Cissp Risk Management

Front 1

are a special type of documented business rules for protecting information and the systems which store information; generally use broad terms so they cover a wide range of items

Back 1

Information security policies

Front 2

concept that all users at all times should run with as few privileges as possible, and also launch applications with as few privileges as possible

Back 2

principle of least privilege

Front 3

describes the restriction of data which is considered very sensitive; even if one has all the necessary official approvals (such as a security clearance) to access certain information, one would not be given access to such information

Back 3

need to know

Front 4

has as its primary objective the prevention of fraud and errors. This objective is achieved by disseminating the tasks and associated privileges for a specific business process among multiple users

Back 4

Separation of duties

Front 5

embodies all the detailed actions that personnel are required to follow

Back 5

Procedures

Front 6

responsible for providing reports to the senior management on the effectiveness of the security controls

Back 6

Information systems security professionals

Front 7

A state of uncertainty where some of the possibilities involve a loss, catastrophe, or other undesirable outcome

Back 7

risk

Front 8

DECIDE's how a company should approach security and what security measures should be implemented

Back 8

Senior management

Front 9

gives a detailed description of a number of important IT practices with comprehensive checklists, tasks and procedures that any IT organization can tailor to its needs

Back 9

Information Technology Infrastructure Library (ITIL)

Front 10

new international standard entitled: "Information technology - Security techniques - Information security management systems - Overview and vocabulary

Back 10

ISO/IEC 27000

Front 11

attainable certification; Information technology -- Security techniques -- Information security management systems -- Requirements

Back 11

ISO/IEC 27001

Front 12

code of practice; Information technology - Security techniques - Code of practice for information security management

Back 12

ISO/IEC 27002

Front 13

Health informatics -- Information security management in health using ISO/IEC 27002

Back 13

ISO 27799

Front 14

standard in the field of Business Continuity Management (BCM)

Back 14

BS 25999

Front 15

provides managers, auditors, and IT users with a set of generally accepted measures, indicators, processes and best practices to assist them in maximizing the benefits derived through the use of information technology and developing appropriate IT governance and control in a company

Back 15

Control Objectives for Information and related Technology (COBIT)

Front 16

Security blueprint which governs preventing fraud

Back 16

COSO

Front 17

the likelihood of a threat agent taking advantage of a vulnerability and the corresponding business impact
likelihood:impact

Back 17

Risk

Front 18

Entity that can authorize or deny access to certain data

Back 18

data owner

Front 19

the process of certifying that a certain product has passed performance and quality assurance tests or qualification requirements stipulated in regulations such as a building code and nationally accredited test standards, or that it complies with a set of regulations governing quality and minimum performance requirements

Back 19

certification

Front 20

management formal approval of a product

Back 20

accreditation

Front 21

the benchmarks used to endure that a minimum level of security "configuration"

Back 21

baselines

Front 22

unlike standards, which mandate company policy, these are simply recommendations

Back 22

guidelines

Front 23

rules that must be followed; thus they are cumpolsory

Back 23

standards

Front 24

Action with a negative impact

Back 24

Threat

Front 25

Absence of control

Back 25

Vulnerability

Front 26

Resource, product, data

Back 26

Asset

Front 27

% of asset loss caused by threat

Back 27

Exposure Factor

Front 28

does this solution carry out the required tasks?

Back 28

Functional requirement

Front 29

provides confidence that security function is performing as expected; critical part of security program

Back 29

Assurance requirements

Front 30

two people perform the same action to complete a task

Back 30

dual control

Front 31

risk

Back 31

liklihood and impact =

Front 32

countermeasure in place and left over risk

Back 32

residual risk

Front 33

identifies and develops countermeasures

Back 33

risk analysis

Front 34

Protect society, the commonwealth, and the infrastructure. Act honorably, honestly, justly, responsibly, and legally. Provide diligent and competent service to principals. Advance and protect the profession

SOCIETY, ETHICS, SERVICE, PROFESSION

Back 34

Code of Ethics Canons

Front 35

A teleological school of thought is one that holds all things to be designed for or directed toward a final result, that there is an inherent purpose or final cause for all that exists

Back 35

Teleology

Front 36

an approach to ethics that holds that acts are inherently good or evil, regardless of the consequences of the acts; we have a duty to do those things that are inherently good ("truth-telling" for example); while the ends or consequences of our actions are important, our obligation or duty is to take the right action, even if the consequences of a given act may be bad

Back 36

deontology

Front 37

RFC 1087, unethical and unacceptable to hack into system, Internet is a privleage not a right

Back 37

Internet Architecture Board

Front 38

the probability that a potential vulnerability be exercised within the construct of the associated threat environment

Back 38

likelihood

Front 39

replacement cost of IT facilities, properties, hardware software, documentationm supplies and IT Staff

Back 39

tangible assets

Front 40

are defined as identifiable non-monetary assets that cannot be seen, touched or physically measured, which are created through time and/or effort and that are identifiable as a separate asset

Back 40

Intangible assets

Front 41

a systematic, interactive forecasting method which relies on a panel of independent experts. The carefully selected experts answer questionnaires in two or more rounds

Back 41

Delphi method

Front 42

= Asset Value x Exposure Factor

Back 42

Single Loss Expectancy (SLE)

Front 43

represents estimated frequency in which threat will occur within one year

Back 43

Annualized Rate of Occurrence (ARO)

Front 44

= SLE x ARO

Back 44

Annualized Loss Expectancy (ALE)

Front 45

Relative measure of risk or asset value based on ranking or separation into descriptive categories such as low, medium, high; not important, important, very important; or on a scale from 1 to 10

Back 45

Qualitative Risk Analysis

Front 46

a procedure in operations management for analysis of potential failure modes within a system for classification by severity or determination of the effect of failures on the system

Back 46

failure modes and effects analysis (FMEA)

Front 47

a failure analysis in which an undesired state of a system is analyzed using boolean logic to combine a series of lower-level events. This analysis method is mainly used in the field of safety engineering to quantitatively determine the probability of a safety hazard

Back 47

Fault tree analysis (FTA)

Front 48

erect barriers to threat, improve procedures, alter the environment, install security control....RISK

Back 48

Risk Reduction

Front 49

get insurance, transfer cost of a loss to insurance

Back 49

Risk Transference

Front 50

Accept the risk, absorb loss

Back 50

Risk Acceptance

Front 51

in risk mitigation, to stop it

Back 51

Avoidance

Front 52

is an Information Assurance (IA) strategy in which multiple layers of defense are placed throughout an Information Technology (IT) system. It addresses security vulnerabilities in personnel, technology and operations for the duration of the system's lifecycle.

Back 52

Defense in Depth