NIST Cybersecurity Framework Overview
198 Questions
0 Views

Choose a study mode

Play Quiz
Study Flashcards
Spaced Repetition
Chat to lesson

Podcast

Play an AI-generated podcast conversation about this lesson

Questions and Answers

Which NIST framework component focuses on the current and desired states of organizational risk management?

  • Framework Profile (correct)
  • Framework Core
  • Risk Management Process
  • Framework Implementation Tiers

    • According to the NIST Cybersecurity Framework, which function is primarily concerned with detecting active cyber attacks?

  • Respond
  • Detect (correct)
  • Identify
  • Protect

    • Which of the following best describes an organization operating at Tier 2 of the NIST Cybersecurity Framework Implementation Tiers?

  • Cybersecurity is isolated from risk management with some awareness of risks. (correct)
  • Formal, documented policies are in place and integrated into planning.
  • The organization is highly responsive to evolving cyber threats and adapts accordingly.
  • Cybersecurity is ad hoc with inconsistent actions.

    • Which of the following is NOT a core function within the NIST Cybersecurity Framework?

    <p>Analyze</p> Signup and view all the answers

    What is the purpose of performing a gap analysis within the NIST Cybersecurity Framework?

    <p>To identify the differences between an organization's current cybersecurity state and its desired future state.</p> Signup and view all the answers

    Which component of the NIST Privacy Framework involves establishing a dialogue around privacy risks?

    <p>Communicate</p> Signup and view all the answers

    Which NIST publication provides a catalog of security and privacy controls applicable to all information systems, but serves as the STANDARD for federal information security systems?

    <p>SP 800-53</p> Signup and view all the answers

    In SP 800-53, which control family deals with the management of security configurations?

    <p>CM</p> Signup and view all the answers

    Which of these is NOT a tier in the NIST Privacy Framework?

    <p>Proactive</p> Signup and view all the answers

    Which of these is a type of vulnerability that patch management addresses?

    <p>Software bugs</p> Signup and view all the answers

    What is the main goal of the "Staging" environment in a DTSPD change environment?

    <p>To ensure that new applications are properly integrated with existing systems</p> Signup and view all the answers

    According to the content, what is the average cost of a data breach?

    <p>$4 million</p> Signup and view all the answers

    Which of the following is NOT a consequence of a data breach?

    <p>Increased stock price</p> Signup and view all the answers

    Which of these is NOT considered a key component of a Patch Management Program?

    <p>Developing new features and functionality</p> Signup and view all the answers

    Which category of individuals is NOT considered the intended audience for SP 800-53?

    <p>Marketing personnel</p> Signup and view all the answers

    Which type of testing is performed to ensure diverse components of an application function as designed?

    <p>System testing</p> Signup and view all the answers

    What type of control is implemented at the organizational level according to SP 800-53?

    <p>Common Control</p> Signup and view all the answers

    What is the primary purpose of 'baseline configuration' in documenting systems controls?

    <p>To establish a starting point before implementing changes to a system</p> Signup and view all the answers

    In the Waterfall Model, which stage primarily involves evaluating and approving changes?

    <p>Testing and Change Review</p> Signup and view all the answers

    Which Act aims to adopt national standards to promote healthcare privacy and security?

    <p>Health Insurance Portability and Accountability Act (HIPAA)</p> Signup and view all the answers

    What does PHI stand for in the context of HIPAA?

    <p>Protected Healthcare Information</p> Signup and view all the answers

    Which type of data collection involves gathering information without direct consent?

    <p>Passive data collection</p> Signup and view all the answers

    What is the main benefit of using a Parallel conversion method when implementing a new system?

    <p>It offers the highest degree of safety and risk reduction</p> Signup and view all the answers

    Which type of change environment is used to test applications in their final phases before deployment?

    <p>Staging</p> Signup and view all the answers

    Which of the following is NOT a risk associated with integration?

    <p>Inability to meet deadlines</p> Signup and view all the answers

    A vulnerability tool is primarily used to:

    <p>Track security controls and identify weaknesses in systems</p> Signup and view all the answers

    What is the purpose of data integration during the Preparation phase of the Data Lifecycle?

    <p>To ensure data is accurate and consistent</p> Signup and view all the answers

    What is a key characteristic of the Agile method in comparison to the Waterfall Model?

    <p>Focus on customer feedback throughout the process</p> Signup and view all the answers

    Which type of data logging focuses on recording access to files?

    <p>Event logs</p> Signup and view all the answers

    What is the main purpose of archiving data in the Data Lifecycle?

    <p>To free up storage and resources in active systems</p> Signup and view all the answers

    Which of these is a type of change that is typically considered routine as part of Change Management?

    <p>Performing system upgrades</p> Signup and view all the answers

    What is the primary advantage of a full backup compared to other types of backups?

    <p>It provides the quickest restoration to functionality.</p> Signup and view all the answers

    Which type of disaster recovery site has equipment on site but not plugged in?

    <p>Warm Site</p> Signup and view all the answers

    What does a differential backup do?

    <p>Copies all changes since the last full backup.</p> Signup and view all the answers

    What is the most important step in developing a disaster recovery plan?

    <p>Testing the plan.</p> Signup and view all the answers

    Which type of backup copies data items that have changed since the last backup?

    <p>Incremental Backup</p> Signup and view all the answers

    What is the primary concern when moving from a private to a public cloud computing model?

    <p>Higher risk due to increased reliance on external providers</p> Signup and view all the answers

    Which of the following is NOT a type of processing control in an information system?

    <p>Data encryption</p> Signup and view all the answers

    What is a key benefit of using an Enterprise Resource Planning (ERP) system?

    <p>Reduced data input complexity due to a central data repository</p> Signup and view all the answers

    Which of the following is a valid concern associated with adopting a Cloud Service Provider (CSP)?

    <p>Possible concentration of risk in a single provider</p> Signup and view all the answers

    What is the purpose of a reasonableness test in an accounting information system?

    <p>To detect potential errors by comparing transaction totals</p> Signup and view all the answers

    What is the primary focus of risk assessment in all SOC engagements?

    <p>Inherent Risk</p> Signup and view all the answers

    Which of the following is a qualitative factor considered when assessing materiality for SOC1?

    <p>The nature and cause of deviations</p> Signup and view all the answers

    What is a 'Deviation or Exception' in the context of a SOC engagement?

    <p>A failure of a control to operate effectively in a specific instance</p> Signup and view all the answers

    What is a 'Service Commitment' in the context of a SOC engagement?

    <p>A declaration made to user entities about a system used to provide a service</p> Signup and view all the answers

    What is the auditor's responsibility when a security breach is identified?

    <p>Inquire with management about controls in place to identify, report, and obtain evidence of the breach</p> Signup and view all the answers

    Which of the following is NOT an additional auditor responsibility when planning a SOC2 or SOC3 engagement?

    <p>Assessing RMM (Risk and Materiality)</p> Signup and view all the answers

    Which of the following is considered a 'System Requirement' in the context of a SOC engagement?

    <p>A specification about how the system should function to meet the service commitment</p> Signup and view all the answers

    Which of the following is an example of a 'Description Misstatement' in a SOC engagement?

    <p>An error or omission in the description of the system</p> Signup and view all the answers

    What is the role of professional skepticism in addressing RMM in an audit?

    <p>Maintaining a questioning mind and critically evaluating evidence</p> Signup and view all the answers

    What is the auditor's responsibility regarding subsequent events in a SOC engagement?

    <p>Address events that come to their attention only if they are material</p> Signup and view all the answers

    Which of the following is NOT a HIPAA safeguard category?

    <p>Financial</p> Signup and view all the answers

    What was the primary goal of the HITECH Act of 2009?

    <p>To promote the transition to electronic health records</p> Signup and view all the answers

    Which of the following best describes the scope of GDPR's applicability?

    <p>It can apply to data processors outside the EU if they offer goods or services to those in the EU or monitor behavior in the EU.</p> Signup and view all the answers

    In the context of GDPR, what does the principle of 'Purpose Limitation' primarily ensure?

    <p>That data is processed for specific, explicit, and legitimate purposes.</p> Signup and view all the answers

    What does the acronym 'RAN' stand for in the context of GDPR's principle of Data Minimization?

    <p>Relevant, Adequate, Necessary</p> Signup and view all the answers

    Which of the following is NOT one of the six goals of PCI DSS?

    <p>Implement Stringent Background Checks on All Employees</p> Signup and view all the answers

    What does CIS stand for in the context of cybersecurity?

    <p>Center for Internet Security</p> Signup and view all the answers

    According to the CIS Controls, what does the design principle Offense Informs Defense primarily mean?

    <p>Controls should be drafted based on observed attacker behavior</p> Signup and view all the answers

    Which CIS implementation group is most suited for organizations that handle highly sensitive data and are subject to regulatory oversight?

    <p>IG3</p> Signup and view all the answers

    What is the primary purpose of CIS Control 3?

    <p>To manage the entire life cycle of data securely</p> Signup and view all the answers

    Which of these is NOT a common feature of CIS Control 5

    <p>Ensuring credentials are not treated as sensitive information</p> Signup and view all the answers

    What is the goal of penetration testing (CIS Control 18), according to the text?

    <p>To simulate attacks and test an organization’s defenses against cyber threats</p> Signup and view all the answers

    What does COBIT stand for?

    <p>Control Objectives for Information and Related Technologies</p> Signup and view all the answers

    Which of the following is NOT a governance system principle of COBIT 2019?

    <p>To only address the needs of the IT function</p> Signup and view all the answers

    What are the design principles of CIS, according to the text?

    <p>Align, Measurable, Offense Informs Defense, Focus, Feasible</p> Signup and view all the answers

    What shape represents a Process in a Data Flow Diagram?

    <p>Circle</p> Signup and view all the answers

    Which of the following is an example of a Network-Based Attack?

    <p>Denial of Service (DoS)</p> Signup and view all the answers

    What is a common method used in Spoofing attacks?

    <p>Address Resolution Spoofing</p> Signup and view all the answers

    Which type of cyberattack manipulates a system to execute operations in an incorrect order?

    <p>Race Condition</p> Signup and view all the answers

    In a System Interface Diagram, what type of flow does it represent?

    <p>Both Logical and Physical Flow</p> Signup and view all the answers

    What characteristic defines Host-Based Attacks?

    <p>They target a single host device.</p> Signup and view all the answers

    Which attack involves an intermediary intercepting communications?

    <p>Man-in-the-Middle</p> Signup and view all the answers

    Which of the following is NOT a form of Cyberattack?

    <p>Database Backup</p> Signup and view all the answers

    What kind of virus changes its structure to avoid detection?

    <p>Polymorphic Virus</p> Signup and view all the answers

    What method is typically used to disrupt server functionality in a Denial of Service attack?

    <p>Repetitive Requests</p> Signup and view all the answers

    What characterizes an Operational Data Store (ODS)?

    <p>It holds information on operational activities and is often interim.</p> Signup and view all the answers

    Which of the following is a defining feature of a Data Warehouse?

    <p>It must be continuously updated to remain relevant.</p> Signup and view all the answers

    What is a primary key in a relational database?

    <p>A unique identifier for each record in a table.</p> Signup and view all the answers

    In which normal form does every cell contain only one piece of information, and each table has a primary key?

    <p>First Normal Form (1NF)</p> Signup and view all the answers

    What does a Snowflake Schema mostly depend on?

    <p>Highly normalized dimension tables.</p> Signup and view all the answers

    What is the function of the SQL JOIN command?

    <p>It connects data from multiple tables based on related attributes.</p> Signup and view all the answers

    In BPMN models, what does a 'pool' represent?

    <p>An organization participating in a process.</p> Signup and view all the answers

    Which of the following SQL statements is used to filter results after aggregation?

    <p>HAVING</p> Signup and view all the answers

    Which of these accurately describes a Data Mart?

    <p>A focused subset of a data warehouse tailored for a specific purpose.</p> Signup and view all the answers

    What is the role of a Data Dictionary?

    <p>To provide information about the database structure.</p> Signup and view all the answers

    What is the primary purpose of a Security Assessment Report (SAR)?

    <p>To issue evidence of controls complying or not complying with security goals</p> Signup and view all the answers

    Which method is NOT typically included in security assessment methodologies?

    <p>Random sampling</p> Signup and view all the answers

    What does tokenization accomplish in data security?

    <p>It replaces production data with a surrogate value</p> Signup and view all the answers

    Which type of Data Loss Prevention (DLP) system scans files on endpoint devices?

    <p>Endpoint-Based DLP</p> Signup and view all the answers

    What is the primary function of obfuscation in data protection?

    <p>To replace sensitive data with less valuable information</p> Signup and view all the answers

    Which encryption method uses a single shared private key for both encryption and decryption?

    <p>Symmetric Encryption</p> Signup and view all the answers

    What does 'champion density' refer to in the context of security program champions?

    <p>The concentration of champions across different departments</p> Signup and view all the answers

    What type of ciphers uses symbols or letters to replace actual letters in a message?

    <p>Substitution ciphers</p> Signup and view all the answers

    What is the main goal of a phishing simulation?

    <p>To educate employees on recognizing phishing attempts</p> Signup and view all the answers

    Which of the following is NOT a safeguard for data at rest?

    <p>Increasing website traffic</p> Signup and view all the answers

    What is the primary function of the Presentation Layer in the OSI model?

    <p>Transforms and formats data for interpretation</p> Signup and view all the answers

    Which layer of the OSI model is mainly associated with adding Media Access Control (MAC) addresses?

    <p>Data Link Layer</p> Signup and view all the answers

    Which of the following is an example of a service offered under Platform as a Service (PaaS)?

    <p>Building an e-commerce platform</p> Signup and view all the answers

    What does the acronym CSP stand for in cloud computing contexts?

    <p>Cloud Service Provider</p> Signup and view all the answers

    What best defines Software as a Service (SaaS)?

    <p>Offering of applications to customers over the internet</p> Signup and view all the answers

    Which cloud computing deployment model is designed for use by a specific organization?

    <p>Private</p> Signup and view all the answers

    What is one of the main responsibilities of the Network Layer in the OSI model?

    <p>Adding routing address headers</p> Signup and view all the answers

    Which of the following is NOT a component of the COSO Enterprise Risk Management framework?

    <p>Application Development</p> Signup and view all the answers

    In which layer of the OSI model does encryption occur?

    <p>Presentation Layer</p> Signup and view all the answers

    What does the SPRIG framework relate to in the context of COSO Enterprise Risk Management?

    <p>Risk and Performance Management</p> Signup and view all the answers

    Which cloud computing model allows companies to rent only the infrastructure components like servers and networking?

    <p>Infrastructure as a Service (IaaS)</p> Signup and view all the answers

    What is the key function of the Session Layer in the OSI model?

    <p>Establishes and maintains communication sessions</p> Signup and view all the answers

    What type of network architecture is typically referred to as a WAN?

    <p>Wide-Area Network that connects multiple offices and locations</p> Signup and view all the answers

    Which of the following is a disadvantage of cloud computing?

    <p>Dependence on internet connectivity</p> Signup and view all the answers

    What type of opinion is issued when there are material but not pervasive issues?

    <p>Qualified Opinion</p> Signup and view all the answers

    Which of the following components is NOT included in a SOC report?

    <p>Service Organization's Financial Statements</p> Signup and view all the answers

    What must a service auditor ensure when using the Inclusive method?

    <p>The services provided by the subservice organization are addressed.</p> Signup and view all the answers

    What is the key difference in wording between a Qualified SOC 1 Report and a Qualified SOC 2 Report?

    <p>Qualified Opinion Section</p> Signup and view all the answers

    What should be included in the auditors test of controls?

    <p>A description of the test of control and the results</p> Signup and view all the answers

    What type of report is issued when a service auditor cannot reach an opinion?

    <p>Disclaimer Opinion</p> Signup and view all the answers

    Which of the following describes Complementary User Entity Controls (CUECs)?

    <p>Controls necessary to be implemented by the user entity</p> Signup and view all the answers

    Which statement describes an Adverse Opinion?

    <p>Reflects that controls were not operating effectively.</p> Signup and view all the answers

    Which of the following correctly identifies what constitutes a Subservice Organization?

    <p>Services are relevant to understanding the service organization system</p> Signup and view all the answers

    What is required in the description of the test of controls for Type 2 reports?

    <p>Describing in detail the nature and results of the tests performed</p> Signup and view all the answers

    Which device is responsible for managing network traffic and assigning IP addresses?

    <p>Router</p> Signup and view all the answers

    What is the primary function of a modem in an internet connection?

    <p>To connect a computer to the internet</p> Signup and view all the answers

    Which topology connects nodes in a circular path and minimizes collisions?

    <p>Ring Topology</p> Signup and view all the answers

    Which component is considered the 'brain' of the computer?

    <p>Microprocessor</p> Signup and view all the answers

    Which type of firewall combines packet filtering and network address translation?

    <p>Stateful Multilayer Inspection Firewall</p> Signup and view all the answers

    Which is NOT a function of edge-enabled devices?

    <p>Enabling high traffic management</p> Signup and view all the answers

    Which of the following steps comes first in the Incident Response Plan process?

    <p>Preparation</p> Signup and view all the answers

    What is the advantage of using a star topology in a network?

    <p>Easy identification of cable damage</p> Signup and view all the answers

    What distinguishes an adverse event from a computer security incident?

    <p>An adverse event may not always indicate malicious intent.</p> Signup and view all the answers

    What type of device can act as an intermediary between networks and convert protocols?

    <p>Gateway</p> Signup and view all the answers

    Which type of incident response team is best suited for widespread organizations?

    <p>Distributed Incident Response Team</p> Signup and view all the answers

    Which OSI Layer serves as the interface between applications?

    <p>Application Layer</p> Signup and view all the answers

    Which type of firewall specifically inspects the packets themselves, which can impact performance?

    <p>Application-Level Gateway Firewall</p> Signup and view all the answers

    In the context of testing incident response plans, what is the purpose of simulations?

    <p>To test procedures against hypothetical situations</p> Signup and view all the answers

    Which of the following metrics indicates the time taken to recognize that an incident is a threat?

    <p>Mean Time to Acknowledge</p> Signup and view all the answers

    What is a key component of all incident response plans?

    <p>Human capital involved in the response</p> Signup and view all the answers

    How does a Type 2 SOC report differ from a Type 1 SOC report?

    <p>Type 2 evaluates controls over a specific period.</p> Signup and view all the answers

    Which cycle focuses on the company's interaction with vendors to manage procurement and payments?

    <p>Purchasing and Disbursements Cycle</p> Signup and view all the answers

    What type of costs do organizations typically seek to recover through cyber insurance?

    <p>Business Interruption Losses</p> Signup and view all the answers

    In the AIS process, what is the purpose of filing source documents?

    <p>To serve as evidence for transactions</p> Signup and view all the answers

    Which cycle is concerned with tracking and managing employee compensation?

    <p>Payroll Cycle</p> Signup and view all the answers

    Which of the following is NOT a part of the General Incident Response Plan?

    <p>Modification</p> Signup and view all the answers

    What is the primary goal of the Management Reporting System (MRS)?

    <p>To solve day-to-day business problems</p> Signup and view all the answers

    What aspect does the COSO component 'Risk Assessment' focus on?

    <p>Analyzing potential risks</p> Signup and view all the answers

    What is meant by 'Mean Time Between Failures' in IRP metrics?

    <p>The period between subsequent failures</p> Signup and view all the answers

    Which document helps organizations identify how quickly they can recover after a disaster?

    <p>Business Impact Analysis</p> Signup and view all the answers

    In the AIS process, what follows after transactions are posted to the General Ledger?

    <p>Trial balances are prepared</p> Signup and view all the answers

    Which trust service primarily focuses on unauthorized access protection?

    <p>Security</p> Signup and view all the answers

    Which cycle focuses on the financial interactions and payment processing associated with customer sales?

    <p>Revenue and Collections Cycle</p> Signup and view all the answers

    Which organization is recognized for creating a recovery framework related to incident response?

    <p>NIST</p> Signup and view all the answers

    What is the main purpose of business continuity plans?

    <p>To ensure continuous operation during and after a disaster</p> Signup and view all the answers

    What is the primary purpose of the EDM governance objective in COBIT?

    <p>To evaluate strategic objectives and ensure they are met</p> Signup and view all the answers

    Which of the following is NOT one of the main components of the BAI management objective?

    <p>Managed security</p> Signup and view all the answers

    Which concept involves the estimation of losses and the classification of risk impacts in BIA?

    <p>Disruption Impacts</p> Signup and view all the answers

    Which of the following best describes Robotic Process Automation (RPA)?

    <p>Employs software to handle high-volume, repeatable tasks</p> Signup and view all the answers

    In the context of COBIT, what does the MEA objective primarily focus on?

    <p>Continuous monitoring and evaluation of processes</p> Signup and view all the answers

    Which design factor refers to the classification of an organization's compliance requirements?

    <p>Compliance Requirements</p> Signup and view all the answers

    Which key function is included in the Fixed Asset Cycle?

    <p>Creating depreciation schedules</p> Signup and view all the answers

    Which COSO principle emphasizes the acquisition and use of quality information?

    <p>COSO Principle 13</p> Signup and view all the answers

    What are the four management objectives in the COBIT Core Model?

    <p>APO, BAI, DSS, MEA</p> Signup and view all the answers

    Which design factor indicates a business's strategy towards adopting technology?

    <p>Technology Adoption Strategy</p> Signup and view all the answers

    What does Recovery Point Objective (RPO) signify?

    <p>The maximum threshold for lost data or downtime</p> Signup and view all the answers

    What is the primary function of the processes in the COBIT governance system?

    <p>To achieve set IT goals</p> Signup and view all the answers

    Which component is considered essential for successful governance in COBIT?

    <p>Cultural attitudes of the organization</p> Signup and view all the answers

    Which role of IT is categorized as 'not critical for operations'?

    <p>Support</p> Signup and view all the answers

    What does the APO objective primarily entail?

    <p>Aligning and planning IT strategy</p> Signup and view all the answers

    What is the primary purpose of piggybacking in physical attacks?

    <p>To gain unauthorized access by following someone into a secure location</p> Signup and view all the answers

    Which of the following is a design factor that deals with the classification of potential risks to an organization?

    <p>Risk Profile</p> Signup and view all the answers

    In the context of cyber threats, what does spear phishing specifically target?

    <p>Specific employees of an organization</p> Signup and view all the answers

    Which aspect of governance does the 'Organizational Structure' component address?

    <p>Decision-making entities within the organization</p> Signup and view all the answers

    Which of the following describes the process of pharming?

    <p>Redirecting users from legitimate websites to fraudulent ones</p> Signup and view all the answers

    What is the characteristic of a 'First Mover Strategy' in technology adoption?

    <p>Taking risks by adopting emerging technologies early</p> Signup and view all the answers

    What is the primary goal of network segmentation?

    <p>To enhance security by isolating network traffic</p> Signup and view all the answers

    In COBIT, which component provides guidance for implementing desired behaviors into practice?

    <p>Principles, Policies, and Frameworks</p> Signup and view all the answers

    Which of the following is a characteristic of rogue mobile apps?

    <p>They appear legitimate while being malicious</p> Signup and view all the answers

    Which risk is NOT associated with cloud computing?

    <p>Physical theft of data centers</p> Signup and view all the answers

    What is the main purpose of Network Hardening?

    <p>To remove unused ports and block unnecessary protocols</p> Signup and view all the answers

    What does the STRIDE threat modeling methodology focus on?

    <p>Categorizing different types of threats to systems</p> Signup and view all the answers

    What does Zero Trust assume about a company's network?

    <p>It is always at risk despite user authentication</p> Signup and view all the answers

    Which of the following is a characteristic of vishing?

    <p>Using telephone systems to deceive individuals</p> Signup and view all the answers

    Which of the following best describes 'Need to Know' access control?

    <p>Access limited to data necessary for tasks</p> Signup and view all the answers

    What is the first phase in the stages of a cyberattack?

    <p>Reconnaissance</p> Signup and view all the answers

    What is the primary function of Whitelisting in cybersecurity?

    <p>To create a list of authorized applications</p> Signup and view all the answers

    Which control is part of the COSO framework for governance?

    <p>Risk Assessment</p> Signup and view all the answers

    Which authentication technology uses physical human characteristics?

    <p>Biometrics</p> Signup and view all the answers

    What is the main purpose of a Risk-Based Access Control strategy?

    <p>To apply controls based on the asset's risk level</p> Signup and view all the answers

    Which of the following best defines an Acceptable Use Policy?

    <p>An outline of acceptable behavior and consequences</p> Signup and view all the answers

    What is a significant risk related to IoT devices?

    <p>Lack of device mismanagement</p> Signup and view all the answers

    How does Multi-Factor Authentication increase security?

    <p>By requiring more than one method of verification</p> Signup and view all the answers

    Which measure is considered a Corrective Control?

    <p>Patches and upgrades</p> Signup and view all the answers

    What is the function of a Virtual Private Network (VPN)?

    <p>To encrypt communications and ensure data security</p> Signup and view all the answers

    What role do Access Control Lists (ACL) serve in cybersecurity?

    <p>They outline permissions for user access to resources</p> Signup and view all the answers

    Which one of the following is NOT a phase in threat modeling?

    <p>Conduct Training</p> Signup and view all the answers

    What does layered security combine to enhance protection?

    <p>Personnel, policies, and technology</p> Signup and view all the answers

    What is the purpose of Context Aware Authentication?

    <p>To authenticate users based on relevant data points</p> Signup and view all the answers

    Which access control method allows data owners to manage their own data?

    <p>Discretionary Access Control</p> Signup and view all the answers

    What does the NIST Cybersecurity Framework's 'Recover' component entail?

    <p>Transition from a vulnerable state to a mitigated state</p> Signup and view all the answers

    Which of the following is NOT a preventative control?

    <p>Virus quarantining</p> Signup and view all the answers

    Study Notes

    NIST Cybersecurity Framework

    • Established in 1901, improved in 1995 to include cybersecurity.
    • Three standardized frameworks: CSF, Privacy Framework, SP 800-53.
    • Framework Core: GOVERN, IDENTIFY, PROTECT, DETECT, RESPOND, RECOVER.
    • 5 functions, 23 categories, 108 subcategories.
    • Implementation Tiers: Tier 1 (partial), Tier 2 (risk-informed), Tier 3 (repeatable), Tier 4 (adaptive). Based on risk management process, program integration, and external participation.
    • Framework Profiles: current and target profiles, gap analysis between them.

    NIST Privacy Framework

    • Data protection framework, industry-agnostic.
    • Overlaps with NIST CSF.
    • Components: Identify, Govern, Control, Communicate, Protect, Detect, Respond, Recover.
    • Tiers identical to NIST CSF Tiers (1-4). Based on Risk Management, Program Integration, External Participation and Workforce.

    NIST SP 800-53

    • Security and Privacy Controls for information systems.
    • Standard for federal information security systems.
    • 20 Control families (e.g., Access and Control, Awareness and Training).
    • Control implementation approaches: Common, System-Specific, Hybrid.
    • Intended for security and privacy assessment and monitoring personnel, logistical/disposition roles and system developers.

    Data Breach Consequences

    • Business disruptions, reputation harm, financial loss, data loss, legal and regulatory implications.
    • Average cost: $4 million.

    HIPAA

    • Health Insurance Portability and Accountability Act.
    • Promotes health care privacy and security with standards for PHI (protected health information).
    • Covered entities include health care providers, health plans, and health care clearing houses.
    • Security Rule protects confidentiality, integrity, and availability of PHI.

    HITECH

    • Increased HIPAA penalties, required electronic record options for patients, added "business associates" as covered entities.
    • Requires notification of breaches within 60 days of discovery.

    GDPR

    • General Data Protection Regulation (European Union).
    • Strictest privacy law, with steep penalties.
    • Scope extended to data processors in or serving the EU even if not based there.
    • Six principles: Lawfulness, Fairness, Transparency; Purpose Limitation; Data Minimization; Accuracy; Storage Limitation; Integrity and Confidentiality.

    PCI DSS

    • Payment Card Industry Data Security Standard for cashless transactions and data security.
    • 6 Goals - Build/Maintain network, Protect Cardholder Data, Maintain Vulnerability Management, Implement Strong Access Control, Regularly Monitor and Test Networks, Maintain an Information Security Policy.

    Center for Internet Security (CIS) Controls

    • Recommended set of actions, processes, and best practices for strengthening cybersecurity defenses.
    • Supported by the SANS Institute.
    • CIS Controls Version 8 - 18 controls and 153 subcategories.
    • Implementation Groups (IG1-IG3) – varying degrees of cybersecurity defense and sophistication.
    • Key Controls include 1-18
    • Design Principles including AMOFF (Align, Measurable, Offense, Focus, Feasible)

    COBIT 2019 Framework

    • Control Objectives for Information and related Technologies. Developed by ISACA.
    • 6 Governance System Principles (VHDDTE), 3 Governance Framework Principles (CFA).
    • Core Model of 1 Governance, 4 Management Objectives (APO, BAI, DSS, MEA).
    • 7 Components of Governance Systems (POPICPS), 11 Design Factors.

    IT Infrastructure

    • Computer Hardware (internal and external peripherals).
    • Network Infrastructure Hardware (modems, routers, switches, gateways, edge-enabled devices, servers and firewalls).
    • Network Protocols (TCP/IP).
    • Network Topologies (Bus, Mesh, Ring, Star).
    • OSI Model (7 layers).
    • Operating Systems (OS).
    • Mobile Technology.
    • Cloud Computing (IaaS, PaaS, SaaS, Deployment Models).
    • CSPs (Cloud Service Providers).
    • COSO Enterprise Risk Management Framework (components).

    Enterprise and Accounting Information Systems

    • Types of Processing Controls (input, output, processing, access)
    • Enterprise Resource Planning (ERP) systems.
    • Accounting Information systems (AIS).
    • Reasonableness Tests.
    • AIS Subsystems (TPS, FRS, MRS).
    • Goals of AIS Subsystems.
    • Processes of purchasing, treasury, payroll, revenue, and collections cycles.
    • AIS process: input, source document filing, transaction recording, general/subsidiary ledger posting, preparing trial balance, adjusting entries, financial reporting.
    • Benefits of Application Software Providers (ASPs).
    • Processes driven by IT Systems (automation, shared services, outsourcing).
    • Offshore Operations. Risks in outsourcing
    • Technology forms like RPA, NLP, Neural networks.
    • Blockchain, COSO Principles related to blockchain.

    Availability, Resiliency, and Disaster Recovery

    • Business Resiliency, Business Continuity plans (BIA process).
    • System Availability Controls (redundancy, backups).
    • Crisis Management.
    • Disaster Recovery (different sites), Backup Types.
    • Recovery Point Objective (RPO), Recovery Time Objective (RTO), Mean Time To Repair (MTTR).

    Change Management

    • Change Management policies, procedures, and resources.
    • Change Management Process (11 steps).
    • Documenting systems controls (baseline, inventory, acceptance criteria)
    • Change Management Controls.
    • Types of Change Environments (development, testing, staging, production, disaster recovery)
    • Integration risks (user resistance, management/stakeholder support, resources, and disruptions).
    • Testing change implications, logging (application, change, event, firewall, network, proxy).
    • Different models (Waterfall, Agile ).
    • Patch Management, Patch Management Programs, Conversion Methods, Testing Methods (Unit, Integration, System, Acceptance).

    Data Collection and Data Lifecycle

    • Data Lifecycle Process (DCP, SAPAP, stages in detail).
    • Data Collection Types (active, passive).
    • ETL processes.
    • Complexities of external data sources (copyright, safety, integrity).

    Data Storage and Database Design

    • Operational Data Store (ODS).
    • Data Warehouse, Data Mart.
    • Data Lake.
    • Relational Databases (tables, attributes, records, fields).
    • Database keys (primary, composite, foreign).
    • Data Dictionary.
    • Data Normalization.
    • Data Model (Conceptual, Logical, Physical), Database Schemas (Fact, Dimension, Star, Snowflake).

    Data Extraction, Integration, and Process Documentation

    • SQL (SELECT, FROM, JOIN, WHERE, GROUP BY, HAVING),
    • Data Flow Diagrams (logical flow, process, data flow, data store, external entity).
    • Flowcharts (logical and physical flow).
    • System Interface Diagrams, BPMN Activity models (events, tasks, flows, gateways).

    Threats and Attacks

    • Threat Agents (attacker, hacker, adversary, government-sponsored, hacktivists, insiders).
    • Types of Cyberattacks (Network-Based, Application-Based, Host-Based, Social Engineering, Physical, Supply Chain).
    • Specific techniques (DoS, DDoS, MITM, port scanning, reverse shell, return-oriented attacks, spoofing).
    • Stages of an attack.
    • Risks related to cloud computing, mobile technologies, and IoT.

    Mitigation

    • COSO - Business Objectives (operations, record-keeping, compliance).
    • COSO - Five Components of Internal Control (control environment, risk assessment, information and communication, monitoring activities, existing control activities).
    • Security Policies (acceptable use, BYOD).
    • Network Segmentation/Isolation.
    • System Hardening.
    • Authorization and Authentication (zero trust, least privilege, need-to-know, whitelisting).
    • Authentication Technologies (context aware, digital signatures, SSO, MFA, PIN, smartcards, token, biometrics).
    • Password Management.
    • Provisioning.
    • NIST Cybersecurity Framework - Vulnerability (Identify, Protect, Detect, Respond, Recover).
    • Common Vulnerabilities and Exposures (CVE) Dictionary.
    • Layered Security (Defense in Depth.)

    Incident Response

    • Incident Response Plan (IRP), Timeline.
    • NIST Response Team Models.
    • Events versus Incidents.
    • General Incident Response Plan (PDCERRL).
    • Testing IRP plans (simulations, metrics).
    • Insurable losses.

    SOC Engagements

    • Types of SOC reports (SOC1, SOC2, SOC3).
    • Type 1 vs. Type 2.
    • Trust Services criteria (Confidentiality, Availability, Processing Integrity, Privacy, Security).
    • Alignment of Trust services to COSO.
    • Complementary Subservice or User Entity Controls (CSOC, CUEC).
    • Planning and Risk assessment considerations.
    • Auditor responsibilities.
    • Materiality considerations.

    Reporting on SOC Engagements

    • Opinions (unmodified, qualified, adverse, disclaimer).
    • Key components of SOC reports.
    • Scope (carve-out, inclusive).
    • Responsibility of service organization, service auditor, and user entity.
    • Subsequent Events.
    • Misstatements, Modified Opinions, and Disclaimers.

    Studying That Suits You

    Use AI to generate personalized quizzes and flashcards to suit your learning preferences.

    Quiz Team

    Description

    Test your knowledge on the NIST Cybersecurity Framework components, including functions, tiers, and publications. This quiz covers critical aspects of organizational risk management and privacy considerations as outlined by NIST. Examine your understanding of the framework's purpose and core functions.

    More Like This

    NIST Special Publication 800-37 Revision 2 Quiz
    20 questions

    NIST 800-37 Rev 2 Quiz and Flashcards

    FresherUtopia avatar
    FresherUtopia
    NIST Cybersecurity Framework Overview
    12 questions

    NIST Cybersecurity Framework Overview

    AmusingCaricature avatar
    AmusingCaricature
    Marco de Ciberseguridad NIST
    21 questions

    Marco de Ciberseguridad NIST

    PlentifulMonkey avatar
    PlentifulMonkey
    Use Quizgecko on...
    Browser
    Open
    Browser
    Browser