1601 Chp 12

अब Quizwiz के साथ अपने होमवर्क और परीक्षाओं को एस करें!

1.Specific warning bulletins issued when developing threats and specific attacks pose measurable risk to the organization 2.Periodic summaries of external information 3.Detailed intelligence on highest risk warnings

Monitoring process has three primary deliverables

black box or white box

Penetration Testing-Can be conducted one of two ways:

-Metrics should be used for monitoring the performance of information security controls -Six-phase iterative process

Performance measures

1. Prepare for data collection 2. Collect data analyze results 3. ID corrective actions 4. Develop Business case 5. Obtain resources 6. Apply corrective actions

Performance measures Six-phase iterative process

Information security program planning and review

Periodic review of an ongoing information security program coupled with planning for enhancements and extensions is a recommended practice for any organization. --should examine future IT needs of organization and its impact on information security

p.651

Review the maintenance model diagram

war driving

Searching for wireless signals from an automobile or on foot using a portable computing device.

1.External monitoring 2.Internal monitoring 3.Planning and risk assessment 4.Vulnerability assessment and remediation 5.Readiness and review

Security Maintenance Model five subject areas

should continuously monitor system performance to ensure that it is consistent with established user and security requirements and that needed system modifications are incorporated

System Development Life Cycle Monitoring activities

identifies risks and proposes controls

The RA process does what 2 things ?

planning and risk assessment domain

The component of the maintenance model that focuses on identifying and planning ongoing information security activities and identifying and managing risks introduced through IT information security projects.

Internal Monitoring Domain

The component of the maintenance model that focuses on identifying, assessing, and managing the configuration and status of information assets in an organization.

revision date

The date associated with a particular version or build.

Interconnecting Systems(Information Security Area)

The direct connection of two or more information systems for sharing data and other information resources. It can expose the participating organizations to risk, but when properly managed, the added benefits include greater efficiency, centralized access to data, and greater functionality.

providing indicators of current or imminent vulnerabilities

The most important value of raw intelligence provided by the intrusion detection system (IDS) is?

Vulnerability repair

The optimum solution in most cases is to repair the vulnerability. Applying patch software or implementing a workaround often accomplishes this.

white box pen test aka full disclosure testing

The org provides info about the systems to be examined

readiness and review domain

The primary goal is to keep the information security program functioning as designed and to keep it continuously improving over time.

Performance Measurement(Information Security Area)

The process in which an organization collects information to measure and report on how well it is doing, usually with the goal of managing to improve its performance.

Vulnerability Assessment and Remediation

The process of identifying and documenting specific and provable flaws in the organization's information asset environment.

version

The recorded state of a particular revision of a software or hardware configuration item.

1. senior management support 2. security policy and procedures 3. quantifiable performance measures 4. analyses

The typical information performance management program consists of 4 interdependent components which are?

Documenting Vulnerabilities

The vulnerability database, like the risk, threat, and attack database, both stores and tracks information. --Low cost and ease of use make relational databases a realistic choice -Vulnerability database is an essential part of effective remediation

Information technology contingency planning(Information Security Area)

This consists of a process for recovery and documentation of procedures.

1.Using vulnerability assessment procedures 2.Documenting background information and providing tested remediation procedures for vulnerabilities 3.Tracking vulnerabilities from the time they are identified 4.Communicating vulnerability information to owners of vulnerable systems 5.Reporting on the status of vulnerabilities 6.Ensuring that the proper level of management is involved

Vulnerability Assessment and Remediation is accomplished by? (6)

Security Risk Assessments

a method of identifying and documenting the risk that a project, process, or action introduces to the organization and may also involve offering suggestions for controls that can reduce that risk.

performance baseline

an expected level of performance against which all subsequent levels of performance are compared

1. Configuration management and configuration control processes for the information system 2. Security impact analyses on changes to the information system 3. Assessment of selected security controls in the information system and reporting of the system's security status to appropriate agency officials

at a minimum, an effective monitoring program requires? (3)

Platform security validation

designed to find and document the vulnerabilities that may be present because there are misconfigured systems in use within the organization.

Internet vulnerability assessment

designed to find and document the vulnerabilities that may be present in the public-facing network of the organization.

Certification, accreditation, and security assessments (Information Security Area)

ensures that an information system operates with the appropriate management review, that there is ongoing monitoring of security controls, and that reaccreditation occurs periodically

Models

frameworks that structure the tasks of managing particular set of activities or business functions

Incident response (Information Security Area)

helps the organization detect incidents rapidly, minimize loss and destruction, identify weaknesses, and restore IT operations rapidly

Configuration and Change Management(Information Security Area)

manages the effects of changes in configurations, five-step process

partner interconnections

network devices, communications channels, and applications that may not be owned by the organization but are essential to the continued operation of the organization's partnership with another company.

60% rule

offers a few guidelines that security personnel can use when exploring the issues of system and network performance

1. Planning needed for infosec programs 2. evaluation of current risks using operational risk assessment

planning and risk assessment domain 2 pivotal processes

1.Establishing a formal information security program review process 2.Instituting formal project identification, selection, planning, and management processes 3.Coordinating with IT project teams to introduce risk assessment and review for all IT projects 4.Integrating a mindset of risk assessment throughout the organization

planning and risk assessment domain Primary objectives (4)

Awareness and Training(Information Security Area)

processes that are put into place to monitor compliance and effectiveness

The NIST SP 800-100 Information Security Handbook

provides technical guidance for the establishment and implementation of an information security program.

1.Policy review 2.Program review 3.Rehearsals

readiness and review domain primary goal is accomplished by: (3)

Threat Removal

some circumstances, threats can be removed without requiring a repair of the vulnerability.

Acceptance or Transference of Risk

some instances, risk must either simply be acknowledged as being part of an organization's business process, or else the organization should buy insurance to transfer the risk to another organization.

external monitoring domain

the component of the maintenance model that focuses on evaluating external threats to the organization's information assets

System Development Life Cycle(Information Security Area)

the overall process of developing, implementing, and retiring information systems through a multi-step process.

Vulnerability Assessment

the process of identifying and documenting specific and provable flaws in the organizations information asset environment.

auditing

the review of a systems use to determine if misuse or malfeasance has occurred

minor release

(update or patch) a minor revision of a version from its previous state

Security Services and Products Acquisition (Information Security Area)

-CBA should be conducted prior to purchasing -vulnerabilities in IT products surface nearly every day -checklist aka lockdown or hardening guide, should be used with new products

Interconnection Security Agreement (ISA)

An agreement between parties intended to minimize security risks for data transmitted across a network.

Configuration and Change Management (CCM) aka Configuration Management (CM)

An approach to implementing system change that uses policies, procedures, techniques, and tools to manage and evaluate proposed changes, track changes through completion, and maintain systems inventory and supporting documentation.

configuration and change management (CCM)

An approach to implementing system change that uses policies, procedures, techniques, and tools to manage and evaluate proposed changes, track changes through completion, and maintain systems inventory and supporting documentation.

intranet vulnerability assessment

An assessment approach designed to find and document selected vulnerabilities that are likely to be present on the organization's internal network. --This assessment is usually performed against critical internal devices with a known, high value by using selective penetration testing

wireless vulnerability assessment

An assessment approach designed to find and document vulnerabilities that may be present in the organization's wireless local area networks.

identify weaknesses in various security efforts

Analyzing attack signatures from unsuccessful system attacks can

traffic analysis

Another IDS monitoring element is

1. Tracking system should capture key information on program activities. 2. Tracking compliance involves assessing the status of the program 3. Security policies must continue to evolve

Awareness and training monitoring activities(3)

1.Identify Change 2. Evaluate Change Request 3.Implementation Decision 4.Implement Approved Change Request 5. Continuous Monitoring

CM process step-by-step procedure for identifying, processing, tracking, and documenting changes. (5)

1.Identify the baseline 2.Identify prioritization requirements 3.Conduct enterprise-level prioritization 4.Conduct system-level prioritization 5.Develop supporting materials 6.Implement an Investment Review Board (IRB) 7.Submit budget approval paperwork

Capital Planning and Investment Control 7 step process

1.Departments required to allocate funding toward highest-priority investments 2.Designed to facilitate the expenditure of agency funds

Capital Planning and Investment Control monitoring activities (2)

1.Acquisition of new assets 2.Emergence of new vulnerabilities 3. Shifting business priorities 4. Partnerships form or dissolve 5. Employee hire and turnover

Changes that may affect an organization's information security environment: (5)

Capital Planning and Investment Control(Information Security Area)

Designed to facilitate and control the expenditures of agency funds. -Departments required to allocate funding toward highest-priority investments

-collects raw intelligence, filters for relevance, assigns a relative risk impact, and communicates to decision makers in time to make a difference

External monitoring does the following

contingency planning

-Consists of a process for recovery and documentation of procedures

Security Planning (Information Security Area)

-One of the most crucial ongoing responsibilities in security management

Risk Management(Information Security Area)

-Ongoing effort -Tasks include performing risk identification, analysis, and management

Network characterization and inventory

-Organizations should have/maintain carefully planned and fully populated inventory of network devices, communication channels, and computing devices

1. Information security governance 2. System Development Life Cycle 3.Awareness and training 4.Risk Management 5.Certification, accreditation, and security assessments 6.Security services and products acquisition 7.Configuration or change management 8.Capital Planning and Investment Control 9. Interconnecting Systems 10. Performance Measurement 11. Security Planning 12. Information Technology Contingency Planning 13. Incident Response

13 areas of information security management

1.vendors, 2.computer emergency response teams (CERTs), 3.public network sources, or 4.membership sites

4 classes of data sources for external monitoring

1.Internet 2. Intranet 3. platform security 4.wireless

4 vulnerability assessment processes

configuration

A collection of components that make up a configuration item.

software library

A collection of configuration items that is usually controlled and that developers use to construct revisions and issue new configuration items.

Black box penetration testing

A form of penetration testing where the tester is not given any system credentials. Used to simulate an external cyber attack

configuration item

A hardware or software item that will be modified and revised throughout its life cycle

build list

A list of the versions of components that make up a build.

Difference Analysis

A procedure that compares the current state of a network segment against a known previous state of the same network segment (the baseline of systems and services).

major release

A significant revision of a version from its previous state.

build

A snapshot of a particular version of software assembled or linked from its component modules.

Penetration Testing

A test by an outsider to actually exploit any weaknesses in systems that are vulnerable. --A level beyond vulnerability testing

war game

A type of rehearsal that seeks to realistically simulate the circumstances needed to thoroughly test a plan.

Characterization

In Network Characterization and Inventory The process of collecting this information is often referred to as?

1.Ongoing information security activities are providing appropriate support to the agency's mission 2.Policies and procedures are current 3.Controls are accomplishing their intended purpose

Information security governance(Information Security Area) - Agencies should monitor the status of their programs to ensure: (3)

Phase 1: Planning the interconnection Phase 2: Establishing the interconnection Phase 3: Maintaining the interconnection Phase 4: Disconnecting the interconnection

Interconnecting Systems 4 phase Life Cycle Management Approach

1.Inventorying network devices and channels, IT infrastructure and applications, and information security infrastructure elements 2.Leading the IT governance process 3.Real-time monitoring of IT activity 4.Monitoring the internal state of the organization's networks and systems

Internal Monitoring accomplished by (4)

1.Planning, scheduling, and notification 2.Target selection 3.Test selection 4.Scanning 5.Analysis 6.Record keeping

Internet vulnerability assessment-Steps in the process include:

manage and operate the ongoing security program

Management model must be adopted to?

Security Maintenance Model

•Designed to focus the organizational effort on maintaining systems -Recommended maintenance model based on five subject areas

1. Smaller projects tend to have more manageable impacts on networks and users 2. Most large projects can easily be broken down into smaller projects, giving more opportunities to change direction and gain flexibility 3. Shorter planning, development, and implementation schedules reduce uncertainty

•Large projects should be broken into smaller projects for several reasons (3)

-monitoring activity, reporting results, and escalating warnings

•Monitoring, escalation, and incident response consists of?

-carefully organized and stored using a mechanism (manual or automated) that allows timely retrieval and rapid integration of disparate facts

•Network characterization and inventory - Once characteristics are identified, they must be?


संबंधित स्टडी सेट्स

Anxiety Disorders and Obesessive-Compulsive and Related Disorders

View Set

neuro sensory/neuro muscular online practice

View Set

baseball & Pats trivia questions

View Set

Language Arts 11 B Brown v. Board of Education

View Set