CISSP - Domain 1

94 flashcards · Computer Science · by Jaysen Lewis

1. What is the ISO27799 standard focused on?

   ISO 27799: Directives on how to protect PHI (Personal Health Information).

2. What are the 3 pillars of the CIA Triad?

   Confidentiality, Integrity and Availability.

3. What can we use to protect Confidentiality?

   Encryption (data at rest) Secure Transport Protocols like SSL, TLS or IPSEC (data in transit) Clean desk policy/ no shoulder surfing/ screen-view angle protectors/ PC Locking (data in use) Strong pwds/passphrases, MFA, Access Controls, Least-Privilege, Need-To-Know

4. What are the common threats to Confidentiality?

   Attacks on your encryption (cryptanalysis) Social engineering Key loggers (software/hardware), Cameras, Steganography IoT (Internet of Things) – The growing number of connected devices we have pose a new threat, they can be a backdoor to other systems.

5. What can we use to protect Integrity?

   Cryptography (again). Check sums (This could be CRC). Message Digests also known as a hash (This could be MD5, SHA1 or SHA2). Digital Signatures (non-repudiation). Access control.

6. What are the common threats to Integrity?

   Alterations of our data. Code Injections. Attacks on your encryption (cryptanalysis)

7. What can we use to protect Availability?

   IPS/IDS. Patch Management. Redundancy on Hardware Power (Multiple Power Supplies/UPS’s/Generators), Disks (RAID), Traffic paths (Network Design), HVAC, Staff, HA (high availability), DR and much more. SLA’s – How high uptime to we want (99.9%?) – (ROI).

8. What are common threats to Availability?

   Malicious attacks (DDOS, physical, system compromise, staff). Application failures (errors in the code). Component failure (Hardware). Disasters (Acts of God, Earthquakes etc.)

9. What is the opposite of the CIA Triad?

   DAD - Disclosure, Alteration and Destruction

10. Define the IAAA security principle.

    Identification and Authentication, Authorization and Accountability

11. What is non-repudiation?

    The ability of a system to prevent, deny and detect attempts to deny authorship, integrity, transmission or modification of information within or leaving that system. User cannot deny what they did (This uses both Authentication and Integrity). Information can absolutely be attributed to someone. Proof of who did what. We use Digital Signatures. (Cryptography Perspective) - Proof of origin & integrity with high assurance of authenticity.

12. What are the 3 types of Authentication?

    1) Something You Know (Password, PIN) 2) Something You Have (ID, Token Code, Cookie, Cert) 3) Something You Are (Bio-metrics)

13. What can we use for Authorization?

    IAM Access Controls RBAC DAC MAC ABAC RUBAC

14. What is the difference between Due Diligence and Due Care? and what do they ultimate both help with?

    Due Diligence - Researching and Practicing the activities to maintain Due Care effort. i.e. "Think before you act!" Do Detect. Research, Planning, Evaluation (and in some cases altering plans/ actions) Monitoring, Control, Manage (Pay attention to the alarms, analyze reports) Usually (but not always) before the decision. Increases Understanding Reduces Risk Supports Due Care Due Care - Doing what a reasonable person would do. i.e. "Do the needful". Do Correct. The "Prudent Man Rule". All lifecy…

15. What are types of evidence?

    Real (Physical) Evidence: Tangible & Physical Objects from the actual crime in IT Security: Tools, Damaged Property, Hard disks, USB drives – NOT the data on them. Documentary Evidence: Consists of written information. Testimonial Evidence: Direct Evidence: Oral or Written Testimony from a firsthand witness, what they experienced with their 5 senses, that either proves or disproves a specific fact. Expert Opinion: Expert witness draws conclusions based upon other evidence Circumstantial Evidenc…

16. What is Secondary Evidence?

    A copy or duplicate of evidence (tapes, backups, screen-captures/ photos). Logs and documents from the systems are considered secondary evidence. Common in cases involving IT.

17. What is the "Best Evidence" Rule of evidence?

    (Defined in the Federal Rules of Evidence) states that “to prove the content of a writing, recording, or photograph, the original writing, recording, or photograph is [ordinarily] required.” The courts prefer the best evidence possible. Evidence should be accurate, complete, relevant, authentic & convincing.

18. Describe the Chain of Custody?

    Proves Integrity of data; that no tampering was done. Who handled it? When did they handle it? Where dd they handle it? What did they do with it?

19. What can we do to ensure Evidence Integrity?

    We use hashes. Any forensics is done on copies - NEVER originals. We hash the original, make a bit-copy of the original, hash the copy & check/compare the hashes before and after forensics is performed.

20. Which Amendment to the US Constitution protects citizens from unreasonable search & seizure by the government?

    The 4th Amendment. In all cases, the court should determine if evidence was obtained legally. Exigent circumstances apply if there is an immediate threat to human life or of evidence destruction. Your organization needs to ensure that employees are made aware that their actions are being monitored.

21. What is Entrapment?

    Entrapment (Illegal and unethical): When someone is persuaded to commit a crime that they had no intention of committing and is then charged with it.

22. What is Enticement?

    (Legal & Ethical grey area): Making committing a crime more enticing, but the person has already broken the law or at least has decided to do so. Example: Honeypots (check with your legal department first).

23. Code Injection is largely used to attack which pillar of the CIA Triad?

    Integrity. Code is injected into user forms (often seen in SQL/LDAP). Our countermeasures should include: only allowing users to input appropriate data into user input fields. Example: only allow letters in names, numbers in phone number, dropdowns for country and state (if applicable); we limit how many characters people can use per cell, etc.

24. Define Cyber Squatting?

    Buying a URL you know someone will need (with no intention of actually using it). Gray-area, legally speaking.

25. Define Typo Squatting?

    Buying a URL that is very similar in spelling to a real website name. AKA URL Hijacking. Sometimes these URLs can be virus-infected.

26. What is PII?

    Personally Identifiable Information Examples: Name DOB SS# Passport, Driver's License# or other Government issued ID. Fingerprint or other Biometric data. Credit or Debit Card #s, Bank Account info. Address Email address Telephone Number

27. What is PHI?

    Protected Health Information A special category of PII protected in the US by HIPAA and the HITECH Act. Essentially, it's PII that can be tied to data about a person's health or medical diagnoses.

28. What is HIPAA?

    Health Insurance Portability and Accountability Act. A US federal statute law with strict privacy and security rules on handling of PHI (Protected Health Information). (Passed in 1996 -104th Congress, Bill Clinton-era).

29. What is the ECPA law?

    Electronic Communications Privacy Act US law for protection of electronic communications against unwarranted wiretapping or unauthorized access. Weakened by the Patriot Act of 2001.

30. Describe the USA PATRIOT Act?

    Uniting and Strengthening America by Providing Appropriate Tools to Restrict, Intercept and Obstruct Terrorism Act of 2001 One of the largest expansions of law enforcement electronic monitoring capabilities in the history of the US. Allowed search and seizure (wiretapping etc.) without immediate disclosure (in order to prevent terrorism). Considered controversial in consideration of the 4th Amendment. Expired but some stuff has carried into other laws.

31. What is the CFAA law?

    Computer Fraud and Abuse Act A US cybersecurity bill that was enacted in 1986 as an amendment to existing computer fraud law, which had been included in the Comprehensive Crime Control Act of 1984. Prohibits accessing a computer without authorization, or in excess of authorization. Most commonly used law to prosecute computer crimes.

32. What is the GLBA law?

    Gramm-Leach-Bliley Act (GLBA) Contains provisions regulating the privacy of customer financial information Applies to financial institutions; driven by the Federal Financial Institutions Requires financial institutions – companies that offer consumers financial products or services like loans, financial or investment advice, or insurance – to explain their information-sharing practices to their customers and to safeguard sensitive data.

33. What is the SOX act?

    Sarbanes-Oxley Act of 2002 (SOX) A bipartisan effort by Senators Paul Sarbanes and Michael Oxley to create a bill that would “protect investors by improving the accuracy and reliability of corporate disclosures made pursuant to the securities laws.” Directly related to the accounting scandals in the late 90s. Since then, all public companies are now required to create and implement processes that report to SEC compliance. Think "SOX audits".

34. What is PCI-DSS?

    Payment Card Industry Data Security Standard (PCI-DSS) Technically not a law, but a required set of standards created by the payment card industry. The standard applies to cardholder data for both credit and debit cards. Requires merchants and others to meet a minimum set of security requirements in order to handle or issue credit/debit cards. Mandates security policy, devices, control techniques, and monitoring. NOT Federal 48 states have individual laws for this. Know the one for your state (…

35. Define GDPR.

    General Data Protection Regulation (GDPR) A 2016 EU regulation law on data protection and privacy for all individuals within the EU and the European Economic Area. Generally better for privacy than the US's patchwork laws.

36. We need to ensure we are compliant with all the laws and regulations of all the states, territories, and countries we operate in. How are Security Breach Notification laws in the US typically handled?

    At the State level. NOT the federal level. 48 states currently have laws for this (none in Alabama and South Dakota) - KNOW YOUR STATE. NOTE: Many states have an encryption clause where lost encrypted data may not require disclosure.

37. Looking at the CIA triad, when we have TOO MUCH Availability, which other controls can suffer?

    Confidentiality and Integrity.

38. What is FRAP?

    Facilitated Risk Analysis Process A control framework/ governance standard. NOT A LAW. Analyzes one business unit, application or system at a time in a round-table brainstorm with internal employees. Impact analyzed, threats and risks prioritized. *Think of the middle letters: RA - "Risk Analysis".

39. What is ITIL?

    Information Technology Infrastructure Library A control framework/ governance standard. NOT A LAW. IT Service Management (ITSM)

40. What is OCTAVE?

    Operationally Critical Threat, Asset, and Vulnerability Evaluation A control framework/ governance standard. NOT A LAW. Self-Directed Risk Management.

41. Define COBIT.

    Control Objectives for Information and related Technology A Security Architecture/ IT governance Framework. It's where you define Goals & Requirements that map stakeholder needs/ business objectives to IT Security Controls. IT should be highlighted here. * Think of the letters IT (easy) and COB is just Control Objectives (My objective is to eat Corn on the COB).

42. What is COSO?

    Committee of Sponsoring Organizations Goals for the entire organization. *Think COSO sounds like SOHO, fancy New York sponsors & organization.

43. We are in a court of law where the victim is generally society, the proof must be "beyond a reasonable doubt" and the punishment can be incarceration, death or financial fines. Which type of court are we in?

    Criminal

44. We're in a court of law where the Victims are individuals, groups or organizations where the proof must be "the majority of proof" and there are financial fines to compensate the victims. Which type of court/law is this?

    Civil (Tort Law)

45. In general, what type of laws are enacted by government agencies (like FDA laws, HIPAA, FAA laws etc.)?

    Administrative Laws, Regulatory Laws.

46. What types of regulations are typically required, not by law, but by contract (like PCI_DSS)?

    Private Regulations.

47. What non-government laws typically cover personal conduct/ patterns of behavior that are either founded in religious beliefs or tradition & customs of a specific region?

    Customary or Religious laws.

48. Usually, who is Ultimately liable?

    Senior Leadership. This does not mean you are not liable; you may be, that depends on Due Care. If a system under your control is compromised and you can prove you performed Due Care, you are most likely not liable. If a system under your control is compromised and you did NOT perform Due Care, you are most likely liable.

49. What is the opposite of Due Care?

    Negligence.

50. We are considering how we should protect our intellectual property. Which of these do you need to apply for to be protected? Patents Trademarks Copyright Trade Secrets

    Trademarks and Patents are both something you need to apply for. Copyright is automatically granted - you don't need to apply for these. Trade Secrets are not granted; it is just the act of you never disclosing your secret formula or product.

51. How long do Copyrights last?

    70 years after creator's death or 95 years after creation by/for corporations.

52. What would you apply for if you wanted to protect your Brand Name, Logo and/or Slogan?

    Trademark TM or Registered Trademark R

53. How long is a Trademark valid for?

    10 Years at a time. Can be renewed indefinitely.

54. If you wanted to protect an invention like a Cryptography algorithm, what would you apply for and how long would it normally last?

    Patent 20 years.

55. Software piracy is typically an attack on what type of intellectual property?

    Copyright

56. Counterfeiting (like fake Rolex's) is an attack on what type of intellectual property?

    Trademarks

57. Using someone else's Patent in your product without permission is known as what?

    Patent infringement.

58. How much can Violators of GDPR be fined?

    Up to 20 million Euros or 4% of the annual worldwide turnover of the preceding financial year (in the case of an enterprise), whichever is greater.

59. What types of Access Controls are used in the Administrative (Directive) Controls category?

    Organizational Policies & Procedures Regulation Training & Awareness

60. What types of Access Controls are used in the Technical Controls category?

    Hardware/Software/Firmware Usernames, Passwords, Tokens etc. Firewalls, Routers, Encryption

61. What types of Access Controls are used in the Physical Controls category?

    Locks, Fences, Gates, Man-traps Alarms Guards, Dogs (Yes, dogs) Bollards (yellow guard posts)

62. What are the 3 Access Control Categories?

    Administrative Controls Technical Controls Physical Controls

63. What are the different Access Control Types?

    Preventative: Prevents action from happening – Least privilege, drug tests, IPS, firewalls, encryption. Detective: Controls that Detect during or after an attack – IDS, CCTV, alarms, anti-virus. Corrective: Controls that Correct – Anti-virus, patches, IPS, reporting exceptions.. Recovery: Controls that help us Recover after an attack – DR Environment, backups, HA Environments . Deterrent: Controls that Deter an attack – Fences, security guards, dogs, lights, Beware of Dog signs. Compensating: C…

64. What is the Risk Mgmt Lifecycle?

    Risk Identification > Risk Assessment > Risk Response & Mitigation > Risk and Control Monitoring and Reporting (repeats in a circle)

65. Who determines Risk Appetite?

    Senior Management

66. Define Qualitative Risk Analysis..

    Qualitative: How likely is it to happen and how bad is it if it happens? (Opinion-based)

67. Define Quantitative Risk Analysis..

    Quantitative: What will it actually cost us in $? Total $ value of asset, math is involved. (Fact-based/ Objective) We place value/ a number on our assets and risks. Assigns a dollar value to evaluate effectiveness of countermeasures What will it cost us if we don't mitigate this?

68. When is it appropriate to Reject/ Ignore Risk?

    NEVER.

69. Define the different Risk Response types:

    Risk Acceptance – DO nothing and Accept the risk (for Lower Risks) and potential loss if threat occurs. We know the risk is there, but (to a reasonable level) the mitigation is more costly than the cost of the risk so we accept ownership of the risk. Risk Mitigation (Reduction) – Implement countermeasures & accept residual risk (Leftover risk = Residual). Risk Transference (Assignment) – Let someone else own the risk. Transfer/outsource the risk to a 3rd party (like purchasing insurance against…

70. What formula can we use to determine Risk?

    Risk = Threat x Vulnerability Sometimes Impact is added to give a fuller picture. So: Risk = Threat x Vulnerability x Impact

71. What formula can we use to calculate Total Risk?

    Total Risk = Threat x Vulnerability x Asset Value

72. What is the formula for Residual Risk?

    Residual Risk = Total Risk - Countermeasures

73. What U.S. government agency oversees compliance with the Privacy Shield framework for organizations wishing to use the personal data of EU citizens?

    The U.S. Department of Commerce.

74. Recite the ISC(2) Code of Ethics.

    Code of Ethics Preamble: The safety and welfare of society and the common good, duty to our principles, and to each other, requires that we adhere, and be seen to adhere, to the highest ethical standards of behavior. Therefore, strict adherence to this code is a condition of certification. Code of Ethics Canons: Protect society, the common good, necessary public trust and confidence, and the infrastructure. Act honorably, honestly, justly, responsibly, and legally. Provide diligent and competen…

75. What are the 4 levels of Security Policy Development?

76. Define the Risk Categories (causes of potential risk):

    Something that could potentially cause risk. Damage. Results in physical loss of an asset or the inability to access the asset. Disclosure. Disclosing critical information regardless of where or how it was disclosed. Losses. These might be permanent or temporary, including altered data or inaccessible data

77. Define Risk Factors:

    Something that increases risk. Physical Damage (i.e. natural disaster, vandalism) Malfunctions (system failures) Attacks (inside/outside attacks, disclosure) Human Errors Application Errors (OS Failures, App Failures)

78. What are the 3 tiers of Security Planning?

79. What is Secondary Risk?

    When mitigating one risk may open things up to another risk.

80. Since NIST 800-37 is the primary Risk Management Framework (RMF) referenced in CISSP, recite the 7 steps of it:

    1. Prepare to execute the RMF 2. Categorize information systems 3. Select security controls 4. Implement security controls 5. Assess the security controls 6. Authorize the system 7. Monitor security controls Nmeumonic Device: Philly CSI Always Arrests Murderers

81. Define Authenticity:

    In short, authentic information is genuine. It comes from a trusted authority, in a trustworthy, reliable and verifiable fashion.

82. What are the 2 ways to evaluate risk to assets?

    Quantitative Qualitative

83. What are the 6 major steps in a Quantitative Risk Analysis?

    Inventory assets and assign Asset Value (AV). Identify threats. Research each asset and produce a list of all possible threats of each asset. (and calculate EF and SLE) Perform a threat analysis to calculate the likelihood of each threat being realized within a single year. (the ARO - Annual Rate of Occurrence) Estimate the potential loss by calculating the annualized loss expectancy (ALE). Research countermeasures for each threat, and then calculate the changes to ARO and ALE based on an appli…

84. Know the 5 COBIT principals:

    Meet stakeholder needs Cover the enterprise end-to-end Apply a single integrated framework Enable a holistic approach Separate governance from management

85. HIPAA requires that anyone working with personal health information on behalf of a HIPAA-covered entity be subject to the terms of what type of agreement?

    Business Associates Agreement (BAA).

86. Which act requires that all communications service providers cooperate with law enforcement requests (who have an appropriate court order)?

    Communication Assistance to Law Enforcement Act (CALEA)

87. Which intellectual property protection mechanism has the shortest duration?

    Patent. Patent = 20 years Copyrights = 70 years beyond the death of the author. Trademarks = Renewable indefinitely Trade Secrets = protected as long as they remain secret.

88. What are the six categories of computer crimes?

    1) military and intelligence attack 2) business attack 3) financial attack 4) terrorist attack 5) grudge attack 6) thrill attack. For the exam, be able to explain the motive of each type of attack.

89. Claire's application produces an exception report at the end of each day. What is MOST likely the type of control that Claire has implemented?

    Corrective. Explanation: Although detecting exceptions appear to be detective, reporting the exceptions is a corrective control.

90. What is the PRIMARY reason we do Security awareness training in our organization?

    To reduce the human risk that staff poses.

91. What is the DMCA?

    Digital Millennium Copyright Act The DMCA states that providers are not responsible for the transitory activities of their users. Transmission of information over a network would qualify for this exemption.

92. What is FISMA?

    The Federal Information Security Management Act (FISMA) Applies to government contractors. The Government Information Security Reform Act (GISRA) was the precursor to FISMA but expired in November 2002.

93. Know the Risk Analysis Formulas:

94. Know how to calculate a cost benefit analysis