Cissp - Information Security And Risk Management

Front 1

What are these types of control: developing and publishing policies, standards, procedures, guidelines, risk management, screening personnel, conducting security awareness training, implementing change control

Back 1

Administrative controls

Front 2

What are these types of controls: Access control, password and resource management, identification and authentication methods, security devices, configuration of infrastructure

Back 2

Technical (or logical) controls

Front 3

What are these types of controls: controlling access to facility, locking systems, protecting perimeter, monitoring intrusion, environmental controls

Back 3

Physical controls

Front 4

What are hardware, software or procedural weaknesses that may provide an attacker the open door to a computer or network?

Back 4

Vulnerabilities

Front 5

What is something or someone that will identify a vulnerability and use it?

Back 5

Threat

Front 6

What is the likelihood of a threat agent taking advantage of vulnerability and the corresponding business impact?

Back 6

Risk

Front 7

What are methods for determining functions, identifying functional failures, and assessing the causes of failure through a structured process?

Back 7

Failure Modes and Effect Analysis (FMEA)

Front 8

What are useful for identifying failures that can take place within complex environments and systems?

Back 8

Fault tree analysis

Front 9

What is asset value x exposure factor (EF)?

Back 9

SLE

Front 10

What represents percentage of loss a realized threat could have on an asset?

Back 10

EF

Front 11

What is SLE x annualized rate of occurrence (ARO)?

Back 11

ALE

Front 12

What is estimated frequency of a specific threat taking place in a year?

Back 12

ARO

Front 13

What are mandatory activities, actions or rules. Defines requirements of policy?

Back 13

Standards

Front 14

What are minimum level of protection required?

Back 14

Baselines

Front 15

What are recommended actions and operational guides to users, IT staff, operations staff, etc when a specific standard does not apply

Back 15

Guidelines

Front 16

What are detailed step by step tasks that should be performed to achieve a certain goal?

Back 16

Procedures

Front 17

What is Due Diligence?

Back 17

Company properly investigated all of its possible weaknesses and vulnerabilities. What are you protecting yourself against
Doing Due Care

Front 18

What is Due Care?

Back 18

Company does all it reasonably can do under the circumstances and takes reasonable steps. Common sense
Minimum Level of protection

Front 19

Equation for SLE (Single Loss Expectancy)

Back 19

Asset Value x Exposure Factor

Front 20

Equation for ALE (Annual Loss Expectancy)

Back 20

SLE x ARO

Front 21

How do you figure ARO (Annualized Rate of Occurrence)?

Back 21

Estimated frequency of a specific threat taking place in a year

Front 22

What can you do with Risk?

Back 22

Reduce, transfer, avoid, or accept risk

Front 23

How is the classification Confidential (corpoate) usually applied?

Back 23

Data that is exempt from disclosure under the Freedom of Information Act or other laws and regulations. Unauthorized disclosure could seriously affect a company.

Front 24

How is the classification Private usually applied?

Back 24

Personal information for use within a company. Unauthorized disclosure could adversely affect personnel or a company. Salary levels and medical information are considered private.

Front 25

How is the classification Sensitive usually applied?

Back 25

Requires special precautions to ensure the integrity and confidentiality of the data by protecting it from unauthorized modification or deletion. Requires higher than normal assurance of accuracy and completeness.

Front 26

How is the classification Secret usually applied?

Back 26

If disclosed, it could cause serious damage to national security.

Front 27

What is an uncertainty analysis?

Back 27

Allows the risk management results to be used knowledgeably

Front 28

What is the result of Top Secret (military) information being leaked?

Back 28

Unauthorized disclosure can cause exceptionally grave damage to National security

Front 29

What is the result of Secret (military) information being leaked?

Back 29

Unauthorized disclosure can cause serious damage to national security.

Front 30

What is the result of Confidential (military) information being leaked?

Back 30

Unauthorized disclosure can cause damage to national security.

Front 31

What is the result of Sensitive (military) information being leaked?

Back 31

Disclosure does not cause damage to national security

Front 32

What is the result of Unclassified (military) information being leaked?

Back 32

Neither sensitive nore classified