I - Security Management Practice

Front 1

Four Canons of the ISC2 Code of Ethics

Back 1

1. Protect society, the commonwealth, and the infrastructure.

2. Act honorably, hosestly, justly, responsibly and legally.

3. Provide diligent and competent service to principals

4. Advance and protect the profession.

Front 2

Which canon would be breached by not reporting the witness of code violations?

Back 2

Canon IV: Advance and protect the profession.

Front 3

Main job of IS security professionals

Back 3

Evaluate risks against our critical assets and deploy safeguards to mitigate those risks.

Front 4

Two keys to talking with C-Level execs (2 acronyms)

Back 4

TCO - Total Cost of Ownership
1) Cost of the product
2) Yearly vendor charges
3) Staff costs for implementation, etc.

ROI - Return on Investment

Learning to talk effectively with executives is key to doing this job successfully.

Front 5

10 Domains of the Common Body of Knowledge (CBK)

Back 5

1) Security Management Practices.

2) Access Control Systems

3) Telecommunications and Network Security

4) Cryptography

5) Security Architecture and Models

6) Security Operations

7) Software Development Security

8) Business Continuity and Disaster Recovery

9) Law, Investigation and Ethics

10) Physical Security

Front 6

Cornerstone Information Security Concepts (The 3 Pillars)

Back 6

Confidentiality - Seeks to prevent unauthorized read access to data.

Integrity - Seeks to prevent unauthorized modification of information.

Availability - Ensures that information is available when needed.

Front 7

The opposite of the CIA Triad

Back 7

(D) Disclosure

(A) Alteration

(D) Destruction

Front 8

What does AAA stand for, and what is the missing (I) component

Back 8

1) Authentication
-Goes with Identification which is your login ID
-Authentication is your password
2) Authorization
-Those parts of the system that you are authorized to view/edit
3) Accountability
-Logging, auditing and possibly disciplining for breach of rights to info.

Front 9

Nonrepudiation

Back 9

A user cannot deny having performed a transaction. It combines authentication and integrity.

Front 10

Least Privilege

Back 10

The old "...what you need, nothing more - nothing less..."

Front 11

Defense-in-Depth

Back 11

Layered defenses. Multiple controls used to reduce risk.

Front 12

Assets

Back 12

Valuable resources that you are trying to protect

Front 13

"Mathmatical Equation" to determine Risk

Back 13

Risk=Threat x Vulnerability

Assign a number to both threat and vulnerability (5 point scale?)... Keep your scale consistent.

Front 14

Annualized Loss Expectancy (ALE)

Back 14

A calculation that allows you to determine the annual cost of a loss due to a risk.

Front 15

Exposure Factor (EF)

Back 15

The percentage of the the value an asset lost due to an incident

Front 16

Single Loss Expectancy (SLE)

Back 16

The cost of a single loss. SLE is a calculated by AV x EF.

Front 17

Annual Rate of Occurrence (ARO)

Back 17

The number of losses you suffer per year.

Front 18

Annualized Loss Expectancy (ALE)

Back 18

Your yearly cost due to risk. Calculated by SLE x ARO

Front 19

Risk Mitigation

Back 19

Lowering the risks

Front 20

Transfer the Risk

Back 20

Such as with Insurance

Front 21

Avoiding the risk

Back 21

If the project has high risks that do not appear to have a chance of mitigation, then avoidance may be the best option

Front 22

Difference between Quantitative and Qualitative Risk Analysis

Back 22

Quantitative deals with hard metrics to measure risks (Quantitative = Quantity), while Qualitative deals with subjective analysis.

ALE is a Quantitative approach while the Risk Analysis Matrix is a Qualitative approach.

Front 23

NIST's 9 Step Risk Analysis

Back 23

1) System Characterization: The scope of the systems being analyzed.
2) Threat Identification: What is the likelihood of the event.
3) Vulnerability Identification: What areas are weakest on the system.
4) Control Analysis: What is in place to aid in mitigation of risks for this risk.
5) Likelihood Determination:
6) Impact Analysis:
7) Risk Determination: Calculated by #2 (Threat) x #3 (Vulnerability)
8) Control Recommendations: Can be determined after analysis of the 7 other areas (above).
9) Results Documentation: Documentation of the Control Recommendations

Front 24

Policies (Include the 4 basic components)

Back 24

High level documents that are directives that must be followed.
1) Purpose
-The need for the policy
2) Scope
-What/who is covered by the policy
3) Responsibilities
-Who is responsible for what
4) Compliance
-How to judge how well the policies are working, and what to do if they are not followed.

Front 25

Procedures

Back 25

Step by Step guide for accomplishing a task. Very low level compared with policies.

Front 26

Standards

Back 26

Hardware and Software specific which are the benchmarks for buying new products for use in the company.

Front 27

Guidelines

Back 27

Discretionary, and do not HAVE to be followed

Front 28

Baselines

Back 28

Baselines mark the minimum level to acihieve. Such as "the baseline security for PC's is a screen saver that requires loving. You can achieve more, but you can't achieve less.

Front 29

Primary Information Security Roles (4 levels)

Back 29

Senior Management: Creates the information security program.

Data Owner (Information owner or Business Owner): Management Employee responsible for ensuring that specific data is protected.

Custodian: Responsible for hands on protection of data (such as performing backups).

User: Must follow policies and procedures to ensure that data (including their usernames/pws are kept safe).

Front 30

PII

Back 30

Personal Identifiable Information

Front 31

Due Care

Back 31

Also called the prudent man rule. Doing what a reasonable person would do.

Front 32

Due Diligence

Back 32

Following steps to ensure that due care is followed.

Front 33

Gross Negligence

Back 33

The opposite of due care.

Front 34

Best Practice

Back 34

The consensus of the best way of completing due care and due diligence

Front 35

NIST

Back 35

National Institute of Standards and Technology

Front 36

Issues with Outsourcing and Offshoring

Back 36

Outsourcing is using a third party to provide IT services, while offshoring is outsourcing overseas. This can create issues with privacy with regards to the data, since they do not necessarily have to follow regulatory mandates (such as HIPAA).

Front 37

Auditing and Control Frameworks

Back 37

You can use control frameworks to assist in Auditing which ensures that you are following the policies that you have established

Front 38

OCTAVE

Back 38

Operationally Critical Threat, Asset, and Vulnerability Evaluation.

Front 39

Three phases of OCTAVE

Back 39

1) ID's staff knowledge, assets and threats
2) ID's vulnerabilities and evaluates safeguards
3) Conducts the Risk Analysis and develops the risk mitigation strategy

Front 40

ISO 27001 and 27002 (need to do further research on these)

Back 40

.

Front 41

COBIT

Back 41

Control Objectives for Information and related Technology: Control framework for aiding best practices within an organization.

Front 42

ITIL

Back 42

Information Technology Infrastructure Library: Control framework for best practices

Front 43

DoS Attack

Back 43

Denial of Service Attack (affects Availability)

Front 44

Total value of the system you are trying to protect (name and acronym)

Back 44

Asset Value (AV)

Front 45

Amount of money you expect to lose per year for a given risk (name and acronym).

Also, how is it calculated?

Back 45

Annual Loss Expectancy (ALE)

Calculated by SLE x ARO

Front 46

What is the percentage of loss expected from a given event (name and acronym)?

Back 46

Exposure Factor (EF)

Front 47

What is the cost of an isolated event called (name and acronym)?

Back 47

Single Loss Expectancy (SLE)

Front 48

How many times per year do you expect an event to occur (name and acronym)?

Back 48

Annual Rate of Occurrence (ARO)

Front 49

What is the acronym and name of the "real cost " of an item? What goes into figuring this amount?

Back 49

Total Cost of Ownership (TCO)

1. Cost of item
2. Service agreement cost
3. Man hours to maintain