Domain 5: Protection of Information Assets

What is the basis for designing and developing logical access controls?

The security policy

Who is accountable for the appropriate maintenance of security controls over information assets?

Data and system owners

What is the first step in data classification?

Establishing ownership, as it would be difficult to conduct criticality analysis or develop an access matrix if an owner is not defined.

Who is responsible for reviewing users’ access rights?

The data owner

What is the first step when reviewing an IT security baseline?

To determine the adequacy and sufficiency of the baseline

What are the common privacy principles?

Organizations should:

• Specify the use of the personal information that is collected

• Obtain consent before transfer of personal information to another jurisdiction

• Personal information should be retained as long as necessary

• Have appropriate controls and safeguards for protecting information

• Have appropriate process for reporting compliance with privacy policy, standards, and laws.

• Appropriate governance mechanism over the third party service provider processing privacy data on behalf of the organization

• ‘comply with applicable data protection regulations

What is the purpose of physical controls?

To protect information system processing facilities thorugh physical mediums to prevent data theft and breach of data leak

What is the purpose of environmental controls?

Controls that are in pace to protect systems, buildings, and related supporting infrastructure against threats with their physical environment.

What are the types of power failure?

1. Blackout: Total loss of power

2. Brownout: Severely reduced voltage and can strain, or even permanently damage, electronic equipment

3. Sags: Rapid decrease in voltage level

4. Spikes and surges: Rapid increase in voltage level

What is the most effective control to protect against short term reduction in electrical power?

The use of power line conditioner.

This control is a device that compensates for the reduction of voltage by providing its own power to maintain equilibrium.

What is Electromagnetic interference (EMI)

Caused by electrical storms or faulty electrical equipment and can cause system corruption/damage

What is the use of a uninterruptible power supply (UPS)?

Device that helps support an organization from interruptions that can last up to 30 minutes.

What are the best practices for the maintenance of an alarm control panel?

1. Should always be accessiible to security personnel

2. Should be placed in weatherproof box

3. Should have electrical power from a dedicated and separate circuit

4. Should be placed in adherence to local regulations and requirements.

What are the best practices for the maintenance of water and smoke detectors?

1. The location for the detectors should be easy to identify and access

2. The water detectior should be placed under raied floors and near drain holes

   1. the smoke detector should be placed above and below the ceiling tiles

What are the different types of fire supression systems?

1. Water based systems

2. Dry pipe Sprinkling Systems

What is the difference between water based systems and dry pipe sprinkling systems?

• In water based system, the water is always present within the system piping whereas for dry pupe sprinkling system, the water is only going to appear if the electronic fire alarm activates the water pump to send water

• Water based systems is more reliable and effective then dry pipe

• The disadvantage of using water based system is that the facility is at risk of water damage if the pipe breaks, whereas dry pipe sprinkling systems do not have this risk

Which gases are safe for humans?

Argonite and FM-200

If CISA asks, FM-200 is safer then argonite

These gases are used to put out fires

Which gases are dangerous for humans?

Carbon Dioxide and Halon Systems

What is halon systems?

These systems remove oxygen from the air to stave a fire

What is single sign on (SSO) ?

A user can use one set of login credential to be able to access multiple applications.

What are the advantages of SSO?

• No need to have multiple passwords

• Reduces time taken by users to log in to multiple applications

• Improves administrators ability to manage user accounts

• Reduce admin overhead cost in resetting passwords due to lower number of IT Help desk calls about passwords

What are the disadvantages of SSO?

• Most important disadvantage: If SSO fails, it has the risk of being the single point of failure

  • On the exam, if the option of single point of failure and acts as single authentication point shows up, the better answer is single authentication point.

• Supporting of all major operating system environments is difficult

What is the most important control for SSO?

Implementation of strong password policy

What is kerberos?

Technology that allows users to authenticate into the system through time limited tickets issues by a trusted key distribution center

What are the 3 factors of authentication that can be used for granting access?

1. Something you know (Ex. Passwords, PIN)

2. Something you have (Key card)

3. Something you are (Biometrics)

How do we know the layers of authentication? What is considered single factor, two factor, three factor, etc.

If the factors to be able to authenticate are of the same type, then it would be single factor. A good example is requireing a password and PIN to be able to authenticate. These authentication factors are both something you know and would be single factor.

If for example the authentication requirements are password and then a eye scan, then that would be two factor since that is something you know (password) and something you are (eye scan)

What is the objective of an IS auditor reviewing logical access control?

To determine whether access is granted and controlled as per the approved authorizations

What is the major risk of shared user accounts?

Individual user accountability may not be established

How can compliance with a password policy best be ensured?

With automated password management tools

What is the most important consideration when reviewing system controls?

Alignment of security and performance requirements

What is the best way to erase data?

Best method: Physical Destruction

Alternative method: Demagnetization/Degaussing: Using magnetic patterns that makes the stored information unreadable

What is the objective of using a naming convention?

Naming convention is grouping a set of assets under one name.

The objective of naming convention is to improve the implementaion of efficient access rules and to simplify security administration.

A good example of this is that if a group of assets are classified as sensitive critical assets, then there should be a standard procedure for sensitive critical assets

What is the first step in the implementation of logical access controls

To prepare an inventory of IS resources

What are the following steps to implement logical access control?

1. Prepare an inventory of the IS resources

2. Classify the IS resources

3. Perform grouping/labeling of the IS resources

4. Create an access control list

What is the most important control to prevent unauthorized access to databases ?

Block access after a specified number of unsuccessful login attempts

What does a does a default deny access control policy do?

Allows approved traffic and rejects all other traffic

• This minimizes the attack surface and prevents unauthorized or unknown traffic from entering

What does a does a default Allow access control policy do?

Denis specific traffic and allows all other traffic.’

• This allows access unless explicitly blocked. It is less secure control when compared to default deny access

What is biometric verification?

Verification of an individual by evaluating one or more distinguishing biological features

What are the biometric measure rates?

1. False acceptance rate: Rate of acceptance of unauthorized individuals

2. False rejection rate: Rate of rejection of authorized individuals even through the person is authorized

3. Cross error rate (CER) or equal error rate (EER): The rate in which the false acceptance and rejection are equal. So, this means that the most effective biometric control is the one with the Cross error rate

Which biometric measure rate is the best perforamcne indicator?

In terms of rank:

1. Cross error rate

2. False acceptance rate

3. False rejection rate

Note that though if the question asks about the overall performance indicator the answer will be CER, but if the question just asks about performance indicator, then it would be false acceptance rate

What are the key biometric attacks?

1. Replay: Residual biometric characteristics that are left on the device is sued by an attacker to gain unauthorized access

2. Brute force: Sending the device numerous biometric samples to force a way in

3. Cryptographic: Targets the algorithm or encrypted data transmitted between biometric device and access control system

4. Mimic: The attacker attempts to fake the biometric characteristics

What biometric characteristic has the highest reliability and lowest false acceptance rate?

Retina Scan

What is the biometric life cycle comprised of?

1. Enrollment: system analyzes the biometric identify and creates a biometric template for the individual

2. transmission: the goal is to protect biometric data as it being transferred between systems

3. storage: So, the goal is to protect biometric data from unauthorized access and alteration.

4. Verification: the process here is to verify that you are who you say you are. This step would require two factor authentication, such as doing a finger scan along side with entering a PIN. This is doing a 1 on 1 comparison

5. Identification: The system is trying to determine who’s biometric data it belongs to so it can log and identify the user log in attempt. This is doing a 1 to many comparison

6. Termination process: happens when biometric access is no longer required and access is revoked

Note that biometric controls are more reliable than any other form of access controls

What is the OSI layer?

It is the open system interconnections and describes how information moves from one computer to another

There are 7 layers and each layer manages a task

What are the OSI layers?

1. Physical

2. Data link

3. Network

4. Transport

5. Session

6. Presentation

7. Application

How does information flow within the OSI?

When a person sends out information from their computer, the sender information is sent out starting at the application level and works its way down to the physical level.

The person receiving the information from the receiver will first receive the information on a physical device, and the information works its way up the OS Iayer up to the application layer

What is the function of the application layer of OSI?

It is the layer that is closest to the suer and provides network services that application use to communicate.

Tip to remember: Application = What network service am I using?

What is the function of the presentation layer of OSI?

It is the layer that makes sure data is in a format that the receiving system can understand.

Major functions include:

• Data formatting

• Data translating

• Encryption / decryption

Tip to remember: Presentation = How should the data look to the receiving user

What is the function of the session layer of OSI?

It is the layer that is responsible for the communication between two systems.

Tip to remember: First think about establishing a connection between two computers, then the connection has to be maintained so that the data / information can be fully transferred, and after it has been competed, the connection is severed.

What is the transport layer of the OSI?

It is the layer that is responsible for the end to end delivery of data between two systems, ensuring the C&A of the data being transferred

Think of Transport = TCP + UDP + Ports

TCP - Transmission Control Protocol: This is connection oriented and the goal is to make sure that the data gets to its destination reliably.

UDP - User datagram protocol: this is a connectionless process and has the goal of just sending over the information

What is the function of the Network layer in OSI

It is the layer that is responsible for how data travels from source to destination across multiple networks

Tip to remember: Network = IP + router + Routing

When we see the words ‘packet filtering firewall’, the answer is network layer

What is the function of the data link in OSI?

It is the layer that is responsible for organizing bits into frames, and ensures reliable transfer between two connected devices

Tip to remember: Data link = MAC address + Switch + Frame

If I see words '‘Protocol Analyzer / Sniffer, answer should be data link layer

What is the physical layer of OSI

Lowest layer of OSI and handles the physical transmission of raw bits

Tip to remember: Physical = Cable + Signal + Bits

At which OSI layer does the packet filtering firewall operate?

Network Layer

Purpose of the network layer is to insert the IP address into the packet header and route the packet to its destiantion

What are the types of firewall?

1. Packet Filtering Router

2. Statefull Inspection

3. Circut Level

4. Application level

What is Bastion Host?

A hardened/computer that is exposed to an untrusted network, such as the internet, while helping proceting the internal network.

Think of it like a reception stand, where the reception is exposed to all guests, but the guests are not allwoed to go to restricted areas.

In bastion host, only essential services and processes are enabled to remove reduce the attack risk

What is a proxy?

A proxy acts as a middle man and stands between internal and external network.

A proxy will not allow direct communication between 2 networks

Proxy that works at the session layer (lower layer) is the circuit level proxy and the proxy at the application layer (higher level) is the application level proxy.

What is the packet filtering filter for types of firewalls?

Simplest kind of firewall and it is an allow or deny action taht is done as per IP address and port number of source and destination