Cissp Domain 1 - Security & Risk Mgmt (Matt)

Front 1

Sensitivity labels are used to find the level of data ___________ in the development of security models?

Back 1

classification

Front 2

What is Discretionary Access Control (DAC)

Back 2

A system that enables the owner of the resource to specify which Subjects can access it.

Front 3

_______ is management decisions, primarily pushed from higher in the organization (broader vision), wise oversight, direction & control, strategic (long term) direction.

Back 3

Governance

Front 4

What is the PCI Security Standards Council

Back 4

An open global forum for the ongoing development, enhancement, storage, dissemination and implementation of security standards for account data protection. (made the PCI-DSS credit card standard)

Front 5

Also known as the "Public Company Accounting Reform and Investor Protection Act" (in the Senate) and "Corporate and Auditing Accountability and Responsibility Act" (in the House)

Back 5

The Sarbanes–Oxley Act of 2002 commonly called Sarbanes–Oxley, Sarbox or SOX

Front 6

A _____________ is an overall general statement produced by senior management (or a selected policy board or committee) that dictates what role security plays within the organization.

Back 6

security policy

Front 7

What are the 3 types of security policies?

Back 7

- Regulatory: ensures that organization follows standards set by specific industry regulations (HIPAA, GLBA,SOX, PCI-DSS, etc.)

- Advisory: strongly advises employees as to whichtypes of behaviors and activities should and shouldn't take place in the organization

- Informative: informs employees of certain topics.It is not an enforceable policy, but rather one that teaches individualsabout specific issues relevant to the company

Front 8

Which (CIA) security function is supported by Encryption, Auditing, Hashing, and Digital Signatures?

Back 8

Integrity

Front 9

Which (CIA) security function is supported by Redundancy, Virtualization, Cloud Computing, Incident Response Plans, and Disaster Recovery?

Back 9

Availability (and reliability)

Front 10

When two (or more) physical disks are paired together in a type of RAID configuration to backup information or create multiple synchronous data sets, it is called _______.

Back 10

Disk mirroring or shadowing

Front 11

This process is by which multiple smaller disks are made to look like one large disk.

Back 11

Disk striping

Front 12

__________ clearly documents senior management's directives toward the role that security plays within the organization.

Back 12

The Security Policy

Front 13

Who determines the security classification / sensitivity and access?

Back 13

System or Data Owner

Front 14

Who administers, maintains, and protects data and backs up data sets or systems?

Back 14

Data Custodian (Responsible for Daily Operation)

Front 15

In the IT field, what is the appropriate chain-of-command?

Back 15

A top-down approach: Senior Mgmt directs Middle Management and they direct Staff.

Front 16

What is GAISP?

Back 16

Generally Accepted Information Security Principles: if security stats with a solid foundation and develops over time with understood goals and objectives, a company should not need to make drastic changes. (old standard)

Front 17

___________ means tested for current compliance.

Back 17

Certification

Front 18

This model was created by the Software Engineering Institute. It was original use to rate the quality of software developers. Helps to improve an organization's processes used to develop software and describes what is needed for a development organization to be successful.

Back 18

CMMI (Capability Maturity Model Integration (best practices))

Front 19

What common control framework has an emphasis on IT services and IT service management?

Back 19

IT Infrastructure Library (ITIL)

Front 20

Control objectives for IT Governance is known as?

Back 20

COBIT (Controls for IT regulatory compliance)

Front 21

What common control framework is the ISO/IEC Joint Standard ISM for governance management requirements?

Back 21

ISO/IEC 27001 (Governance)

Front 22

What common control framework is the ISO/IEC Joint Standard ISM for defining information security controls?

Back 22

ISO/IEC 27002 (Controls)

Front 23

What refers to your degree of legal responsibility as an intermediary defendant in a business to business tort lawsuit?

Back 23

Downstream Liability

Front 24

What is a model for corporate governance, not IT governance, and has to do with Money?

Back 24

COSO or CO$O
(Committee of Sponsoring Organizations)

Front 25

What are the 4 elements of the COBIT model?

Back 25

Organization Design/Strategy, People, Process, Technology

Front 26

What defines a minimum acceptable level of security?

Back 26

Baselines

Front 27

What are Guidelines?

Back 27

Recommended best practices to follow (not mandatory)

Front 28

What describes how long systems can be down before affecting the mission?

Back 28

MTD - Maximum Tolerable Downtime

Front 29

Who is the executive in charge of IT?

Back 29

CIO (Chief Information Officer)

Front 30

Who in an organization is focused on IT and IT Risk Management?

Back 30

CISO (Chief Information Security Officer)

Front 31

What is PCI-DSS?

Back 31

Payment Card Data Security (Payment Card Industry (PCI) Data Security Standard)

Front 32

What common control framework is the ISO/IEC Joint Standard ISM for 27001, 27002, 27003, 27004 and 27799?

Back 32

- 27001: IT Governance

- 27002: Controls

- 27003: Implementation

- 27004: Measurement

- 27799: Health (using 27002)

Front 33

What is the "Plan, Do, Check, Act (PDCA) model?

Back 33

COBIT

Front 34

What open standard of Information Security infrastructure development is a life cycle model focused on risks?

Back 34

SABSA (Sherwood Applied Business Security Architecture)

Front 35

_____________ is defined as the likelihood of occurrence of threat and the corresponding loss or negative business outcomes.

Back 35

Risk

Front 36

______________ is a process that helps in identifying the risk, rating the risks and the controls that are used for reducing the risks.

Back 36

Risk analysis and assessment

Front 37

_________________ is the process of analyzing all business functions and inter-dependencies then evaluates the effect that specific disaster scenarios may have upon them.

Back 37

Business Impact Analysis (BIA)

Front 38

_______________ is the overall systematic team approach to analyzing risk and implementing controls to minimize loss.

Back 38

Risk Management

Front 39

Define Due Diligence and Due Care

Back 39

- Due Diligence: Due diligence is the act of gathering the necessary information so the best decision-making activities can take place

- Due Care: Due care pertains to acting responsibly and “doing the right thing.”

Front 40

Culpable (wrongful) ________ is often used to prove liability

Back 40

negligence

Front 41

__________ states that a person should perform duties that prudent (sensible) people would exercise in similar circumstances to protect assets

Back 41

U.S. Prudent Person Rule (from1830)

Front 42

What Law (2002) pertains to accurate corporate accountability with regards to financial recordkeeping

Back 42

Sarbanes-Oxley (SOX)

Front 43

Regarding US Legal and regulatory compliance:

__________ pertains to banking consumer privacy and information disclosure.

Back 43

Gramm-Leach-Bliley (GLB)

Front 44

What is the HIPAA Security Rule?

Back 44

Requires reasonable and appropriate safeguards to ensure the CIA of electronic protected Health information?

(vice the privacy rule - protect PII)

Front 45

What financial privacy law mandates a set of both internal procedures and independent audits to ensure accurate financial disclosure by public companies?

Back 45

U.S. Sarbanes-Oxley Act of 2002 or SOX or $OX

Front 46

What law protects kids' data under 13 years of age?

Back 46

U.S. Children's Online Privacy Protection Act (COPPA)

Front 47

What law protects students' data?

Back 47

FERPA (Family Educational Rights and Privacy Act)

Front 48

People have a reasonable expectation of privacy, based on ________?

Back 48

4th Amendment

Front 49

Define: Event, Incident, Breach, Data Disclosure

Back 49

- Event: Something of note

- Incident: Negative impact

- Breach: Unauthorized access

- Data Disclosure: Confirmed loss of control (disclosed data/information)

Front 50

This type of law defines regulatory standards (mandatory regulations) for the performance and conduct of public bodies, including private companies and Federal Agencies.

Back 50

Administrative Laws

Front 51

This type of law deals with legal suits over wrongs against individuals or companies that result in damages or loss.

Back 51

Civil or Tort Law

Front 52

This type of law deals with crimes against society

Back 52

Criminal Law

Front 53

These laws protect products of the mind from privacy and license violations.

Back 53

Intellectual property law

Front 54

____________ Indicators help an organization define and measure progress toward organizational goals.

Back 54

Key Performance Indicators (KPI) also known as Key Success Indicators (KSI)

Front 55

Describe the differences in these crimes: computer-targeted, computer assisted, computer incidental

Back 55

Targeted: computer is the victim

Assisted: PC is the tool to conduct the crime

Incidental: a computer is used, but not attacked or attacking (such as storing illegal files)

Front 56

What are the 3 intellectual property laws?

Back 56

- Copyright: Music, movies, paintings (lifetime of author plus 70 yrs, 75 yrs for businesses)

- Trade Secrets: confidential business secrets

- Trademark: unique design or phrase (10yrs + 10 Yrs)

Front 57

Versus intellectual property (intangible), what protects tangible property?

Back 57

Patents (not intellectual property) (good for 20 yrs)

Front 58

What is the Wassenaar Arrangement regarding encryption?

Back 58

Allows for the transportation of laptops with encryption software for personal use in many (but not all) countries.

Front 59

What is "Safe Harbor" regarding international data flow?

Back 59

Permits U.S. based organizations to certify themselves as properly handling private data belonging to European Citizens?

Front 60

What is Trans-border Data Flow?

Back 60

The flow of electronic data across political boundaries, such as between states or countries.

Front 61

What are the 4 ISC2 code of ethics canons in order of importance and priority? (priority order is for conflicts of interest)

Hint: Advance, Provide, Act, Protect

Back 61

1. Protect society, the commonwealth (nation), and the infrastructure

2. Act honorably, honestly, justly, responsibly, and legally

3. Provide diligent and competent service to principals (employers)

4. Advance and protect the profession

Front 62

What is the difference between laws, ethics, and policies?

Back 62

- Laws: Rules/regulations made by gov that require/prohibit certain behavior in a society
- Ethics: defines socially accepted behavior (peers)
- Policies: rules for employees in a workplace

Law - enforced by gov, ethics/policies frowned upon, but not enforced

Front 63

What are Standards?

Back 63

compulsory rules that dictate how hardware and software are to be used and the expected behavior of employees? (Binding/mandatory)

Front 64

What is a minimum level of security that is required throughout an organization? (Binding/mandatory)

Back 64

Baseline

Front 65

What are detailed step-by-step actions to be taken to achieve a specific tasks. (Binding/mandatory)

Back 65

Procedures

Front 66

What are recommended actions and operational guides for users and staff members where standards do not apply? (non-Binding/non-mandatory)

Back 66

Guidelines

Front 67

What are the three cornerstones of ITIL (still holds true today)

Back 67

Technology, processes, and people

Front 68

NIST, OCTAVE, CRAMM, SOMAP, and VAR (Value at Risk Quantile measurement) are all ____________ models.

Back 68

Risk assessment and management models

Front 69

In NIST Risk Assessment (and other generic plans) what is the appropriate first step?

Back 69

Identify the purpose (and scope) of the assessment

Front 70

In NIST Risk Assessment (and other generic plans) what is the appropriate second step?

Back 70

Identify threats, events, and vulnerabilities

Front 71

Calculation of ALE

Asset Value (AV)

Exposure Factor (EF %)

Single Loss Expectancy (SLE)

Annualized Loss Expectancy (ALE)

Annualized Rate of Occurrence (ARO)

Bldg worth $200K EF = 50% ALE = every 5 yrs

How to calculate?

Back 71

AV = $200K, EF% = .50

SLE = $100K

ARO = 5

ALE = $20K

AV * EF = SLE SLE * ARO = ALE

Don't spend more than $20K/year in countermeasures against this risk.

Front 72

AV * EF (%) = ____
And
SLE * ARO = ____

Back 72

SLE

ALE

Front 73

What is residual risk?

Back 73

Total Risk - security controls = control gaps (or residual risk)

Front 74

What is total risk?

Back 74

any risk that exists before controls

Front 75

What is accepted risk?

Back 75

A risk the company chooses to live with without any implemented countermeasures.

Front 76

What is Threat * Vulnerability * Asset Value?

Back 76

Total Risk

Front 77

What are the RMF 6 steps? (also good for holistic view of risk management)

Moniker: "Cat Sat on It's Assets All Morning"

Back 77

1. Categorize

2. Select

3. Implement

4. Assess

5. Authorize and Certification

6. Monitor (ongoing)

Front 78

What are the RMF 7 common control categories?

DDPCDCR

Back 78

Directive (Tell - no smoking)

Deterrent (Fine if smoking)

Preventative (Take away cigarettes)

Compensatory (Smoking area)

Detective (Smoke Detector)

Corrective (Return to original baseline)

Recovery (Restoration)

Front 79

What are the 4 RMF common control types?

APLR

Back 79

- Administrative Controls (policies, procedures, audits, etc.)

- Physical Controls (protects physical facility)

- Logical/Technical Controls (digitally restrict access)

- Regulatory/Compliance Controls (mandated by law)

Front 80

The 7 common control categories and 4 common control types of RMF are mutually...

Back 80

inclusive (on both lists)

- multiple categories

- only one type

Front 81

______________ provides a structure for informed decision making about risk management.

Back 81

Threat Modeling

Front 82

What do the letters of the STRIDE Threat Modeling acronym cover?

Back 82

Threat modeling:

Spoofing

Tampering

Repudiation

Information Disclosure

Denial of Service

Elevation of Privilege

Front 83

Training is what type of control?

Back 83

Administrative

Front 84

What are the 4 COBIT Domains?

Back 84

Plan/Organize

Acquire/Implement

Deliver/Support

Monitor/Evaluate

(NOT Maintain/Certify)

Front 85

what is the difference between COSO and Sorbanes Oxley? (SOX)

Back 85

COSO is a governing framework

SOX is a law that requires compliance with COSO framework and holds executives legally accountable.

Front 86

What is the Delphi Technique?

Back 86

A group decision method where each group member can communicate anonymously.

Front 87

What is risk avoidance?

Back 87

Change an activity that is causing risk.