Exam (elaborations)
CISMP Exam Prep.
- Course
- Institution
Exam of 6 pages for the course Be the business challenge C954 at Be the business challenge C954 (CISMP Exam Prep.)
[Show more]
Seller
Follow
denicetho
Content preview
CISMP Exam PrepInformation Assurance - ANS-The confidence that systems will protect the info they
carry and will function as and when they need to under legit, authorised users
information security management system (ISMS) - ANS-Preservers the CIA of info by
applying a risk management process.
ISMS must be part of and integr. with the org's processes/management structure and
that InfoSec is considered in the design of processes, IS's and controls
CIA - ANS-Confidentiality, integrity, and availability.
Confidentiality helps prevent the unauthorized disclosure of data.
Integrity provides assurances that data has not been modified, tampered with, or
corrupted.
Availability indicates that data and services are available when needed.
statement of applicability (SOA) - ANS-a document listing all the controls that you have
implemented against the risks you have identified
SIEM - ANS-System Information and Event Management
Software tool that aggregates multiple server logs and monitors them
CTI - ANS-Cyber Threat Intelligence
Risk Assessment - ANS-The overall process of risk identification, analysis and
evalation.
Risk treatment - ANS-a process to modify risk
Risk management/evaluation process - ANS-coordinated activities to direct and control
an org with regard to risk
AVOID, ACCEPT, TRANSFER, REDUCE
Risk Management Lifecycle - ANS-Identify, analyse, treat, monitor
, Residual risk - ANS-exposure remaining from a specific risk after action has been taken
to manage it, assuming the action is effective
Risk appetite - ANS-level of risk an org is prepared to accept, tolerate or be exposed to
Asset value - ANS-How much the business will lose if the asset is compromised, how
much it is worth in business terms
Qualitative Risk Analysis - ANS-Rating risk on high, medium, low basis e.g traffic light
system, red amber green
Quantitative risk analysis - ANS-Uses a formal scoring methodology based on complex
mathemativcal formula and gathering of data
Impact - ANS-the max consequence to the business of the risk occurring
Likelihood - ANS-the probability that the risk will occur or the threat will come to pass
Cost benefit analysis - ANS-must be done before implementing a control
Risk Treatment plan - ANS-Plan -> Do -> Check -> Act
risk assessment review - ANS-Needs regular review, at least Annually. Once implanted
effectively look to do mid year as well.
Types of controls - ANS-Directive, preventative, detective, corrective
Directive Control - ANS-putting in place some form of instruction e.g policy/contract
PReventative control - ANS-Stopping something from happening, typically reduce
likelihood
Detective control - ANS-detect E&O's, omissions or malicious acts,report occurrence
and reduce impacts. An example of this is an audit
Corrective control - ANS-Altering the state of something, correct E&Os once they are
detected and reduce impact
Operational controls - ANS-3 types - NEED LAYERED APPROACH
The benefits of buying summaries with Stuvia:
Guaranteed quality through customer reviews
Stuvia customers have reviewed more than 700,000 summaries. This how you know that you are buying the best documents.
Quick and easy check-out
You can quickly pay through credit card or Stuvia-credit for the summaries. There is no membership needed.
Focus on what matters
Your fellow students write the study notes themselves, which is why the documents are always reliable and up-to-date. This ensures you quickly get to the core!
Frequently asked questions
What do I get when I buy this document?
You get a PDF, available immediately after your purchase. The purchased document is accessible anytime, anywhere and indefinitely through your profile.
Satisfaction guarantee: how does it work?
Our satisfaction guarantee ensures that you always find a study document that suits you well. You fill out a form, and our customer service team takes care of the rest.
Who am I buying these notes from?
Stuvia is a marketplace, so you are not buying this document from us, but from seller denicetho. Stuvia facilitates payment to the seller.
Will I be stuck with a subscription?
No, you only buy these notes for $9.36. You're not tied to anything after your purchase.
Can Stuvia be trusted?
4.6 stars on Google & Trustpilot (+1000 reviews)
79373 documents were sold in the last 30 days
Founded in 2010, the go-to place to buy study notes for 14 years now