1Business Continuity
- An organization's ability to maintain their everyday productivity by establishing risk disaster recovery plans.
2Asset Security
Focused on securing digital and physical assets. it's also related to the storage, maintenance, retention, and destruction of data
3Security architecture and engineering
- focused on optimizing data security by ensuring effective tools, systems, and processes are in place to protect an organization's assets and data
4Shared responsibility
All individuals within an organization take an active role in lowering risk and maintaining both physical and virtual security.
5communication and network security
- focused on managing and securing physical networks and wireless communications.
6identity and access management, or IAM
it's focused on access and authorization to keep data secure by making sure users follow established policies to control and manage assets.
7The four main componets of IAM are...
- Identification, Authentication, Authorization, Accountability
8security assessment and testing
- focuses on conducting security control testing, collecting and analyzing data, and conducting security audits to monitor for risks, threats, and vulnerabilities.
9Security operations
The security operations domain is focused on conducting investigations and implementing preventive measures.
10Software development security
- Focused on using secure coding practices
- The security operations domain is focused on conducting investigations and implementing preventive measures.
- focuses on conducting security control testing, collecting and analyzing data, and conducting security audits to monitor for risks, threats, and vulnerabilities.
- it's focused on access and authorization to keep data secure by making sure users follow established policies to control and manage assets.
11Threat
Any circumstance or event that can negatively impact assets
12Social engineering
A manipulation technique that exploits human error to gain private information, access, or valuables
13Risk
Risk anything that can impact the confidentiality integrity, or availability of an asset
14Low-risk asset
Information that would not harm the organization's reputation or ongoing operations, and would not cause financial damage if compromised
15Medium-risk asset
information that's not availbale to the public and may cause some damage to the organization's finances, reputation, or ongoing operations
16High risk asset
information protected by regulations or laws, which if compromised would have a severe negative impact on an organization's finances, ongoing operations, or reputation
17Vulnerability
A weakness that can be exploited by a threat
18Ransomware
a malicious attack where threat actors encrypt an organization's data and demand payment to restore access
19what are the three layers of the web
- surface web,deep web, and the dark web
20what are the key impacts of threats
- financial, identity theft, and damaged to an organizations reputation
21What are the 7 steps in the RMF
- prepare,categorize,select,implement,assess,authorize,and monitor
22prepare
- activities that are necessary to manage security and privacy risks before a breach occurs.
23Categorize
used to develop risk management processes and tasks
24select
choose, customize, and capture documentation of the controls that protect an organization
25implement
implement security and privacy plans for the organization
26assess
determine if established controls are implemented correctly
27authorize
Being accountable for security and privacy risks that may exist in an organization
28monitor
to be aware of how systems are operating.