D2

Front 1

Criticality v Sensitivity in the sense of data classification

Back 1

sneisitivity is commensurate with losses org would sustain if revealed; criticality is indicator of how the loss would impact fundamental business processes of the org

Front 2

Data sensitivity levels in commercial sector

Back 2

"Confidential, prviate, sensitive, public"

Front 3

Data sensitivity labels in government sector

Back 3

"Top secret, secret, confidential, sensitive but unclassified, unclassified"

Front 4

Criteria for data classification

Back 4

"Conditions, Elements, Limitations, Procedures"

Front 5

Considerations during security labeling

Back 5

"usefulness of data, value of data, age, effects of data on security"

Front 6

Privacy v Security

Back 6

Security leads to privacy; privacy refers to the amount of control an individual ca expect to have as it relates to release of their personal info

Front 7

CSO and CPO positions

Back 7

CSO has broader responsibility than CISO because their concerned with organizational risk; CPO is chief privacy officer and is concerned with preventing disclosure of data

Front 8

Data Owner responsibility

Back 8

responsible for classifying data and authorizing controls

Front 9

data custodian

Back 9

"responsible for backing up data, implementing controls, performing integrity checks, restoring data, maintaing activity records, etc."

Front 10

system owner

Back 10

"responsible for ensuring proper security controls on owned systems; have to manage vulnerabilities on their systems, etc.; might be the same person as the data owner"

Front 11

security administrator

Back 11

"responsible for implementing specific security network devices and software in the enterprise; this person might also handle account provisioning, patch mgmt, and password issuance"

Front 12

TPM

Back 12

Trusted Platform Module

Front 13

3 States of Data

Back 13

"At rest, in-use, in transit"

Front 14

Definition of Configuration Management

Back 14

"The process of identifying and documenting hardware components, software, and the associated settings'"

Front 15

Example contents of a configuration management document

Back 15

"Make, Model, MAC, Serial#, OS/Firmware, BIOS or passwords"

Front 16

Distinction between QA and QC

Back 16

QA procedures maintain quality throughout all development stages while QC occurs at the end of the production cycle

Front 17

Data Standards Examples

Back 17

"Agreements on format, representation, definition, structuring, etc. All leads to more efficient management"

Front 18

Media Viability Controls

Back 18

"Marking, handling, storage"

Front 19

Data Remanance

Back 19

Data that is left over after we purge a disk

Front 20

FIPS

Back 20

Federal Information Processing Standards

Front 21

3 fundamentals of data retention policies

Back 21

"What do we keep, how long, and where do we keep it?"

Front 22

e-discovery

Back 22

process of producing for a ccourt all electronically stored information pertinent to a legal proceeding

Front 23

side channel attack example

Back 23

analyzing how a processor changes during encryption to determine the type of algo in use

Front 24

3 Types of DLP approaches

Back 24

"Network, Endpoint, Hybrid"

Front 25

Misuse Case

Back 25

describe the actions of a threat actor rather than a legitimate user

Front 26

CCCA of 1984

Back 26

"Precursor to 86 CFAA; this idetnfied a number of crimes, which include some ocmputer crimes"

Front 27

Computer Security Act of '87

Back 27

Mandated baseline security requirements for federal info systems; led to formation of NIST

Front 28

Prudent Man Rule

Back 28

Would a theoretical prudent man do this? Also relates to executives being personally liable for info sec negligence

Front 29

1994 CFAA Amendments

Back 29

Basically broadened the jurisdiction so that it was no longer JUST federal and financial info systems

Front 30

GISRA

Back 30

"Government information security act- Amendment to late 90's paperwork reduction act, which placed some controls on agency in the areas of, say, collecting more data or adding processes"

Front 31

FISMA

Back 31

Tasked NIST with developing some infosec requirements for federal agencies

Front 32

4 Types of License agreements

Back 32

"Contractual, Shrink-wrap, click-through, cloud service"

Front 33

Privacy Act of '74

Back 33

Limits ability of feds to disclose personal data

Front 34

Fourth Amendment

Back 34

Constitutional right to privacy

Front 35

ECPA

Back 35

Electronic Communications Privacy Act of '74 - prohibits any interception of transmissions

Front 36

CALEA

Back 36

Comm Assist for Law Enforc. - requires comm carriers to make wiretaps possible

Front 37

COPPA

Back 37

Childrens Online Privacy Protection Act of 98

Front 38

PHI

Back 38

Protected Health Information

Front 39

Clearing v purging

Back 39

clearing will write a bit pattern over the disk space once; purging provides higher assurance by performing the operation multiple times

Front 40

Bitlocker

Back 40

"Microsofts disk encryption method, which uses AES on the TPM"

Front 41

Blowfish

Back 41

symmetric algo with variable key sizes between 32 and 448 bits

Front 42

Safe Harbor

Back 42

set of STANDARDS companies must comply with if they transfer data/work with EU companies

Front 43

ISMS Definition

Back 43

"a coherent set of policies, processes, and systems to manage risks to information assets. Outlined in ISO 27001"

Front 44

ISMS v enterprise security architecture

Back 44

"Enterprise Security architecture is a subset of business architecture and focuses on strategically aligning security initiatives throughout processes, systems, etc. ESA should tie in strategic alignment, business enablement, rpcoess enhancement, and security effectiveness."

Front 45

STRIDE

Back 45

"Microsoft threat categorization scheme - Spoofing, Tampering, Repudiation, Information Disclosure, DoS, Escalation of Privledge"