Quick Tips

• A vulnerability is the absence of a safeguard (in other words, it is a weakness) that can be exploited.

• A threat is the possibility that someone or something would exploit a vulnerability, intentionally or accidentally, and cause harm to an asset.

• A risk is the probability of a threat agent exploiting a vulnerability and the loss potential from that action.

• Reducing vulnerabilities and/or threats reduces risk.

• An exposure is an instance of being exposed to losses from a threat.

• A countermeasure, also called a safeguard, mitigates the risk.

• A countermeasure can be an application, software configuration, hardware, or procedure.

• If someone is practicing due care, they are acting responsibly and will have a lower probability of being found negligent and liable if a security breach takes place.

• Security management has become more important over the years because networks have evolved from centralized environments to distributed environments.

• The objectives of security are to provide availability, integrity, and confidentiality protection to data and resources.

• Strategic planning is long term, tactical planning is midterm, and operational planning is day to day. These make up a planning horizon.

• ISO 17799 is a comprehensive set of controls comprising best practices in information security and provides guidelines on how to set up and maintain security programs.

• Security components can be technical (firewalls, encryption, and access control lists) or nontechnical (security policy, procedures, and compliance enforcement).

• Asset identification should include tangible assets (facilities, hardware) and intangible assets (corporate data, reputation).

• Project sizing, which means to understand and document the scope of the project, must be done before a risk analysis is performed.

• Assurance is a degree of confidence that a certain security level is being provided.

• CobiT is a framework that defines goals for the controls that should be used to properly manage IT and ensure IT maps to business needs.

• CobiT is broken down into four domains; Plan and Organize, Acquire and Implement, Deliver and Support, and Monitor and Evaluate.

• ISO 17799:2005 is the newest version of BS7799 Part 1.

• ISO 27001:2005 is the newest version of BS7700 Part II.

• ISO 27001:2005 provides the steps for setting up and maintaining a security program.

• ISO 17799:2005 provides a list of controls that can be used within the framework outlined in ISO 27001:2005.

• Security management should work from the top down, from senior management down to the staff.

• Governance is the set of responsibilities and practices exercised by the board and executive management with the goal of providing strategic direction, ensuring that objectives are achieved, ascertaining that risks are managed appropriately, and verifying that the enterprise’s resources are used responsibly.

• Which security model a company should choose depends on the type of business, its critical missions, and its objectives.

• The OECD is an international organization that helps different governments come together and tackle the economic, social, and governance challenges of a globalized economy.

• Risk can be transferred, avoided, reduced, or accepted.

• An example of risk transference is when a company buys insurance.

• Ways to reduce risk include improving security procedures and implementing safeguards.

• Threats × vulnerability × asset value = total risk

• (Threats × vulnerability × asset value) × controls gap = residual risk

• The main goals of risk analysis are the following: identify assets and assign values to them, identify vulnerabilities and threats, quantify the impact of potential threats, and provide an economic balance between the impact of the risk and the cost of the safeguards.

• Information risk management (IRM) is the process of identifying, assessing, and reducing risk to an acceptable level and implementing the right mechanisms to maintain that level of risk.

• Failure Modes and Effect Analysis (FMEA) is a method for determining functions, identifying functional failures, and assessing the causes of failure and their failure effects through a structured process.

• A fault tree analysis is a useful approach to detect failures that can take place within complex environments and systems.

• A quantitative risk analysis attempts to assign monetary values to components within the analysis.

• A purely quantitative risk analysis is not possible because qualitative items cannot be quantified with precision.

• Capturing the degree of uncertainty when carrying out a risk analysis is important, because it indicates the level of confidence the team and management should have in the resulting figures.

• When determining the value of information, the following issues must be considered: the cost to acquire and develop data; the cost to maintain and protect data; the value of the data to owners, users, and adversaries; the cost of replacement if the data is lost; the price others are willing to pay for the data; lost opportunities; and the usefulness of the data,

• Automated risk analysis tools reduce the amount of manual work involved in the analysis. They can be used to estimate future expected losses and calculate the benefits of different security measures.

• Single loss expectancy (SLE) is the amount that could be lost if a specific threat agent exploited a vulnerability.

• Single loss expectancy × frequency per year = annualized loss expectancy (SLE × ARO = ALE)

• Qualitative risk analysis uses judgment and intuition instead of numbers.

• Qualitative risk analysis involves people with the requisite experience and education evaluating threat scenarios and rating the probability, potential loss, and severity of each threat based on their personal experience.

• The Delphi technique is a group decision method where each group member can communicate anonymously.

• When choosing the right safeguard to reduce a specific risk, the cost, functionality, and effectiveness must be evaluated and a cost/benefit analysis performed.

• A security policy is a statement by management dictating the role security plays in the organization.

• Procedures are detailed step-by-step actions that should be followed to achieve a certain task.

• A standard specifies how hardware and software are to be used. Standards are compulsory.

• A baseline is a minimum level of security.

• Guidelines are recommendations and general approaches that provide advice and flexibility.

• Job rotation is a control to detect fraud.

• Mandatory vacations are a control type that can help detect fraudulent activities.

• Separation of duties ensures no single person has total control over an activity or task.

• Split knowledge and dual control are two aspects of separation of duties.

• Data is classified to assign priorities to data and ensure the appropriate level of protection is provided.

• Data owners specify the classification of data.

• Security has functional requirements, which define the expected behavior from a product or system, and assurance requirements, which establish confidence in the implemented products or systems overall.

• The security program should be integrated with current business objectives and goals.

• Management must define the scope and purpose of security management, provide support, appoint a security team, delegate responsibility, and review the team’s findings.

• The risk management team should include individuals from different departments within the organization, not just technical personnel.

• A qualitative rating would be expressed in high, medium, or low, or on a scale of 1 to 5 or 1 to 10. A quantitative result would be expressed in dollar amounts and percentages.

• Safeguards should default to least privilege, and have fail-safe defaults and override capabilities.

• Safeguards should be imposed uniformly so everyone has the same restrictions and functionality.

• A key element during the initial security planning process is to define reporting relationships.

• The data custodian (information custodian) is responsible for maintaining and protecting data.

• A security analyst works at a strategic level and helps develop policies, standards, and guidelines, and also sets various baselines.

• Application owners are responsible for dictating who can and cannot access their applications, as well as the level of protection these applications provide for the data they process and for the company.

Questions

Please remember that these questions are formatted and asked in a certain way for a reason. You must remember that the CISSP exam is asking questions at a conceptual level. Questions may not always have the perfect answer, and the candidate is advised against always looking for the perfect answer. The candidate should look for the best answer in the list.

Answers