Cissp Security And Risk Management Bullet Points

Front 1

The objectives of security are

Back 1

to provide availability, integrity, and confidentiality protection to data and resources.

Front 2

A vulnerability is

Back 2

a weakness in a system that allows a threat source to compromise its security.

Front 3

A threat is

Back 3

is the possibility that someone or something would exploit a vulnerability, either intentionally or accidentally, and cause harm to an asset.

Front 4

A risk is ...

A countermeasure, also called a safeguard or control,...

Back 4

...the probability of a threat agent exploiting a vulnerability and the loss potential from that action.

...mitigates the risk.

Front 5

A control can be

Back 5

administrative, technical, or physical and can provide deterrent, preventive, detective, corrective, or recovery protection.

Front 6

A compensating control is

Back 6

an alternative control that is put into place because of financial or business functionality reasons.

Front 7

COBIT is

Back 7

a framework of control objectives and allows for IT governance.

Front 8

ISO/IEC 27001 is

Back 8

the standard for the establishment, implementation, control, and improvement of the information security management system.

Front 9

The ISO/IEC 27000 series were derived from ...

and are ...

Back 9

...BS 7799

...international best practices on how to develop and maintain a security program.

Front 10

Enterprise architecture frameworks are used to

Back 10

develop architectures for specific stakeholders and present information in views.

Front 11

An information security management system (ISMS) is

Back 11

a coherent set of policies, processes, and systems to manage risks to information assets as outlined in ISO\IEC 27001.

Front 12

Enterprise security architecture is

Back 12

a subset of business architecture and a way to describe current and future security processes, systems, and subunits to ensure strategic alignment.

Front 13

Blueprints are

Back 13

functional definitions for the integration of technology into business processes.

Front 14

Enterprise architecture frameworks are used to

Back 14

uild individual architectures that best map to individual organizational needs and business drivers.

Front 15

Zachman Framework is

Back 15

an enterprise architecture framework, and SABSA is a security enterprise architecture framework.

Front 16

COSO (...) is ...

Back 16

(Internal Control—Integrated Framework)

is a governance model used to help prevent fraud within a corporate environment.

Front 17

ITIL is

Back 17

a set of best practices for IT service management.

Front 18

Six Sigma is used to

Back 18

to identify defects in processes so that the processes can be improved upon.

Front 19

CMMI is

Back 19

(Capability Maturity Model Integration)

a maturity model that allows for processes to improve in an incremented and standard approach.

Front 20

Security enterprise architecture should tie i

Back 20

strategic alignment, business enablement, process enhancement, and security effectiveness.

Front 21

NIST SP 800-53 uses the following control categories:

Back 21

technical, management, and operational.

Front 22

Civil law system

Back 22

- Uses prewritten rules and is not based on precedent.

- Is different from civil (tort) laws, which work under a common law system.

Front 23

Common law system

Back 23

Made up of criminal, civil, and administrative laws.

Front 24

Customary law system

Back 24

- Addresses mainly personal conduct and uses regional traditions and customs as the foundations of the laws.

- Is usually mixed with another type of listed legal system rather than being the sole legal system used in a region.

Front 25

Religious law system

Back 25

Laws are derived from religious beliefs and address an individual’s religious responsibilities; commonly used in Muslim countries or regions.

Front 26

Mixed law system

Back 26

Uses two or more legal systems.

Front 27

Criminal law deals with

Back 27

an individual’s conduct that violates government laws developed to protect the public.

Front 28

Civil law deals with

Back 28

wrongs committed against individuals or companies that result in injury or damages. Civil law does not use prison time as a punishment, but usually requires financial restitution.

Front 29

Administrative, or regulatory, law covers

Back 29

standards of performance or conduct expected by government agencies from companies, industries, and certain officials.

Front 30

A patent

Back 30

grants ownership and enables that owner to legally enforce his rights to exclude others from using the invention covered by the patent.

Front 31

Copyright

Back 31

protects the expression of ideas rather than the ideas themselves.

Front 32

Trademarks

Back 32

protect words, names, product shapes, symbols, colors, or a combination of these used to identify products or a company. These items are used to distinguish products from the competitors’ products.

Front 33

Trade secrets

Back 33

are deemed proprietary to a company and often include information that provides a competitive edge. The information is protected as long as the owner takes the necessary protective actions.

Front 34

Crime over the Internet has brought about

Back 34

jurisdiction problems for law enforcement and the courts.

Front 35

Privacy laws dictate

Back 35

that data collected by government agencies must be collected fairly and lawfully, must be used only for the purpose for which it was collected, must only be held for a reasonable amount of time, and must be accurate and timely.

Front 36

When choosing the right safeguard to reduce a specific risk,

Back 36

the cost, functionality, and effectiveness must be evaluated and a cost/benefit analysis performed.

Front 37

A security policy is a

Back 37

statement by management dictating the role security plays in the organization.

Front 38

Procedures are

Back 38

detailed step-by-step actions that should be followed to achieve a certain task.

Front 39

Standards are

Back 39

documents that outline rules that are compulsory in nature and support the organization’s security policies.

Front 40

A baseline is

Back 40

a minimum level of security.

Front 41

Guidelines are

Back 41

recommendations and general approaches that provide advice and flexibility.

Front 42

OCTAVE is a

Back 42

eam-oriented risk management methodology that employs workshops and is commonly used in the commercial sector.

Front 43

Security management should work from

Back 43

the top down (from senior management down to the staff).

Front 44

Risk can be

Back 44

transferred, avoided, reduced, or accepted.

Front 45

Total Risk

Residual Risk

Back 45

Threats × vulnerability × asset value = total risk

(Threats × vulnerability × asset value) × controls gap = residual risk

Front 46

The main goals of risk analysis are the following:

Back 46

- identify assets and assign values to them,

- identify vulnerabilities and threats,

- quantify the impact of potential threats

- provide an economic balance between the impact of the risk and the cost of the safeguards

Front 47

Failure Modes and Effect Analysis (FMEA) is

Back 47

a method for determining functions, identifying functional failures, and assessing the causes of failure and their failure effects through a structured process.

Front 48

A fault tree analysis is

Back 48

a useful approach to detect failures that can take place within complex environments and systems.

Front 49

A quantitative risk analysis attempts to

Back 49

assign monetary values to components within the analysis

Front 50

A purely quantitative risk analysis is

Back 50

not possible because qualitative items cannot be quantified with precision.

Front 51

Capturing the degree of uncertainty when carrying out a risk analysis is important, because

Back 51

it indicates the level of confidence the team and management should have in the resulting figures.

Front 52

Automated risk analysis tools

Back 52

reduce the amount of manual work involved in the analysis. They can be used to estimate future expected losses and calculate the benefits of different security measures.

Front 53

ALE

ARO

ALE

Back 53

Single loss expectancy × frequency per year = annualized loss expectancy

(SLE × ARO = ALE)

Front 54

Qualitative risk analysis uses

Back 54

judgment and intuition instead of numbers.

Front 55

Qualitative risk analysis involves

Back 55

people with the requisite experience and education evaluating threat scenarios and rating the probability, potential loss, and severity of each threat based on their personal experience.

Front 56

The Delphi technique is

Back 56

a group decision method where each group member can communicate anonymously.

Front 57

Job rotation is

Back 57

a detective administrative control to detect fraud.

Front 58

Mandatory vacations are

Back 58

a detective administrative control type that can help detect fraudulent activities.

Front 59

Separation of duties ensures

Back 59

no single person has total control over a critical activity or task. It is a preventive administrative control.

Front 60

Split knowledge and dual control are

Back 60

two aspects of separation of duties.

Front 61

Management must define ... of security management, ...

Back 61

...the scope and purpose

...provide support, appoint a security team, delegate responsibility, and review the team’s findings.

Front 62

The risk management team should includ

Back 62

individuals from different departments within the organization, not just technical personnel.

Front 63

Social engineering is

Back 63

a nontechnical attack carried out to manipulate a person into providing sensitive data to an unauthorized individual.

Front 64

Personally identifiable information (PII) is

Back 64

a collection of identity-based data that can be used in identity theft and financial fraud, and thus must be highly protected.

Front 65

A supply chain

Back 65

is a sequence of suppliers involved in delivering some product.

Front 66

A service level agreement (SLA) is

Back 66

a contractual agreement that states that a service provider guarantees a certain level of service.

Front 67

Security governance is

Back 67

a framework that provides oversight, accountability, and compliance.

Front 68

ISO/IEC 27004:2016 is

Back 68

an international standard for information security measurement management.

Front 69

NIST SP 800-55 is

Back 69

a standard for performance measurement for information security.

Front 70

usiness continuity management (BCM) is

Back 70

is the overarching approach to managing all aspects of BCP and DRP.

Front 71

A business continuity plan (BCP) contains

Back 71

trategy documents that provide detailed procedures that ensure critical business functions are maintained and that help minimize losses of life, operations, and systems.

Front 72

A BCP provides

Back 72

procedures for emergency responses, extended backup operations, and post-disaster recovery.

Front 73

A BCP should have

Back 73

an enterprise-wide reach, with individual organizational units each having its own detailed continuity and contingency plans.

Front 74

A BCP needs to

Back 74

prioritize critical applications and provide a sequence for efficient recovery.

Front 75

A BCP requires

Back 75

senior executive management support for initiating the plan and final approval.

Front 76

BCPs can quickly

Back 76

become outdated due to personnel turnover, reorganizations, and undocumented changes.

Front 77

...may be held liable if proper BCPs are not developed and used.

Back 77

Executives

Front 78

Threats can be

Back 78

natural, manmade, or technical.

Front 79

The steps of recovery planning include

Back 79

- initiating the project

- performing business impact analyses

- developing a recovery strategy

- developing a recovery plan

- implementing, testing, and maintaining the plan

Front 80

The project initiation phase of recovery planning involves

Back 80

- getting management support

- developing the scope of the plan

- securing funding and resources

Front 81

The business impact analysis (BIA) is

Back 81

one of the most important first steps in the planning development. Qualitative and quantitative data on the business impact of a disaster need to be gathered, analyzed, interpreted, and presented to management.

Front 82

... are the most critical elements in developing the BCP.

Back 82

Executive commitment and support

Front 83

A business case must be presented

Back 83

to gain executive support. This is done by explaining regulatory and legal requirements, exposing vulnerabilities, and providing solutions.

Front 84

Plans should be prepared by

Back 84

the people who will actually carry them out.

Front 85

The planning group should

Back 85

comprise representatives from all departments or organizational units.

Front 86

The BCP team should identify...

Response to the disaster should...

Back 86

...the individuals who will interact with external players, such as the reporters, shareholders, customers, and civic officials.

...be done quickly and honestly, and should be consistent with any other organizational response.

Front 87

ISO/IEC 22301

ISO/IEC 27031:2011

Back 87

...is the standard for business continuity management (BCM).

...describes the concepts and principles of information and communication technology (ICT) readiness for business continuity.