Theories

Front 1

What are the 3 different IS security policies?

Back 1

Enterprise Information Security Policy, Issue Specific Security Policy, Systems Specific Policy

Front 2

What is an Enterprise Information Security policy?

Back 2

It sets the strategic direction, scope and tone for all of security efforts in org. Executive level document drafted by CIO. Should include the responsibilities of everyone, of roles and the specified penalties and displinary actions

Front 3

What is an Issue Specific Security policy?

Back 3

Addresses specific area of technology, contains statement on orgs position to specific issue

Front 4

What is a Systems Specific Policy?

Back 4

Frequently codified as standards and procedures when configuring or maintaing systems. Fall into two groups, ACLs and configuration rules

Front 5

What must happen for a policy to remain viable?

Back 5

Constantly adapt to changing env. Must have a responsible manager, a schedule of reviews, method for making recommendations, a policy issuance and revision date and an automated policy management tool

Front 6

What must happen for a policy to be effective?

Back 6

Disseminated (distributed), read, understood and agreed upon, be applied fairly

Front 7

What is information classifications?

Back 7

Important aspect of policy, defines classification levels for example confidential and public

Front 8

What are threats to classified information?

Back 8

No clean desk policy, dumpster diving, sharing of classified documents by insecure methods

Front 9

What is the information security blueprint?

Back 9

Basis for design, selection and implementation of all security policies and training programs. Should specify how tasks are to be accomplished. Should also serve as scalable, upgradeable and comprehensive plan for InfoSec needs

Front 10

Why use Security Education?

Back 10

Everyone in an org needs to be trained and aware of InfoSec. Does not need to be a formal degree or cert

Front 11

Why use Security Training?

Back 11

Involves providing members of org with detailed information and hands-on experience. Can also be conferences or external courses

Front 12

Why use Security Awareness?

Back 12

One of least frequently implemented but most beneficial programs. Designed to keep InfoSec at forefront of users' mind

Front 13

Why use IDPS?

Back 13

Primary purpose is to identify and report and intrusion. Can quickly contain and mitigate damage. Data collected during attack can be used to diagnose and fix vulnerabilities in system

Front 14

What are the advantages of NIDPS?

Back 14

Good network design and smart placement can enable and org to monitor large network with few devices. NIDPs are passive and can be deployed with little disruption. Not usually susceptible to attack

Front 15

What are the disadvantages of NIDPS?

Back 15

Can become overwhelmed with network volume and miss attacks, require access to all traffic, cannot anaylze encrypted traffic

Front 16

What is commonly detected by network behaviour analysis systems?

Back 16

DoS, scanning, worms, policy violations

Front 17

What are the benefits of HIDPs?

Back 17

Resides on particular server and only monitors traffic for that server, can view encrypted traffic, monitors key system files and detects modifications

Front 18

What are the disadvantages of HIDPS?

Back 18

Does not detect multihost scanning, can be a large overhead on a server, vulnerable to system attacks, harder to manage

Front 19

What is signature based detection?

Back 19

Examines traffic for patterns that much known signatures, many attacks have distinct signatures, has to be continually updated

Front 20

What is anomaly based detection?

Back 20

Collects statistical summary of baseline traffic/usage. Compares current traffic to baseline. Can detect new types of attacks. Can generate many more false positives

Front 21

What are log file monitors?

Back 21

Similar to NIDPS, review log files generated by servers/network devices for patterns and signatures. Requires considerable resources

Front 22

What must be taken into consideratio when selecting a IDPS?

Back 22

Is it sufficiently scalable for org, has it been tested, do we have expertise to use, what is the support for the product

Front 23

Where are the best locations to put IDPS?

Back 23

Behind an external firewall, in the network DMZ, outside external firewall, on critical subnets, on major network backbones

Front 24

What do vendors often do to help test IDPs?

Back 24

Provide testing suites/mechanisms to verify systems and performing as expected

Front 25

What are the disadvantages to honeypots/nets and padded cells?

Back 25

Admins need high level of expertise, may provoke attacker to perform a larger attack, have not be proven to be very effective

Front 26

What are important qualities of an InfoSec candidate?

Back 26

Strong communication and writing skills, as InfoSec is usually a management problem not a technical one. Need to understand role of policy, most mainstream technologies, orgs threats, and how orgs operate

Front 27

What are some InfoSec roles?

Back 27

Chief information security officer, chief security officer, security manager, security technician

Front 28

What are common employee termination activities?

Back 28

Information disclosure agreements, audit system use and storage, changing system access, equipment inventorying, changing of locks, exit interview

Front 29

What is some advice for IS professionals?

Back 29

Always business before technology, never lose sight of goal - protection, be heard not seen, know more than you say, speak to users not at them, your education is never complete

Front 30

What is important to keep in mind when hiring?

Back 30

On site visits as part of interviews should exercise caution when showing employee around facility. Background checks should be used, references check

Front 31

What is an employment contract?

Back 31

An important security instrument that should include non disclosure and monitoring agreements

Front 32

How should a new employee be treated?

Back 32

Should receive extensive IS briefing on policies, procedures and requirements. Levels of access should be outlined and employee should receive training of secure use of IS

Front 33

What are the key infosec issues around termination?

Back 33

Protection of all information employee could access, securing keys, key cards, and other property. Perform exit interview

Front 34

What additional measures should be taken for hostile termination?

Back 34

Employee should lose access to information systems before aware. Keycards are deactivated. Employee collects belongings and then is escorted off premisis

Front 35

What additional measures should be taken for temporary employees?

Back 35

Carefully manage relationship to prevent theft, have supervisor restrict access when possible, least privilege, escorted through secure facilities

Front 36

What infosec measures should be taken with business partners?

Back 36

Non disclosure agreements, clear boundaries on what data should be exchanged and in what format

Front 37

What are internal methods to control employees?

Back 37

Two man control - two people work on similar tasks reviewing each others work, seperation of duties, job rotation, mandatory leave, garden leave, least privilege

Front 38

What is a secure facility?

Back 38

Physical location with controls implemented to minimize risk of attacks

Front 39

What are examples of phsyical security controls?

Back 39

Fences, gates, locks, guards, dogs, mantraps, cameras, alarms, computer rooms, interior doors and walls

Front 40

What are the main lock categories?

Back 40

Manual, programmable, electronic, biometric

Front 41

What is a man trap?

Back 41

Small enclosure that has entry and exit point. Only one door may open at a time. A guard authorises entry into secure area

Front 42

What are the drawbacks of electronic monitoring?

Back 42

Passive, does not prevent access. Recordings are often not monitored 24/7

Front 43

What are the different type of alarms?

Back 43

Fire, intrusion, environmental disturbance, interruption to service

Front 44

What should be taken into account for walls/doors?

Back 44

Firewall grade for secure areas, install push or crash bars on computer rooms/closets

Front 45

What should be handled by inventory management?

Back 45

Computer equipment regular inspections, classified information, physical security of equipment/sensitive data/documents

Front 46

What is the role of accountability/auditability?

Back 46

All authorised and unauthorised actions should be logged and attributed to an authenticated identity. Examples are system logs, database journals

Front 47

What are the 3 types of firewall filtering?

Back 47

Static - based on rules set by admin, dynamic - firewall that reacts to emergent event and creates new rules, stateful inspection - keep track of connection between internal and external systems

Front 48

What is a bastion host?

Back 48

A type of firewall that stands at edge of security perimeter, has two NICs one internal and one external. Often implements NAT as another layer of security

Front 49

What is a screened host firewall?

Back 49

Packet filtered router backed by fire wall. Less burden on fire wall. Requires external attack to compromise both router and firewall

Front 50

What is a screened subnet firewall?

Back 50

Connections from outside are routed through external filtering router, into DMZ. Only connections into secure network are allowed from DMZ bastion host servers. DMZ hosts are essentially proxies

Front 51

What should be taken into account when selecting firewalls?

Back 51

What firewall offers balance between protection and cost for orgs neeeds. Which features do you have to pay additional for. What is easiest to setup/configure/maintain. Is it scalable to orgs needs?

Front 52

What are firewall best practices?

Back 52

All traffic from trsuted network is allowed out. Firewall isn't accessible from public network. SMTP data are allowed. ICMP are denied. Telnet to internal servers is denied. Web servers offered outside of firewall, all other incoming HTTP is denied. All data not verifably authentic should be denied

Front 53

What 3 interacting services does kerberos consist of?

Back 53

Authentication server, Key distribution center, Kerberos ticket granting service

Front 54

What are 2 VPN modes?

Back 54

Transport mode, where only data is encrypted. Tunnel mode, entire client package is encrypted including headers

Front 55

How does kerberos grant access to a network resource?

Back 55

A client will authenticate with the authentication server && KDC and receive an auth token. This token can then be used to request a ticket by the TGS for the service, this ticket is encrypted with services private key. The client sends this ticket to the service which then authenticates it with it's own private key

Front 56

What are the 5 different risk control strategies?

Back 56

Defend - attempt to prevent exploitation of vulnerability, transfer - get insurance, mitigate - IRP DRP BCP, accept - accept costs/risk, terminate - risk isn't worth it terminate service

Front 57

What is an example of a feasability study?

Back 57

Cost benefit analysis

Front 58

What is the CBA formula?

Back 58

ALE(prior) - ALE(post) - ACS where ACS = annualized cost of safeguard

Front 59

What is benchmarking?

Back 59

An alternative approach to risk management. Process of seeking out and studying practices in other orgs that org desires to replicate

Front 60

What are the issues with benchmarking?

Back 60

No two orgs are the same. The two orgs don't communicate. Best practices are a moving target. Only looks to the past

Front 61

What is baselining?

Back 61

Analysis of measures against established standards