Exam 6: Security Management Models

____ helps organizations comply with critical regulations like the Sarbanes-Oxley Act of 2002.

____________________ channels are unauthorized or unintended methods of communications hidden inside a computer system,and include storage and timing channels.

TCSEC is also known as the "Orange Book" and is considered the cornerstone of the DoD Rainbow Series that defines the criteria for assessing the access controls in a computer system.

____ specifies the authorization classification of information asset an individual user is permitted to access,subject to the need-to-know principle.

Which of the following is not an element of the Clark-Wilson model?

ISO/IEC 17799 is designed to promote certification of information security management system.

Under lattice-based access controls,the row of attributes associated with a particular subject (such as a user)is referred to as a(n)____.

The NIST Security model documents enjoy two notable advantages over many other sources of security information: (1)They are publicly available at no charge,and (2)they have been available for some time and thus have been broadly reviewed by government and industry professionals.

A(n)____ is a generic blueprint offered by a service organization.

The COSO framework component ____ provides the foundation of all internal control components.

Access to a specific set of information may be dependent on its subject matter is called ____.

An information security blueprint describes existing controls and identifies other necessary security controls.

____________________ controls remedy a circumstance or mitigate damage done during an incident

There are two types of covert channels,storage channels and network channels.

____________________ is the principle by which members of the organization can access the minimum amount of information for the minimum amount of time necessary to perform their required duties.

Lattice-based access control assigns users a matrix of authorizations for particular areas of access.

The Brewer-Nash model is commonly known as a Japanese wall.

Under TCSEC,the ____ is the combination of all hardware,firmware,and software responsible for enforcing the security policy.

____ access controls are determined by a central authority and can be based on roles or tasks.

Compensating controls remedy a circumstance or mitigate damage done during an incident.