Information Security Chapter 4 – Flashcards
Unlock all answers in this set
Unlock answersquestion
A(n) disaster recovery plan dictates the actions an organization can and perhaps should take while an incident is in progress.
answer
False
question
Internal benchmarking can provide the foundation for baselining.
answer
False
question
Each of the threats faced by an organization must be examined to assess its potential to endanger the organization and this examination is known as a threat profile.
answer
False
question
Some argue that it is virtually impossible to determine the true value of information and information-bearing assets.
answer
True
question
Protocols are activities performed within the organization to improve security.
answer
False
question
Security efforts that seek to provide a superior level of performance in the protection of information are referred to as best business practices.
answer
True
question
Best business practices are often called recommended practices.
answer
True
question
Risk evaluation assigns a risk rating or score to each information asset.
answer
False
question
Major risk is a combined function of (1) a threat less the effect of threat-reducing safeguards, (2) a vulnerability less the effect of vulnerability reducing safeguards, and (3) an asset less the effect of asset value-reducing safeguards.
answer
False
question
Qualitative-based measures are comparisons based on numerical standards, such as numbers of successful attacks.
answer
False
question
Eliminating a threat is an impossible proposition.
answer
False
question
A(n) exposure factor is the expected percentage of loss that would occur from a particular attack.
answer
True
question
One problem with benchmarking is that there are many organizations that are identical.
answer
False
question
When determining the relative importance of each asset, refer to the organization's mission statement or statement of objectives to determine which elements are essential, which are supportive, and which are merely adjuncts.
answer
True
question
CBAs cannot be calculated after controls have been functioning for a time.
answer
False
question
Once the organizational threats have been identified, an assets identification process is undertaken.
answer
False
question
Benefit is the value that an organization realizes by using controls to prevent losses associated with a specific vulnerability.
answer
True
question
The results from risk assessment activities can be delivered in a number of ways: a report on a systematic approach to risk control, a project-based risk assessment, or a topic-specific risk assessment.
answer
True
question
When the organization is pursuing an overall risk management program, it requires a(n) systematic report that enumerates the opportunities for controlling risk.
answer
True
question
The general management of an organization must structure the IT and information security functions to defend the organization's information assets.
answer
True
question
A(n) qualitative assessment is based on characteristics that do not use numerical measures.
answer
True
question
You should adopt naming standards that do not convey information to potential system attackers.
answer
True
question
The most common of the mitigation procedures is the disaster recovery plan.
answer
True
question
Likelihood risk is the risk to the information asset that remains even after the application of controls.
answer
False
question
Risk measure defines the quantity and nature of risk that organizations are willing to accept as they evaluate the tradeoffs between perfect security and unlimited accessibility.
answer
False
question
Risk control is the application of controls to reduce the risks to an organization's data and information systems.
answer
True
question
Within best practices, the optimum standard is a subcategory of practices that are typically viewed as "the best of the best."
answer
False
question
Mutually exclusive means that all information assets must fit in the list somewhere.
answer
False
question
If every vulnerability identified in the organization is handled through mitigation, it may reflect an inability to conduct proactive security activities and an apathetic approach to security in general.
answer
False
question
A best practice proposed for a small home office setting is appropriate to help design control strategies for a multinational company.
answer
False
question
Know yourself means identifying, examining, and understanding the threats facing the organization.
answer
False
question
Program-specific policies address the specific implementations or applications of which users should be aware.
answer
False
question
You cannot use qualitative measures to rank values.
answer
False
question
Policies are documents that specify an organization's approach to security.
answer
True
question
Every organization should have the collective will and budget to manage every threat by applying controls.
answer
False
question
Risk control is the examination and documenting of the security posture of an organization's information technology and the risks it faces.
answer
False
question
The mitigate control strategy attempts to reduce the impact caused by the exploitation of vulnerability through planning and preparation.
answer
True
question
In information security, benchmarking is the comparison of security activities and events against the organization's future performance.
answer
False
question
The value of intellectual property influences asset valuation.
answer
True
question
ALE determines whether or not a particular control alternative is worth its cost.
answer
False
question
Comprehensive means that an information asset should fit in only one category.
answer
False
question
Establishing a competitive business model, method, or technique enabled an organization to provide a product or service that was superior and created a(n) competitive advantage.
answer
True
question
One way to determine which information assets are critical is by evaluating how much of the organization's revenue depends on a particular asset.
answer
True
question
Information security managers and technicians are the creators of information.
answer
False
question
Examples of exceptionally grave damage include armed hostilities against the United States or its allies and disruption of foreign relations vitally affecting the national security.
answer
True
question
Within organizations, technical feasibility defines what can and cannot occur based on the consensus and relationships between the communities of interest.
answer
False
question
"If you realize you do not know the enemy, you will gain an advantage in every battle." (Sun Tzu)
answer
False
question
Leaving unattended computers on is one of the top information security mistakes made by individuals.
answer
True
question
The amount of money spent to protect an asset is based in part on the value of the asset.
answer
True
question
To determine if the risk is acceptable or not, you estimate the expected loss the organization will incur if the risk is exploited.
answer
True
question
A certificate authority should actually be categorized as a software security component.
answer
True
question
Metrics-based measures are generally less focused on numbers and more strategic than process-based measures.
answer
False
question
Identifying human resources, documentation, and data information assets of an organization is less difficult than identifying hardware and software assets.
answer
False
question
In the U.S. military classification scheme, ____ data is any information or material the unauthorized disclosure of which reasonably could be expected to cause damage to the national security.
answer
Confidential
question
____________________ is the process of seeking out and studying the practices used in other organizations that produce results you would like to duplicate in your organization.
answer
Benchmarking
question
The military uses a ____-level classification scheme.
answer
Five
question
____________________ components account for the management of information in all its states: transmission, processing, and storage.
answer
Data
question
For hardware devices, the ____________________ number is used by the network operating system to identify a specific network device.
answer
electronic serial, MAC address, or hardware address
question
____ is simply how often you expect a specific type of attack to occur.
answer
ARO
question
The actions an organization can and perhaps should take while an incident is in progress should be specified in a document called the ____ plan.
answer
IR
question
A single loss ____________________ is the calculation of the value associated with the most likely loss from an attack.
answer
Expectancy
question
A(n) ____________________ is a "value or profile of a performance metric against which changes in the performance metric can be usefully compared."
answer
Baseline
question
Behavioral feasibility is also known as _________________________.
answer
Operational Feasibility
question
____ equals likelihood of vulnerability occurrence times value (or impact) minus percentage risk already controlled plus an element of uncertainty.
answer
Risk
question
Operational ____________________ analysis examines user acceptance and support, management acceptance and support, and the overall requirements of the organization's stakeholders.
answer
Feasibility
question
The ____ security policy is a planning document that outlines the process of implementing security in the organization.
answer
Program
question
The concept of competitive ____ refers to falling behind the competition.
answer
Disadvantage
question
After identifying and performing the preliminary classification of an organization's information assets, the analysis phase moves on to an examination of the ____________________ facing the organization.
answer
Threats
question
____________________ is the process of identifying risk, as represented by vulnerabilities, to an organization's information assets and infrastructure, and taking steps to reduce this risk to an acceptable level.
answer
Risk Management
question
The formal decision making process used when considering the economic feasibility of implementing information security controls and safeguards is called a(n) ____.
answer
CBA
question
The ____ strategy attempts to shift risk to other assets, other processes, or other organizations.
answer
Transfer Control
question
____ addresses are sometimes called electronic serial numbers or hardware addresses.
answer
MAC
question
Cost ____________________ is the process of preventing the financial impact of an incident by implementing a control.
answer
Avoidance
question
____________________ is the probability that a specific vulnerability within an organization will be successfully attacked.
answer
Likelihood
question
When organizations adopt levels of security for a legal defense, they may need to show that they have done what any prudent organization would do in similar circumstances. This is referred to as a(n) ____.
answer
Standard of Due Care
question
Of the three types of mitigation plans, the _________________________ plan is the most strategic and long term.
answer
Business Continuity or BC
question
You can assess the relative risk for each of the vulnerabilities by a process called risk ____________________.
answer
Assessment
question
Overriding an employee's security ____________________ requires that the need-to-know standard be met.
answer
Clearance
question
Once the inventory and value assessment are complete, you can prioritize each asset using a straightforward process known as ____________________ analysis.
answer
Weighted Factor
question
Management of classified data includes its storage and ____.
answer
Distribution, Destruction, and Portability
question
All information that has been approved by management for public release has a(n) ____________________ classification.
answer
External
question
In a(n) ____, each information asset is assigned a score for each of a set of assigned critical factor.
answer
Weighted Factor Analysis
question
____________________ involves three major undertakings: risk identification, risk assessment, and risk control.
answer
Risk Management
question
____ feasibility analysis examines user acceptance and support, management acceptance and support, and the overall requirements of the organization's stakeholders.
answer
Operational
question
The ____________________ control strategy attempts to reduce the impact caused by the exploitation of vulnerability through planning and preparation.
answer
Mitigation
question
A(n) ____________________ desk policy requires that employees secure all information in appropriate storage containers at the end of each day.
answer
Clean
question
____ policies address the particular use of certain systems.
answer
Systems-specific
question
Asset ____________________ is the process of assigning financial value or worth to each information asset.
answer
Valuation
question
____________________ are defined as information and the systems that use, store, and transmit information.
answer
Assets
question
A(n) ____ is an authorization issued by an organization for the repair, modification, or update of a piece of equipment.
answer
FCO
question
Due ____________________ is the demonstration that the organization is diligent in ensuring that the implemented standards continue to provide the required level of protection.
answer
Diligence
question
The ____ strategy is the choice to do nothing to protect a vulnerability and to accept the outcome of its exploitation.
answer
Accept Control
question
The ____ strategy attempts to prevent the exploitation of the vulnerability.
answer
Defend Control
question
Risk ____ is the application of controls to reduce the risks to an organization's data and information systems.
answer
Control
question
The first phase of risk management is ____.
answer
Risk Identification
question
Organizations should communicate with system users throughout the development of the security program, letting them know that change are coming.
answer
True
question
The difference between an organization's measures and those of others is often referred to as a performance ____________________.
answer
Gap
question
Security ____________________ are the technical implementations of the policies defined by the organization.
answer
Technologies
question
Many corporations use a ____ to help secure the confidentiality and integrity of information.
answer
Data Classification Scheme
question
____ plans usually include all preparations for the recovery process, strategies to limit losses during the disaster, and detailed steps to follow when the smoke clears, the dust settles, or the floodwaters recede.
answer
DR
question
Risk ____ defines the quantity and nature of risk that organizations are willing to accept as they evaluate the tradeoffs between perfect security and unlimited accessibility.
answer
Appetite
question
There are individuals who search trash and recycling — a practice known as ____ — to retrieve information that could embarrass a company or compromise information security.
answer
Dumpster Diving
question
The ____ security policy is an executive-level document that outlines the organization's approach and attitude towards information security and relates the strategic value of information security within the organization.
answer
General
