Information Assurance Key Terms 2

Front 1

*Audit

Back 1

It assures the integrity of the security solution

Front 2

Audit Conclusion

Back 2

When the audit report is reviewed with auditee’s upper management prior to release

Front 3

Audit Criteria

Back 3

A set of predefined controls to be audited

Front 4

Audit Documentation

Back 4

Audit activities at each stage are documented

Front 5

Audit Reporting

Back 5

Audit manager assumes the responsibility for audit reporting

Front 6

Auditee

Back 6

The organization being audited

Front 7

Checklist

Back 7

Checklist for performing the audit against different factors

Front 8

Client Organization

Back 8

Organization that mandates the audit

Front 9

*Compliance

Back 9

Meeting the standards

Front 10

*Confidentiality

Back 10

Keeping practices and procedures between the company and client private (not the same thing as the information security property in subsequent chapters)

Front 11

Contracts

Back 11

Agreements between the company and customer

Front 12

*Control Objective

Back 12

These are focused behaviors with observable outcomes

Front 13

*Corrective Action

Back 13

Documented action against perceived risk/threat

Front 14

*Cost Benefit

Back 14

Analyses the pros and cons of an action

Front 15

*Countermeasures

Back 15

They are steps that will be taken to mitigate a given risk

Front 16

*Estimate of the Consequences

Back 16

Harm caused against a threat

Front 17

Evidence

Back 17

Obtained by conducting interviews

Front 18

Event Logs

Back 18

Audit records are kept in event logs that are automatically maintained by the system

Front 19

*Follow-up

Back 19

A follow-up is another audit to confirm compliance

Front 20

**Gaps

Back 20

They are identified risks between ideal practice and the current operation

Front 21

Impartiality

Back 21

Objective, non-biased opinion

Front 22

Internal Audit

Back 22

The organization performs the audit within their own organization with their own people

Front 23

Interviews

Back 23

They are conducted to gather evidence

Front 24

*Latent Threat

Back 24

A possible threat that only becomes active at a later time if one of the conditions changes

Front 25

Laws and Regulations

Back 25

These are the structure with which a company must be in compliance

Front 26

Lead Auditor

Back 26

The person who has the sole authority for the auditing process

Front 27

**Likelihood

Back 27

The certainty of risk

Front 28

Noncompliances

Back 28

Areas where a plan is not fulfilling a law or regulation

Front 29

Nonconformances

Back 29

It is another term for noncompliances

Front 30

Operational Security Analysis

Back 30

It leads to the deployment of a concrete security solution

Front 31

*Preventative Measures

Back 31

The strategy to reduce the likelihood of a risk occurrence

Front 32

*Process Entropy

Back 32

It is the natural tendency for any organized system to degrade over time due to the changing conditions

Front 33

*Probability of Occurrence

Back 33

A percentage indicating the likelihood of occurrence

Front 34

Proof of Compliance

Back 34

It is the audit evidence document

Front 35

Quantitative Factors

Back 35

Numerically measurable risk factors

Front 36

*Reactive Measures

Back 36

The strategy to respond effectively if a risk becomes a direct threat

Front 37

***Risk

Back 37

It is a possibility of a threat

Front 38

**Risk Analysis

Back 38

The process by which the risk is understood

Front 39

Risk Analysis Report

Back 39

It is an operational response by identifying those threats that have to be managed

Front 40

***Risk Assessment

Back 40

It is an operational process by which risks are identified and characterized

Front 41

***Risk Estimation

Back 41

Determines the probability and impact of threats

Front 42

*Risk Evaluation

Back 42

It is a function that is used to decide about the nature of emerging threats

Front 43

Risk Identification

Back 43

Documenting the characteristics of vulnerabilities

Front 44

**Risk Management

Back 44

It ensures effective and up-to-date alignment between identified threats and the countermeasures deployed to mitigate them

Front 45

***Risk Mitigation

Back 45

It determines how the risk will be handled

Front 46

Risk Mitigation Report

Back 46

It is the mechanism for communicating information about how risk is handled

Front 47

*Risk Tolerance

Back 47

It is the minimum level of protection that management can reasonably afford in its day-to-day operations

Front 48

*Risk Transfer

Back 48

It specifies how any foreseen impact can be reallocated so that the loss is not permanent or catastrophic

Front 49

*Scope of the Assessment

Back 49

It should include the entire set of organizational and technical issues

Front 50

*Standards

Back 50

Gap analysis must be based on universal standards such as ISO 27000, NIST, GASSP or COBIT

Front 51

Third Party Work

Back 51

Risk management plan must include work performed by entities outside the organization

Front 52

***Threat

Back 52

A way of exploiting known weakness in an organization

Front 53

Threat Picture

Back 53

It is a comprehensive understanding of all threats

Front 54

***Vulnerability

Back 54

Perceived weakness in an organization can be exploited

Front 55

**Weakness

Back 55

A part of a system that can be exploited