ISO27001 and ISO27002, standards and risk management
What security principle refers to the reliable and timeless access to data and resources to authorized individuals?
Availability
Some examples of Integrity measures are?
Changes in data and systems are authorized Auditing Segregation of Duties Hashing (data integrity) Configuration management (system integrity) Change control (process integrity) Access control (physical and logical) Transmission CRC functions
Some examples of Confidentiality measures are?
Clear desk policy Need to know basis Strict access controls (physical and logical) Separation of duties Strict separations between environments Logical access management Encryption for data at rest (whole disk, database encryption) Encryption for data in transit (IPsec, SSL, PPTP, SSH)
ISO/IEC 27002
Code of practice for information security management
Additional steps in risk analysis - iso27005
Communication and Consultation Monitor and Review
What security principle ensures that a necessary level of secrecy is enforced at each element of data processing and prevents unauthorized disclosure?
Confidentiality
ISO/IEC 27000
Overview and vocabulary
To achieve information security, a suitable set of controls needs to be implemented, what are they?
Policies, procedures, organizational structures and software and hardware functions.
What is traffic padding?
Produces a continuous random data stream of cipher text making it harder for an attacker to distinguish between true data flow and padding.
Some examples of Availability measures are?
RAID Clustering Load Balancing Redundancy Software and Data backups dish shadowing Co-location and off-site facilities Roll back functions fail-over configurations
The likelihood of a threat agent taking advantage of a vulnerability and the corresponding business impact is referred to as?
Risk
6 step in risk analysis - iso27005
Risk Acceptance
2 step in risk analysis - iso27005
Risk Assessment - Risk Identification
NIST 800-30
Risk Management Guide for Information Technology
5 step in risk analysis - iso27005
Risk Treatment (Modify, Avoid, Retain, Share)
Something that is put into place to mitigate the potential risk of a vulnerability being exploited?
Safeguard, counter measure or control
Risk Sharing
The risk is shared with another party that can most effectively manage the particular risk. Sharing can be done by insurance that will support the consequences, or by sub-contracting a partner whose role will be to monitor the information system and take immediate actions to stop an attack.
A weakness that can be exploited by one or more threats and that exposes an organization to possible damages is called?
Vulnerability (running service, unpatched application or operating system software, open port on a FW, lax physical security, etc)
Risk Retention
The decision to retaining the risk without further action. Will rely on risk evaluation.
top-down approach
The initiation, support, and direction come from top management; work their way through middle management; and then reach staff members.
Risk modification
The level of risk is managed by introducing, removing or altering controls so that the residual risk can be reassessed as being acceptable.
residual risk
risk remaining after risk treatment
Six Sigma
...is a process improvement methodology. It is the "new and improved" Total Quality Management (TQM) that hit the business sector in the 1980s. Was was developed by Motorola with the goal of identifying and removing defects in its manufacturing processes.
ITIL
...is the de facto standard of best practices for IT service management. It was created because of the increased dependence on information technology to meet business needs.
bottom-up approach
...refers to a situation in which staff members (usually IT) try to develop a security program without getting proper management support and direction.
Before we are able to start defining a security strategy, we must first know what we are protecting and what we are protecting it from.
Risk Analysis Risk Assessment
3 step in risk analysis - iso27005
Risk Assessment - Risk Analysis
4 step in risk analysis - iso27005
Risk Assessment - Risk Evaluation
The potential of an unwanted incident occurring that may result in harm to a system or organization.
A threat
An entity that takes advantage or exploits a threat is called?
A threat agent
Risk Avoidance
An activity or condition that gives rise to a particular risk being avoided. For example, for risks caused by nature (e.g. earthquakes) it may be most cost effective to physically move the information processing facilities to another location.
All security controls and mechanisms are implemented to protect one or more of these security principles?
Confidentiality (exclusivity), Integrity and Availability
1 step in risk analysis - iso27005
Context
Confidentiality can be achieved by?
Encrypting data while at rest and during transit Using network traffic padding Implementing strict access controls and data classifications Training and awareness of proper procedures
The presence of a vulnerability that exposes an organization to a threat is called?
Exposure
ISO/IEC 27003
Guideline for ISMS implementation
ISO/IEC 27004
Guideline for information security management measurement and metrics framework
ISO/IEC 27005
Guideline for information security risk management
ISO/IEC 27033-1
Guideline for network security
ISO/IEC 27006
Guidelines for bodies providing audit and certification of information security management systems
ISO/IEC 27001
ISMS requirements
Process Management
ITIL Six Sigma
What security principle refers to being correct or consistent with the intended state of information?
Integrity
Likelihood
chance of something happening
risk communications and consultation
continual and iterative processes that an organization conducts to provide, share or obtain information, and to engage in dialogue with stakeholders regarding the management of risk
risk management
coordinated activities to direct and control an organization with regard to risk
risk
effect of uncertainty on objectives
Plan - Do - Check - Act (PDCA)
establishing objectives and making plans implementation of the plans measuring results to understand if objectives are met direction on how to correct and improve plans to better achieve success
external context
external environment in which the organization seeks to achieve its objectives
ISO-IEC27005 provides guidance for?
information security risk management
Internal context
internal environment in which the organization seeks to achieve its objectives
level of risk
magnitude of risk, expressed in terms of consequences and their likelihood
Control
measure that is modifying risk
Event
occurrence or change of a particular set of circumstances
Consequence
outcome of an event
risk assessment
overall process of risk identification, risk analysis and risk evaluation
stakeholder
person or organization that can affect, be affected by, or perceive themselves to be affected by a decision or activity.
risk evaluation
process of comparing the results of risk analysis with risk criteria to determine whether the risk and/or its magnitude is acceptable or tolerable
risk identification
process of finding, recognizing and describing risks
risk analysis
process to comprehend the nature of risk and to determine levels of risk
risk treatment
process to modify risk