5. Risk Management
Incident Response Procedures
-notification -escalation -reporting -system isolation -forensic analysis -evidence handling
Security procedures
-outline a step by step process for an activity -may require compliance, depending upon the circumstances
Incident Response Process
-preparation -identification -containment -eradication -recovery -lesson learned
Security Guidelines
-provide advice to the organization -follow best practices from industry -suggest optional practices: not mandatory
Security Standards
-provide specific details of security controls -derive their authority from policies -follow a less rigorous approval process -require compliance form all employees
Security Policies
-provide the foundation for a security program -are written carefully over a long period of time -require compliance from all employees -are approved at the highest levels of the organization
Warm sites
-stocked with all necessary equipment and data -not maintained in a parallel fashion -similar in expense to hot sites -available in hours or days
Classification Levels Military
-top secret -secret -confidential -unclassified
Documentary Evidence Rules
1. Authentication rule Documents must be authentication by testimony 2. Best evidence rule Original documents are superior to copies 3. Parol evidence rule written contracts are assumed to be the entire agreement
Business Impact analysis BIA
Identifies and prioritizes risks
Risk Assessment
Identify and prioritize risk
Incremental Backups
Include all data modified since the last full or incremental backup
Redundant Array of Inexpensive Disks RAID
Instead of using one large disk to store data, one can use many smaller disks (because they are cheaper). An approach to using many low-cost drives as a group to improve performance, yet also provides a degree of redundancy that makes the chance of data loss remote.
Criminal Investigations
Look into possible crimes -involve the possibility of fines and jail time -use the beyond a reasonable doubt standard of evidence
Operational Investigations
Look into technology issues -seek to resolve technology issues -restore normal operations as quickly as possible -use very low standards of evidence -involve root cause analysis
Fault Tolerance FT
Makes a single system resilient against technical failures
Recovery Time Objective RTO
Maximum amount of time that it souls take to recover a service after a disaster
Recovery Point Objectives RPO
Maximum time period from which data may be lost in the wake of a disaster
Defense in Depth
Multiple controls for one objective.
Separation of Duties
No individual should possess two permissions that, in combination, allow them to perform a highly sensitive action.
What technology is commonly used for Big Data datasets? PostreSQL NoSQL MySQL SQL Server
NoSQL
Annualized Rate of Occurrence ARO
Number of times a risk is expected to occur each year
GAPP principle 5 Use, Retention, and Disposal
Organization should only collect and use personal information for disclosed purposes and they should dispose of the data securely as soon as it is no longer needed for the disclosed purpose.
GAPP principle 7 Disclosure to Third Parties
Organization should only share information with third parties if that sharing is consistent with the purposes disclosed in privacy notices and they have the consent of the individual to share that information.
GAPP principle 1 Management
Organizations handing private information should have polices, procedures, and governance structures in place to protect privacy.
GAPP principle 6 Access
Organizations should provide data subjects with the ability to review and update their personal information.
GAPP principle 8 Security
The organization must secure private information against unauthorized access, either physically or logically
GAPP principle 3 Choice and Consent
The organization should inform data subjects of their options regarding the data they own and get consent from those individuals for the collection, storage, use, and sharing of that information
GAPP principle 4 Collection
The organization should only collect personal information for purpose disclosed in their privacy notices.
Service Level Agreement SLA
a written contract between the vendor and the customer that describes the conditions of service and penalties the vendor will incur for failure to maintain the agreed-upon service levels.
Acceptance use policy AUP
defines proper system usage or the rule of behavior for employees when using information technology system
Data Disposal Policies
describes proper techniques for destroying data that is no longer needed by the organization
Deterrent Controls
designed to discourage attack attempts (fence, burglar alarms)
Corrective Controls
designed to help an organization recover from an incident backups
Preventive controls
designed to stop attacks that are in progress
Physical controls
deter, detect, or prevent unauthorized physical access to a facility
Clean Desk Policy
directs users to keep their areas organized and free of papers. The primary goal is to reduce threats of security incidents by ensuring the protection of sensitive data.
Server logs are an example of _____ evidence. testimonial expert opinion real documentary
documentary
Exposure Factor EF
expected % of damage to an asset
Annualized Loss Expectancy ALE
expected dollar loss from a risk in any given year SLE * ARO = ALE
Single Loss Expentancy SLE
expected dollar loss if risk occurs one time AV * EF + SLE
Memorandum of understanding MOU and Memorandum of agreement MOA
expresses an understanding between two or more parties indicating their intention to work together towards a common goal.
Threat
external force jeopardizing security
Compensating controls
fill gaps left when you are unable to implement other required controls.
Mandatory Vacation
force privilege users to take one or two weeks of consecutive cation annually
Which element of the security policy framework includes suggestions that are not mandatory? policies guidelines standards procedures
guidelines
Data Steward
handles the day-to-day data governance activities. They are delegated responsibility by data owner.
Protected Health Information PHI
health records about an individual patient
What type of control are we using if we supplement a single firewall with a second standby firewall ready to assume responsibility if the primary firewall fails? component redundancy load balancing high availability clustering
high availability
What type of disaster recovery site is able to be activated most quickly in the event of a disruption? hot site warm site lukewarm site cold site
hot site
Full Backups
include a complete copy of all data
Differential Backups
include all data modified since the last full backup
What type of backup includes only those files that have changed since the most recent full or incremental backup? full incremental partial differential
incremental
Which one of the following is not one of the GAPP principles? collection management integrity notice
integrity
Separation of duty
is a principle that prevents any single person or entity from being able to complete all the functions of a critical or sensitive process. It designed to prevent fraud, theft, and errors.
Privilege Aggregation
jeopardized least privileges Privilege sprawl
What security principle prevents against an individual having excess security rights? separation of duties mandatory vacations job rotation least privilege
least privileged
Memorandum of Understanding MOU
letter written to document aspects of the relationship. Also known as Memorandum of Agreement MOA
What two factors are used to evaluate a risk? frequency and likelihood criticality and likelihood impact and criticality likelihood and impact
likelihood and impact
Need to know
limits information access
Least Privileged
limits system permissions
Replacement cost technique
looks at current supplier prices to determine the actual cost of replacing an asset in the current market and then uses that cost as the asset's value.
Administrative controls
management processes that we put in place improve enterprise security
Which evidence source should be collected first when considering the order of volatility? temporary files process information logs memory contents
memory content
Wireshark Monitors Networks
network packet capture
Asset Value AV
the dollar value of an asset -original cost -depreciate cost -replacement cost
GAPP principle 10 Monitoring and Enforcement
the organization should have a program in place to monitor compliance with its privacy policies and provide a dispute resolution mechanism
GAPP principle 9 Quality
the organization should take reasonable steps to ensure that the private information they maintain is accurate, complete, and relevant
Pulverizing
the process of physically destroying media to sanitize it, such as with a sledge hammer.
Volatility
the relative permanence of a piece of evidence: evidence that may not last long is more volatile than more permanent sources of evidence.
Which one of the following is not a commonly-used business classification level? Internal Highly Sensitive Top Secret Sensitive
top secret
Technical controls
use of technology to achieve security controls objectives
Risk assessment: Quantitative
uses objective numeric rating to evaluate risk likelihood and impact (usually in terms of dollars)
Risk assessment: Qualitative
uses subjective rating to evaluate risk likelihood and impact Low, medium, high
Degaussing
very powerful electronic magnet. Passing a disk through a degassing field renders the data on tape and magnetic disk drives unreadable.
What type of technology prevents a forensic examiner from accidentally corrupting evidence while creating an image of a disk? sealed container hashing evidence log write blocker
write blocker
Business Partners Agreement BPA
written agreement that details the relationship between business partners, including their obligations towards the partnership.
Risk Deterrence
takes actions that dissuade a threat from exploiting a vulnerability
Hot site
-fully operated data centers -stocked with equipment and data -available at a moment's notice -very expensive
Classification Levels Business
-highly sensitive -sensitive -internal -public
Compliance Obligations
-laws -regulations -standards
Preemployment Screening
-criminal records checks -sex offender registry -reference checks -education and employment verification -credit checks
Cold sites
-empty data centers -stocked with equipment, network, and environmental controls -relatively inexpensive -operational in weeks or months
Information security Policy
-designation of individual responsible for security -description of security roles and responsibilities -authority for creation of security standards -authority for incident response -process for policy exceptions and violations
Acceptable Use Policy
-also known as responsible use policy -describe how individuals may use information systems -prohibits illegal activity -describes what personal use is permitted.
Order of Volatility
1. Network traffic 2. Memory contents 3. system and process data 4. files 5. Logs
Incident Response Program Components
1. Policy and plan documentation 2. Procedures for incident handling 3. Guidelines for communicating externally 4. Structure and staffing model for the team 5. Description of relationship with other groups
What is the minimum number of disks required to perform RAID level 5? 1 2 4 3
3
grandfather-father-son (GFS)
A common backup rotation scheme that uses three levels of backups.
Risk Register
A document that contains results of various risk management processes, often displayed in a table or spreadsheet format
Risk Avoidance
A risk response strategy whereby the project team acts to eliminate the threat or protect the project from its impact. (move the data center to non flood zone)
Once an organization complies with GAPP, best practice says they should collect as much information as possible to provide good service, provided that they remain GAPP compliant. TRUE FALSE
False
What is the correct formula for computing the annualized loss expectancy? ALE = EF * SLE * ARO ALE = AV - SLE ALE = ARO * AV ALE = SLE * ARO
ALE = SLE * ARO
Business partnership agreement BPA
Agreement between partners
GAPP Developers
American Institute of Certified Public Accountants AICPA Canadian Institute of Chartered Accountants CICA Information System Audit and Control Association ISACA Institute of Internal Auditors IIA
Interconnection Security Agreement (ISA)
An agreement between parties intended to minimize security risks for data transmitted across a network. Normally provides details on connection security parameters as the encryption standards and transfer protocols
Mean Time to Repair MTTR
Average time to require to return a repairable component to service
Which one of the following individuals would not normally be found on the incident response team? CEO human resources staff legal counsel information security professional
CEO
Documentary Evidence
Consists of written information
GAPP principle 2 Notice
Data subjects should receive notice that their information is being collected and used, as well as access to the privacy polices and procedures followed by the organization.
RAID 5
Disk striping with parity, RAID 5, uses three or more disks to store data and parity information. (requires three or more)
Service Level Requirements SLR
Document specific requirements that a customer has about any aspect of a vendor's service performance.
Lessons Learned
Provides incident responders with an opportunity to reflect on the incident response efforts and offers feedback that will improve the organization's response to future incidents
RAID Mirroring
RAID 1 stores the same data on two different disks (requires two disks)
What disaster recovery metric provides the targeted amount of time to restore a service after a failure? MTO RPO RTO TLS
RTO
Risk Mitigation
Reduce the likelihood or impact of the risk.
Twp Person Control
Requires the authorization of two separate individuals to carry out a sensitive action: also know as dual control. Missile launch
Job Rotation
Rotate users in and out of position with sensitive responsibilities
What type of agreement is used to define availability requirements for an IT service that an organization is purchasing from a vendor? SLA MOU ISA BPA
SLA
Security Incident and event Management SIEM
Security solution that collects information from diverse sources analyzes it for signs of security incidents, and retains it for later use.
Software Forensics: Malware Origins
Software forensics may be used to identify the author of malicious software found on a system
Software forensics may be used to identify the origin of malware. TRUE FALSE
T
The chain of custody must be updated EVERY time someone handles a piece of evidence. TRUE FALSE
T
High Availability HA
Uses multiple systems to protect against service failure
Vulnerability
Weaknesses in security control (missing patches, promiscuous firewalls, firewalls misconfigurations)
Risk Acceptance
accepts the risk without taking future actions.
Parallel tests
activate the disaster recovery facility but do not switch operations there.
Data Castodian
actually store and process information and are often IT staff members
Service Level Agreement SLA
agreement between a company and a vendor that stipulates performance expectations, such as minimum up time and maximum downtime levels.
Pulping
an additional step taken after shredding paper. It reduces the shredded paper to mash or puree
Regulatory Investigations
are conducted by the govenrment
Security controls
are the procedures and mechanisms that an organization puts in place to manage security risks.
What goal of security is enhanced by a strong business continuity program? confidentiality non-repudiation integrity availability
availability
Mean Time to Failure MTTF
average time a nonrepairable component will last
Mean Time Between Failures MTBF
average time gap between failures of a repairable component
Data Owners
business leaders with overall responsibility for data. They set policies and guidelines for their data sets
Job Rotation
concept that has employees rotate through different jobs to learn the processes and procedures in each job.
Real Evidence
consists of tangible objects
Testimonial Evidence
consists of witness statements 1.direct evidence - witness provides evidence based upon his or her own observations 2. expert opinion expert witness draws conclusions based upon other evidence
During an incident response, what is the highest priority of first responders? restoring operations identifying the root cause containing the damage collecting evidence
containing the damage
After Action Report AAR
create a formal record of a disaster recovery DR or business continuity BC event.
Data in Motion
data being sent over a network between two systems
Data Sovereignty
data is subject to the law of the jurisdiction where it's stored.
What data security role is normally filled by a senior-level official who bears overall responsibility for the data? data custodian data guardian data owner data steward
data owner
Data at Rest
data stored for later use on a hard drive, USB device, magnetic tape, cloud service, or other data storage environment
Which category of security control focuses on the processes that we put in place to manage technology in a secure manner? technical controls management controls administrative controls operational controls
operational control
What type of investigation would typically be launched in response to a report of high network latency? criminal civil operational regulatory
oprerational
Three of these choices are data elements found in NetFlow data. Which is not? packet contents amount of data transferred source address destination address
packet content
Which one of the following disaster recovery tests involves the actual activation of the DR site? parallel test simulation walk-through read-through
parallel tests
Privacy Policy
policy that indicates what kind of information a website will take from you and what they intend to do with it
Risk management
process of systematically analyzing potential responses to each risk and implementing strategies to control those risks appropriately.
During what phase of ediscovery does an organization share information with the other side? collection analysis preservation production
production
NetFlow Summarizes Traffic
providing high-level information 1. telephone bill numbers called timestamp, call duration 2. NetFlow Data IP addresses and ports Timestamps amount of data transferred
Personally Identifiable Information PII
records that may be associated with a specific individual
Civil Investigations
resolve disputes between parties -do not involve the possibility of fines and jail time -use the preponderance of the evidence standard
Purchasing an insurance policy is an example of which risk management strategy? risk acceptance risk mitigation risk transference risk deterrence
risk transference
Threat intelligence
shares the risk information by joining a threat intelligence consortium or purchasing a threat intelligence service
Transferring Risk
shifts the impact of a risk to another organization (insurance policy)
Software Forensics : Intellectual Property
software forensics may be used to resolve intellectual property disputes between two parties
Threat vector
specific method that threats use to exploit a vulnerability ( hacker tool kit, social engineering, physical intrusion, or any number of hacking techniques)
Interconnection security agreement ISA
specifies technical and security requirements for planning, establishing, maintaining, and disconnecting a secure connection between two or more entitles.
Data Retention Policies
specifies the minimum and /or maximum periods that an organization will retain different data elements