Exam 6: Security Management Models

Controls that discourage an incipient incident are called ____.

One of the criticisms of the ISO/IEC 17799 standard was that it was not as ____________________ as other frameworks.

Controls that are tied to the position assigned to and performed by an individual user in the organization are called ____.

TCSEC is a U.S.DoD standard that is also known as the Red Book,because of its color-coding._________________________

Preventative controls discourage or deter an incipient incident.

Under the Clark-Wilson model,internal consistency means that the system is consistent with similar data in the outside world.

____________________ controls restore operating conditions back to normal.

An ATM machine is a common example of a(n)constrained user interface form of access control._________________________

In the TCSEC,the reference monitor is the combination of all hardware,firmware,and software responsible for enforcing the security policy.

Under the TCSEC model,the term ____ refers to the rules of configuration for a system,rather than a managerial guidance document.

Within the TCB is a conceptual object known as the ____________________,which is the piece of the system that manages access controls-in other words,it mediates all access to objects by subjects.

Controls that help an organization avoid an incident are called ____.

Another data classification scheme is the personnel security clearance structure,in which each user of an information asset is assigned an authorization level that identifies the level of information classification he or she can access._________________________

What are the two primary properties of the Bell-LaPadula model and what do they restrict?

In the ____________________ confidentiality model,rules prevent information from being moved from a level of higher security to a level of lower security.

The COBIT model categorizes control objectives into four domains.List them.

____ access controls are implemented at the option of the data user.

The cornerstone of the ISO/IEC 27001 standard is a set of processes known as the ____ cycle.

Role-based controls are tied to the role that a particular user performs in an organization,whereas content-based controls are tied to a particular assignment or responsibility.

____ provides a library of Special Publications that includes Generally Accepted Principles and Practices for Securing IT Systems.