CISMP Exam Prep
Information Assurance - ANS-The confidence that systems will protect the info they
carry and will function as and when they need to under legit, authorised users
information security management system (ISMS) - ANS-Preservers the CIA of info by
applying a risk management process.
ISMS must be part of and integr. with the org's processes/management structure and
that InfoSec is considered in the design of processes, IS's and controls
CIA - ANS-Confidentiality, integrity, and availability.
Confidentiality helps prevent the unauthorized disclosure of data.
Integrity provides assurances that data has not been modified, tampered with, or
corrupted.
Availability indicates that data and services are available when needed.
statement of applicability (SOA) - ANS-a document listing all the controls that you have
implemented against the risks you have identified
SIEM - ANS-System Information and Event Management
Software tool that aggregates multiple server logs and monitors them
CTI - ANS-Cyber Threat Intelligence
Risk Assessment - ANS-The overall process of risk identification, analysis and
evalation.
Risk treatment - ANS-a process to modify risk
Risk management/evaluation process - ANS-coordinated activities to direct and control
an org with regard to risk
AVOID, ACCEPT, TRANSFER, REDUCE
Risk Management Lifecycle - ANS-Identify, analyse, treat, monitor
, Residual risk - ANS-exposure remaining from a specific risk after action has been taken
to manage it, assuming the action is effective
Risk appetite - ANS-level of risk an org is prepared to accept, tolerate or be exposed to
Asset value - ANS-How much the business will lose if the asset is compromised, how
much it is worth in business terms
Qualitative Risk Analysis - ANS-Rating risk on high, medium, low basis e.g traffic light
system, red amber green
Quantitative risk analysis - ANS-Uses a formal scoring methodology based on complex
mathemativcal formula and gathering of data
Impact - ANS-the max consequence to the business of the risk occurring
Likelihood - ANS-the probability that the risk will occur or the threat will come to pass
Cost benefit analysis - ANS-must be done before implementing a control
Risk Treatment plan - ANS-Plan -> Do -> Check -> Act
risk assessment review - ANS-Needs regular review, at least Annually. Once implanted
effectively look to do mid year as well.
Types of controls - ANS-Directive, preventative, detective, corrective
Directive Control - ANS-putting in place some form of instruction e.g policy/contract
PReventative control - ANS-Stopping something from happening, typically reduce
likelihood
Detective control - ANS-detect E&O's, omissions or malicious acts,report occurrence
and reduce impacts. An example of this is an audit
Corrective control - ANS-Altering the state of something, correct E&Os once they are
detected and reduce impact
Operational controls - ANS-3 types - NEED LAYERED APPROACH
Information Assurance - ANS-The confidence that systems will protect the info they
carry and will function as and when they need to under legit, authorised users
information security management system (ISMS) - ANS-Preservers the CIA of info by
applying a risk management process.
ISMS must be part of and integr. with the org's processes/management structure and
that InfoSec is considered in the design of processes, IS's and controls
CIA - ANS-Confidentiality, integrity, and availability.
Confidentiality helps prevent the unauthorized disclosure of data.
Integrity provides assurances that data has not been modified, tampered with, or
corrupted.
Availability indicates that data and services are available when needed.
statement of applicability (SOA) - ANS-a document listing all the controls that you have
implemented against the risks you have identified
SIEM - ANS-System Information and Event Management
Software tool that aggregates multiple server logs and monitors them
CTI - ANS-Cyber Threat Intelligence
Risk Assessment - ANS-The overall process of risk identification, analysis and
evalation.
Risk treatment - ANS-a process to modify risk
Risk management/evaluation process - ANS-coordinated activities to direct and control
an org with regard to risk
AVOID, ACCEPT, TRANSFER, REDUCE
Risk Management Lifecycle - ANS-Identify, analyse, treat, monitor
, Residual risk - ANS-exposure remaining from a specific risk after action has been taken
to manage it, assuming the action is effective
Risk appetite - ANS-level of risk an org is prepared to accept, tolerate or be exposed to
Asset value - ANS-How much the business will lose if the asset is compromised, how
much it is worth in business terms
Qualitative Risk Analysis - ANS-Rating risk on high, medium, low basis e.g traffic light
system, red amber green
Quantitative risk analysis - ANS-Uses a formal scoring methodology based on complex
mathemativcal formula and gathering of data
Impact - ANS-the max consequence to the business of the risk occurring
Likelihood - ANS-the probability that the risk will occur or the threat will come to pass
Cost benefit analysis - ANS-must be done before implementing a control
Risk Treatment plan - ANS-Plan -> Do -> Check -> Act
risk assessment review - ANS-Needs regular review, at least Annually. Once implanted
effectively look to do mid year as well.
Types of controls - ANS-Directive, preventative, detective, corrective
Directive Control - ANS-putting in place some form of instruction e.g policy/contract
PReventative control - ANS-Stopping something from happening, typically reduce
likelihood
Detective control - ANS-detect E&O's, omissions or malicious acts,report occurrence
and reduce impacts. An example of this is an audit
Corrective control - ANS-Altering the state of something, correct E&Os once they are
detected and reduce impact
Operational controls - ANS-3 types - NEED LAYERED APPROACH
