Front 20

Step by step instructions for performing specific security related tasks.

Back 20

Procedures

Front 21

A formal mechanism for responding to any incident that appears to be a violation of a security policy, standard, guideline, or procedure that threatens the overall information security of the organization.

Back 21

Computer incident response team (CIRT)

Front 22

Potential harm or loss to a system; the probability that a threat will materialize.

Back 22

Risk

Front 23

A resource, process, product, system, etc...

Back 23

Asset

Front 24

Any event that causes an undesirable impact on an organization.

Back 24

Threat

Front 25

Absence of a safeguard.

Back 25

Vulnerability

Front 26

Asset, threat, and vulnerability,

Back 26

Risk management (RM) triple

Front 27

A technical means to exploit a vulnerability.

Back 27

Exploit

Front 28

Percentage loss a realized threat would have on an asset.

Back 28

Exposure factor (EF)

Front 29

Loss from a single threat

Back 29

Single loss expectancy (SLE) SLE = asset value($) x EF

Front 30

Estimated frequency at which a threat is expected to occur.

Back 30

Annualized rate of occurrence (ARO)

Front 31

The total of SLE multiplied by the ARO.

Back 31

Annualized loss expectancy (ALE). ALE=SLE x ARO

Front 32

Control or countermeasure to reduce risk associated with a threat.

Back 32

Safeguard

Front 33

Two types of risk analysis.

Back 33

Qualitative, quantitative

Front 34

Type of risk assessment that assigns an objective dollar cost to an asset.

Back 34

Quantitative

Front 35

Type of risk assessment that assigns intangible values to data loss and other issues that are not pure hard costs.

Back 35

Qualitative

Front 36

Four risk management techniques.

Back 36

Mitigate, avoid, accept, transfer

Front 37

Risk management technique that puts controls in place to reduce the risk to the organization.

Back 37

Mitigate

Front 38

Risk management technique that changes the organizations activities to completely avoid the risk.

Back 38

Avoid

Front 39

Risk management technique that acknowledges the risk and takes no action whatsoever.

Back 39

Accept

Front 40

Risk management technique that places the burden of the risk on someone else.

Back 40

Transfer

Front 41

Five elements of a security awareness training program.

Back 41

Initial training, recurring training, retraining, remedial training, security reminders

Front 42

Four levels of security awareness.

Back 42

Security awareness, security training, security education, security certification