Cissp Domain 1: Security And Risk Management

Front 4

Administrative Controls

Back 4

Procedures implemented to define the roles, responsibilities, policies, and administrative functions needed to manage the control environment.

Front 5

Annualized Rate of Occurrence (AR)

Back 5

An estimate of how often a threat will be successful in exploiting a vulnerability over the period of a year.

Front 6

Arms Export Control Act of 1976

Back 6

Authorizes the President to designate those items that shall be considered as defense articles and defense services and control their import and the export.

Front 7

Availability

Back 7

The principle that ensures that information is available and accessible to users when needed.

Front 8

Breach

Back 8

An incident that results in the disclosure of potential exposure of data.

Front 9

Compensating Controls

Back 9

Controls that substitute for the loss of primary controls and mitigate risk down to an acceptable level.

Front 10

Compliance

Back 10

Actions that ensure behavior that complies with established rules.

Front 11

Confidentiality

Back 11

Supports the principle of lease privilege by providing that only authorized individuals, processes, or systems should have access to information on a need to know basis.

Front 12

Copyright

Back 12

Covers the expression of ideas rather than the ideas themselves; it usually protects artistic property such as writing, recordings, databases, and computer programs.

Front 13

Corrective Controls

Back 13

Controls implemented to remedy circumstance, mitigate damage, or restore controls.

Front 14

Data Disclosure

Back 14

A breach for which it was confirmed that data was actually disclosed (not just exposed) to an unauthorized party.

Front 15

Detective Controls

Back 15

Controls designed to signal a warning when a security control has been breached.

Front 16

Deterrent Controls

Back 16

Controls designed to discourage people from violating security directives.

Front 17

Directive Controls

Back 17

Controls designed to specify acceptable rules of behavior within an organization.

Front 18

Due Care

Back 18

The care a reasonable person would exercise under given circumstances.

Front 19

Due Diligence

Back 19

Is similar to due care with the exception that it is a preemptive measure made to avoid harm to other persons or their property.

Front 20

Enterprise Risk Management

Back 20

A process designed to identify potential events that may affect the entity, manage risk so it is with its risk appetite, and provide reasonable assurance regarding the achievement of entity objectives.

Front 21

Export Administration Act of 1979

Back 21

Authorized the President to regulate exports of civilians goods and technologies that have military applications.

Front 22

Governance

Back 22

Ensures the business focuses on core activities, clarifies who in the organization has the authority to make decisions, determines accountability for actions and responsibility for outcomes, and addresses how expected performance will be evaluated.

Front 23

Incident

Back 23

A security event that compromises the confidentiality, integrity, or availability of an information asset.

Front 24

Integrity

Back 24

Comes in two forms: making sure that information is processed correctly and not modified by unauthorized persons, and protecting information as it transits a network.

Front 25

Information Security Officer

Back 25

Accountable for ensuring the protection of all of the business information assets from intentional and unintentional loss, disclosure, alteration, destruction, and unavailability.

Front 26

Least Privilege

Back 26

Granting users only the accesses that are required to perform their job functions.

Front 27

Logical (Technical) Controls

Back 27

Electronic hardware and software solutions implemented to control access to information and information networks.

Front 28

Patent

Back 28

Protects novel, useful, and nonobvious inventions.

Front 29

Physical Controls

Back 29

Controls to protect the organization’s people and physical environment, such as locks, fire management, gates, and guards; physical controls may be called “operational controls” in some contexts.

Front 30

Preventive Controls

Back 30

Controls implemented to prevent a security incident or information breach.

Front 31

Recovery Controls

Back 31

Controls implemented to restore conditions to normal after a security incident.

Front 32

Recovery Time Objective

Back 32

How quickly you need to have that application’s information available after downtime has occurred.

Front 33

Recovery Point Objective

Back 33

The point in time to which data must be restored in order to successfully resume processing.

Front 34

Risk

Back 34

A combination of the probability of an event and its consequence and an expectation of loss expressed as a probability that a particular threat will exploit a particular vulnerability with a particular harmful result.

Front 35

Risk Acceptance

Back 35

The Practice of accepting certain risks, typically based on a business decision that may also weigh the cost versus the benefit of dealing with the risk in another way.

Front 36

Risk Avoidance

Back 36

The practice of coming up with alternatives so that the risk in question is not realized.

Front 37

Risk Mitigation

Back 37

The practice of elimination of or the signification decrease in the level of risk presented.

Front 38

Risk Transfer

Back 38

The practice of passing on the risk in question to another entity, such as an insurance company.

Front 39

Risk Management

Back 39

A systematic process for identifying, analyzing, evaluation, remedying, and monitoring the risk.

Front 40

Single Loss Expectancy

Back 40

The difference between the original value and the remaining value of an asset after a single exploit.

Front 41

Single Point of Failure

Back 41

Any single input to a process that, if missing, would cause the process or several processes to be unable to function.

Front 42

Trademark

Back 42

Any word, name, symbol, color, sound, product shape, device, or combination of these that is used to identify goods and distinguish them from those made or sold by others.

Front 43

Trade Secret

Back 43

Proprietary business or technical information, processes, designs, practices, ets., that are confidential and critical to the business.

Front 44

Vulnerability Assessment

Back 44

Determines the potential impact of disruptive events on the organization’s business processes.

Front 45

Wassenaar Arrangement

Back 45

Established to contribute to regional and international security and stability by promoting transparency and greater responsibility in transfers of conventional arms and dual-use goods and technologies, thus preventing destabilizing accumulations.