Info Sec Test 2

Front 1

Information Security Program

Back 1

Used to describe the structure and organization of the effort that strives to contain the risks to the information assets of the organization

Front 2

1) Functions by non technology business units

Back 2

Legal and training

Front 3

2) Functions performed by IT groups outside the InfoSec area of management

Back 3

Systems Security administration

Network security administration

Centralized authentication

Front 4

3) Functions performed within the InfoSec department as customer service

Back 4

Risk assessment

Systems testing

Incident response

Planning

Measurement

Vulnerability Assessment

Front 5

4)Functions performed with InfoSec departments as a compliance enforcement

Back 5

Policy

Compliance/audit

Risk management

Front 6

Chief Information Security Officer (CSO or CISO)

Back 6

responsible for the assessment, management, and implementation of the program that secures the organization's information.

Front 7

Security Manager

Back 7

Accountable for the day-to-day operations

Front 8

Security Administrators and Analysts

Back 8

Hybrid of a security technician and a security manager

Front 9

Security Technicians

Back 9

Qualified individuals who configure firewalls and implement security software

Front 10

Security Staffers and Watch standers

Back 10

Perform routine watch standing or administrative activities. Watch intrusion consoles, monitor e-mail accounts.

Front 11

Security Consultants

Back 11

independent expert in InfoSec, used when the decision to outsource aspects of the security program

Front 12

Security Offices and Investigators

Back 12

Physical security officers and investigators, guards

Front 13

Help Desk Personnel

Back 13

Helps identify potential problems and helps minor issues

Front 14

Security education, training, and awareness (SETA)

Back 14

responsibility of the CISO and is designed to reduce the incidence of accidental security breaches

-can improve employee behavior

- can inform members of the org about where to report violations of policy

-enable the org to hold employees accountable for their actions

Front 15

Security Training

Back 15

Seeks to train members of the org how they should react and respond when encountered with a threat. (workshops, formal training)

Front 16

Security Education

Back 16

seeks to educate members of the org as to why the org has prepared and why they react the way they do when a threat occurs. (background reading, seminars)

Front 17

Security Awareness

Back 17

Seeks to teach members of the org what security is and what should they do in some situations. (posters, media videos)

Front 18

Seven Steps for implementing training

Back 18

1) Identify Program scope, goals, and objectives

2) Identify training staff

3)Identify target audience

4) Motivate Management and employees

5)Administer the program

6)Maintain the program

7) Evaluate the program

Front 19

Training delivery method

Back 19

one-one-one - informal, personal training with a trainer

on-the-job - learn while working

Web seminars- watch a presentation on their computer

Front 20

Due Care

versus

Due Diligence

Back 20

Due care- the conduct a reasonable person would do in a particular situation

Due diligence- the process where a person gathers facts to make an informed choice on a matter

Front 21

Awareness Components

Back 21

Videos

Posters

Lectures and conferences

Front 22

Framework

Back 22

outline of a blueprint that defines policies and procedures

Front 23

Bluepritn

Back 23

sets out the model to be followed in the creation of the design and the implementation of security controls, including infosec policies, security, education and training programs.

Front 24

Security Model

Back 24

A generic blueprint offered by a service organization

Front 25

Access Control models

Back 25

regulate the admission of users into trusted ares of the organization

Front 26

Least Privilege

Back 26

members of the org can access the minimum amount of information for the minimum amount of time necessary to perform their duties

Front 27

Need-to-know

Back 27

limits a user's access to the specific information required to perform the currently assigned task

Front 28

Separation of duties

Back 28

requires the task be split up in a way that more than one individual is responsible for their completion

Front 29

Categories of Access control

Deterrent-

Back 29

discourages or deters an incipient accident

Front 30

Categories of Access control

Preventative

Back 30

helps an organization avoid an incident

Front 31

Categories of Access control

Detective

Back 31

Detects or identifies an incident or threat when it occurs

Front 32

Categories of Access control

Corrective

Back 32

remedies a circumstance or mitigates damage done during an incident

Front 33

Categories of access control

Recovery

Back 33

restores operating conditions back to normal

Front 34

Categories of access control

Compensating

Back 34

resolves shortcomings

Front 35

NIST approach to categorize controls based on operation impact on the org

Back 35

management-controls that cover security process that are designed by security planners, integrated into orgs management practices, and routinely used by security admins

Front 36

NIST approach to categorize controls based on operation impact on the org

Back 36

Operational- controls that deal with operation functions of security that have been integrated into the repeatable process

Front 37

NIST approach to categorize controls based on operation impact on the org

Back 37

Technical- controls that support the tactical portion of a security program and have been implemented into the repeatable process

Front 38

Mandatory Access Controls

Back 38

required and is structured and coordinated within a data classification scheme that rates each collection of information as well as each user. The ratings are often referred to a classification level.

Front 39

Data Classification model

Back 39

Unclassified- generally free for distribution to the public

Front 40

Data classification model-

Back 40

Sensitive but unclassified data-any information of which the loss, misuse, or unauthorized access to, or modification of, might adversely affect U.S. national interests

Front 41

Data Classification model

Back 41

Confidential data- any information or material the unauthorized disclosure of which reasonably could be expected to cause serious damage to the national security

Front 42

Data Classification model

Back 42

Secret data- any information or material the unauthorized disclosure of which reasonably could be expected to cause serious damage to the national security.

Front 43

Data classification model-

Back 43

top secret data- any information that unauthorized disclosure could be expected to cause exceptionally grave damage to the national security.

Front 44

Compartmentalization

Back 44

the restriction of information to the fewest possible people

public

for official use only

sensitive

classified

Front 45

Security Clearance

Back 45

each user of information asset is assigned an authorization level, that level identifies the level of information classification he or she can access

Front 46

Dumpster diving

Back 46

could potentially be a threat to the disposal of sensitive information when a person(s) searches through recycling bins to find information there

Front 47

Lattice-based access control

Back 47

assigns user a matrix of authorizations for particular areas of access

Front 48

Capabilities table

Back 48

the row of attributes associated with a particular user

Front 49

Non discretionary controls

Back 49

are determined by a central authority in the org and can be based on roles(role-based controls) or tasks(task-based controls)

Front 50

role-based controls

Back 50

controls are tied to the role that a particular user performs in an organization

Front 51

Task-based controls

Back 51

are tied to a particular assignment of responsibility

Front 52

Discretionary access controls

Back 52

are implemented at the discretion or option of the data user

Front 53

Content-dependent access controls

Back 53

access to a specific set of information may be dependent on its content

Front 54

Constrained user interfaces

Back 54

some systems are designed specifically to restrict what information an individual user can access

Front 55

Temporal(time-based) isolation

Back 55

access to information is limited by a time of day constraint

Front 56

Trusted computer system evaluation criteria (TCSEC)

Back 56

defines the criteria for assessing the access controls in a computer system

Front 57

Trusted computing base (TCB)

Back 57

the combination of all hardware, firmware, and software responsible for enforcing the security policy

Front 58

Reference monitor-

Back 58

the piece of the system that manages access controls, mediates all access to objects by subjects

Front 59

covert channels

Back 59

unauthorized or unlimited method of communications hidden inside a computer system

Front 60

Storage channels

Back 60

which communicate by modifying a stored object

Front 61

Timing channels

Back 61

transmit information by managing the relative timing of events

Front 62

information technology system evaluation criteria

Back 62

an international set of criteria for evaluating computer sytems

Front 63

common criteria for information technology security evaluation

Back 63

an international standard for computer security certification

Front 64

Bell-LaPadula confidentiality model

Back 64

is a model of an automated system that is able to manipulate its state or status over time

Front 65

Biba Integrity model

Back 65

based on the premise that higher levels of integrity are more worthy of trust than lower ones

Front 66

Clark-Wilson integrity model

Back 66

based on principles of change control rather than integrity levels

Front 67

Graham-Denning Access control model

Back 67

set of objects, set of subjects, a sets of rights. subjects composed of a process and a domain. The domain is the set of constraints controlling how subjects may access objects.

Front 68

Harrison-Ruzzo-Ullman model

Back 68

Defines a method to allow changes to access rights and the addition and removal of subjects and objects

Front 69

Brewer-Nash Model (Chinese Wall)

Back 69

designed to prevent a conflict of interest between to parties

Front 70

NIST security model

Back 70

available at no charge and they have been available for some time

Front 71

Benchmarking

Back 71

The paths taken by organization similar to the one whose plan you're developing

Front 72

Due care

versus

Due diligence

Back 72

Due care- the conduct a reasonable person would do in a particular situation

Due diligence- The process where a person gathers facts to make an informed choice on a matter

Front 73

Baseline

and

Baselining

Back 73

Baseline- an assessment of the performance of some action or process

Baselining- is the process of measuring against an established internal value or standard

Front 74

InfoSec performance management

Back 74

is the process of designing, implementing, and managing the use of the collected data elements to determine effectiveness of overall security program.

Front 75

Performance measurements

Back 75

are the data points or the trends computed from such measurements may indicate the effectiveness of security countermeasures or controls

Front 76

Organizations use three types of measurements

Back 76

determine the effectiveness of execution of infosec policy

determine the effectiveness and or efficiency of the delivery of infosec services

assess the impact of an incidnet

Front 77

information security metrics

Back 77

generally describe any statistical analysis technique on performance

Front 78

Certification

Back 78

a comprehensive assessment of both technical and nontechnical protection strategies for a particular system.

Front 79

Risk management

Back 79

is the process of discovering and assessing the risks to an organization's operations and determining how those risks can be controlled or mitigated

Front 80

Risk analysis

Back 80

is the identification and assessment of levels of risk in an organization

Front 81

Risk identification

Back 81

begins with the self-examination. Managers identify the organization's information, assets, classify and categorize them into useful groups, and prioritize them by their overall importance.

Front 82

Thread identification

Back 82

assessing potential weakness in each information asset

Front 83

Risk Assessment

Back 83

assigns a risk rating or score to each vulnerability

Front 84

Qualitative Risk assessment

Back 84

using categories instead of specific values to determine risk

Front 85

Residual risk

Back 85

the risk that remains even after the existing control has been applied

Front 86

program

Back 86

are activities performed within the organization to improve security (SETA)

Front 87

Questions to ask when assessing values for information assets

Back 87

which information asset is the most critical to the success of the organization

which information asset generates the most revenue

which information asset generates the highest profitability

which information asset is the most expensive to replace

which information asset is the most expensive to protect

which information asset's compromise or loss would be the most embarrassing or cause the greatest liability

Front 88

Identifying and prioritize threats and threat agents

Back 88

Which threats present a danger to this org's information assets in its current environment?

Which threats represent the gravest danger to the organizations information assets?

Front 89

TVA worksheet

Back 89

Worksheet that shows threats and assets and allows you to clearly see how expensive the threat is towards the assets

Front 90

Likelihood

Back 90

the overall rating a numerical value on a defined scaled on the probability that a specific vulnerability will be exploited

Front 91

assessing potential loss questions

Back 91

which threats present a danger to this org's current assets in its current environment?

which threats represent the gravest danger to the org's information assets?

how much would it cost to recover from a successful attack?

which threats would require the greatest expenditure to prevent?

Front 92

Access controls

Back 92

specifically address the admission of users into a trusted area of the organization

Front 93

When documenting the results of a risk assessment you need

Back 93

asset

asset impact

vulnerability

vulnerability likelihood

risk rating factor