CYBR 3100 Test 1

What are the 3 stages that the CPMT (contingency planning management team) conducts the BIA (business impact analysis) in?

1. Identify recovery priorities for system resources 2. Determine mission/business processes & recovery criticality 3. Identify resource requirements

When BS 7799 first came out, several countries, including the United States, Germany, & Japan, refused to adopt it, claiming that it had fundamental problems. What were these problems?

1. The standard lacked the measurement precision associated with a technical standard. 2. It was not as complete as other frameworks. 3. The standard was hurriedly prepared given the tremendous impact its adoption could have on industry information security controls. 4. The global information security community had not defined any jurisdiction for a code of practice identified in ISO/IEC 17799. 5. There was no reason to believe that ISO/IEC 17799 was more useful than any other approach.

​What are the goals of information security governance?

1. ​Strategic alignment of info security with business strategy to support organizational objectives. 2. ​Risk management by executing appropriate measures to manage & mitigate threats to information resources. 3. Resource management by using info security knowledge & infrastructure efficiently & effectively. ​4. Performance measurement by measuring, monitoring, & reporting info security governance metrics to ensure that organizational objectives are achieved. 5. Value delivery by optimizing info security investments in support of organizational objectives.

An industry recommendation for password structure and strength that specifies password should be at least 10 characters long and contain at least one uppercase letter, one lowercase letter, one number, and one special character

10.4 password rule

A famous study entitled "Protection Analysis: Final Report" was published in ____.

1978

False

A best practice proposed for a small to medium business will be similar to one used to help design control strategies for a large multinational company. Select one: True False

False

A champion is a project manager, who may be a departmental line manager or staff unit manager, and understands project management, personnel management, and information security technical requirements.

Subject

A computer is the ____ of an attack when it is used to conduct the attack.

Object

A computer is the ____________________ of an attack when it is the target entity.

False

A data classification scheme is a formal access control methodology used to assign a level of availability to an information asset and thus restrict the number of people who can access it. Select one: True False

Procedures

A frequently overlooked component of an IS, ____________________ are written instructions for accomplishing a specific task.

False

A hard drive feature know as "hot swap" is a RAID implementation in which the computer records all data to twin drives simultaneously, providing a backup if the primary drive fails (T/F)

False

A managerial guidance SysSP is created by IT experts in a company to guide management in the implementation and configuration of technology. (T/F)

Dissemination, Review, Comprehension, Compliance, Enforcement

A policy needs what to be effective

False

A security clearance is a component of a data classification scheme that assigns a status level to systems to designate the maximum level of classified data that may be stored on it. Select one: True False

c. data classification scheme

A(n) _________ is a formal access control methodology used to assign a level of confidentiality to an information asset and thus restrict the number of people who can access it.. Select one: a. security clearance scheme b. risk management scheme c. data classification scheme d. data recovery scheme

d. FCO

A(n) _________ is an authorization issued by an organization for the repair, modification, or update of a piece of equipment. Select one: a. IP b. CTO c. HTTP d. FCO

Enterprise

A(n) ____________________ information security policy outlines the implementation of a security program within the organization.

Methodology

A(n) ____________________ is a formal approach to solving a problem by means of a structured sequence of procedures.

False

A(n) disaster recovery plan includes the steps necessary to ensure the continuation of the organization when a disaster's scope or scale exceeds the ability of the organization to restore operations, usually through relocation of critical business functions to an alternate location. _________________________ Select one: True False

True

A(n) project team should consist of a number of individuals who are experienced in one or multiple facets of the technical and nontechnical areas.

True

A(n) qualitative assessment is based on characteristics that do not use numerical measures. _________________________ Select one: True False

false

ACLs are more specific to the operation of a system than rule-based policies and they may or may not deal with users directly. (T/F)

A subjects ability to use, manipulate, modify =, or affect another subject or object

Access

A specification of an organization's information asset, the users who may access and use it, and their rights and privileges for using the asset.

Access Control List (ACL)

support the mission of the organization, require comprehensive and integrated approach, and be cost-effective

According to NIST SP 800-14's security principles, security should ________.

False

According to Sun Tzu, if you know your self and know your enemy you have an average chance to be successful in an engagement. Select one: True False

An attribute of information that describes how data is free or errors and has the value that the user expects

Accuracy

malware intended to provide desired marketing and advertising, including popups and banners on a users screens

Adware

An __________ is a document containing contact information for the people to be notified in the event of an incident.

Alert roster

after-action review

An _________ is a detailed examination of the events that occurred from first detection to final recovery

incident

An _________ is an adverse even that could result in loss of an information asset or assets, but does not currently threaten the viability of the entire organization

framework

An information security __________ is a specification of a model to be followed during the design, section, and initial and ongoing implementation of all subsequent security controls, including information security policies, security education, and training

Hardware, Software, Data

An information system is the entire set of ____, people, procedures, and networks that make possible the use of information resources in the organization.

In cost-benefit analysis, the product of the annualized rate of occurrence and single loss expectancy

Annualized Loss Expectancy (ALE)

In cost-benefit analysis, the expected frequency of an attack, expressed on a per-year basis

Annualized Rate of Occurrence (ARO)

False

Applications systems developed within the framework of the traditional SDLC are designed to anticipate a software attack that requires some degree of application reconstruction.

____ is the predecessor to the Internet.

Arpanet

The organizational resource being protected

Asset

World first educational and scientific computing society

Association of Computing Machinery (ACM)

Intentional or unintentional act that can damage or otherwise compromise information and systems that support it

Attack

The adoption and implementation of a business model, method, technique, resource, or technology to prevent being outperformed by a competing organization; working to keep pace with the competition through innovation, rather than falling behind.

Avoidance of competitive disadvantage

A __________ plan ensures that critical business functions continue if a catastrophic incident or disaster occurs.

BC (business continuity)

True

Baselining is the comparison of past security activities and events against the organization's current performance. Select one: True False

True

Benchmarking is the process of comparing other organizations' activities against the practices used in one's own organization to produce results it would like to duplicate._________________________ Select one: True False

True

Best business practices are often called recommended practices. Select one: True False

SP 800-14, Generally Accepted Principles and Practices for Securing Information Technology Systems, provides best practices and security principles that can direct the security team in the development of a security ________.

Blueprint

also known as a boot sector virus, a type of virus that targets the boot sector or Master Boot Record (MBR) of a computer system's hard drive or removable storage media.

Boot Virus

A long-term decrease in electrical power availability.

Brownout

A service __________ is an agency that provides a service for a fee.

Bureau

A plan that shows the organization's intended efforts to continue critical functions when operations at the primary site are not feasible

Business Continuity Plan

An investigation and assessment of the various adverse events that can affect the organization, conducted as a preliminary phase of the contingency planning process, which includes a determination of how critical a system or set of information is to the organization's core processes and recovery priorities.

Business Impact Analysis (BIA)

The industry standard for computer security since the development of the mainframe. The standard is based on three characteristics that describe the utility of information confidentiality, integrity , and avaliability

C.I.A Triad

An executive-level position that oversees the organization's computing technology and strives to create efficiency in the processing and access of the organization's information.

Chief Information Officer (CIO)

Typically considered the top information security officer in an organization. The CISO is usually not an executive-level position, and frequently the person in this role reports to the CIO.

Chief Information Security Officer (CISO)

During the ____________________ War, many mainframes were brought online to accomplish more complex and sophisticated tasks so it became necessary to enable the mainframes to communicate via a less cumbersome process than mailing magnetic tapes between computer centers.

Cold

A(n) _________________________ is a group of individuals who are united by similar interests or values within an organization and who share a common goal of helping the organization to meet its objectives.

Community of Interest

a group of individuals who are united by similar interests or values within an organization and who share a common goal of helping the organization to meet its objectives.

Community of Interest

The history of information security begins with the history of ____________________ security.

Computer

cornerstone of many computer-related federal laws and enforcement efforts

Computer Fraud and Abuse Act of 1986

Purpose of commercial advantage Private financial gain Furtherance of a criminal act

Computer Fraud is punishable if if falls into what categories?

The UK law that makes it illegal to hack into a person's computer and to disrupt deliberately someone else's computer.

Computer Misuse Act 1990

one of the first attempts to protect federal computer systems by establishing minimum acceptable security practices

Computer Security Act of 1987

In an organization, the value of ____________________ of information is especially high when it involves personal information about employees, customers, or patients.

Confidentiality

an attribute of informations that describes how data is protected from disclosure r exposure to unauthorized individuals or systems

Confidentiality

True

Confidentiality ensures that only those with the rights and privileges to access information are able to do so.

The instructions a system administrator codes into a server, networking device, or security device to specify how it operates.

Configuration rules

security mechanisms, policies, or procedures that can successfully counter attacks, reduce risk, resolve vulnerabilities, and otherwise improve the security within an organization

Control, safeguard, or countermeasure

Executive management's responsibility to provide strategic direction, ensure accomplishment of objectives, oversee that risks are appropriately managed, and validate responsible resource use

Corporate Governance

False

Cost Benefit Analyses (CBAs) cannot be calculated after controls have been functioning for a time, as observation over time prevents precision in evaluating the benefits of the safeguard and determining whether it is functioning as intended. Select one: True False

False

Cost mitigation ​is the process of preventing the financial impact of an incident by implementing a control. _________________________ Select one: True False

​In 2014, NIST published a new Cybersecurity Framework to create a mandatory framework for managing cybersecurity risk for the delivery of __________, based on vendor-neutral technologies.

Critical infrastructure services

A Web application fault that occurs when an application running on a Web server inserts commands into a user's browser session and causes information to be sent to a hostile server.

Cross-Site Scripting (XSS)

A hacker who seeks to interfere with or disrupt systems to protest the operations, policies, or actions of an organization or government agency.

Cyberactivist/Hacktivist

Formally sanctioned offensive operations conducted by a government or state against information or systems of another government or state.

Cyberwarfare

Incident _________ is the rapid determination of the scope of the breach of the confidentiality, integrity, & availability of information & information assets during or just following an incident.

Damage assessment

items of fact collected by an organization

Data

Which of the following is a valid type of data ownership?

Data Users, Data Owners and Data Custodians

A subset of information security that focuses on the assessment and protection of information stored in data repositories like database management systems and storage media.

Database Security

A backup strategy to store duplicate online transaction data along with duplicate databases at the remote site on a redundant server. This server combines electronic vaulting with remote journaling by writing multiple copies of the database simultaneously to two locations.

Database Shadowing

__________ is an improvement to the process of remote journaling, in which databases are back up almost in real-time to multiple servers at local & remote sites.

Database shadowing

No particular standards, they are established as a matter of practice

De facto standards

Standards may be published, scrutinized, and ratified by a group, as in formal or ________standards.

De jure

Certified standards that actually have weight to them

De jure standards

A strategy for the protection of information assets that uses multiple layers and different types of controls (managerial, operational, and technical) to provide optimal protection.

Defense in Depth

__________ is a strategy for the protection of information assets that uses multiple layers & different types of controls (managerial, operational, & technical) to provide optimal protection.

Defense in depth

created in 2003 from the homeland security act of 2002

Department of Homeland Security

One of the basic tenets of security architectures is the layered implementation of security, which is called defense in __________.

Depth

Integrating the need for the development team to provide iterative and rapid improvements to systems functionality and the need for the operations team to improve security and minimize the disruption from software releases

DevOps

A variation of the brute force password attack that attempts to narrow the range of possible passwords guessed by using a list of common passwords and possibly including attempts based on the target's personal information.

Dictionary password attack

The American contribution to an effort to improve copyright protection internationally

Digital Millennium Copyright Act (DMCA)

A(n) ____ attack is a hacker using a personal computer to break into a system.

Direct

A hacker using a PC to break into a system

Direct Attack

False

Direct attacks originate from a compromised system or resource that is malfunctioning or working under the control of a threat.

The intentional hacking and modification of a DNS database to redirect legitimate traffic to illegitimate internet locations. Also known as DNS spoofing

Domain Name System (DNS) cache poisoning

Within security perimeters the organization can establish security __________, each with differing levels of security, between which traffic must be screened.

Domains

Physical Design

During the ____ phase, specific technologies are selected to support the alternatives identified and evaluated in the logical design.

The __________ is based on and directly supports the mission, vision, and direction of the organization and sets the strategic direction, scope, and tone for all security efforts. Sets out requirements that must be met by the information security blueprint or framework. Shapes the philosophy of security in the environment. AKA general security policy. pg 163-164

EISP (enterprise information security policy)

False

Each of the threats faced by an organization must be evaluated, including determining the threat's potential to endanger the organization. known as a threat prioritization. _________________________ Select one: True False

prevents trade secrets from being illegally shared

Economic Espionage Act (1996)

Keep the design as simple and small as possible

Economy of mechanism

A collection of statutes that regulates the interception of wire, electronic, and oral communications

Electronic Communications Privacy Act of 1986

A backup method that uses bulk batch transfer of data to an off-site facility; this transfer is usually conducted via leased lines or secure Internet connections.

Electronic Vaulting

The transfer of large batches of data to an off-site facility, usually through leased lines or services, is called __________.

Electronic vaulting

Another name for static electricity, which can damage chips and destroy motherboards, even though it might not be felt or seen with the naked eye. Difference of electric potential (Voltage) between two conductors.

Electrostatic Discharge (ESD)

Those whom the new system will most directly affect.

End users

True

Establishing a competitive business model, method, or technique enabled an organization to provide a product or service that was superior and created a(n) competitive advantage. _________________________ Select one: True False

The branch of philosophy that considers nature, criteria, sources, logic, and the validity of moral judgment

Ethics

An __________ is any occurrence within the organization's operational environment.

Event

False

Every member of the organizations InfoSec department must have a formal degree or certification in information security (T/F)

__________ is the physical object or documented information that proves an action occurred or identifies the intent of a perpetrator.

Evidence

True

Exposure factor is the expected percentage of loss that would occur from a particular attack. _________________________ Select one: True False

Base access decisions on permission rather than exclusion

Fail-safe defaults

True

Failure to develop an information security system based on the organizations mission, vision, and culture guarantees the failure of the information security program (T/F)

A breach of possession always results in a breach of confidentiality.

False

A policy should state that if employees violate a company policy or any law using company technologies, the company will protect them, & the company is liable for the employee's actions.

False

An e-mail virus involves sending an e-mail message with a modified field.

False

Every member of the organization's InfoSec department must have a formal degree or certification in information security.

False

Hardware is often the most valuable asset possessed by an organization and it is the main target of intentional attacks.

False

Information has redundancy when it is free from mistakes or errors and it has the value that the end user expects.

False

Key end users should be assigned to a developmental team, known as the united application development team.

False

MULTICS stands for Multiple Information and Computing Service.

False

Risk evaluation is the process of identifying, assessing, and evaluating the levels of risk facing the organization, specifically the threats to the organization's security and to the information stored and processed by the organization.

False

The implementation phase is the longest and most expensive phase of the systems development life cycle (SDLC).

False

ACLs are more specific to the operation of a system than rule-based policies & they may or may not deal with users directly.

False, ACLs regulate: *Who* can use the system *What* authorized users can access *When* authorized users can access the system *Where* authorized users can access the system

A cold site provides many of the same services & options of a hot site, but at a lower cost.

False, cold sites provide only rudimentary services & facilities

Primary branch of US law enforcement. One of the primary missions is to investigate cyber crime

Federal Bureau of Investigation (FBI)

mandates that all federal agencies to protect their information assets

Federal Information Security Management Act (FISMA)

Regulates government agencies and holds them accountable if they release private information about individuals or businesses without permission

Federal Privacy Act of 1974

b. Unclassified

Federal agencies such as the NSA, FBI, and CIA use specialty classification schemes. For materials that are not considered 'National Security Information', __________ data is the lowest level classification. Select one: a. Confidential b. Unclassified c. Sensistive d. Public

contains many provisions that focus on facilitating affiliation among banks, securities firms, and insurance companies

Financial Services Modernization Act of 1999 Gramm-Leach Bliley Act

Redundancy can be implemented at a number of points throughout the security architecture, such as in __________.

Firewalls, proxy servers, and access controls

A security __________ is an outline of the overall information security strategy for the organization & a road map for planned changes to the information security environment of the organization.

Framework

allows any person to request access to federal agency records or information not determined to be a matter of national security.

Freedom of Information Act (FOIA)

Set of responsibilities and practices exercised by the board and executive management with the goal of providing strategic direction, ensured objectives are achieved and risks are properly managed.

Governance

protects the confidentiality and security of healthcare data by establishing and enforcing standards and by standardizing electronic data interchange

Health Insurance Portability and Accountability Act (HIPAA) Kennedy-Kassebaum Act

An alert roster in which the first person calls a few other people on the roster, who in turn call others. This method typically uses the organizational chart as a structure.

Hierarchical roster

professional association that focuses on auditing, control, and security

ISACA

non profit society of more that 10,000 information security professionals in over 100 countries

ISSA

__________, commonly referred to as fair & responsible use policies, are used to control constituents' use of a particular resource, asset, or activity. pg 164

ISSPs (issue-specific security policies)

In early 2014, in response to Executive Order 13636, NIST published the Cybersecurity Framework that intends to allow organization to __________.

Identify & prioritize opportunities for improvement within the context of a continuous & repeatable process

False

Identifying human resources, documentation, and data information assets of an organization is less difficult than identifying hardware and software assets. Select one: True False

True

If the acceptance strategy is used to handle every vulnerability in the organization, its managers may be unable to conduct proactive security activities and portray an apathetic approach to security in general Select one: True False

Components are ordered, received, and tested

Implementation

False

In a cost-benefit analysis, a single loss expectancy (SLE) is the calculated value associated with the most likely loss from an attack, with the SLE being the product of the asset's value and the annualized loss expectancy. Select one: True False

b. weighted factor analysis

In a(n) __________, assets or threats can be prioritized by identifying criteria with differing levels of importance, assigning a score for each of the criteria and then summing and ranking those scores. Select one: a. data classification scheme b. weighted factor analysis c. risk management program d. threat assessment

True

In addition to their other responsibilities, the three communities of interest are responsible for determining which control options are cost effective for the organization, Select one: True False

Hash

In file hashing, a file is read by a special algorithm that uses the value of the bits in the file to compute a single large number called a ____ value.

False

In general, protection is "the quality or state of being secure—to be free from danger."

False

In information security, benchmarking is the comparison of past security activities and events against the organization's current performance. _________________________ Select one: True False

True

In information security, salami theft occurs when an employee steals a few pieces of information at a time, knowing that taking more would be noticed — but eventually the employee gets something complete or useable.

a plan that shows the organization's intended efforts in the event of an incident

Incident Response Plan

Response

Incident ____________________ is the set of activities taken to plan for, detect, and correct the impact of an incident on information assets.

The rapid determination of how seriously a breach of confidentiality, integrity, and availability affected information and information assets during an incident or just following one.

Incident damage assessment

A hacker compromising a system and using it to attack other systems (ie. Botnet)

Indirect Attack

The act of an attacker or trusted insider who steals information from a computer system and demands compensation for its return or for an agreement not to disclose the information.

Information Extortion

The entire set of software, hardware, data, people, procedures, and networks that enable the use of information resources in the organization.

Information System

Integrity

Information has ____________________ when it is whole, complete, and uncorrupted.

False

Information security can be an absolute.

Protecting the organization's ability to function, protecting the data and information the organization collects and uses, whether physical or electronic, Enabling the safe operation of applications running on the organization's IT systems, safeguarding the organization's technological assets

Information security important functions

The creation, ownership, and control of original ideas as well as the representation of those ideas.

Intellectual property (IP)

A hacker attempting to break into an IS system

Intentional Attack

nonprofit organization that focuses on the development and implementation of information security certifications and credentials

International Information Systems Security Certification Consortium

A structured process in which users, managers, and analysts work together for several days in a series of intensive meetings to specify or review system requirements.

Joint Application Design (JAD)

power to make legal decisions

Jurisdiction

False

Know yourself means identifying, examining, and understanding the threats facing the organization. Select one: True False

Providing only the minimum amount of privileges necessary to perform a job or function.

Least Privilege

Minimize mechanisms (or shared variables) common to more than one user and depended on by all users.

Least common mechanism

True

Likelihood is the probability that a specific vulnerability within an organization will be the target of an attack. _________________________ Select one: True False

The ability of a legal entity to exercise influence beyond its normal range

Long Arm Jurisdiction

A single instance of an information asset suffering damage or destruction

Loss

False

Loss event frequency is the combination of an asset's value and the percentage of it that might be lost in an attack.. _________________________ Select one: True False

____ was the first operating system to integrate security as its core functions.

MULTICS

Backdoor used by programmers to debug and test programs.

Maintenance hook

A group of attacks whereby a person intercepts a communications stream and inserts himself in the conversation to convince each of the legitimate parties that he is the other communications partner.

Man-in-the-middle

A managerial guidance SysSP document is created by __________ to guide the implementation & configuration of technology.

Management

The stated purpose of ISO/IEC 27002 is to "offer guidelines & voluntary directions for information security __________."

Management

b. All of the above

Management of classified data includes its storage and _________. Select one: a. portability b. All of the above c. distribution d. destruction

__________ controls are info security safeguards that focus on administrative planning, organizing, leading, & controlling. They're designed by strategic planners & implemented by the security administration of the organization. Includes governance & risk management.

Managerial

A systems-specific security policy that expresses management's intent for the acquisition, implementation, configuration, and management of a particular technology, written from a business perspective.

Managerial guidance SysSP

The total amount of time the system owner or authorizing official is willing to accept for a business process outage or disruption. The MTD includes all impact considerations.

Maximum Tolerable Downtime (MTD)

A graphical representation of the architectural approach widely used in computer and information security.

McCumber Cube

The average amount of time a computer repair technician needs to resolve the cause of a failure through replacement or repair of a faulty unit.

Mean Time to Repair (MTTR)

The average amount of time until the next hardware failure.

Mean time to failure (MTTF)

____ presents a comprehensive information security model and has become a widely accepted evaluation standard for the security of information systems.

NSTISSI No. 4011

The Internet brought connectivity to virtually all computers that could reach a phone line or an Internet-connected local area ____________________.

Network

False

Network security focuses on the protection of the details of a particular operation or series of activities.

False

One advantage to benchmarking is that best practices change very little over time. Select one: True False

True

One way to determine which information assets are valuable is by evaluating which information asset(s) would expose the company to liability or embarrassment if revealed. _________________________ Select one: True False

the design of a security mechanism should be open rather than secret

Open Design

__________ controls address personnel security, physical security, and the protection of production inputs and outputs. They also guide the development of education, training, and awareness programs for users, administrators, and management.

Operational

True

Operational feasibility is also known as behavioral feasibility. _________________________ Select one: True False

hacker tools

Organizations generally have policies against installation of _____________ without written permission for the CISO

Incidence Response

Part of the logical design phase of the SecSDLC is planning for partial or catastrophic loss. ____ dictates what steps are taken when an attack occurs.

An attempt to learn or make use of information from the system that does not affect system resources

Passive Attack

Standards of performance to which participating organizations must comply. Applies to organizations that process payment cards, such as credit cards, debit cards, ATM cards, stored-value cards, gift cards, and other items.

Payment Card Industry Data Security Standard (PCI DSS)

The spheres of security are the foundation of the security framework and illustrate how information is under attack from a variety of sources, with far fewer protection layers between the information and potential attackers on the __________ side of the organization.

People

A set of information that could uniquely identify an individual

Personally Identifiable Information (PII)

The redirection of legitimate user Web traffic to illegitimate Web sites with the intent to collect personal information

Pharming

the fraudulent practice of sending emails purporting to be from reputable companies in order to induce individuals to reveal personal information, such as passwords and credit card numbers.

Phishing

A hacker who manipulates the public telephone system to make free calls or disrupt services.

Phreaker

During the early years, information security was a straightforward process composed predominantly of ____________________ security and simple document classification schemes.

Physical

Specific technologies are selected to support the alternatives identified and evaluated in the logical design.

Physical Design

The protection of physical items, objects, or areas from unauthorized access and misuse.

Physical Security

False

Policies are written instructions for accomplishing a specific task.

A __________ is a plan or course of action that conveys instructions from an organization's senior management to those who make decisions, take actions, and perform other duties.

Policy

examples of actions that illustrate compliance with policies

Practices

a form of social engineering in which one individual lies to obtain confidential data about another individual

Pretexting

The unauthorized modification of an authorized or unauthorized system user account to gain advanced access and control over system resources

Privilege Escalation

The entire set of controls and safeguards, including policy, education, training and awareness, and technology, that the organization implements to protect the asset.

Protection profile or security posture

The key components of the security perimeter include firewalls, DMZs (demilitarized zones), __________ servers, & IDPSs.

Proxy

It is essential that the human interface be designed for ease of use, so that users routinely and automatically apply the protection mechanisms correctly

Psychological acceptability

A security policy should begin with a clear statement of __________.

Purpose (policy)

A table of hash values and their corresponding plaintext values that can be used to look up password values if an attacker is able to steal a system's encrypted password files

Rainbow Tables

a computer software designed by hackers that locks people out of their computers or files and demands payment for access.

Ransomware

The point int time prior to a disruption or system outage to which mission/business process data can be recovered

Recovery Point Objective (RPO)

The maximum amount of time that a system resource can remain unavailable before there is an unacceptable impact on other system resources, supported mission/business processes, and the MTD.

Recovery Time Objective (RTO)

firewalls, proxy servers, access controls

Redundancy can be implemented at a number of pints throughout the security architecture such as

RAID stands for a __________ array of independent disk drives that stores information across multiple units to spread out data & minimize the impact of a single drive failure.

Redundant

A system of drives that stores information across multiple units to spread out data and minimize the impact of a single drive failure

Redundant Array of Independent Disks (RAID)

The backup of data to an off-site facility in close to real time based on transactions as they occur.

Remote Journaling

the probability of an unwanted outcome, such as an adverse event or loss

Risk

a. acceptance

Risk _________ defines the quantity and nature of risk that organizations are willing to accept as they evaluate the tradeoffs between perfect security and unlimited accessibility. Select one: a. acceptance b. appetite c. avoidance d. benefit

c. control

Risk _________ is the application of security mechanisms to reduce the risks to an organization's data and information systems. Select one: a. identification b. management c. control d. security

Same as jailbreaking

Rooting

professional research and education cooperative organization the also awards security certificates

SANS

A managerial program designed to improve the security of information assets by providing targeted knowledge, skills, and guidance for an organization's employees.

SETA

__________ is a managerial program designed to improve the security of information assets by providing targeted knowledge, skills, and guidance for organizations. The end goal is to reduce accidental security breaches by employees.

SETA (security education, training, and awareness)

Seeks to improve the reliability and accuracy of financial reporting, as well as increase the accountability of corporate governance, in publicly traded organizations

Sarbanes-Oxley Act

Organizations are moving toward more ____-focused development approaches, seeking to improve not only the functionality of the systems they have in place, but consumer confidence in their product.

Security

Dedicated, trained, and well-educated specialists in all aspects of information security from both a technical and nontechnical standpoint.

Security Professionals

provides guidance for the use of encryption and provide protection from government intervention

Security and Freedom through Encryption Act of 1999

The boundary in the network within which an organization attempts to maintain security controls for security information threats from untrusted network areas

Security perimeter

People who understand the organizational culture, existing policies, and requirements for developing and implementing successful policies.

Security policy developers

Provide mechanisms that separate the privileges used for one purpose from those used for another

Separation of privileges

An alert roster in which a single contact person calls each person on the roster

Sequential roster

A level of redundancy provided by mirroring entire servers called redundant servers

Server fault tolerance

A continuity strategy in which an organization contracts with a service agency to provide a BC facility for a fee.

Service Bureau

A document or part of a document that specifies the expected level of service from a service provider. Usually contains provisions for minimum acceptable availability and penalties or remediation procedures for downtime.

Service Level Agreement (SLA)

The collection, analysis, and distribution of information from foreign communications networks for intelligence and counterintelligence purposes and in support of military operations.

Signals Intelligence

The ____________________ component of the IS comprises applications, operating systems, and assorted command utilities.

Software

A methodological approach to the development of software that seeks to build security into the development life cycle rather than address it at later stages. Attempts to intentionally create software free of vulnerabilities and provide effective, efficient software that users can deploy with confidence

Software Assurance

Using the DevOPs methodologies of an integrated development and the operations approach that is applied to the specification, creation, and implementation of security control systems

SpecOps

A technique for gaining unauthorized access to computers using a forged or modified source IP address to give the perception that messages are coming from a trusted host.

Spoofing

Initiation, Development/Acquisition, Implementation/Assessment, Operations/Maintenance, Disposal

Stages in NIST approach to SDLC

Investigation, Analysis, Logical Design, Physical Design, Implementation, Maintenance and Change

Stages of the SDLC

__________ are more detailed statements of what must be done to comply with policy.

Standards

The organization's __________ plan documents the organization's intended long-term direction & efforts for the next several years.

Strategic

the process of defining and specifying the long tems direction to be taken by the organization

Strategic Planning

Some policies may also need a __________ clause indicating their expiration date.

Sunset

A component of policy or law that defines an expected end date for its applicability.

Sunset Clause

According to NIST SP 800-14's security principles, security should ________.

Support the mission of the organization, require a comprehensive and integrated approach, and be cost-effective.

__________ often function as standards or procedures to be used when configuring or maintaining systems. pg 168

SysSPs (system-specific security policies)

People with primary responsibility for administering systems that house the information used by the organization

Systems Administrators

A methodology for the design and implementation of an information system.

Systems Development Life Cycle (SDLC)

The most successful kind of top-down approach involves a formal development strategy referred to as a ____.

Systems Development Life Cycle (SDLC)

Organizational policies that often function as standards or procedures to be used when configuring or maintaining systems.

Systems-Specific Security Policies (SysSPs)

A form of man-in-the-middle attack whereby the attacker inserts himself into TCP/IP-based communications.

TCP hijacking

Information security safeguards focused on the application of modern technology, systems, and processes to protect information assets. These safeguards include firewalls, virtual private networks, and IDPSs.

Technical Controls

False

The Analysis phase of the SecSDLC begins with a directive from upper management.

CIA

The CNSS model of information security evolved from a concept developed by the computer security industry known as the ____________________ triangle.

True

The ISO/IEC 27000 series is derived from an earlier standard, BS7799 (T/F)

accidental

The SETA program is a control measure designed to reduce the instances of ________ security breaches by employees

False

The Security Development Life Cycle (SDLC) is a methodology for the design and implementation of an information system.

SDLC

The ____ is a methodology for the design and implementation of an information system in an organization.

CISO

The ____ is the individual primarily responsible for the assessment, management, and implementation of information security in the organization.

a. defense

The _________ control strategy that attempts to eliminate or reduce any remaining uncontrolled risk through the application of additional controls and safeguards. Select one: a. defense b. transfer c. mitigate d. termination

c. transfer

The __________ control strategy attempts to shift risk to other assets, other processes, or other organizations. Select one: a. defend b. accept c. transfer d. mitigate

c. performance gap

The __________ is the difference between an organization's observed and desired performance. Select one: a. issue delta b. objective c. performance gap d. risk assessment

c. IR

The __________ plan specifies the actions an organization can and should take while an adverse event (that could result in loss of an information asset or assets, but does not currently threaten the viability of the entire organization) is in progress. Select one: a. BC b. DR c. IR d. BR

b. acceptance

The __________ strategy is the choice to do nothing to protect a vulnerability and to accept the outcome of its exploitation. Select one: a. transfer b. acceptance c. mitigation d. defense

Analysis

The ____________________ phase consists primarily of assessments of the organization, its current systems, and its capability to support the proposed systems.

False

The bottom-up approach to information security has a higher probability of success than the top-down approach.

a. loss frequency

The calculation of the likelihood of an attack coupled with the attack frequency to determine the expected number of losses within a specified time range is called the __________. Select one: a. loss frequency b. benefit of loss c. likelihood d. annualized loss expectancy

True

The computer security resource center at NIST provides several useful document free of charge in it special publications area (T/F)

d. disadvantage

The concept of competitive _________ refers to falling behind the competition. Select one: a. shortcoming b. drawback c. failure d. disadvantage

d. risk identification

The first phase of risk management is _________. Select one: a. risk evaluation b. risk control c. design d. risk identification

d. CBA

The formal decision making process used when considering the economic feasibility of implementing information security controls and safeguards is called a(n) __________. Select one: a. ARO b. SLE c. ALE d. CBA

True

The investigation phase of the SecSDLC begins with a directive from upper management.

False

The possession of information is the quality or state of having value for some purpose or end.

true

The process of examining an incident candidate and determine whether it constitutes an actual incident is called incident classification (T/F)

True

The roles of information security professionals are aligned with the goals and mission of the information security community of interest.

Information

The senior technology officer is typically the chief ____________________ officer.

remote journaling

The transfer of live transactions in real time to an off-site facility is called ______________

True

The value of information comes from the characteristics it possesses.

a. dumpster diving

There are individuals who search trash and recycling - a practice known as _________ - to retrieve information that could embarrass a company or compromise information security. Select one: a. dumpster diving b. shoulder surfing c. corporate espionage d. pretexting

any event or circumstance that has the potential to adversely affect operations and assets

Threat

A category of objects, people, or other entities that represents the origin of danger to an asset - in other words, a category of threat agents

Threat Source

the specific instance or a component of a threat

Threat agent

An occurrence of an event caused by a threat agent

Threat event

True

To achieve balance — that is, to operate an information system that satisfies the user and the security professional — the security level must allow reasonable access, yet protect against threats.

True

To remain viable, security policies must have a responsible individual, a schedule of reviews, a method for making recommendations for reviews, and policy issuance and planned revision date. (T/F)

A capability table specifies which subjects & objects users or groups can access.

True

A data custodian works directly with data owners and is responsible for the storage, maintenance, and protection of the information.

True

A disaster recovery plan is a plan that shows the organization's intended efforts to restore operations at the original site in the aftermath of a disaster.

True

Disaster recovery personnel must know their roles without supporting documentation, which is a function of preparation, training & rehearsal.

True

Each policy should contain procedures & a timetable for periodic review.

True

Failure to develop an information security system based on the organization's mission, vision, & culture guarantees the failure of the information security program.

True

Hardware is the physical technology that houses and executes the software, stores and transports the data, and provides interfaces for the entry and removal of information from the system.

True

Information security can begin as a grassroots effort in which systems administrators attempt to improve the security of their systems, which is often referred to as a bottom-up approach.

True

NIST 800-14's Principles for Securing Information Technology Systems, can be used to make sure the needed key elements of a successful effort are factored into the design of an information security program & to produce a blueprint for an effective security architecture.

True

Of the two approaches to information security implementation, the top-down approach has a higher probability of success.

True

Recently, many states have implemented legislation making certain computer-related activities illegal.

True

Security training provides detailed information & hands-on instruction to employees to prepare them to perform their duties securely.

True

The Computer Security Resource Center at NIST provides several useful documents free of charge in its special publications area.

True

The primary threats to security during the early years of computers were physical theft of equipment, espionage against the products of the systems, and sabotage.

True

The process of examining an incident candidate and determining whether it constitutes an actual incident is called incident classification.

True

To remain viable, security policies must have (1) a responsible manager, (2) a schedule of reviews, (3) a method for making recommendations for reviews, & (4) a policy issuance & revision date.

True

To remain viable, security policies must have a responsible individual, a schedule of reviews, a method for making recommendations for reviews, and a policy issuance and planned revision date.

True

To remain viable, security policies must have a responsible manager, a schedule of reviews, a method for making recommendations for reviews, & a policy issuance & planned revision date.

True

Located in the DHS and charged with protecting the financial sector infrastructure

US secret service

provides law enforcement agencies with broader latitude to combat terrorism related activities

USA PATRIOT ACT

A lightning strike that causes a building fire (or something like that)

Unintentional Attack

True

Using a methodology increases the probability of success.

A type of malware that is attached to other executable programs. Requires user interaction to replicate

Virus

A type of SDLC in which each phase of the process "flows from" the information gained in the previous phase, with multiple opportunities to return to previous phases and make adjustments.

Waterfall Model

False

When a computer is the subject of an attack, it is the entity being attacked.

c. standards of due care

When organizations adopt security measures for a legal defense, they may need to show that they have done what any prudent organization would do in similar circumstances. This is referred to as __________. Select one: a. best practices b. benchmarking c. standards of due care d. baselining

Maintenance and Change

Which of the following phases is the longest and most expensive phase of the systems development life cycle?

True

You can create, a single comprehensive ISSP document covering all information security issues (T/F)

b. DR

_______ plans usually include all preparations for the recovery process, strategies to limit losses during the disaster, and detailed steps to follow when the smoke clears, the dust settles, or the flood waters recede. Select one: a. BR IncorrectIncorrect b. DR c. BC d. IR

d. MAC

________ addresses are sometimes called electronic serial numbers or hardware addresses. Select one: a. IP b. DHCP c. HTTP d. MAC

a. security clearance scheme

________ assigns a status level to employees to designate the maximum level of classified data they may access. Select one: a. security clearance scheme b. risk management scheme c. data recovery scheme d. data classification scheme

technical

________ controls are information security safeguards that focus on the application of modern technologies, systems, and processes to protect information assets

d. Risk

________ equals the probability of a successful attack times the expected loss from a successful attack plus an element of uncertainty. Select one: a. Loss Frequency b. Loss c. Loss Magnitude d. Risk

mangerial

_________ controls cover security processes that are designed by the strategic planners and implemented by the security administration of the organization

c. Operational

_________ feasibility analysis examines user acceptance and support, management acceptance and support, and the overall requirements of the organization's stakeholders. Select one: a. Political b. Organizational c. Operational d. Technical

a. Qualitative assessment

_________ is an asset valuation approach that uses categorical or non-numeric values rather than absolute numerical measures. Select one: a. Qualitative assessment b. Metric-centric model c. Quantitative assessment d. Value-specific constant

a. ARO

_________ is simply how often you expect a specific type of attack to occur. Select one: a. ARO b. CBA c. ALE d. SLE

mangerial

__________ controls are security processes that are designed by strategic planners and implemented by the security administrator of the organization

Software

____________________ carries the lifeblood of information through an organization.

Availability

____________________ enables authorized users — persons or computer systems — to access information without interference or obstruction and to receive it in the required format.

Authenticity

____________________ of information is the quality or state of being genuine or original, rather than a reproduction or fabrication.

The risk control strategy that indicates the organization is willing to accept the current level of risk

acceptance risk control strategy

An integration of access control lists (focusing on assets) and capability tables (focusing on users) that results in a matrix with organizational assets listed in the column headings and users listed in the row headings. The matrix contains ACLs in columns for a particular device or asset and capability tables in rows for a particular user

access control matrix

the perpetrator offers to share the proceeds of some large payoff with the victim if the victim will make a "good faith" deposit or provide some partial funding first.

advance fee fraud

An event with negative consequences that could threaten the organization's information assets or operations

adverse event

A detailed examination and discussion of the events that occurred, from first detection to final recovery

after-action review

Collective data that relates to a group or category of people and that has been altered to remove characteristics or components that make it possible to identify individuals within the group.

aggregate information

A scripted description of the incident that usually contains just enough information so that each person knows what portion of the IR plan to implement without slowing down the notification process

alert message

A document that contains contact information for people to be notified in the event of an incident

alert roster

in a cost-benefit analysis, the total cost of a control or safeguard, including all purchase, maintenance, subscription, personnel, and support fees, divided by the total number of expected years of use.

annualized cost of a safeguard (ACS)

The combination of an asset's value and the percentage of it that might be loss in an attack

asset exposure

The process of assigning financial value or worth to each information asset.

asset valuation

The number of successful attacks that are expected to occur within a specified time period.

attack success probability

An attribute of information that describes how data is genuine or original rather than reproduced or fabricated.

authenticity

____ of information is the quality or state of being genuine or original.

authenticity

An attribute of information that describes how data is accessible and correctly formatted for use without interference or obstruction.

availability

An interruption in service, usually from a service provider, which causes an adverse event within an organization.

availability disruption

a malware payload that provides access to a system by bypassing normal access controls.

back door

An assessment of performance of some action or process against which future performance is assessed

baseline

The process of conducting a baseline

baselining

An examination of how well a particular solution fits within the organizations culture and the extent to which users are expected to accept the solution

behavioral feasibility

An attempt to improve information security practices by comparing an organization's effort against practices of a similar organization or an industry-developed standard to produce results it would like to duplicate.

benchmarking

Security efforts that are considered among the best in the industry.

best business practices

A long-term interruption (outage) in electrical power availability.

blackout

an abbreviation of robot, an automated software program that executes certain commands when it receives a specific input

bot

False

bottom-up is generally more successful that top-down (T/F)

A method of establishing security policies and/or practices that begins as a grassroots effort in which systems administrators attempt to improve the security of their systems

bottum-up approach

an attempt to guess a password by attempting every possible combination of characters and numbers in it

brute force password attack

An application error that occurs when more data is sent to a program buffer than it is designed to handle.

buffer overrun (or buffer overflow)

The actions taken by senior management to develop and implement the BC policy, plan, and continuity teams

business continuity planning

The actions taken by senior management to develop and implement a combined DR and BC policy, plan, and set of recovery teams

business resumption plan

In a lattice-based access control, the row of attributes associated with a particular subject (such as a user).

capabilities table

A senior executive who promotes the project and ensures its support, both financially and administratively, at the highest levels of the organization

champion

An organizational policy that specifies employees must inspect their work areas and ensure that all classified information, documents, and materials are secured at the end of every work day.

clean desk policy

A facility that provides only rudimentary services, with no computer hardware or peripherals

cold site

An application error that occurs when user input is passed directly to a compiler or interpreter without screening for content that may disrupt or compromise the intended function.

command injection

The protection of all communications media, technology, and content

communications security

The adoption and implementation of an innovative business model, method, technique, resource, or technology in order to outperform competition

competitive advantage

The collection and analysis of information about an organization's business competitors through legal and ethical means to gain business intelligence and competitive advantage.

competitive intelligence

The process of collecting, analyzing, and preserving computer-related evidence.

computer forensics

in the early days of computers, this term specified the need to secure the physical location of computer technology for outside threats This term later came to represent concepts of information security as the scope of protecting information in an organization has expanded.

computer security

The formal assessment and presentation of the economic expenditures needed for a particular security control, contrasted with its projected value to the organization

const-benefit analysis

A plan that shows that organizations intended effort in reaction to adverse events

contingency plan

The actions taken by senior management to specify the organization's efforts and actions if an adverse events becomes an incident or disaster

contingency planning

The group of senior managers and project members organized to conduct and lead all CP efforts.

contingency planning management team (CPMT)

The financial savings from using the defense risk control strategy to implement a control and eliminate the financial ramifications of an incident

cost avoidance

A hacker who intentionally removes or bypasses software copyright protection designed to prevent unauthorized duplication or use.

cracker

Attempting to reverse-engineer, remove, or bypass a password or other access control protection, such as the copyright protection on software.

cracking

An organization's set of planning and preparation efforts for dealing with potential human injury, emotional trauma, or loss of lie as a result of disaster

crisis mangment

fixed moral attitudes or customs of a particular group

cultural mores

Attacker whose motivation may be defined as ideological, or attacking for the sake of principles or beliefs.

cyberterrorist

Individuals who work directly with dta owners and are responsible for storage, maintenance, and protection of information

data custodians

Individuals who control (and are therefore responsible for) the security and use of a particular set of information. Data owners may rely on custodians for the practical aspects of protecting their information, specifying which users are authorized to access it, but they are ultimately responsible for it.

data owners

Commonly used as a surrogate for information security, data security is the focus of protecting data or information in its various states—at rest (in storage), in processing, and in transmission (over networks).

data security

Internal and external stakeholders (customers, suppliers, and employees) who interact with information in support of their organization's planning and operations.

data users

A collection of data organized in a manner that allows access, retrieval, and use of that data

database

The risk control strategy that attempts to eliminate or reduce any remaining uncontrolled risk through the application of additional controls and safeguards. Also known as the avoidance strategy.

defense risk control strategy

An attack that attempts to overwhelm a computer target's ability to handle incoming communications, prohibiting legitimate users from accessing those systems

denial-of-software (DoS) attack

An adverse event that could threaten the viability of the entire organization

disaster

A plan that shows the organization's intended effort in the event of a disaster

disaster recovery plan

The actions taken by senior management to specify the organization's efforts in preparation for and recovery from a disaster.

disaster recovery planning

An approach to disk mirroring in which each drive has its own controller to provide additional redundancy.

disk duplexing

A RAID implementation (typically referred to as RAID Level 1) in which the computer records all data to twin drives simultaneously, providing a backup if the primary drive fails

disk mirroring

A RAID implementation (typically referred to as RAID Level 0) in which one logical volume is created by storing data across several available hard drives in segments called stripes.

disk striping

A DoS attack carried out by multiple computers.

distributed-denial-of-service (DDoS) attack

The percentage of time a particular service is not available; the opposite of uptime.

downtime

Measures that an organization takes to ensure every employee knows what is acceptable and what is not.

due care

reasonable steps taken by a person in order to satisfy a legal requirement, especially in buying or selling something.

due dilligence

An information attack that involves searching through a target organization's trash and recycling bins for sensitive information.

dumpster diving

The high-level security policy that is based on and directly supports the mission, vision, and direction of the organization and sets the strategic direction, scope, and tone for all security efforts.

enterprise information security policy (EISP)

A physical object or documented information entered into a legal proceeding that proves an action occurred or identifies the intent of a perpetrator

evidence

A hacker who uses extensive knowledge of the inner workings of computer hardware and software to gain unauthorized access to systems and information.

expert hacker

A technique used to compromise a system

exploit

State of being expose, in infosec: when a vulnerability is known to an attacker

exposure

The expected percentage of loss that would occur from a particular attack

exposure factor

A short-term interruption in electrical power availability

fault

the desired end of a planning cycle

goals

Non Mandatory recommendations the employee may use as a reference in complying with policy

guidelines

a person who uses computers to gain unauthorized access to data.

hacker

A fully operational offsite data processing facility equipped with both hardware and system software to be used in the event of a disaster

hot site

A hard drive feature that allows individual drives to be replaced without fault and without powering down the entire system

hot swap

An adverse event that could result in loss of an information asset or asset, bu does not currently threaten the viability of the entire organization

incident

The process of examining an incident candidate and determining whether it constitutes an actual incident.

incident classification

The actions taken by senior management to develop and implement IR policy, plan, anc computer security incident response team

incident response planning

The collection and analysis of information about an organization's business competitors, often through illegal or unethical means, to gain an unfair competitive advantage.

industrial espionage

data that has been organized, structured, and presented to provide additional insights into its context, worth, and usefulness

information

Pieces of non-private data that, when combined, may create information that violates privacy.

information aggregation

The focus of information security; information that has value to the organization, and the systems that store, process, and transmit the information.

information asset

Protection of the confidentiality, integrity, and availability of information assets, whether in storage, processing, or transmission, via the application of policy, education, training and awareness, and technology.

information security

a framework or security model customized to an organization, including implementation details

information security blueprint

A specification of a model to be followed during the design, selection and initial and ongoing implementation of all subsequent security controls

information security framework

The application of the principles of corporate governance to the information security function.

information security governance

Written instructions provided by management that informs employees and others in the workplace about proper behavior regarding the use of information and information assets

information security policy

A class of computational error caused by methods that computers use to store and manipulate integer numbers; this bug can be exploited by attackers.

integer bug

An attribute of data that describes how data is whole, complete, and uncorrupted

integrity

During this phase, the objective, constraints, and scope of the project are specified

invesigation

An organizational policy that provides detailed, targeted guidance to instruct all members of the organization in the use of a resource, such as one of its processes or technologies.

issue-specific security policy

Escalating privileges to gain administrator-level or root access control over a smartphone

jailbreaker

rules that mandate or prohibit certain behavior and are enforced by the state

laws

Entity's legal obligation or responsibility

liability

The probability that a specific vulnerability within an organization will be the target of an attack

likelihood

In this phase, the information gained from the analysis phase is used t begin creating a systems solution for a business problem. Contains no reference to specific technologies, vendors, or products.

logical design

The calculation of the likelihood of an attack coupled with the attack frequency to determine the expected number of losses within a specified time range.

loss frequency

A type of virus written in a specific macro language to target applications that use the language

maco virus

An attack designed to overwhelm the receiver with excessive quantities of e-mail.

mail bomb

longest and most expensive phase of the systems development life cycle

maintenance and change

Computer software specifically designed to perform malcious or unwanted actions

malware/malicious code/malicious software

information security safeguards that focus on administrative planning, organizing, leading, and controlling, and that are designed by strategic planners and implemented by the organization's security administration. These safeguards include governance and risk management.

managerial controls

The average amount of time a computer repair technician needs to determine the cause of a failure.

mean time to diagnose (MTTD)

The average amount of time between hardware failures, calculated as the total amount of operation time for a specified number of units divided by the total number of failures

meantime between failure (MTBF)

As a subset of information assets, teh systems and networks that sore, process and transmit information

media

A virus that is capable of installing itself in a computer's operating system, starting when the computer is activated, and residing in the system's memory even after the host application is terminated.

memory-resident virus

A formal approach to solving a problem based on a structured sequence of procedures.

methodology

performance measures or metrics based on observed numerical data

metrics-based performance

The risk control strategy that attempts to reduce the impact of the loss caused by a realized incident, disaster, or attack through effective contingency planning and preparation.

mitigation risk control strategy

A continuity strategy in which two organizations sign a contract to assist the other in a disaster by providing BC facilities, resources, and services until the organization in need can recover from the disaster.

mutual agreement

A subset of communications security; the protection of voice and data networking components, connections, and content.

network security

The presence of additional and disruptive signals in network communications or electrical power delivery

noise

A virus that terminates after it has been activated, infected its host system, and replicated itself.

non-memory-resident virus

A relatively unskilled hacker who uses the work of expert hackers to perform attacks.

novice hacker

the entity being attacked

object of attack

Specific, short-term statements detailing how to achieve the organization's goals.

objectives

Information security safeguards focusing on lower-level planning that deals with the functionality of the organization's security. These safeguards include disaster recovery and incident response planning.

operational controls

a plan for the organization's intended operational efforts on a day-today basis for the next several months

operational plan

The action taken by management to specify the short-term goals and objective of the organization in order to obtain specified tactical goals

operational planning

An examination of how well a particular solution fits within the organizations strategic planning objectives and goals

organizational feasibility

A script kiddie who uses automated exploits to engage in denial-of-service attacks.

packet monkey

A software program or hardware appliance that can intercept, copy, and interpret network traffic.

packet sniffer

An information security professional with authorization to attempt to gain system access in an effort to identify and recommend resolutions for vulnerabilities in those systems.

penetration tester

The difference between an organization's observed and desired performance

performance gap

____ security addresses the issues necessary to protect the tangible items, objects, or areas of an organization from unauthorized access and misuse.

physical

Guidelines that dictate certain behavior within an organization

policy

An employee responsible for the creation, revision, distribution, and storage of a policy in an organization.

policy administrator

An examination of how well a particular solution fits within the organization's political environment

political feasibility

Malware (a virus or worm) that over time changes the way it appears to antivirus software programs, making it undetectable by techniques that look for preconfigured signatures.

polymorphic threat

An attribute of information that describes the data's ownership or control is legitimate or authorized

possession

The ____________________ of information is the quality or state of ownership or control of some object or item.

possession

right of individuals to keep their information from being disclosed to others

privacy

step-by-step instructions for completing a task. Designed to assist employees

procedures

Performance measures or metrics based on intangible activities

process-based measures

A hacker who conducts attacks for personal financial benefit or for a crime organization or foreign government.

professional hacker

A small functional team of people who are experienced in one or multiple facets of the required technical and nontechnical areas for the project to which they are assigned.

project team

As asset valuation approach that uses categorical or non-numeric values rather that absolute numerical measures

qualitative assesment

An asset valuation approach that attempts to assign absolute numerical measures

quantitative assessment

The use of multiple types of instances of technology that prevent the failure of one system from compromising the security of information

redundancy

The risk of information assets that remains even after current controls have been applied

residual risk

A legal requirement to make compensation or payment from a loss or injury

restitution

The quantity and nature of risk that organizations are willing to accept as they evaluate the trade-offs between perfect security and unlimited accessibility

risk appetite

A determination of the extent to which an organization's information assets are exposed to risk

risk assessment

People who understand financial risk assessment techniques, the value of organizational assets, and the security methods to be used.

risk assessment specialists

The application of controls that reduce the risks to an organization's information assets to an acceptable level

risk control

The recognition, enumeration, and documentation of risks to an organization's information assets.

risk identification

the process of identifying risk, assessing its relative magnitude, and taking steps to reduce it to an acceptable level

risk management

A short-term decrease in electrical power availability.

sag

A hacker of limited skill who uses expertly written software to attack a system.

script kiddie

A state of being secure and free from danger or harm. Also, the actions taken to make someone or something secure

security

A personnel security structure in which each user of an information asset is assigned an authorization level that identifies the level of classified information he or she is "cleared" to access.

security clearance

An area of trust within which information assets share the same level of protection

security domain

The direct, covert observation of individual information or system use.

shoulder surfing

The calculated value associated with the most likely loss from an attack

single loss expectancy

Attackers posing as IT professionals attempt to gain access to information systems by contacting low-level employees and offering help with computer issues

social engineering password attack

unauthorized copying or distribution of copyrighted software

software piracy

unwanted e-mail (usually of a commercial nature sent out in bulk)

spam

A variation of phishing that target specific people or systems

spear phising attack

A short-term increase in electrical power availability, also known as a swell.

spike

Any technology that aids in gathering information about people or organizations without their knowledge

spyware

A detailed statement of what must be done to comply with policy, sometimes viewed as the rules governing policy compliance.

standard

a plan for the organization's strategic effort over the next several years

strategic plan

the entity conducting the attack

subject of attack

A long-term increase in electrical power availability

surge

People with the primary responsibility for administering the systems that house the information used by the organization perform the ____ role.

system administrator

a plan for the organization's intended tactical efforts over the next few years

tactical plan

The actions taken by management to specify the intermediate goals and objectives of the organization in order to obtain specified strategic goals, followed by estimates and schedules for the allocation of resources necessary to achieve those goals and objectives

tactical planning

a project manager, who may be a departmental line manager or staff unit manager, who understands project management, personnel management, and information security technical requirements.

team leader

An examination of how well a particular solution is supportable given the organization's current technological infrastructure and resources

technical feasibility

A systems-specific security policy that expresses technical details for the acquisition, implementation, configuration, and management of a particular technology, written from a technical perspective. Typically the policy includes details on configuration rules, systems policies, and access control.

technical specifications SysSP

The risk control strategy that eliminates all risk associated with an information asset by removing it from service

termination risk control strategy

An evaluation of the threats to information assets, including a determination of their potential to endager the organization

threat assessment

a pairing of an asset with a threat and an identification of vulnerabilities that exist between the two.

threats-vulnerabilities-assets (TVA) triples

A document that shows a comparative ranking of prioritized assets against prioritized threats, with an indication of any vulnerabilities in the asset/threat pairings

threats-vulnerabilities-assets (TVA) worksheet

A continuity strategy in which an organization co-leases facilities with business partner or sister organization

time-share

In the ____________________ approach, the project is initiated by upper-level managers who issue policy, procedures and processes, dictate the goals and expected outcomes, and determine accountability for each required action.

top-Down

A methodology of establishing security policies that is initiated by upper management.

top-down approach

A malware program that hides its true nature and reveals its designed behavior only when activated

torjan horse

The risk control strategy that attempts to shift risk to other assets, other processes, or other organizations.

transference risk control strategy

Unauthorized entry into the real or virtual property of another party.

trespass

the percentage of time a particular service is available; the opposite of downtime.

uptime

An attribute of information the describes how data has value or usefulness for an end purpose

utility

A message that reports the presence of a nonexistent virus or worm and wastes valuable time as employees share the message

virus hoax

A potential weakness in an asset or its defensive control system(s).

vulnerability

A facility that provides many of the same services and options as a hot site, but typically without installed and configured software applications

warm site

The ____ model consists of six general phases.

waterfall

The amount of effort necessary to make the business function operational after the technology element is recovered

work time recovery

A type of malware that is capable of activation and replication without being attached to an existing program

worm

An attack that makes used of malware that is not yet know by the anti-virus software

zero-day attack