Cissp - Security Architecture And Design

Front 1

What was the first mechanism developed by NCSC to evaluate IT computers, OSs, etc.?

Back 1

TCSEC

Trusted Computer System Evaluation Criteria

Front 2

What security model is the TCSEC based upon?

Back 2

Bell-Lapadula

Front 3

Name the four levels of system classification define in TCSEC from highest to lowest?

Back 3

A. Verified
B.Mandatory
C. Discretionary
D. Minimal security

Front 4

What are the 4 main criteria topics that TCSEC addresses?

Back 4

security policy
accountabilty
assurance
documentation

Front 5

What was the mechanism developed by European countries to Evaluate IT Systems?

Back 5

ITSEC

Front 6

What two attributes are evaluated by ITSEC?

Back 6

functionality (can perform at least one time)

assurance (will perform consistently)

Front 7

What was design after TCSEC and ITSEC to address concerns of both methods.

Back 7

Common Criteria developed by the IOS.

Front 8

What model uses Evaluation Assurance Levels for evaluating IT systems?

Back 8

Common Criteria
There are 7 test levels of functionality and assurance

Front 9

Products successfully test by the Trusted Products Evaulation Program are added to what list?

Back 9

Evaluated Products List

Front 10

The BS 7799 later evolved into what ISO standard for measuring risk.

Back 10

ISO 17799 and then later to ISO 27005

Front 11

What is the certification process developed by NIST that can be used by the government and civilian?

Back 11

NIST SP 800-37

Front 12

What is certification?

Back 12

A comprehensive evaluation of security components and their compliance for the purpose of accreditation

Front 13

What is accreditation?

Back 13

Formal accptance of the adequacy of a system's overall security and functionality be management

Front 14

What is Strategic alignment?

Back 14

Business drivers and the regulatory and legal requirements are being met by the security architecture

Front 15

What are the concerns in designing an Enterprise Security Architecture

Back 15

business enablement
process enhancement
security effectiveness

Front 16

Who is responsible for asset inventory, discovery, monitoring, responding, administration

Back 16

Operation Management

Front 17

Who is responsible for Configuration management, installation, maintenance of indvidual products

Back 17

Component Management

Front 18

What Rainbow Series deals with password management guidelines?

Back 18

Green Book

Front 19

What Rainbow Series deals with Database Management Systems

Back 19

Lavander

Front 20

What Rainbow Series deals with Auditing?

Back 20

Tan

Front 21

What is the distinguishing characteristic of Dedicated Security Mode?

Back 21

All user must have a need to know and a
need access to all data

Front 22

What are distinguishing characteristics of System High-Security Mode

Back 22

All user must have a need know some of the information

Front 23

What are distinguishing characteristics of Compartmented Security Mode

Back 23

Formal approval to access some of the information

Front 24

What are distinguishing characteristics of Multilevel Security Mode?

Back 24

All user can access some data, based on their need to knwo, clearance, and formal access approval

Front 25

National Information Assurance Certification and Accreditation Process (NIACAP) ?

Back 25

establishes the minimum national standards for certifying and accrediting national security systems

Front 26

What security model is based on well-formed transaction and SOD?

Back 26

Clark-Wilson

Front 27

What MAC and Lattice model provides confidentiality

Back 27

Bell-LaPadula

Front 28

What MAC and lattice model provides integrity?

Back 28

Biba

Front 29

In a lattice model simple refers to;
and * refers to

Back 29

read;

write

Front 30

According to the Common Criteria, what can be described as an intermediate combination of security requirement components?

Back 30

package

Front 31

TCSEC level D

Back 31

Minimal protection

Front 32

TCSEC level C

Back 32

C – Discretionary protection
C1 – Discretionary Security Protection
C2 – Controlled Access Protection

Front 33

TCSEC level B

Back 33

B – Mandatory Protection
B1 – Labeled Security
B2 – Structured Protection
B3 – Security Domains

Front 34

TSCEC level A

Back 34

A – Verified Protection
A1 – Verified Design

Front 35

Difference between Compartmented Security Mode and Multilevel Security Mode

Back 35

In a CSM, all users must have clearance for the highest level of database. MSM can handle multiple information levels.

Front 36

What are the 2 components of an object's sensitivity label?

Back 36

A single classification and different categories that represents compartments of information.

Front 37

Give examples of security subjects

Back 37

users, programs, print queue, and processes

Front 38

Give examples of security objects

Back 38

files, directories, devices, windows, and sockets

Front 39

What is Data Hiding?

Back 39

Making information available at one processing level, but not another

Front 40

What is Orange book level is the first to support object reuse, and distinguish users by means of strict login? controls?

Back 40

C2

Front 41

Give examples of a C2 level systems.

Back 41

Windows, Novell

Front 42

What Orange book level requires sensitvity labels for all subjects and storage objects?

Back 42

B1

Front 43

What Orange book level support hierarchical device labels, trust path communications between user and system, and covert channel analysis

Back 43

B2

Front 44

What Orange book level spports trusted recovery, automated security analysis, must address covert timing vulnerabilitie?

Back 44

B3

Front 45

What Orange book must meet formal proof of integrity and must also be installed and delivered securely?

Back 45

A1

Front 46

What is the difference between Information Labels and Sensitivity Label?

Back 46

In addition to the classification and category set, Information Labels have the necessary controls to be able to operate as a trusted computer.

Front 47

What are the five assurance requirements specified in the Orange Book?

Back 47

system architecture, system integrity, covert channel analysis, trusted facility management, and trusted recovery