Cissp Review (Fort Gordon)

Front 1

CISSP

Back 1

Certified Information Systems Security Professional

Front 2

Types of policy

Back 2

regulatory, advisory, or informative.

Front 3

Associate Job rotation with Mandatory vacations

Back 3

Also known as rotation of duties, Builds skill redundancy, Can mitigate fraud/relieve worker burnout, Implemented through mandatory vacations

Front 4

How do you calculate SLE?

Back 4

single loss expectancy = Exposure Factor (EF) X Asset Value (AV)

Front 5

annualized rate of occurrence (ARO) changes as?

Back 5

Historical records change

Front 6

Quantitative Risk Analysis (know the 6 types)

Back 6

1. Asset Valuation, 2. Threat Identification, 3. Threat Analysis, 4. Derive Overall Loss Potential, 5. Research Countermeasures, 6. Perform cost/benefit analysis

Front 7

XOR (Exclusive-OR Operation)

Back 7

if the values are the same, result is 0; if values are different, result is 1(1/1 or 0/0, the output is 0; 1/0, the output is 1)

Front 8

MD5

Back 8

512-bit blocks (class); Digest size(s) - 128 bits, Rounds - 4; 32 character output

Front 9

Types of Asymmetric Systems/Algorithms

Back 9

(think DEER) Diffie-Hellman, ElGamal, Elliptical Curve Cryptosystem (ECC), RSA **Digital Signature Algorithm is also listed in the slides**

Front 10

Online Certificate Status Protocol (OCSP)

Back 10

responds to a query with a status of Valid, Suspended, or Revoked. It’s used to query the CA as to the status of a certificate issued by that CA

Front 11

Threat Identification

Back 11

Single Loss Expectancy (SLE) = Exposure Factor (EF) * Asset Value (AV)

Front 12

Threat Analysis

Back 12

calculate likelihood of each threat taking place in a single year. Annual Rate of Occurrence (ARO)

Front 13

Derive Overall Loss Potential

Back 13

Annualized Loss Expectancy (ALE) = Single Loss Expectancy (SLE) * Annual Rate of Occurrence (ARO)

Front 14

Research Countermeasures

Back 14

calculate changes to Annualized Loss Expectancy (ALE)

Front 15

Web of Trust (aka Mesh Model)

Back 15

all parties involved trust each other equally; there is no CA to certify certificate owners. What protocol is associated with Web of Trust? Pretty Good Privacy (PGP)

Hint 15

hybrid cryptographic system; performs data encryption, digital signatures, and key distribution; provides confidentiality, authentication, integrity, compression. It’s weakness is peer-to-peer trust (not x.509)

Front 16

IGMP (proto 2)

Back 16

the “multicast control protocol”; allow one signal to be sent to multiple addresses. It’s more controlled than broadcast.

Front 17

Fiber Modes

Back 17

(2 modes) Singlemode used in carrier backbones (for long distances / difficult to work with) Multimode (used in LAN) higher attenuation (best for short distances / easy to work with)

Front 18

Frequency Hopping (FHSS)

Back 18

goes from frequency to another (rapidly changes frequencies) used by Bluetooth

Front 19

MPPE

Back 19

associate it with PPTP. MPPE is encryption for PPTP (Point-to-Point Tunneling Protocol)

Front 20

IPSEC

Back 20

basically uses tunneling and transport mode

Front 21

AH (Authentication Header)

Back 21

provides authentication and integrity; IPSEC protocol; no encryption

Front 22

SOCKS (SocketSecure)

Back 22

is a circuit-level gateway firewall; layer 5 of OSI model; port 1080

Front 23

Beacon Frame

Back 23

SSID is passed in beacon frame, even after disabling

Front 24

Primary Rate Interface (PRI)

Back 24

23 64 Kpbs B channels (carry network payload); 1 64 Kbps D channel (call setup/maintenance)

Front 25

Data Over Cable Service Interface (DOCSIS)

Back 25

is the standard for cable modems; provides 56-bit DES and 128-bitAES

Front 26

What level of system access to Java Applets have?

Back 26

if it’s unsigned, it runs in the sandbox; if it’s signed, it has access to system resources

Front 27

What are the levels of the Capability Maturity Model (CMM)

Back 27

1. Initial 2. Repeatable 3. Defined 4. Managed 5. Optimizing

Front 28

Exploratory Model

Back 28

is least (not) cost-effective; results in less-than-optimal systems

Front 29

Method

Back 29

functionality an object can carry out

Front 30

Cohesion

Back 30

degree to which an object depends on other objects / highly independent objects have high cohesion; high cohesion is easy to troubleshoot

Front 31

Coupling

Back 31

level of interaction between objects / less interaction; low coupling is easy to troubleshoot

Front 32

Polymorphism

Back 32

how different objects respond to the same command, i.e., you can give one command and two objects react differently

Front 33

Polyinstantiation

Back 33

two versions of the same object (i.e., Secret and Top Secret)

Front 34

Polymorphic Virus

Back 34

mutates by modifying its own code as it travels from system to system, while still keeping the original algorithm intact; makes pattern recognition hard

Front 35

Primary Key/Foreign Key

Back 35

Used in a relational database. Primary points to foreign; foreign keys reference primary keys

Front 36

Deadlocking

Back 36

two people try to access the same file/record (at same time) and the database locks them both out

Front 37

ACID (lock controls)

Back 37

Atomicity, Consistency, Isolation, Durability

Front 38

Two-Phase Commit

Back 38

dealing with a DB, able to apply all transactions, then it’s committed

Front 39

Asynchronous token

Back 39

uses CHAP; token device (something you have)

Front 40

Mandatory Access Control

Back 40

based on security/sensitivity labels and your clearance

Front 41

Discretionary Access Control

Back 41

based on owners discretion

Front 42

IDS in passive mode

Back 42

logs suspicious activity / generates alerts if the attack is deemed to be severe

Front 43

(IDS) True positive

Back 43

there was an attack and IDS alerted you / malicious activity identified as malicious activity

Front 44

Pre-emptive multi-tasking

Back 44

operating system controls the resource

Front 45

Cooperative multi-tasking

Back 45

application controls the resource

Front 46

Dedicated (security mode)

Back 46

security clearance for all data; approved to access all data; need-to-know for all information access

Front 47

System High (security mode)

Back 47

security clearance for all data; approved to access all data; need-to-know for some information access

Front 48

Bell La-Padula * Security Property

Back 48

no write down.

Front 49

Bell La-Padula Simple Security Property

Back 49

there is no read up

Front 50

Biba Simple Integrity Axiom

Back 50

no read down

Front 51

Biba * Integrity Axiom

Back 51

the * means no write up

Front 52

Clark Wilson

Back 52

focuses on integrity (by having subjects access objects via programs).

Front 53

Brewer and Nash

Back 53

also know as Chinese Wall/goal is to prevent conflicts of interest

Front 54

Graham Denning model (description and commands or primitive rights)

Back 54

made up of subjects, objects, and rights, dealing with 8 commands or primitive rights (create/delete object; create/delete subject; read/grant/delete/transfer access rights)

Front 55

Target of Evaluation (TOE)

Back 55

vendor’s product that they are trying to get evaluated

Front 56

Security Targets

Back 56

vendor’s claim of security…what they’re planning to implement into product (“I will provide”)

Front 57

Crime Prevention through Environmental Design (CPTED)

Back 57

outlines how the proper design of a physical environment can reduce crime by affecting human behavior. Basically, you design your site in a manner to prevent crime.

Front 58

Brownout

Back 58

prolonged low voltage

Front 59

Static electricity

Back 59

what creates static? Low humidity (below 40%)

Front 60

Different classes of fire extinguishers

Back 60

A, B, C, D, K

Front 61

Drill frequency

Back 61

when you’re doing it (annually)

Front 62

Recovery Time Objective (RTO)

Back 62

maximum allowable time you can be down (any time outside RTO is considered disaster recovery)

Front 63

Recovery Point Objective (RPO)

Back 63

point at which you want to backup/restore back to (known point)

Front 64

Maximum Tolerable Downtime

Back 64

how much time I can do without this service

Front 65

Nonessential MTD

Back 65

30 days

Front 66

Normal MTD

Back 66

7 days

Front 67

Important MTD

Back 67

72 hours

Front 68

Urgent MTD

Back 68

24 hours

Front 69

Critical MTD

Back 69

minutes to hours

Front 70

Cold sites (recovery time-frame)

Back 70

1-2 weeks

Front 71

Recovery Mgmt Team (also known as Emergency Mgmt Team)

Back 71

leads recovery operations

Front 72

Common Law (Types)

Back 72

you have criminal (protect people), civil (wrongs inflicted on people or business), and administrative (standards of conduct). It’s based on precedent.

Front 73

Patents (Duration)

Back 73

they are good for 20 years (invention must be new, useful, and not be obvious)

Front 74

Trade Secret

Back 74

lasts forever unless it becomes public knowledge / are good for as long as you can keep it a secret

Front 75

PCI DSS (Payment Card Industry Data Security Standards)

Back 75

sets security standards for credit card companies

Front 76

Safe Harbor (what location does it apply)

Back 76

if you’re doing business in Europe (protection against prosecution)

Front 77

Prudent Man Rule

Back 77

do what a reasonable/common person would do

Front 78

What are the requirements for Evidence to be admissible?

Back 78

must be relevant (fact related to crime), material (related to the case), competent (obtained legally)

Front 79

Real Evidence (or physical)

Back 79

something discovered at the crime scene

Front 80

Chain of Custody

Back 80

document that follows the evidence

Front 81

Deterrent

Back 81

anything that prevents or discourages a potential attacker

Front 82

Redundant Array of Independent Disks RAID Levels

Back 82

1 through 5 (know them!!)

Front 83

RAID 0

Back 83

Striping: highest performance/no redundancy; if 1 fail, they all fail

Front 84

RAID 1

Back 84

Mirroring: duplicates data on other disks/expensive; double cost of storage

Front 85

RAID 0 + 1

Back 85

Striping and Mirroring: highest performance/highest data protection (can tolerate multiple drive failures) ; double cost of storage

Front 86

RAID 3/4

Back 86

Striped w/ dedicated parity (3 byte/4-block): excellent performance/fault tolerance; write requests suffer from same single parity-drive

Front 87

RAID 5

Back 87

Block-level striping with distributed parity: best cost/performance for networks; high performance/high data protection; write performance is slower than RAID 0 or RAID 1

Front 88

Archive bit

Back 88

Incremental and Full (for Full, archive bit it is cleared (set to 0 after backup)

Front 89

Due Diligence

Back 89

doing your checks and risk analysis; also “active” good business practice

Front 90

Due Care

Back 90

taking care of the problem / “duty of care”/informal (“passive”)

Front 91

Locard’s Principle

Back 91

if you enter a crime scene, you brought something there and left it behind, and then take something else entirely different away with you. It is part of computer forensic investigative process (identification)

Front 92

What Covert Channel is more difficult to troubleshoot Timing or Storage?

Back 92

timing is more difficult to troubleshoot.

Front 93

Storage Covert Channels

Back 93

one process writes data to a storage location and another process directly or indirectly reads it

Front 94

Timing Covert Channels

Back 94

one process relays information to another by modulating its use of system resources

Front 95

Change Control Process

Back 95

you should be able to reverse the changes. It is typically overseen and coordinated by the Configuration (Change) Control Board (CCB)

Front 96

Depth of Field

Back 96

dealing with a camera…area in focus (Closed Circuit Television (CCTV). Good light allows for a larger depth of field (small aperture) / low light reduces depth of field (wide aperture)

Front 97

Change Management components

Back 97

three components: request control, change control, and release control. Must be authorized, tested, and recorded

Front 98

EDE2 (two key) what is the effective strength?

Back 98

112

Front 99

EDE3 (three key) what is the effective strength?

Back 99

168

Front 100

(ISC)2 Code of Ethics

Back 100

Code of Ethics Canons: Protect society, the commonwealth, and the infrastructure, Act honorably, honestly, justly, responsibly, and legally, Provide diligent and competent service to principals, Advance and protect the profession

Front 101

Maximum Tolerable Downtime

Back 101

how much time I can do without this service

Front 102

Work Recovery Time (WRT)

Back 102

time required to recover a system

Front 103

Mean Time Between Failure (MTBF)

Back 103

the time you expect a computer to fail

Front 104

Mean Time To Repair (MTTR)

Back 104

Self explanatory

Front 105

Minimum Operation Requirements (MOR)

Back 105

Self explanatory

Front 106

What Systems are moved back/restored first back at your primary site

Back 106

least critical

Front 107

Classes A Fire Extinguishers

Back 107

Ash (paper/wood/cardboard turn to Ash) - common combustible (most plastics)

Front 108

Classes B Fire Extinguishers

Back 108

Boil - liquids boil (gasoline, kerosene, grease, oil),

Front 109

Classes C Fire Extinguishers

Back 109

Current - electrical fires (electrical appliances, wiring, circuit breakers),

Front 110

Classes D Fire Extinguishers

Back 110

Drum - metal,

Front 111

Classes K Fire Extinguishers

Back 111

Kitchen Fires