Monthly Archives: October 2019

Wentz’s Information Risk Model

Posted on by
Reply

Wentz’s Information Risk Model

The Peacock

InformationSecurityDefinition

What’s Risk?

  • Risk is “the effect of uncertainty on objectives”, ISO 31000
  • An effect is a positive or negative deviation from what is expected.

Business Mindset

  • A threat is a risk with a negative effect.
  • An opportunity is a risk with a positive effect.

Business Driver

  • Information Security is a business issue. It’s time for security professionals to think from both the perspective of opportunities and threats.
  • Information Security is a business enabler, and it may be a business driver if opportunities are taken into consideration.
  • Think about Facebook Libra!

CISSP PRACTICE QUESTIONS – 20191014

Posted on by
1

Effective CISSP Questions

Your organization implements the multi-level mandatory access control which is based on the Bell-LaPadula model. An employee with “Secret” clearance complained that he cannot write to a file classified as “Top Secret”. Which of the following is the most likely reason?
A. The employee is assigned the * (star) Property
B. The employee is not assigned the Simple Security Property
C. The employee and the file belong to the different lattice of need-to-know
D. The employee is under a race condition against the file locked by another user

Continue reading →

CISSP PRACTICE QUESTIONS – 20191013

Posted on by
1

Effective CISSP Questions

Your company decides to start the business of selling toys online and shipping globally. The E-Commerce system that supports the new business will be developed in-house. The development team is evaluating the data persistence solution for transactions. The solution shall support huge volume of transactions and the single point of failure shall be addressed. Which of the following will best address the requirements?
A. Key-value stores that support multi-node parallel computing
B. Snowflake tables in data marts supported by an active-passive server cluster
C. Data warehouse as big data storage with an active-active cluster
D. Attributes and tuples in relations with one primary and one standby server
Continue reading →

Access Control Terminologies

Posted on by
1

TCBAccessControl

Terminologies

  • Subject – An active entity, generally in the form of a person, process, or device that causes information to flow among objects or changes the system state. Technically, a process/domain pair. [Orange Book]
  • Object – A passive entity that contains or receives information. Access to an object potentially implies access to the information it contains. Examples of objects are: records, blocks, pages, segments, files, directories, directory trees, and programs, as well as bits, bytes, words, fields, processors, video displays, keyboards, clocks, printers, network nodes, etc. [Orange Book]
  • Clearance – A formal security determination by an authorized adjudicative office that an individual is authorized access, on a need to know basis, to a specific level of classified information (TOP SECRET, SECRET, or CONFIDENTIAL). [CNSSI 4009-2015]
  • Sensitivity Label – A piece of information that represents the security level of an object and that describes the sensitivity (e.g., classification) of the data in the
    object. Sensitivity labels are used by the TCB as the basis for mandatory access control decisions. [Orange Book]
  • Trusted Computing Base (TCB) – The totality of protection mechanisms within a computer system — including hardware, firmware, and software — the combination of which is responsible for enforcing a security policy.
  • Reference Monitor Concept – An access control concept that refers to an abstract machine that mediates all accesses to objects by subjects. [Orange Book]
  • Security Kernel – The hardware, firmware, and software elements of a Trusted Computing Base that implement the reference monitor concept. It must mediate all accesses, be protected from modification, and be verifiable as correct. [Orange Book]

Good Sources of Glossary

CISSP PRACTICE QUESTIONS – 20191012

Posted on by
2

Effective CISSP Questions

Your company decides to start the business of selling toys online and shipping globally. The E-Commerce system that supports the new business will be developed in-house. In a requirement workshop, a participant proposed that discounted products in promotion campaigns shall be purchased by those customers who meet the criteria specified by marketing staff, e.g. customer’s identity, gender, role, city, income, login time, device type, etc. The development team considers the authorization rules of purchase are too complicated. As a security professional, which of the following will you best recommend to address the requirement?
A. Lattice-based access control
B. Role-based access control
C. Attribute-based access control
D. Rule-based access control
Continue reading →

InfoSec Governance and Value Delivery

Image

1

PMI Value DeliveryInformation Security Governance

Information Security Governance as a Value Delivery Process

Cost management is extensively described in “A Guide to the Project Management Body of Knowledge” (PMBOK Guide) and the “Practice Standard for Earned Value Management“.

The focus on BRM is on the benefits component, including tangible and intangible benefits.

Quantifying benefits and allocating appropriate costs for attaining these benefits can be difficult in some cases due to the degree of subjectivity involved.

This can be especially true when quantifying intangible benefits, although there are methods that aid in quantifying intangible benefits such as the use of proxy or representative measures.

Source: Benefits Realization Management: A Practice Guide

CISSP PRACTICE QUESTIONS – 20191011

Posted on by
Reply

Effective CISSP Questions

Your company decides to start the business of selling toys online and shipping globally. The E-Commerce system that supports the new business will be developed in-house. The software development project has just been kicked off for a couple of days and you are preparing for the project meeting tomorrow.  As a security professional, which of the following should you consider first?
A. Risks to the system
B. Impact of privacy breach
C. System Security Architecture
D. Stakeholders protection needs and requirements
Continue reading →

Layer vs Tier

Posted on by
1

Layer vs Tier

LAYER VS TIER

Layering is a logical way to group design concerns into different divisions or layers; Tiering is a physical way to deploy system components into different placements or tiers.

It’s not uncommon to deploy a software solution with a 3-layer design into a one-tier system, e.g. only one machine that runs the software solution.

CISSP PRACTICE QUESTIONS – 20191010

Posted on by
Reply

Effective CISSP Questions

Your company decides to start the business of selling toys online and shipping globally. The E-Commerce system that supports the new business will be developed in-house. In a requirement workshop, the representative of the customer support department suggests when a user logged in with the wrong password, the system shall display a message, “Invalid password. please login again.” It is because users are frequently calling for customer support to reset the password but insist they didn’t type the password wrong. As a security professional, which of the following should you suggest first?
A. Use a semantic passphrase
B. Automate the reset password process
C. Revise the message to guide the reattempts of login
D. Lower the requirement of password length
Continue reading →