cissp secure-u

A control put into place to mitigate potential losses

Weakness in a mechanism that can threaten the confidentiality, integrity, or availability of an asset.

Someone uncovering a vulnerability and exploiting it

Probability of a threat becoming real, and the corresponding potential damages.

When a threat agent exploits a vulnerability

• Administrative
• Managements responsibilities necessary to protect assets
• "soft" controls

• Technical
• Logical protection mechanisms
• Built in software and hardware
• Physical
• Controls to protect the facility's perimeter and internal resources

• Confidential
• Integrity
• Availability

• 1. top down
• 2. bottom up

Security is directed, driven, and supported by senior management

staff member or group drives initiative

• BS/ISO 7799 / ISO 27001
• ISO 17799 also

There are 10

• 1. Security policy
• 2. Security Organization
• 3. assets classification and control
• 4. personnel security
• 5. physical and environmental security
• 6. computer and network management
• 7. system access control
• 8. system development and maintenance
• 9. business continuity planning
• 10. compliance

• Defines the scope, objectives, priorities, and strategies of the company's security program
• Provides vision, funds, visibility, and enforcement
• ultimately liable
• without management's support, efforts can be doomed from the start

• Data owner
• system owner
• data custodian
• user

• Responsible for the subset(s) of data and data classification
• Sets security requirements for data protection

• Responsible for specific computer system(s)
• One system will have one system owner
• Can hold data from several data owners

• is delegated data maintenance tasks
• required to implement and maintain controls to provide the protection level dictated by data owner

person who routinely uses company data for work-related tasks

• Usefulness and value of information
• how long information will hold this protection requirement
• the level of damage possible if the data was disclosed, modified, or corrupted
• Laws, regulations, or liability responsibilities pertaining to the data
• who should be accessing this data?
• who should maintain this data?
• who should monitor and audit the use of this data?

Prudent person rule - Perform duties that prudent and responsible people would exercise in similar circumstances

Single Loss Expectancy

SLE = Asset value X exposure factor

Annualized Loss Expectancy

ALE = SLE X Annualized rate of occurence

• Answer:
• 650,000 x 0.35 x 0.10 = 22,750

total risk is defined by the following formula.

threats x vulnerability x asset value

residual risk is defined by the following formula.

(threats x vulnerability x asset value) x control gap

• primary memory
• real memory
• cache memory
• virtual memory

• 1. keep track of used and unused memory segments
• 2. assign memory segments to processes
• 3. manage swapping between main memory and secondary storage
• 4. memory protection
• 5. access control
• 6. keeping track of software and virtual addressing schemes
• 7. multi-user OS requires more complex memory manager
• dos and windoes 9x are single-user OSes

• 1. Stopped
• 2. Waiting
• 3. Running
• 4. Ready

• Running
• Ready/Waiting
• Stopped

Trusted Computing Base

• Provides rules and structures used to control access and shows how access decisions are made
• The main components are subjects, objects, operations and their relationships
• The goal is to control how objects are accessed and ensure one security principle or another (confidentiality, integrity)

If a system comes up in a secure state (all state transitions are secure; including failing) and shuts down in a secure state, the system is secure.

no write up and no read down - the strong star property

strong star property