4680final

IIA core priciples

Integrity, Objectivity, Confidentiality, and Competency

Hot Site

Allows an organization to stay as current as possible with replicated data so switching from your original environment to the alternate environment can occur with a minimum of downtime.

Basic standard of system configurations and the management of configuration items.

Baseline Configuration Management

The IIA provides audit-related certifications, including _____________.

C.I.A.

COSO stands for this.

Committee of Sponsoring Organizations

Document that communicates your organization's security policy clearly when hiring new employees.

Confidential Agreement

Internal codes of ethics.

Employer Driven codes of Ethics

IPSec, L2F, and GRE are types of

Encapsulating protocols

BCP/DRP does not ensure that the data is available to authorized users on demand in the Sys/App Domain.

False

FCAPS stands for this.

Fault-Management (F), the configuration level (C), the accounting level (A), the performance level (P) and the security level (S).

Financial Privacy Rule is found in this act

GLBA

The criteria, circumstance, cause, and impact are all included in me!

Gap Analysis

GIAC stands for this.

Global Information Assurance Certification

Protects a network from all types of attacks unlike a firewall whose rules are based on static attributes

IDS/IPS

Obtain certifications like SSCP, CAP, CSSLP, and CISSP from this organization.

ISC2

Ensuring compliance in the Workstation Domain

Increases information security and reduces liability

Three IT security controls covered by the National Institute of Standards and Technology (NIST)

Management, Technical, and Operational.

Applying controls is a direct result of the risk assessment process combined with an analysis of the tradeoffs and is a tradeoff of this.

Operational Impact

The PCI DSS standard is used for

Payment Card

Controls fall into these three functional types.

Preventive, Detective, and Corrective.

Each user has the permission to carry out assigned tasks and nothing else.

Principle of Least Privilege

Firewall that makes requests for remote services on the behalf of the local clients.

Proxy Server

RADIUS stands for this.

Remote Authentication Dial In User Service

When using remote access and VPN tunnels, these activities should be monitored.

Remote computer login

RACI stands for

Responsible, Accountable, Consulted, and Informed

Connects two or more separate networks in the LAN-to-WAN domain.

Router

The configuration items that are directly related to controls or settings representing significant risk, if not managed properly.

Security Control Management

Regulatory compliance benefits organizations, consumers, and this group of people.

Shareholders

SSO stands for this.

Single Sign On

Formal method to control the software development life cycle

Software Configuration Management

Details about the infrastructure systems

System Characterization

TACACS stands for this.

Terminal Access Controller Access-Control System

An AUP is used primarily in

User Domain

The three authentication types include these

What you know, What you have, and What you are

end user's operating environment.

Workstation Domain

Application data encryption is

a strategy used for encrypting data to send to remote users.

Difference between an Assessment and an Audit

assessment finds blame where an Audit does not.

Net Neutrality

proposed rule change by the FCC governing Internet traffic

NOS

provides the interface between the hardware and the application layer software.

Analyzing the potential threats requires the identification of all possible threats first

Threat Identification

COBIT

framework used to stay in compliance with SOX 404.

Organizations perform this to identify anything that is missing.

gap analysis

Main types of attacks that may originate from within your organization.

internal attacks on your organization and internal to external attacks on another organization

Reasons to expand the scope from the initial interviews

lack of controls, the override of controls, and Fraudulent Activity

Two types of patch management.

OS and application

Controls are classified as

Preventive, Detective, and Corrective

COBIT stands for

Control Objectives for Information and Related Technology.

These are the two types of object access control.

discretionary access control and mandatory access control

Under the two components, People and Documentation, you find people fall into three types:

employees, guests/third parties, and Contractors

Federal Information Security Management Act (FISMA)

ensures that organizations have sound information security practices and framework for effective information security resources that support federal operations, data, and infrastructure.

Confidentiality

ensuring that information is not disclosed to unauthorized sources