Cissp: Infosec Gov & Risk Mgmt - Brown

Front 1

What are the Objectives of Security?

Back 1

To provide confidentiality, integrity, and availability protection to data and resources.
Prevent, detect, and deter unauthorized Disclosure, Alteration, and Denial of access

Hint 1

CIA

Front 2

Alternative map to CIA

Back 2

DAD
Disclosure / Alteration / Destruction (access denial)

Map to CIA:
confidentiality = disclosure
integrity = alteration
availability = destruction

Front 3

Name the four Canons of the CISSP?

Back 3

-Protect Society, Common Wealth, and the Infrastructure.
-Act Honorably, Honestly , Justly, Responsibly & Legally.
-Provide diligent and competent Service.
-Advance and Protect the Profession.

Hint 3

In priority order

Front 4

What are the three Phases of Security Planning?

Back 4

1. Strategic
2. Tactical
3. Operational

Front 5

Who provides Policy and how does it effect every day activity?

Back 5

Senior Management Provide Policy (Broad in Scope).
Mid Level Management Provide Standards.
Team leads provide Baselines, Procedures, and Guidelines.

Front 6

Cole: 7 Step Data Classification Process @ 10:44 Part B

Back 6

1.


7.

Front 7

What does ISO 27001 provide?

Back 7

A best practices guide for Information Security Management.

Front 8

Name SIX Enterprise Level Architecture Processes?

Back 8

TQM - Is about Planning.
ITIL = Managing Quality.
COBIT = Control Points.
Six Sigma = Managing Skills and Disciplines.
CMM/CMMI = Maturing Processes
ISO = Standards

Front 9

Name two types of Qualitative Risk Analysis?

Back 9

Spanning tree and ANZ 4360

Front 10

What is ISO 17799 aka (27002-2005)?

Back 10

Internationally recognized guidelines and general principles for initiating, implementing, maintaining, and improving information security management in an organization.

Front 11

What is the Delphi technique?

Back 11

Each person provides their individual anonymous opinion.

Front 12

What do the COBIT (Control Objectives for Information and Related Technology) an COSO ( Committee of Sponsoring Organizations of the Treadway Commission) frameworks address?

Back 12

What is to be achieved.

NOT how to achieve it.

Hint 12

COSO is for corporate governance

COBIT is for IT governance (derived from COSO)

Front 13

How many objectives in the COBIT framework?

Back 13

34 objectives achieved through ITIL processes

Hint 13

COBIT is the objective
ITIL is the process

Front 14

What are the 4 COBIT domains?

Back 14

1) Plan & Organize
2) Acquire & Implement
3) Deliver & Support
4) Monitor & Evaluate

Hint 14

Encompass 34 objectives

Front 15

What is ITIL?

Back 15

Information Technology Infrastructure Library

Hint 15

Framework for providing best services (practices) in IT Service Management

Front 16

What are the 5 Service Management practices of ITIL?

Back 16

1) Strategy
2) Design
3) Transition
4) Operation
5) Continual service improvement

Front 17

Name a few Risk Management models:

Back 17

- AS/NZS 4360: 1st widely accepted
- Basel II: EU financial
- FRAP: Qualitative approach
- ISO/IEC 27005: International (extension of 27002)
- NIST SP 800-30: U.S. developed (3 phases)
- Octave: Developed by U.S.

Front 18

Risk analysis using a chart with numbers and letters that intersect - the intersection depicts a number/letter value that matches the level of risk. Impact vs Probability.

Back 18

AS/NZS 4360 or AS/NZS ISO 31000:2009

Australian: AS
New Zealand: NZ

Front 19

3 Phases on NIST SP 800-30

Back 19

1) Risk Assessment
2) Controls Implementation
3) Ongoing Controls Evaluation

Front 20

3 types of policies

Back 20

1) Regulatory
2) Advisory
3) Informative

Front 21

Define Regulatory policy

Back 21

Follows specific industry regulations

Hint 21

HIPPA, SOX, PCI

Front 22

Define Advisory policy

Back 22

Strongly advises behaviors and activities; outlines possible ramifications

Front 23

Define Informative policy

Back 23

Teaches specific issues; not enforceable

Front 24

Define Safe Harbor framework

Back 24

Outlines how to move privacy data in and out of Europe

Front 25

What is the Annualized Loss Expectancy (ALE) formula?

Back 25

Single loss expectancy (SLE) * Annualized rate of occurrence (ARO) = ALE

Front 26

What is an Information Security Management System (ISMS)?

Back 26

A coherent set of policies, processes, and systems to manage risks to information assets as outlined in ISO\IEC 27001.

Front 27

What is a System-specific policy?

Back 27

Technical directives devised by management to protect individual systems. They can outline how a system should be accessed or how users should be trained on a specific system.

Front 28

What is the absence of or a weakness in a control?

Back 28

A vulnerability

Front 29

What is a safeguard or control, mitigates the risk?

Back 29

A countermeasure

Front 30

What are the three types of controls?

Back 30

administrative, technical, or physical

Hint 30

A / T / P

Front 31

A Control can provide what types of protection?

Back 31

Controls provide deterrent, preventive, detective, corrective, or recovery protection

Hint 31

DPDCR

Front 32

What is the name of the control that is put into place because of financial or business functionality reasons?

Back 32

A compensating control

Hint 32

Begins with Comp

Front 33

What is a framework of control objectives and allows for IT governance?

Back 33

CobiT

Front 34

What is the standard for the establishment, implementation, control, and improvement of the information security management system?

Back 34

ISO/IEC 27001

Front 35

What ISO/IEC series were derived from BS 7799 and are international best practices on how to develop and maintain a security program?

Back 35

ISO/IEC 27000

Front 36

____ ____ ____ are used to develop architectures for specific stakeholders and present information in views.

Back 36

Enterprise architecture frameworks

Front 37

What is a coherent set of policies, processes, and systems to manage risks to information assets as outlined in ISO\IEC 27001?

Back 37

An information security management system (ISMS)

Front 38

What is a subset of business architecture and a way to describe current and future security processes, systems, and subunits to ensure strategic alignment?

Back 38

Enterprise security architecture

Front 39

_____ are functional definitions for the integration of technology into business processes?

Back 39

Blueprints

Hint 39

Are needed to build a house

Front 40

___ ___ ___ are used to build individual architectures that best map to individual organizational needs and business drivers?

Back 40

Enterprise architecture frameworks

Hint 40

Three words first word start with E

Front 41

______ is an enterprise architecture framework, and _____ is a security enterprise architecture framework.

Back 41

Zachman is an enterprise architecture framework, and SABSA is a security enterprise architecture framework.

Front 42

_____ is a governance model used to help prevent fraud within a corporate environment.

Back 42

COSO

Hint 42

Kind of like the store costco

Front 43

_____ is a set of best practices for IT service management.

Back 43

ITIL

Hint 43

Had to take training on this at our work!

Front 44

___ _____ is used to identify defects in processes so that the processes can be improved upon.

Back 44

Six Sigma

Hint 44

Start with the number 6

Front 45

____ is a maturity model that allows for processes to improve in an incremented and standard approach.Security enterprise architecture should tie in strategic alignment, business enablement, process enhancement, and security effectiveness.

Back 45

CMMI

Front 46

NIST ???-?? uses the following control categories: technical, management, and operational.

Back 46

NIST 800-53

Hint 46

First three numbers is a toll free call. The seconds 2 numbers are the DNS port

Front 47

------ is a team-oriented risk management methodology that employs workshops and is commonly used in the commercial sector.

Back 47

OCTAVE

Hint 47

Think piano keys

Front 48

Security management should work from the --- ---- (from senior management down to the staff).

Back 48

top down

Hint 48

stuff rolls down hill

Front 49

What does the following describe:
identify assets and assign values to them, identify vulnerabilities and threats, quantify the impact of potential threats, and provide an economic balance between the impact of the risk and the cost of the safeguards.

Back 49

The main goals of risk analysis

Front 50

Probability of a threat agent exploiting a vulnerability and the loss potential from that action.

Back 50

Risk

Front 51

Name two methods of conducting a risk analysis?

Back 51

Quantitative and Qualitative.

Front 52

Risk analysis that uses hard measures such as dollars. Objective.

Back 52

Quanti - tative

Calculate Qty of of asset protected

Front 53

Risk analysis that uses simple approximate values.
Subjective.

Back 53

Quali - tative

Front 54

Risk Choices (4)

Back 54

Risk can be:
- transferred (e.g. insurance)
- reduced (mitigated)
- accepted
- avoided (need calculation of ALE and ROI)

Front 55

Total Cost of a mitigating safeguard.

Back 55

Total Cost of Ownership (TCO)

Front 56

Amount of money saved by implementing a safeguard.

Back 56

Return on Investment (ROI)

Front 57

Risk Avoidance

Back 57

Calculate ALE (Annual Loss Expectancy) and ROI (Return on Investment)

If ALE > ROI then avoid risk; do not implement project.

Front 58

Potential harmful occurrence.

Possibility that someone or something would exploit a vulnerability, intentionally or accidentally, and cause harm to an asset

Back 58

Threat

Front 59

Formula for Total risk

Back 59

Total Risk = Threats × Vulnerability × Asset value

Front 60

Formula for Residual Risk

Back 60

Residual Risk = (Threats × vulnerability × asset value) × controls gap

Front 61

Value of an Asset to be protected.

Back 61

Asset Value: AV

Front 62

The percentage (%) of loss of an asset due to an incident.

Back 62

Exposure Factor (EF)

Front 63

Cost of a single loss due to an incident.

Back 63

SLE - Single Loss Expectancy

SLE = AV x EF

AV: Asset Value
EF: Exposure Factor (%)

Front 64

Number of losses experienced per year.

Back 64

Annual Rate of Occurrence: ARO

Front 65

Yearly cost due to a risk.

Back 65

Annual Loss Expectancy: ALE

ALE = SLE x ARO

SLE: Single Loss Expectancy
Annual Rate Occurrence: ARO

Front 66

------- ----- --- ------ -------- (----) isa method for determining functions, identifying functional failures, and assessing the causes of failure and their failure effects through a structured process

Back 66

Failure Modes and Effect Analysis (FMEA)

Hint 66

FMEA

Front 67

A ----- ---- analysis is a useful approach to detect failures that can take place within complex environments and systems.

Back 67

fault tree