ISC Overall

S1: Regulations, Standards, and Frameworks

…

Who is the NIST SP 800-53 (security and privacy) framework intended for?

A wide audience

What is required by the organization under NIST SP 800-53 when managing security and privacy risks?

Continuous monitoring of:

• Information systems and orgs to determine the ongoing effectiveness of controls

• Changes in informations systems and environments of operation

• State of security and privacy org-wide

What does the NIST CSF Core describe?

Cybersecurity outcomes and creates a taxonomy and structure for understanding, assessing, and communicating risk

What does the NIST CSF and Privacy Framework offer in comparison to NIST SP 800-53?

The CSF and Privacy Framework offer flexible guidance tailored to managing cybersecurity and privacy risks, whereas SP 800-53 defines detailed and prescriptive control requirements primarily used for protecting federal systems and orgs

How do the Privacy Framework Tiers differ from the NIST CSF Tiers?

By the addition of workforce as a tier subdivision. Otherwise, they operate identically.

What does the Control function focus on in the NIST Privacy Framework?

Defining management practices and internal processes for handling privacy risks

What does the Personnel Security (PS) control family for NIST SP 800-53 focus on?

Evaluating employees to determine their trustworthiness and prevent insider threats or compromise

How does NIST SP 800-53 divide control families?

Into controls and control enhancements, where controls are the objectives to be implemented for family baseline conformance, and control enhancements are best practices

How are the functions in the NIST CSF Core organized?

By categories that define outcomes, and subcategories that list key activities

Does corporate ownership or the parent company’s location by itself determine GDPR applicability?

No, applicability depends on where data subjects are and how they’re targeted

Under PCI DSS, is sensitive authentication data stored after the authorization of a transaction?

No

What does the “Based on a Conceptual Model” principle mean?

Governance frameworks should identify key components and their relationships to enable greater automation and maximize consistency

What is the Threat Landscape?

A design factor that can be described as the environment in which the company operations, and it may be classified as normal, high, or low because of geopolitical threats or issues, industry sector, or economic issues

What six functions does the NIST Cybersecurity Framework contain that should be performed concurrently?

1. Govern

2. Identify

3. Protect

4. Detect

5. Respond

6. Recover

What does Tier 1 (Partial) of NIST CSF include?

• Small businesses

• Done on an ad hoc basis (handle as arise)

• No detailed processes

What does Tier 2 (Risk-Informed) of NIST CSF include?

• Bigger businesses

• Based on organization risk

• Aware of cybersecurity risks

• No consistency

What does Tier 3 (Repeatable) of NIST CSF include?

• BIG businesses

• Cybersecurity risk is real

• Documented

• Systematic

• Monitor

What does Tier 4 (Adaptive) of NIST CSF include?

• HUGE businesses (affects everyone)

• Organization-wide approach

• Continuous improvement

• Part of culture

What is the five-step approach that NIST recommends to using the organizational profiles? (mnemonic)

Some - Scope the organizational profile

Guy - Gather information needed to prepare the organizational profile

Created - Create the organizational profile

A - Analyze the gap between the current and target profiles and create an action plan

I - Implement the actional plan and update the organizational profile

What are the 8 functions of the NIST Privacy Framework?

1. Identify (CSF, privacy)

2. Govern (CSF, privacy)

3. Control (privacy)

4. Communicate (privacy)

5. Protect (CSF, privacy)

6. Detect (CSF)

7. Respond (CSF)

8. Recover (CSF)

What falls under the protect function for the NIST Privacy Framework?

• Identity Management

• Authentication

• Access Control

• Data Security

• Maintenance

What is the Privacy Rule?

Permits a covered entity to use/disclose protected health information (PHI) with no further authorization required

What is the Security Rule?

Requires ensuring confidentiality, integrity, and availability of electronic PHI

What safeguards does the HIPPA security rule require?

Administrative, technical, and physical safeguards

When is the org permitted to disclose personal health information without authorization?

• If it’s for the public interest or benefit as allowed under law

• If patient information is redacted as part of a data set for use in health research

What is HITECH?

• Amends HIPPA

• Added business associates as a covered entity

• Increases penalties for violations

• Requires electronic record options

• Notification of breaches within 60 days

What are the principles of GDPR?

• Lawfulness

• Fairness

• Transparency

• Purpose Limitation Data

• Data Minimization

• Accuracy

• Storage Limitation

• Integrity/Confidentiality

Under GDPR, when is further processing of data beyond the stated principles permitted?

For public interest archiving, scientific/historical research, or statistical purposes

What does data subject to PCI DSS include?

• Cardholder Data: primary account #, name, expiry, service cost

• Sensitive Authentication Data: verification cost, PIN, full track data

Collectively, they’re referred to as account data

What are the six goals of the PCI Data Security Standard (PCI DSS)? (mnemonic)

1. Bihhh - Build and maintain a secure network and systems

2. Please - Protect account data

3. Mind - Maintain a vulnerability management program

4. Information - Implement strong access control measures

5. Regarding - Regularly monitor and test networks

6. Me - Maintain an information security policy

What are the requirements of Goal #1 (Build and maintain a secure network and systems)?

• Requirement 1: Install/maintain network security controls

• Requirement 2: Apply secure configurations

What are the requirements of Goal #2 (Protect account data)

• Requirement 3: Protect stored account data

• Requirement 4: Protect cardholder data with strong cryptography during transit

What are the requirements of Goal #3 (Maintain a vulnerability management program)?

• Requirement 5: Protect systems/networks from malicious software

• Requirement 6: Develop/maintain secure system

What are the requirements of Goal #4 (Implement strong access control measures)?

• Requirement 7: Restrict access through need to know restrictions

• Requirement 8: Identify users and authenticate access

• Requirement 9: Restrict physical access to data

What are the requirements of Goal #5 (Regularly monitor and test networks)?

• Requirement 10: Log/monitor access to system components and data

• Requirement 11: Test security

What are the requirements of Goal #6 (Maintain an information security policy)?

• Requirement 12: Support information security with policies/programs (documentation)

With what principles in mind were Center for Internet Security (CIS) controls designed?

• Context

• Coexistence

• Consistency

How can the implementation of Center for Internet Security (CIS) controls be tailored to an organization’s size?

By using one of the three implementation groups based on a self-assessment. The implementation groups mirror the NIST CSF tiers.

What is Control 01: Inventory and Control of Enterprise Assets?

This control helps organizations actively track and manage all IT assets connected to a company’s IT infrastructure physically or virtually within a cloud environment

What is Control 02: Inventory and Control of Software Assets?

This control provides recommendations for organizations to track and actively manage all software applications so that only authorized software is installed on company devices

What is Control 03: Data Protection?

This control helps organizations develop ways to securely manage the entire life cycle of their data, from the initial identification and classification data to its disposal

What is Control 04: Configuration of Enterprise Assets and Software?

This control helps organizations establish and maintain secure baseline configurations for their enterprise assets

What is Control 05: Account Management?

This control outlines best practices for companies to manage credentials and authorization for user accounts, privileged user accounts, and service accounts for company hardware and software applications

What is Control 06: Access Control Management?

This control expands on Account Management (Control 05) by specifying the type of access that user accounts should have; Use processes to create, assign, manage, revoke access credentials for accounts

What is Control 07: Continuous Vulnerability Management?

This control assists organizations in continuously identifying and tracking vulnerabilities within its infrastructure so that it can remediate and eliminate weak points or windows of opportunity for bad actors

What is Control 08: Audit Log Management?

This control established an enterprise log management process so that organizations can be alerted and recover from an attack in real time, or near real time, using log collection and analytic features

What is Control 09: Email and Web Browser Protections?

This control provides recommendations on how to detect and protect against cybercrime attempted through email or the internet by directly engaging employees

What is Control 10: Malware Defenses?

This control assists companies in preventing the installation and propagation of malware onto company assets and its network

What is Control 11: Data Recovery?

This control establishes data backup, testing, and restoration processes that allow organizations to effectively recover company assets to a pre-incident state

What is Control 12: Network Infrastructure Management?

This control establishes procedures and tools for managing and securing a company’s network infrastructure

What is Control 13: Network Monitoring and Defense?

This control establishes processes for monitoring and defending a company’s network infrastructure against internal and external security threats

What is Control 14: Security Awareness and Skill Training?

This control guides organizations in establishing a security awareness and training program to reduce cybersecurity risk

What is Control 15: Service Provider Management?

This control helps organizations develop processes to evaluate third-party service providers that have access to sensitive data or that are responsible for managing some or all of a company’s IT functions

What is Control 16: Application Software Security?

This control establishes safeguards that manage the entire life cycle of software that is acquired, hosted, or developed in-house to detect, deter, and resolve cybersecurity weaknesses before they are exploited

What is Control 17: Incident Response Management?

This control provides the recommendations necessary to establish an incident response management program to detect, respond, and prepare for potential cybersecurity attacks

What is Control 18: Penetration Testing?

This control helps organizations test the sophistication of their cybersecurity defense system in place by simulating actual attacks in an effort to find and exploit weaknesses

What does IT governance under COBIT constitute?

• Company success

• BOD

What does management under COBIT constitute?

• Daily planning/ops

• Officers

What are the six principles for a governance system under COBIT 2019? (mnemonic)

Very - provide stakeholder Value

Healthy - Holistic approach

Dieters - Dynamic governance system

Do - governance Distinct from management

Try - Tailored to enterprise needs

Everything - End to end governance system

What are the three principles for a governance framework under COBIT 2019? (mnemonic)

Cashmere - based on Conceptual model

Feels - open and Flexible

Awesome - Aligned to major standards

How are Governance objectives under COBIT 2019 grouped?

Into one domain: Evaluate, Direct, and Monitor (EDM)

Under the COBIT Core Model, what do the EDM objectives include?

• Government framework setting/maintenance

• Ensured benefits delivery

• Ensured risk optimization (most important)

• Ensured resource optimization

• Ensured stakeholder engagement (most important)

How are Management objectives under COBIT 2019 grouped?

Into four domains:

1. Align, Plan, and Organize (APO)

2. Build, Acquire, and Implement (BAI)

3. Deliver, Service, and Support (DSS)

4. Monitor, Evaluate, and Assess (MEA)

Under the COBIT Core Model, what do the BAI objectives include?

• Managed knowledge

• Managed organizational changes

• Managed availability and capacity

This is about putting the tech into place

Under the COBIT Core Model, what do the DSS objectives include?

• Service requests and incidents

• Managed problems

• Managed security devices

This is about fixing the tech

Under the COBIT Core Model, what do APO objectives include?

• Managed security

• Managed HR

• Managed budget/costs

This is about deciding the tech

Under the COBIT Core Model, what do MEA objectives include?

• Managed performance and conformance monitoring

• Managed system of internal control

• Managed compliance with external requirements

• Managed Assurance

This spans the other 3 management domains

What are the two main consideration areas when customizing the COBIT Core Model to your specific business?

• Design Factors: enterprise strategy/goals, risk profile IT issues, source model for IT, IT implementation methods, Role of IT, enterprise size, etc.

• Focus Areas: Government issues/domains/topics solved by a combination of mgmt and governance objectives

How do you determine the Role of IT?

• Not Critical = Support

• Critical = Factory

• Critical for Innovation = Turnaround

• Critical for Innovation AND Business Operations = Strategic

S2: Information Systems and Data Management

…

What are Firewalls?

Software applications or hardware devices that protect a person’s or company’s network traffic by filtering it through security protocols with predefined rules

What is an Application-Level Gateway?

A type of firewall that inspects the packet itself and are very resource-intensive

What is a Circuit-Level Gateway?

A type of firewall that verifies that source of a packet and meets rules and policies set by the security team

What is a Network Address Translation Firewall?

Assigns an internal network address to specific, approved external sources so that those sources are approved to be inside the firewall

What is a Stateful Multilayer Inspection Firewall?

Combines packet filtering and network address translation

What is a Next-Gen Firewall?

Assigns different firewall rules to different applications as well as users. Therefore, a low-threat application has more permissive rules assigned to it and vice versa.

What is a Modem?

Connects a network to an internet service provider’s network, usually through a cable connection

What is a Router?

Manage network traffic by connecting devices to form a network

What are Switches?

Connect and divide devices within a computer network

What are Gateways?

Computer or device that acts as an intermediary between different networks, translating data from one protocol to another

What are Edge Enabled Devices?

Perform the function of a traditional server by shifting most or all of the computational power to the edge-enabled device where the initial request was originated, which is a decentralization of computing power, resulting in faster response times

What is a Server?

Physical or virtual machines that coordinate the computers, programs, and data that are part of the network

What is Network Topology?

Refers to the physical layout of equipment, or “nodes”, in a network

What is Bus Topology?

Layout is either in a linear or tree form, which each node connected to a single line or cable

What is Mesh Topology?

Numerous connections between nodes, with all nodes being connected in a full mesh topology and only some connected in a partial mesh topology (commonly used in wireless networks)

What is a Ring Topology?

Nodes are connected in a circular path

What is Star Topology?

Data passes through a central hub that acts as a switch or server, and then transmits to peripheral devices that act as clients

What does the Open Systems Internconnection Model help explain?

How protocols work and how networking devices communicate with each other

What are Local-Area Networks (LANs)?

Provides network access to a limited geographic area such as a home or single-location office

What are Wide-Area Networks (WANs)?

Provides access to a larger geographic area such as cities, regions, or countries

What are Software-Defined Wide Area Networks (SD-WANs)?

Monitors the performance of WAN connections and manages traffic to optimize connectivity

What is a Demilitarized Zone (DMZ)?

A subnetwork that separates a LAN from other untrusted networks such as the internet

What is a Virtual Private Network (VPN)?

Virtual connections through a secure channel or tunnel that provide remote and secure access to an existing network

What are the benefits of using a Cloud Service Provider (CSP)?

• Flexible pricing that varies based on resource consumption

• Reduction in on-site hardware support

• Processing data more efficiently by accessing advanced computing power

• Make organizations more resilient by enhancing their disaster recovery capabilities

• Provides clients with duplication of critical infrastructure

What are the Cloud Computing Models?

• IaaS = CSP controls infrastructure, org controls OS/apps/data/runtime environment

• PaaS = CSP controls infrastructure/runtime environment/OS, org develops/manages custom apps and manages data

• SaaS = CSP manages everything, org just uses the finished application and manages user configurations/access controls

What does a BPaaS provider deliver?

Business process outsourcing services to a user (like a major transaction cycle)

What are the five components of the COSO Integrating Strategy and Performance Framework?

1. Governance and Culture

2. Strategy and Objective Setting: Define risk appetite

3. Performance: Prioritize risks based on risk appetite

4. Review and Revision

5. Information, Communication, and Reporting

When using public cloud services, who remains responsible for managing access controls for its cloud applications?

The customer organization

What are the components of COSO’s Enterprise Risk Management Framework that are applied for companies to create optimal cloud configurations?

1. Internal Environment

2. Objective Setting

3. Event Identification

4. Risk Assessment

5. Risk Response

6. Control Activites

7. Information and Communication

8. Monitoring