Iss Test 1

Front 1

A security methodology:
Security from a grass-roots effort - systems administrators attempt to improve the security of their system.
LACKS: Participant support, organizational staying power

Back 1

Bottom Up Approach

Front 2

A security methodology:
Initiated by upper management: policys and procedures, dictate goals and expected outcomes, and determine accountability.

Back 2

Top-down Approach

Front 3

SecSDLC Driver:
as a result of a carefully developed implementation strategy

Back 3

Plan-driven

Front 4

SecSDLC Driver:
started in response to some occurrence

Back 4

Event-driven

Front 5

SDLC Step:
The objectives, constraints, and scope of the project are specified
A preliminary cost/benefit analysis is developed
A feasibility analysis is performed to assesses the economic, technical, and behavioral, feasibilities of the process

Back 5

Investigation

Front 6

SDLC Step:
Consists primarily of:
-Assessments of the organization
-the status of current systems
-capability to support the proposed systems

Back 6

Analysis

Front 7

SDLC Step:
Based on business need, applications are selected capable of providing needed services
Based on applications needed, data support and structures capable of providing the needed inputs are identified
Finally, based on all of the above, select specific ways to implement the physical solution are chosen

Back 7

Logical Design

Front 8

SDLC Step:
Specific technologies are selected to support the alternatives identified and evaluated in the logical design
selected components are evaluated based on a make-or-b uy decision
entire solution is presented to the end-user representatives for approval

Back 8

Physical Design

Front 9

SDLC Step:
Components are ordered, received, assembled, and tested
users are trained and documentation created
users are then presented with the system for a performance review and acceptance test

Back 9

Implementation

Front 10

SDLC Step:
Tasks necessary to support and modify the system for the remainder of its useful life
The life cycle continues until the process begins again from the investigation phase
When the current system can no longer support the mission of the organization, a new project is implemented

Back 10

Maintenance and Change

Front 11

the senior technology officer
primaryily responsible for advising the senior executive(s) for strategic planning

Back 11

Chief Information Officer

Front 12

Responsible for the assessment, management, and implementation of securing the information int he organization
May also be referred to as the manager for security, the security administrator, or a similar title

Back 12

Chief Information Security OFfficer

Front 13

When a computer is used to conduct an attack. It is the ______ of an attack.

Back 13

Subject

Front 14

When a computer is the target of an attack. It is the ________ of an attack.

Back 14

Object

Front 15

A Normal Flow

Back 15

What kind of information flow is this?

Front 16

An Interruption

Back 16

What kind of information flow is this?

Front 17

Modification

Back 17

What kind of information flow is this?

Front 18

Interception

Back 18

What kind of information flow is this?

Front 19

Fabrication

Back 19

What kind of information flow is this?

Front 20

Created to address the systematic and structural weaknesses affecting... capital markets which were revealed by repeating failures of audit effectiveness and corporate financial and broker-dealer responsibility in recent months and years.

Back 20

Sarbanes-Oxley Act of 2002

Front 21

What is the PCAOB

Back 21

Public Company Accounting Oversight Board. Created by SOX.

Front 22

-Control Environment
-Risk Assessment
-Information and Communication
-Control Activities
-Monitoring

Back 22

Components of Internal Conrtol

Front 23

-Recording
-Custody
-Authorization

Back 23

Segregation of Duties

Front 24

Internal Control
-Achieve performance and -profitability targets
-prevent loss of resources
-ensure reliable financial reporting
-avoid damage to reputation and other consequences

Back 24

What internal control can do

Front 25

The framework that provides a tool for the business process owner that facilitates the discharge of their responsibilities.

Back 25

COBIT Framework

Front 26

SysTrust Principal:
The system is avaliable for operation and use at times set forth in service agreements

Back 26

Availability

Front 27

SysTrust Principal:
The system is protected against unauthorized physical and logical access

Back 27

Secuirty

Front 28

SysTrust Principal:
System processing is complete, accurate, timely and in accordance with the entity's transaction approval and output distribution policy

Back 28

Integrity

Front 29

SysTrust Principal:
System can be updated in a manner that provides continuous availability, security and integrity

Back 29

Maintainability

Front 30

Risk management Community Role:
That best understands the threats and attacks that introduce risk into the organization.

Back 30

Information Security

Front 31

Risk management Community Role:
play a part in the early detection and response process - they also insure sufficient resources are allocated

Back 31

Management and users

Front 32

Risk management Community Role:
must assist in building secure systems and operating them safely

Back 32

Information Technology

Front 33

the internal control weakness (Qualitative)
or A potential attack any of the assets that are protected.

Back 33

Threat

Front 34

Specific avenues that threat agents can exploit to attack an information asset.

Back 34

Vulnerability

Front 35

assigning a rating or score to each specific information asset.

Back 35

Risk Assessment

Front 36

financial lost expected due to internal control weakness (Financial)

Back 36

Exposure

Front 37

probability of internal control weakness materializing (Statistical)

Back 37

Risk

Front 38

Percentage of time in SDLC spent on everything except maintenance

Back 38

5-10%

Front 39

Access Control Type:
Implemented at the discretion or option of the data user.

Back 39

Discretionarya Access Conrols

Front 40

Access Control Type:
Structured and coordinated with a data classification scheme, and required

Back 40

Mandatory Access Controls

Front 41

Access Control Type:
Those determined by a central authroity in the organization and can be based on that individual's role (Role-Based Controls) or a specified set of duties or tasks the individual is assigned (Task-Based Controls) or can be based on specified lists maintained on subjects or objects

Back 41

Nondiscretionary Controls

Front 42

apply safeguards

Back 42

avoidance

Front 43

Transfer the risk

Back 43

transference

Front 44

Reduce the impact

Back 44

mitigation

Front 45

Inform themselves of all of the consequences and accept the risk without control or mitigation

Back 45

acceptance

Front 46

__________ controls stop attempts to exploit vulnerability by implementing enforcement of an organizational policy or a security principle, such as authentication or confidentiality

Back 46

Preventive

Front 47

___________ controls warn of violations of security principles, organizational policies, or attempts to exploit vulnerabilities

Back 47

Detective

Front 48

___________ controls use techniques such as audit trails, intrusion detection, or configuration monitoring

Back 48

Detective

Front 49

examines how well the proposed information security alternatives will contribute to the efficiency, effectiveness, and overall operation of an organization

Back 49

Organizational Feasibility

Front 50

Addresses user acceptance and support, management acceptance and support, and the overall requirements of the organization’s stakeholders

Back 50

Operational Feasibility

Front 51

Examines whether or not the organization has or can acquire the technology necessary to implement and support the control alternatives

Back 51

Technical Feasibility

Front 52

what can and cannot occur based on the consensus and relationships between the communities of interest

Back 52

Political Feasibility

Front 53

The analysis of measures against established standards

Back 53

Baselining

Front 54

When we have controlled any given vulnerability as much as we can, there is often risk that has not been completely removed or has not been completely shifted or planned for

Back 54

Residual Risk

Front 55

A plan or course of action intended to influence and determine decisions, actions and other matters.

Back 55

Policy

Front 56

Sets the strategic direction, scope, and tone for all security efforts within the organization

Back 56

Security Program Policy

Front 57

-addresses specific areas of technology
-requires frequent updates
-contains an issue statement on the organization’s position on an issue

Back 57

Issue-Specific Security Policy(ISSP)

Front 58

Formalized as written documents, distributed to users, and agreed to in writing, ______ are frequently codified as standards and procedures used when configuring or maintaining systems

Back 58

Systems-Specific Policy(SysSP)

Front 59

-Who can use the system
-What authorized users can access
-When authorized users can access the system
-Where authorized users can access the system from
-How authorized users can access the system

Back 59

ACL Policies

Front 60

Policy that stipulates at the end of the business day, all classified information must be properly stored and secured

Back 60

clean desk policy

Front 61

the basic skeletal structure within which additional detailed planning of the blueprint can be placed as it is developed of refined

Back 61

framework

Front 62

The people must become a layer of security, a ____________ that protects the information from unauthorized access and use

Back 62

Human firewall

Front 63

Continuity Strategies:
focuses on immediate response; if attack escalates or is disastrous, process changes to disaster recovery

Back 63

Incident response plans (IRPs)

Front 64

Continuity Strategies:
typically focuses on restoring systems after disasters occur

Back 64

Disaster recovery plans (DRPs)

Front 65

Continuity Strategies:
when damage is major or long term, requiring more than simple restoration of information and information resources

Back 65

Business continuity plans (BCPs)

Front 66

high-level manager to support, promote, and endorse findings of project

Back 66

Champion

Front 67

leads project and makes sure sound project planning process is used, a complete and useful project plan is developed, and project resources are prudently managed

Back 67

Project manager

Front 68

should be managers or their representatives from various communities of interest: business, IT, and information security

Back 68

Team Members

Front 69

-Most common occurrence is complaint about technology support, often delivered to help desk
-Careful training needed to quickly identify and classify an incident
-Once attack is properly identified, organization can respond

Back 69

Incident Detection

Front 70

-Consists of actions that guide organization to stop incident, mitigate impact of incident, and provide information for recovery from incident

Back 70

Incident Reaction

Front 71

-Once incident has been contained, and control of systems regained
-First task is to identify human resources needed and launch them into action
-Full extent of the damage must be assessed
-Organization repairs vulnerabilities, addresses any shortcomings in safeguards, and restores data and services of the systems

Back 71

Incident Recovery

Front 72

Several sources of information on ______, including system logs; intrusion detection logs; configuration logs and documents; documentation from incident response; and results of detailed assessment of systems and data storage

Back 72

Damage Assessment

Front 73

-Once extent of damage determined, _______ process can begin
-Process involves much more than simple restoration of stolen, damaged, or destroyed data files

Back 73

Recovery

Front 74

-New systems can respond to incident threat autonomously

Back 74

Automated Response

Front 75

Positive identification of person/system seeking access to secured information/services (Username and Password)

Back 75

Authentication

Front 76

Predetermined level of access to resources (Access Level)

Back 76

Authorization

Front 77

Logging use of each asset (System logs)

Back 77

Accounting

Front 78

Unique alphanumeric identifier used to identify an individual when logging onto a computer/network

Back 78

Username

Front 79

Secret combination of keystrokes that, when combined with a username, authenticates a user to a computer/network

Back 79

Password

Front 80

Small, fixed-length numerical value

Back 80

Checksum

Front 81

-a (network) authentication protocol, NOT an authorization protocol.
-It is designed to provide strong authentication for client/server applications by using secret-key cryptography.

Back 81

Kerberos

Front 82

Secret key used during logon session between client and a service

Back 82

Session key

Front 83

Device (eg, PPP network server) that requires authentication from a peer and specifies authentication protocol used in the configure request during link establishment phase

Back 83

Authenticator

Front 84

Set of electronic information used to authenticate identity of a principal to a service

Back 84

Ticket

Front 85

Allows principal to authenticate itself to gain access to services in a distant part of a Kerberos system

Back 85

Cross-realm authentication

Front 86

-Point-to-Point Protocol (PPP) mechanism used by an authenticator to authenticate a peer
-Uses an encrypted challenge-and-response sequence

Back 86

Challenge Handshake Authentication Protocol (CHAP)

Front 87

Piece of data that claims that a specific, named individual wrote or agreed to the contents of an electronic document to which the signature is attached

Back 87

Digital signature

Front 88

Converts plain text message into secret message

Back 88

Encryption

Front 89

Converts secret message into plain text message

Back 89

Decryption

Front 90

Uses only one key

Back 90

Symmetric cipher

Front 91

Uses a key pair (private key and public key)

Back 91

Asymmetric cipher

Front 92

Trusted, third-party entity that verifies the actual identity of an organization/individual before providing a digital certificate

Back 92

Certificate authority (CA)

Front 93

Practice of using a trusted, third-party entity to verify the authenticity of a party who sends a message

Back 93

Nonrepudiation

Front 94

-Authentication devices assigned to specific user
-Small, credit card-sized physical devices
-Incorporate two-factor authentication methods
-Utilize base keys that are much stronger than short, simple passwords a person can remember

Back 94

Security Tokens

Front 95

Types of Security Tokens:
-Act as a storage device for the base key
-Do not emit, or otherwise share, base tokens

Back 95

Passive

Front 96

Types of Security Tokens:
-Actively create another form of a base key or encrypted form of a base key that is not subject to attack by sniffing and replay
-Can provide variable outputs in various circumstances

Back 96

Active

Front 97

-Uses measurements of physical or behavioral characteristics of an individual
-Generally considered most accurate of all authentication methods
-Traditionally used in highly secure areas
Expensive

Back 97

Biometric authentication

Front 98

Error Rates:
-What percent of the time will an authorized person be rejected by the system?
-Occurrence of an authorized person not being authenticated by a biometric authentication process when they are who they claim to be

Back 98

FRR (False Rejection Rate) Type 1 error rate / False Negatives

Front 99

Error Rates:
-What percent of the time will an unauthorized person be accepted by the system?
-Occurrence of an unauthorized person being authenticated by a biometric authentication process

Back 99

FAR (False Acceptance Rate) Type 2 error rate / False Positives

Front 100

Error Rates:
Point at which FRR and FAR cross over.

Back 100

Equal Error Rate (ERR)

Front 101

Biometric Technologies:
Looks at the details of how we sign our name, the loops in letters and angles in them.

Back 101

Dynamic Signature Verification

Front 102

Biometric Technologies:
Checks for a unique typing pattern.

Back 102

Keystroke dynamics

Front 103

Combination of password, tokens, bio (multiple of these)

Back 103

Multi-factor authentication

Front 104

This merges biometrics with the art of cryptography.

Back 104

Biometric Encryption

Front 105

a process effected by an entity's board of directors, management, and other personnel, designed to provide reasonable assurance.

Back 105

Internal Control

Front 106

True of False:
Risk "control" is the process of examining and documenting the security posture of and organization's information technology and the risks it faces.

Back 106

False
Identification

Front 107

True of False:
Each of the threats must be examined to assess its potential to endanger the organization and explore ways to reduce the risk it poses. This examination is know as a threat "profile".

Back 107

False
assessment

Front 108

True of False:
"Likelihood" risk is the risk that remains to the information asset even after the existing control has been applied.

Back 108

False
Residual

Front 109

True of False:
"Major" risk is a combined function of (1) threat less the effect of threat-reducing safeguards, (2) a vulnerability less the effect of vulnerability reducing safeguards, and (3) an asset less the effect of asset value reducing safeguards.

Back 109

False
Residual

Front 110

True of False:
The "standard" should begin with a clear statement of purpose.

Back 110

False
Policy

Front 111

True of False:
"Systems" specific security policies are formalized as written documents to be distributed to users and agreed to in writing.

Back 111

True

Front 112

True of False:
"VISA" promotes a series of security modules with links to practices and implementation that represents a security methodology.

Back 112

False
CERT

Front 113

True of False:
One of the basic tenets of security architectures is the implementation of security in layers. This layered approach is called defense in "layers"

Back 113

False
depth

Front 114

True of False:
A(n) "IRP) ensures that critical business functions continue, if a catastrophic incident or disaster occurs by establishing operations at an alternative site.

Back 114

False
BCP

Front 115

True of False:
The false "detect" rate is the percentage or or value associated with the rate at which supplicants who are not legitimate users are allowed access to systems or areas as a result of a failure in the biometric device.

Back 115

False
Accept

Front 116

Information has ________ when it is whole, complete, and uncorrupted.

Back 116

integrity

Front 117

Weaknesses or faults in a system or protection mechanism that expose information to attack or damage are known as ___________.

Back 117

Vulnerabilities

Front 118

A(n) _________ is an object, person, or other entity that represents a constant danger to an asset.

Back 118

Threat

Front 119

A(n) _________ is an act or action that takes advantage of a vulnerability to compromise a controlled system.

Back 119

Attack

Front 120

A(n) __________ is a private word or combination of characters that only the user should know.

Back 120

Password

Front 121

_______ security addresses the issues necessary to protect the tangible items, objects, or areas of an organization from unauthorized access and misuse.

Back 121

Physical

Front 122

_______ of information is the quality or state of being genuine or orignial.

Back 122

Authenticity

Front 123

An Information System is the entire set of _________, people, procedures, and networks necessary to use information as a resource in the organization.

Back 123

Software, Hardware, Data

Front 124

The most successful kind of top-down approach involves a formal development strategy referred to as a(n)_______.

Back 124

Systems Development Life cycle

Front 125

In the ______ phase of the systems development life cycle, solutions are evaluated, selected and acquired through make-or-buy process.

Back 125

Implementation.

Front 126

-Protects the organiztion's ability to function
-Enables the safe operation of applications implemented on the organization's IT systems
-Protects the data the organization collects and uses

Back 126

The functions performed by Information security

Front 127

The formal processed used in decision making regarding the adoption of specific controls is called a(n) ______.

Back 127

Cost Benefit Analysis (CBA)

Front 128

_________ Feasability addresses the user acceptance and support, managment acceptance and suppor and the overall requirements of the organization's stakeholders.

Back 128

Operation

Front 129

A buffer against the outside attacks is frequently referred to as a(n) ______.

Back 129

Firewall

Front 130

What is the most secure Biometric authentication system?

Back 130

Retina Pattern Recognition

Front 131

Steps of SecDLC

Back 131

Investigate
Analyze
Design
Implement
Maintinece

Front 132

Steps of SDLC.

Back 132

Investigate
Analyze
Design (logical)
Design (Physical)
Implement
Maintinence