Hernan Cissp Domain 1

Front 1

How do you calculate residual risk?

Back 1

(Threats × vulnerability × asset value) × controls gap

Front 2

Who has the primary responsibility of determining the classification level for information?

Back 2

The owner

Front 3

Which is the most valuable technique when determining if a specific security
control should be implemented?

Back 3

Cost/benefit analysis

Front 4

Quantitative risk analysis is?

Back 4

A quantitative risk analysis assigns monetary values and percentages to the different components within the assessment.

Front 5

Qualitative risk analysis is?

Back 5

A qualitative analysis uses opinions of individuals and a rating system to gauge the severity level of different threats and the benefits of specific countermeasures.

Front 6

Why is a truly quantitative risk analysis not possible to achieve?

Back 6

Quantitative measures must be applied to qualitative elements.

Front 7

What is CobiT?

Back 7

Open standards for control objectives.
It is a Framework for a model IT Governance and Control.
Funtion on the Operation level.

Front 8

What are the four domains that make up CobiT?

Back 8

Plan and Organize, Acquire and Implement, Deliver and Support, and Monitor and Evaluate.

Front 9

What is the ISO/IEC 27799 standard?

Back 9

Provide guidance to health organizations and other holders of personal health information on how to protect such information via implementation of ISO/IEC 27002.

Front 10

What is COSO ?

Back 10

In a corporate environment prevent financial fraud.
COSO is a model for corporate governance on a strategic level. COSO deals with non-IT items

Front 11

Core Information Security Principles

Back 11

Confidentiality, Integrity and Availability

Front 12

Confidentiality

Back 12

Only authorized individuals, processes, or systems should have access to information on a need-to-know basis.

Front 13

Integrity

Back 13

Information should be protected from intentional, unauthorized, or accidental changes.

Front 14

Availability

Back 14

Information is accessible by users when needed.

Front 15

Business Continuity Planning (BCP)

Back 15

Ensures that the department can function without the computer system within a defined period using alternate processes. (Plan of how to continue bussines.

Front 16

Disaster Recovery Planning (DRP)

Back 16

Recovering Plan from an IT disaster and having the IT infrastructure back to an acceptable operational state.

Front 17

Continuity of Operations Plan (COOP)

Back 17

The plan for continuing to do business until the IT infrastructure can be restored.

Front 18

MTBF (Mean Time Between Failures)

Back 18

A time determination for how long a piece of IT infrastructure will continue to work before it fails.

Front 19

MTTR (Mean Time to Repair)

Back 19

A time determination for how long it will take to get a piece of hardware/software repaired and back on-line.

Front 20

RPO (Recovery Point Objective)

Back 20

Is the organization’s definition of acceptable data loss.

Front 21

RTO (Recovery Time Objective)

Back 21

Is the organization’s definition of the acceptable amount of time an IT system can be off-line.

Front 22

Intangible assets

Back 22

Non-physical things of value that a company owns. These assets have no set monetary value and no physical measurement. They can not be seen or touched.

Front 23

What are Tangible Assets ?

Back 23

The amount of money in your bank account is tangible, as is the property you own, like cars, houses or boats.

Front 24

What is a definite intangible asset?

Back 24

Definite assets are those that last for a particular amount of time, like contract agreements.

Front 25

What is a indefinite intangible asset?

Back 25

Indefinite assets go on for an unspecified amount of time, like a brand name that will continue on for as long as the company chooses to produce the product.

Front 26

Security Governance

Back 26

Is the preparation that will guarantees that the appropriate information security activities are being performed to ensure that the risks are appropriately reduced.

Front 27

Policies

Back 27

Establishes the glue that ensures everyone has a common set of expectations and communicates management's goals and objectives.

Front 28

Components that support the implementation of a security policy

Back 28

Procedures, standards, guidelines, and baselines.

Front 29

Standards

Back 29

Are software and harware security mechanisms selected as the organization's method of controlling security risk,

Front 30

Proceedures

Back 30

step by step instructions in support of the policies, standards, guidelines, and baselines.

Front 31

Baselines

Back 31

Provide descriptions of how to implement security packages to ensure this implemantations are consistance throughtout the organization. Are specific list of rules that will be applied to harden.

Front 32

Guidelines

Back 32

Optionals controls used to enable individuals to make judgments with respect to a security action. Also set of recommendations or best practice.

Front 33

Type of security planing

Back 33

Strategic = Long term planing, and should be review at least anually. (3 to 5 years or more).
Tatical = Mid term planing, and is the action of the strategic planing. (6 to 18 month).
Operational = Daily, weekly or short term projects.

Front 34

Security Officer

Back 34

Who directs, coordinates, plans, and organizes information security activities throughout the organization.
Who chairs the security oversight committee?

Front 35

Risk management

Back 35

A discipline for living with the possibility that future events may cause harm. The technique of assessing, minimizing and preventing accidental loss to a business, using safety measures. Reducing risks by defining and controlling threats and vulnerabilities

Front 36

What are the two types of risk assessments?

Back 36

Quantitative risk analysis and Qualitative risk analysis.

Front 37

SLE

Back 37

Single Lost Expectancy

Asset value ($) * exposure factor % = SLE

Front 38

ARO

Back 38

Annual Rate of Occurrence. How often a threat will be successful in exploiting a vulonerability over the period of a year .

Front 39

ALE

Back 39

Annualized Loss Expectancy. Product of the yearly estimate for the exploit (ARO) and the loss in value of an assets after a single exploitation.

ARO * SLE = ALE

Front 40

LAFE

Back 40

Localized Annual Frequency Estimate (adjusted for geographical distances)

Front 41

OCTAVE

Back 41

(Operationally Critical Threat, Asset, and Vulnerability Evaluation) Is a self-directed information security risk evaluation. Set of principles, attributes and outputs.

Front 42

The Total Cost of Ownership (TCO)

Back 42

Is the total cost of a mitigating safeguard. TCO combines upfront costs (often a one-time capital expense) plus annual cost of maintenance, including staff hours, vendor maintenance fees, software subscriptions, etc.

Front 43

The Return on Investment (ROI)

Back 43

Is the amount of money saved by implementing a safeguard.

Front 44

Nonrepudiation

Back 44

A user cannot deny (repudiate) having performed a transaction.

Front 45

Risk assesment methodology

Back 45

FRAP = Facilitated Risk Analysis Process
CRAMM = CCTA Risk Analysis and Management Method
Spanning Tree Analysis = Creates a tree of all possible threats to or faults of the system .
OCTAVE = self-directed information security risk valuation.

Front 46

What are the four risk management principles?

Back 46

1) Avoidance = Cutting the service.
2) Transfer = Using insurance.
3) Mitigation = reducing the risk
4) Acceptance = after monetary analysis.

Front 47

Threat

Back 47

The potential to successfully exploit a particular vulnerability.

Front 48

Separation of duties

Back 48

Tasks are broken into different phases. This limits chances for financial fraud

Front 49

Consistency in security implementation is achieved through?

Back 49

Standards and baselines

Front 50

Job rotation

Back 50

To avoid Collusion.

Front 51

Risk

Back 51

Describes the probability of a theat materializing.

Front 52

How do you calculate total risk?

Back 52

Threats * vulnerability * asset Value

Front 53

Delphi methods

Back 53

Consensus Delphi Method = Experts opinions help to identify the highest priority security issues and corresponding countermeasures.
Modified Delphi Method = is a silent form of brainstorming in which the participants develop ideas individually and silently with no group interaction.

Front 54

ISO/IEC 27799

Back 54

Standard on how to protect personal health information. It is referred to as the health informatics. Protect such information via implementation of ISO/IEC 27002.

Front 55

NIST 800-30

Back 55

Risk Management Guide for Information Technology Systems is a U.S. federal standard that is focused on IT risks.

Front 56

AS/NZS 4360

Back 56

Takes a much broader approach to risk management. This methodology can be used to understand a company's financial, capital, human safety, and business decisions risks. Although it can be used to analyze security risks, it was not created specifically for this purpose.

Front 57

Security Controls : Types

Back 57

Deterrent = Informed people they are been monitor.
Preventing = Actions been taking to prevent after the investigation.
Corrective = Making the adjustments.

Front 58

Change Controls

Back 58

Documentation detailing changes made to the system architecture and infrastructure. Detail what changes were made, when, why, and by whom, remainder of pass changes.

Front 59

The Delphi

Back 59

Qualitative technique uses each person’s honest opinion in a group
setting to get a wide range of ideas on how to address the issue. It allows people
to submit their opinions anonymously to ensure that they are not intimidated or
bullied by others who might sway them from giving their honest feelings on a
specific subject.

Front 60

Security Access controls

Back 60

Administrative, Technical, and Physical

Front 61

Administrative Control

Back 61

Administrative security controls are primarily policies and procedures put into place to define and guide employee actions in dealing with the organization’s sensitive information. Policies, Procedures, awareness, Training , Background check , Separation of duty.

Front 62

Technical

Back 62

Technical security controls (also called logical controls) are devices, processes, protocols, and other measures used to protect the C.I.A. of sensitive information.
Examples include logical access systems, encryptions systems, antivirus systems, firewalls, and intrusion detection systems. ACLs, Smart Cards, Encryptions, Token card.

Front 63

Physical Control

Back 63

Physical security controls are devices and means to control physical access to sensitive information and to protect the availability of the information. Examples
are physical access systems (fences, mantraps, guards), physical intrusion detection systems (motion detector, alarm system), and physical protection systems (sprinklers, backup generator).

Front 64

Exposure

Back 64

An exposure means that a vulnerability has been exploited by a threat. Examples are a hacker accesses a database through an open port on the firewall, an employee shares confidential information via e-mail, or a virus infects
a computer.

Front 65

Access Control

Back 65

Is method for allowing or denying access to information objects, enforced Authentication, Identification, Confidentiality, Integrity and Availability.

Front 66

Access Control Models

Back 66

Mandatory Access Control (MAC) Applied levels that classified the information assets. Hard to maintain. Discretionary Access Control (DAC) Use Access list to apply the access control policies, very popular on the industry and home jobs. Rule Base Access Control (RBAC) work access list on Fire walls apply the security policy. Role Base Access Control (RBAC) Categorize the personal base on their role in the organization.

Front 67

planning horizon

Back 67

Strategic goals or long-term goals, tactical goals or mid-term goals, operational goals or daily goals. This approach to planning is called a planning horizon.

Front 68

The data owner

Back 68

Is the one who decides upon the classification of the data.

Front 69

The data custodian

Back 69

Is the one assigned by the owner to manage and maintain the data.

Front 70

Remote journaling

Back 70

Is a technology used to transmit data to an off-site
facility, but this usually only includes moving the journal or transaction logs to
the off-site facility, not the actual files.

Front 71

Security through obscurity

Back 71

Is not implementing true security controls, but rather attempting to hide the fact that an asset is vulnerable in the hope that an attacker will not notice. Security through obscurity is an approach to try and fool a potential attacker, which is a poor way of practicing security. Vulnerabilities should be identified and fixed, not hidden.

Front 72

Disaster recovery

Back 72

Deals with the actions that need to take place right after a disaster.

Front 73

Business continuity

Back 73

Deals with the actions that need to take place to
keep operations running over a longer period of time.

Front 74

The proper steps for developing a disaster recovery plan are

Back 74

Develop the continuity planning policy statement.
. Conduct the business impact analysis (BIA).
. Identify preventive controls.
. Develop recovery strategies.
. Develop the contingency plan.
. Test the plan and conduct training and exercises.
. Maintain the plan.

Front 75

Defense in Depth

Back 75

The practice of implementing appropriate access control mechanisms is also the first line of defense ... Defense in depth is the practice of applying multiple layers of security protection between an information resource and a potential attacker.

Front 76

Identification

Back 76

User makes a claim as to his or her identity.

Front 77

Authentication

Back 77

User proves his or her identity using one or more mechanisms.

Front 78

Authorization

Back 78

System makes decisions about what resources the user is allowed to access and the manner in which they may be manipulated.

Front 79

System keeps an accurate audit trail of the users activity.

Back 79

Accounting

Front 80

Subjects

Back 80

Entities that may be assigned permissions.

Front 81

Objects

Back 81

Types of resources that subjects may access.

Front 82

Three important access control concepts.

Back 82

Subjects, objects, access permissions .

Front 83

Access control type where the Administrator determines which subjects can have access to certain objects based on an organizations security policy.

Back 83

Non-discretionary access control (NDAC) also known as role based access control (RBAC)

Front 84

Access control type where the Administrator determines which subjects can have access to certain objects based on an organizations security policy.

Back 84

Lattice based access control (LBAC) .

Front 85

Users gain different access permissions as they move from position to position in an organization but old permissions are not revoked.

Back 85

Privilege creep

Front 86

Kerberos

Back 86

Software used on a network to establish a users identity.

Front 87

Technology that enables centralized authentication.

Back 87

Single sign on (SSO)

Front 88

Three components of kerberos

Back 88

Key distribution center (KDC), Authentication service (AS), Ticket granting service (TGS)

Front 89

Four different kinds of tokens

Back 89

Four different kinds of tokens

Front 90

Three evaluation factors for biometric techniques.

Back 90

Enrollment time, throughput rate, acceptability

Front 91

The amount of time that it takes to add a new user to a biometric system.

Back 91

Enrollment time

Front 92

The number of users that may be authenticated to a biometric system per minute.

Back 92

Throughput rate

Front 93

The likelihood that users will accept the use of a biometric technique.

Back 93

Acceptability

Front 94

Six types of attack.

Back 94

Brute force, dictionary, spoofing, denial of service, man in the middle, sniffer.

Front 95

The type of attack where the attacker simply guesses passwords until eventually succeeding.

Back 95

Brute force attack

Front 96

Type of attack where the attacker uses the password encryption algorithm to encrypt a dictionary of common words and then compares the encrypted words to the password file.

Back 96

Dictionary attack

Front 97

Type of attack where an individual or system poses as a third party.

Back 97

Spoofing

Front 98

Type of attack where the system is flooded with traffic so that it cannot provide service to legitimate users.

Back 98

Denial of service (DoS)

Front 99

Type of attack where the attacker can monitor all traffic occurring on the same network segment,

Back 99

Sniffer

Front 100

An effective way to assess the security of a system.

Back 100

Penetration test

Front 101

Two types of monitored environment for IDS.

Back 101

Host based, Network based

Front 102

IDS that resides on a single system and monitors the systems even log and audit trail for signs of unusual activity.

Back 102

Host based IDS

Front 103

IDS that performs real time monitoring in a passive manner by monitoring all of the traffic on a specific network segment,

Back 103

Network based IDS

Front 104

IDS that stores characteristics of an attack and then compares activity in a monitored environment to those characteristics.

Back 104

Signature based IDS

Front 105

IDS that measures user, system, and network behavior over an extended period of time to develop baselines.

Back 105

Anomaly based IDS