Book 1, Section 107

Front 1

Define IA

Back 1

Information Assurance is Information Operations that protect and defend data and Information Systems by ensuring their availability, integrity, authentication, confidentiality, and non-repudiation

Front 2

Define the following:

Certification

Back 2

The comprehensive evaluation of security features of an I.S. and other safeguards.

Front 3

Define the following:

Accreditation

DAA

Back 3

Decision to operate an I.S. in a specified environment

Designated Approving Authority

Front 4

Define the following:

System Security Plan

Back 4

Describes the Contractor’s approach to ensuring that the system meets the security standards required by the Project.

Front 5

Define the following:

System Security Authorization Agreement

Back 5

Document that represents the formal agreement between the DAA, the Certification Authority, the Program Manager, and the user representative.

Front 6

Define the following:

ATO

Back 6

Authority to Operate:

An ATO indicates a DoD IS has implemented all assigned IA controls acceptableto the DAA. May be issued for up to 3 years.

Front 7

Define the following:

IATO

Back 7

Interim Authority to Operate:

Provides a limited authorization to operate the information system under specific terms and conditions.

Front 8

Define the following:

Configuration Management

Back 8

Identifies, controls, accounts for, and audits all changes to a site or information system during its design, development, and operational lifecycle.

Front 9

Discuss security procedures involved when performing cross-domain transfers

Back 9

Conducting datatransfer across security domains must be done accurately to ensure integrity and absolute security of the source information and to prevent spillage incidents.

Front 10

Discuss risk management

Back 10

Risk management is the process that allows IT managers to balance the operational and economic costs of protective measures to achieve mission capability by protecting the IT systems.

Front 11

Define the five attributes:]

Confidentiality

Back 11

Information is not disclosed to unauthorized individual.

Front 12

Define the five attributes:

Non-repudiation

Back 12

Assurance the sender is provided with proof of delivery and the recipient is provided with proof of the sender’s identity, so neither can deny having processed the data.

Front 13

Listand define 9 categories of computer incidents:

Cat 1 to Cat 3

Back 13

Cat 1 - Root Level Intrusion (Incident

Cat 2 - User Level Intrusion (Incident)

Cat 3 - Failed Activity Attempt (Event)

Front 14

Describe the DON World Wide Web Security Policy

Back 14

All DON Web sites must have a clearly articulated purpose, approved by the commander and support the command’s mission.

Front 15

Define the following:

IAVA

Back 15

Information Assurance Vulnerability Alert (IAVA):

An announcement of a high risk vulnerability.

Front 16

Define the following:

CTO

Back 16

Communications Tasking Order (CTO): A DoD-wide instruction that disseminates mandatory changes and standing instructions on how communications are handled.

Front 17

Define the following:

NTD

Back 17

Navy Telecommunications Directive (NTD): A widely disseminated Naval Message givingan order or direction about a certain IT function that needs to be complied with.

Front 18

Define vulnerability assessment

Back 18

Vulnerability Assessment: A testing process used to evaluate the network infrastructure, software and users in order to identify known weaknesses.

Front 19

Explain to difference between vulnerability and threat

Back 19

Vulnerability: A realweakness

Threat: Potential weakness

Front 20

State the duties and responsibilities of the IAM

Back 20

Information Assurance Manager (IAM): The person, appointed in writing, who is responsible for establishing, implementing and maintaining the DoD information system IA program

Front 21

Define the five attributes:

Integrity

Back 21

Protection against unauthorized modification or destruction of information.

Front 22

Define the five attributes:

Availability

Back 22

Timely and reliable access to data and information services for authorized users.

Front 23

Define the five attributes:

Authentication

Back 23

Security measure designed to verify an individual’s authorization to receive specific categoriesof information.

Front 24

Define the following:

IAVB

Back 24

Information Assurance Vulnerability Bulletin(IAVB):

An announcement of a medium vulnerability.

Front 25

Define the following:

IAVT

Back 25

Information Assurance VulnerabilityTechnical Advisory (IAVT):

An announcement of a low risk vulnerability.

Front 26

Define the following:

Service Pack

Back 26

Collection of updates, fixes and/or enhancements.

Front 27

Listand define 9 categories of computer incidents:

Cat4 to Cat 6

Back 27

Cat 4 - Denial of Service (Incident)

Cat 5 - Non-Compliance Activity (Event)

Cat 6 - Reconnaissance (Event)

Front 28

Listand define 9 categories of computer incidents:

Cat7 to Cat 9

Back 28

Cat 7 - Malicious Logic (Event)

Cat 8 – Investigating (Event)

Cat 9 – Explained Anomaly (Event)