Management of Cybersecurity: Chapters 5, 6, 7, and 8

Comprehensive vocabulary flashcards covering law and ethics, policy frameworks, program development and staffing, and management/access control models from Whitman and Mattord's Management of Cybersecurity.

Deontological Ethics

An ethical framework that evaluates the morality of actions based on established duties, rules, and obligations rather than the consequences of those actions.

Utilitarian Approach

An ethical standard asserting that an action is morally acceptable if it produces the greatest balance of good over harm for the largest number of people.

Conditions for Deterrence

The three mandatory criteria required for laws, policies, and penalties to deter illegal or unethical activity: fear of penalty, probability of being caught, and probability of the penalty being administered.

(ISC)² Code of Ethics Canons

Four mandatory ethical principles required of certified members: protect society, the commonwealth, and the infrastructure; act honorably, honestly, justly, responsibly, and legally; provide diligent and competent service to principals; and advance and protect the profession.

Computer Fraud and Abuse (CFA) Act of 1986

The cornerstone U.S. federal computer crime statute that penalizes unauthorized access, commercial advantage theft, private financial gain, or criminal actions with fines and imprisonment for up to 20 years.

Computer Security Act (CSA) of 1987

A U.S. federal law designed to protect federal computer systems by mandating periodic security awareness training for all users and creating the Computer System Security and Privacy Advisory Board within the Department of Commerce.

Electronic Communications Privacy Act (ECPA) of 1986

A collection of federal statutes commonly referred to as the federal wiretapping acts that regulate the interception of wire, electronic, and oral communications in cooperation with the Fourth Amendment.

Health Insurance Portability and Accountability Act (HIPAA) of 1996

Also known as the Kennedy-Kassebaum Act; federal legislation designed to protect health care data confidentiality and security by establishing electronic data interchange standards and five privacy principles.

Health Information Technology for Economic and Clinical Health (HITECH) Act

Legislation enacted under ARRA in 2009 that strengthens HIPAA by requiring covered entities to formally notify information owners when their data has been breached.

Gramm-Leach-Bliley (GLB) Act of 1999

Also known as the Financial Services Modernization Act; requires financial institutions to disclose privacy policies regarding nonpublic personal information and provide mechanisms for customers to opt out of third-party sharing.

Economic Espionage Act (EEA) of 1996

A federal law passed by Congress to protect commercial trade secrets and preserve economic competitive advantage from industrial espionage and theft.

Sarbanes-Oxley (SOX) Act of 2002

A law that enforces corporate financial record-keeping accountability by holding the CEO and CFO personally liable for the accuracy, completeness, and integrity of financial reporting systems.

Payment Card Industry Data Security Standard (PCI DSS)

A private-sector standard mandated by major credit card companies requiring organizations handling payment cards to comply with 12 specific requirements across six core control areas.

Due Care

The standard of organizational responsibility requiring leadership to take active measures ensuring all employees understand acceptable behaviors and the penalties for noncompliance.

Due Diligence

The valid, verifiable, and ongoing legal effort an organization makes to maintain and execute protective measures to prevent harm to others.

InfraGard

An FBI-sponsored outreach program operating across local field offices to facilitate threat and vulnerability information sharing between the public, private, and academic sectors.

Cybersecurity Policy

A formal statement of managerial intent designed to direct and regulate employee and stakeholder behavior concerning the authorized use of information assets and technology systems.

Spheres of Cybersecurity

A conceptual model illustrating how information assets are shielded from external threats through layered perimeter and network technologies, and from internal threats through policy, law, and employee education.

Information Security Policy Hierarchy

A tiered governance structure consisting of Policies (sanctioned by management), Standards (detailed minimum specifications), Guidelines (recommendations for compliance), and Procedures (step-by-step instructions).

Cybersecurity Program Policy (CPP)

A high-level governance directive (also called an EISP) that establishes the strategic vision, scope, executive philosophy, and shared responsibilities for an entire organization's security program.

Issue-Specific Security Policy (ISSP)

A targeted organizational directive designed to provide detailed rules regulating the acceptable and responsible use of a specific resource or technology, such as email or the Internet.

System-Specific Policy (SysSP)

A technical or managerial policy that provides operational specifications and rules for configuring and maintaining individual technology systems.

Agreement by Act

A method of establishing policy compliance where an employee undertakes a specific action, such as logging on after viewing a warning banner, that constitutes affirmation of the policy.

Configuration Rules

Instructional codes and scripts that guide how a security appliance or system executes actions and processes information passing through it.

Cybersecurity Program

The entire collective set of activities, resources, personnel, and technologies utilized by an organization to manage risks to its information assets.

Chief Security Officer (CSO)

The senior executive who acts as the primary spokesperson for the security department, oversees the overall security program, and typically reports to the Chief Information Officer (CIO).

Security Administrator

A hybrid role that combines technical competence with management duties to oversee the daily configuration and operation of security controls.

Security Analyst

A specialized technical administrator responsible for analyzing user needs and designing technical security architectures within a specific domain.

Security Education, Training, and Awareness (SETA)

A multi-tiered program designed to reduce security incidents by providing in-depth knowledge, job-specific operational skills, and continual awareness reminders to employees.

Security Training

The element of a SETA program focused on providing hands-on instruction and procedural knowledge so employees can securely perform their assigned job responsibilities.

PMBOK Knowledge Areas

The foundational project management domains comprising Team, Stakeholder, Development approach and life cycle, Planning, Uncertainty, Delivery, Measurement, and Project work.

Cybersecurity Blueprint

A customized security framework or model tailored specifically to the operational architecture and risk profile of an individual organization.

Baselining

A form of internal benchmarking that compares an organization's current operational security performance against an earlier established baseline state.

ISO/IEC 27001

The international standard that specifies the formal requirements for establishing, implementing, operating, and certifying an Information Security Management System (ISMS).

ISO/IEC 27001 Implementation Process

The sequence of procedural phases required to establish an ISMS, including obtaining management support, scoping, risk assessment and treatment, control deployment, internal audits, and two-stage external certification audits.

ISO/IEC 27002

A standard offering guidance and a comprehensive code of practice outlining specific control objectives and recommended controls for information security managers.

Control Objectives for Information and Related Technology (COBIT)

An IT governance framework published by ISACA and ITGI providing structured principles and control objectives for managing enterprise technology risk.

COSO Internal Control Framework

A private-sector governance framework based on five interrelated components: control environment, risk assessment, control activities, information and communication, and monitoring.

ITIL Service Management Model

An IT infrastructure management lifecycle framework centered around business value strategy and structured into Service Design, Service Transition, Service Operation, and Continual Service Improvement.

Rainbow Series

A historic collection of Department of Defense computer security evaluation guidelines, named for the distinctive colors of each book and led by the Orange Book (TCSEC).

Trusted Computing Base (TCB)

The integrated collection of all computer hardware, firmware, and software mechanisms that are collectively responsible for enforcing a system's security policy.

Reference Monitor

A conceptual, tamper-proof component within the Trusted Computing Base that validates and mediates every access attempt by subjects to objects.

Covert Channel

An unintended, unauthorized communication path within a computer system that transfers information in violation of the system's security policy.

Common Criteria (CC)

An international standard (ISO/IEC 15408) that succeeded TCSEC and ITSEC, establishing standardized processes for evaluating and certifying computer security products.

IAAA Framework

The core access control architecture consisting of four sequential concepts: Identification, Authentication, Authorization, and Accountability.

Principle of Least Privilege

The security practice of restricting users and computing processes to the minimum access rights and resources necessary to carry out their legitimate duties.

Separation of Duties

An operational control requiring critical tasks to be divided among two or more individuals to prevent fraud, abuse, and unilateral error.

Mandatory Access Control (MAC)

A non-negotiable access control scheme where a central authority rates information with sensitivity labels and regulates access based on subject clearance levels.

Discretionary Access Control (DAC)

An access control model where the individual owner of a data asset has the personal discretion to determine access rights and grant permissions to other users.

Role-Based Access Control (RBAC)

A nondiscretionary control mechanism that assigns system access rights based on an employee's organizational position or job function rather than individual identity.

Capabilities Table

A row in an access control matrix associated with a specific subject that specifies all the objects and corresponding rights that the subject is permitted to access.

Bell-LaPadula (BLP) Confidentiality Model

A formal state machine security model designed to preserve confidentiality through strict security levels, preventing higher-level information from flowing down to lower-level subjects.

Simple Security Axiom

The Bell-LaPadula confidentiality rule prohibiting a subject from reading data from an object at a higher security level (commonly known as 'no read up').

Star (*) Property Axiom

The Bell-LaPadula confidentiality rule prohibiting a subject from writing or transferring data to an object at a lower security level (commonly known as 'no write down').

Biba Integrity Model

An access control state machine model designed to prevent unauthorized modification and maintain information integrity by preventing lower-integrity data from contaminating higher-integrity assets.

Simple Integrity Property

The Biba model integrity rule stating that a subject cannot read an object possessing a lower integrity level (commonly known as 'no read down').

Integrity Star (*) Property

The Biba model integrity rule stating that a subject cannot write to or modify an object possessing a higher integrity level (commonly known as 'no write up').

Clark-Wilson Integrity Model

An access control model created for commercial applications that preserves data integrity through well-formed transactions, separation of duties, and transformation procedures.

Graham-Denning Access Control Model

A formal theoretical model composed of objects, subjects (a process and a domain), and eight primitive rights governing the creation, deletion, and delegation of security entities.

Brewer-Nash Model (Chinese Wall)

A dynamic access control model designed to prevent commercial conflicts of interest by barring users from viewing data of competing business interests once an initial dataset is accessed.

NIST Control Assessment Process

A standardized five-phase security assessment workflow comprising Organization Preparation, Assessor Preparation, Assessment Execution, Organization Approval, and Organization Oversight.