Term
|
Definition
| is a time-honored strategy for defending against attack |
|
|
Term
| IATF says about Degense in depth |
|
Definition
| application of services should be based on the "protect, detect, and react paradigm" |
|
|
Term
| it is NOT ENOUGH to just ___, we must assume that protective measures may be compromised, ____ such failures and be prepared to ___ accordingly |
|
Definition
| it is NOT ENOUGH to just PROTECT, we must assume that protective measures may be compromised, DETECT such failures and be prepared to REACT accordingly |
|
|
Term
| IA requires a balance focus on three primary elements |
|
Definition
| - people, technology, and operations |
|
|
Term
|
Definition
policies & procedures
training and awareness
system administration
physical security
personnel security |
|
|
Term
|
Definition
IA Architecture
IA criteria
acquisition/Integration of products
system risk assessment |
|
|
Term
|
Definition
security policy
certification and accreditation
securiy Mgmt
key management
readiness assessments
Recovery and Reconnstitution |
|
|
Term
|
Definition
| passive, active, insider, close-in, distribution |
|
|
Term
| IATF defines ISSE (information systems security engineering) as |
|
Definition
| the art and science of discovering users' information protection needs and the designing and making information systems .... |
|
|
Term
| IATF gives 3 important priciples that are applicable to SE and ISSE |
|
Definition
1 - always keep the probelm and solution spaces separate
2- the problem space is defined by the customer's mission
3 - the systems engineer and info systems security engineer define the solution space, driven by the problem space |
|
|
Term
|
Definition
1 - discover needs
2 - define system requirements
3 - design sysem architecture
4 - develop detailed design
5 - implement system |
|
|
Term
| Information Management Model (IMM) |
|
Definition
| describes information domains |
|
|
Term
|
Definition
| to define the minimum level of access to each information domain for each group of users necessary for them to do their work |
|
|
Term
|
Definition
1 - determining harm to information
2 - identify potentially hramful events
3 - combining 1 and 2 to determine threat levels |
|
|
Term
|
Definition
1 disclosure
2 loss or modificaiton
3 denial of service
4 repudiation |
|
|
Term
| harm to information is determined by |
|
Definition
| estimating the VALUE of info and the COST IMPACT if the info is harmed |
|
|
Term
| potentially harmful events are events that can cause _____ |
|
Definition
harm to information
-can be attacks or accidental/unintentional |
|
|
Term
| Potential harmful event is estimated by |
|
Definition
| likelihood (or probability) of occurrence |
|
|
Term
|
Definition
| potentially harmful events and harm to info tatings describe info threats |
|
|
Term
|
Definition
|
|
Term
|
Definition
| the formal process of identifying and controlling risk |
|
|
Term
| 2 components of risk management |
|
Definition
1 - risk identification
2 - risk control |
|
|
Term
| 3 broad areas of knowledge in risk management |
|
Definition
1 - know yourself
2 - know the enemy
3 - know the communities of interest |
|
|
Term
|
Definition
1 - plan and organize the process
2 - categorize system components
3 - inventory and categorize assets
4 - identify threats
5 - specify vulnerable assets |
|
|
Term
| common approach in risk identification |
|
Definition
|
|
Term
| risk control 4 strategies |
|
Definition
1 - avoidance
2 - transference
3 - mitigation
4 - acceptance |
|
|
