Deck 6: Security Management Models

Question 1

When MACs are implemented,users and data owners have limited control over access to information resources.

Answer 1

True

Question 2

Separation of duties is the principle by which members of the organization can access the minimum amount of information for the minimum amount of time necessary to perform their required duties.

Answer 2

False

Question 3

Information Technology-Code of Practice for Information Security Management was originally published as British Standard BS7799.

Answer 3

True

Question 4

In the TCSEC,the reference monitor is the combination of all hardware,firmware,and software responsible for enforcing the security policy.

Question 5

Management controls deal with the functions of security that have been integrated into the repeatable processes of the organization.

Question 6

ISO 27002 is an international standard for computer security certification,considered to be the successor to both TCSEC and ITSEC.

Question 7

There are two types of covert channels,storage channels and network channels.

Question 8

Role-based controls are tied to the role that a particular user performs in an organization,whereas content-based controls are tied to a particular assignment or responsibility.

Question 9

Compensating controls remedy a circumstance or mitigate damage done during an incident.

Question 10

Lattice-based access control assigns users a matrix of authorizations for particular areas of access.

Question 11

TCSEC is also known as the "Orange Book" and is considered the cornerstone of the DoD Rainbow Series that defines the criteria for assessing the access controls in a computer system.

Question 12

Within lattice-based access controls,the row of attributes associated with a particular subject (such as a user)is referred to as a capabilities table.

Question 13

ITSEC is the international set of equivalent for evaluating computer systems,and is very similar to the TCSEC.

Question 14

In rule-based access controls,access is granted based on a set of rules which may be specified by the central authority.

Question 15

The 'need to know' principle limits a user's access to the specific information required to perform the currently assigned task,and not merely to the category of data required for a general work function.

Question 16

All security models discussed in the text are freely available to the public.

Question 17

ISO/IEC 17799 is designed to promote certification of information security management system.

Question 18

Bell-LaPadula security rules prevent information from being moved from a level of higher security to a level of lower security.

Question 19

Preventative controls discourage or deter an incipient incident.

Question 20

An information security blueprint describes existing controls and identifies other necessary security controls.

Question 21

Under the Clark-Wilson model,internal consistency means that the system is consistent with similar data in the outside world.

Question 22

An ATM machine is a common example of a(n)constrained user interface form of access control._________________________

Question 23

Operational controls cover security processes designed by strategic planners,are integrated into the organization's management practices and are routinely used by security administrators to design,implement and monitor other control systems._________________________

Question 24

TCSEC is a U.S.DoD standard that is also known as the Red Book,because of its color-coding._________________________

Question 25

Need to know limits a user's access to the specific information required to perform the currently assigned task,and not merely to the category of data required for a general work function._________________________

Question 26

The trusted computing base is the piece of the system that manages access controls under TCSEC._________________________

Question 27

The NIST Security model documents enjoy two notable advantages over many other sources of security information: (1)They are publicly available at no charge,and (2)they have been available for some time and thus have been broadly reviewed by government and industry professionals.

Question 28

Covert channels are unauthorized or unintended methods of communications hidden inside a computer system._________________________

Question 29

The ITSEC is the international set of criteria for evaluating computer systems and is very similar to the TCSEC._________________________

Question 30

The major process steps in the ISO 27000 series include Plan-Do-Check-Act.

Question 31

The information security blueprint serves as the basis for the design,selection,and implementation of all subsequent security controls._________________________

Question 32

Discretionary controls are determined by a central authority in the organization._________________________

Question 33

Deterrent controls help an organization avoid an incident._________________________

Question 34

Another data classification scheme is the personnel security clearance structure,in which each user of an information asset is assigned an authorization level that identifies the level of information classification he or she can access._________________________

Question 35

Under the Common Criteria for IT Security Evaluation,a(n)Security Target is the system being evaluated._________________________

Question 36

A security framework is a generic blueprint offered by a service organization._________________________

Question 37

Classified documents should not be disposed of in trash otherwise people who engage in refuse recovery (digging through the trash)may retrieve information and thereby compromise the security of the organization's information assets._________________________

Question 38

COBIT is an IT development framework and supporting toolset that allows managers to bridge the gap between control requirements,technical issues,and design specifications.

Question 39

The Brewer-Nash model is commonly known as a Japanese wall.

Question 40

In an access control matrix,as part of lattice-based controls,the column of attributes associated with a particular object (such as a printer)is referred to as a(n)capability table._________________________

Question 41

The individual categories of data classification (Unclassified,Confidential,Secret etc.)are also called ____.

A) discretionary access controls
B) task-based access controls
C) security clearances
D) sensitivity levels

Question 42

____ is an international standard framework that is based on the security model Information Technology-Code of Practice for Information Security Management.

A) ISO/IEC 17799
B) NIST SP 800-12
C) RFC 2196
D) NIST SP 800-26

Question 43

The primary objective of the Committee of Sponsoring Organizations of the Treadway Commission (COSO),a private-sector initiative formed in 1985,is to identify the factors that cause fraudulent financial reporting and to make recommendations to reduce its incidence._________________________

Question 44

Controls that remedy a circumstance or mitigate damage done during an incident as called ____,

A) preventative
B) deterrent
C) corrective
D) compensating

Question 45

A(n)____ is a generic blueprint offered by a service organization.

A) framework
B) security outline
C) organizational model
D) security model

Question 46

The Biba model is a state machine model that helps ensure the confidentiality of an information system by means of MACs,data classification,and security clearances._________________________

Question 47

One of the key elements of the Clark-Wilson model is the unconstrained data item which is a data item with protected integrity._________________________

Question 48

Controls that are tied to the position assigned to and performed by an individual user in the organization are called ____.

A) mandatory access controls
B) lattice-based access controls
C) role-based access controls
D) rule-based access controls

Question 49

The original purpose of ISO/IEC 17799 was to give recommendations for information security management for use by those who are responsible for initiating,implementing,or maintaining security in their organization._________________________

Question 50

The objective of COBIT is to identify the factors that cause fraudulent financial reporting and to make recommendations to reduce its incidence._________________________

Question 51

Controls that discourage an incipient incident are called ____.

A) preventative
B) deterrent
C) corrective
D) compensating

Question 52

Controls that help an organization avoid an incident are called ____.

A) preventative
B) deterrent
C) corrective
D) compensating

Question 53

The principle by which members of the organization can access the minimum amount of information for the minimum amount of time necessary to perform their required duties is known as ____.

A) need-to-know
B) eyes only
C) least privilege
D) separation of duties

Question 54

One discretionary model is ____,in which access is granted based on a set of rules specified by the central authority.

A) mandatory access controls
B) lattice-based access controls
C) role-based access controls
D) rule-based access controls

Question 55

Controls that are structured and coordinated within a data classification scheme that rates each collection of information as well as each user are called ____.

A) mandatory access controls
B) lattice-based access controls
C) role-based access controls
D) rule-based access controls

Question 56

____ specifies the authorization classification of information asset an individual user is permitted to access,subject to the need-to-know principle.

A) Discretionary access controls
B) Task-based access controls
C) Security clearances
D) Sensitivity levels

Question 57

The U.S.government data classification and security clearance system is an example of which of the following types of access controls?

A) Mandatory access controls
B) Lattice-based access controls
C) Role-based access controls
D) Rule-based access controls

Question 58

A control requiring that significant tasks be split up in such a way that more than one individual is responsible for their completion is known as ____.

A) need-to-know
B) eyes only
C) least privilege
D) separation of duties

Question 59

An outline of an information security blueprint is called a(n)____.

A) summary
B) framework
C) index
D) model

Question 60

Which of the following is the primary purpose of ISO/IEC 27001:2005?

A) Use within an organization to formulate security requirements and objectives
B) Implementation of business-enabling information security
C) Use within an organization to ensure compliance with laws and regulations
D) To enable organizations that adopt it to obtain certification

Question 61

Under the TCSEC model,the term ____ can be misleading-note that in this context,it means that components are part of the TCB security system,but it does not necessarily follow that they are all above reproach.

A) reference monitor
B) trusted
C) covert
D) security policy

Question 62

Under the Biba model,the ____ property permits a subject to have write access to an object only if the security level of the subject is equal to or higher than that of the object.

A) star (*)
B) simple security
C) integrity star (*)
D) simple integrity

Question 63

Under lattice-based access controls,the column of attributes associated with a particular object (such as a printer)is referred to as a(n)____.

A) access control list
B) capabilities table
C) access control matrix
D) sensitivity level

Question 64

Under the Common Criteria,____ is the document describing the system being evaluated's security properties.

A) Target of Evaluation (ToE)
B) Protection Profile (PP)
C) Security Target (ST)
D) Security Functional Requirements (SFRs)

Question 65

____ access controls are implemented at the option of the data user.

A) Mandatory
B) Nondiscretionary
C) Discretionary
D) Lattice-based

Question 66

Under ITSEC,what is the highest level of assessment a product can be rated?

A) EAL7
B) E1
C) E6
D) A1

Question 67

Under the Bell-LaPadula model,the ____ property prohibits a subject of lower clearance from reading an object of higher classification,but allows a subject with a higher clearance level to read an object at a lower level.

A) star (*)
B) simple security
C) integrity star (*)
D) simple integrity

Question 68

Under the Common Criteria,____ is the user-generated specifications for security requirements.

A) Target of Evaluation (ToE)
B) Protection Profile (PP)
C) Security Target (ST)
D) Security Functional Requirements (SFRs)

Question 69

Under the Biba model,the ____ property permits a subject to have read access to an object only if the security level of the subject is either lower or equal to the level of the object.

A) star (*)
B) simple security
C) integrity star (*)
D) simple integrity

Question 70

An Automated Teller Machine (ATM)is an example of a ____.

A) content-dependent access control
B) constrained user interface
C) temporal isolation
D) None of these

Question 71

Under TCSEC,the ____ is the combination of all hardware,firmware,and software responsible for enforcing the security policy.

A) trusted computing base
B) reference monitor
C) covert channel
D) verification module

Question 72

Storage of classified documents must be accessible only to authorized individuals,which usually requires which of the following?

A) Safes
B) Locking file cabinets
C) Other protective devices for hard copies
D) All of these

Question 73

Under TCSEC,the ____ is the piece of the system that manages access controls-in other words,it mediates all access to objects by subjects.

A) trusted computing base
B) reference monitor
C) covert channel
D) verification module

Question 74

____ access controls are determined by a central authority and can be based on roles or tasks.

A) Mandatory
B) Nondiscretionary
C) Discretionary
D) Lattice-based

Question 75

Under the TCSEC model,the term ____ refers to the rules of configuration for a system,rather than a managerial guidance document.

A) reference monitor
B) trusted
C) covert
D) security policy

Question 76

Access to a specific set of information may be dependent on its subject matter is called ____.

A) content-dependent access controls
B) constrained user interfaces
C) temporal isolation
D) None of these

Question 77

Under lattice-based access controls,the row of attributes associated with a particular subject (such as a user)is referred to as a(n)____.

A) access control list
B) capabilities table
C) access control matrix
D) sensitivity level

Question 78

Under the Bell-LaPadula model,the ____ property prohibits a high-level subject from sending messages to a lower-level object.In short,subjects can read down and objects can write or append up.

A) star (*)
B) simple security
C) integrity star (*)
D) simple integrity

Question 79

What is the highest level of protection or evaluation which a system can be assigned under TCSEC?

A) A1
B) B1
C) B3
D) Beyond A1

Question 80

The Clark-Wilson model,designed for commercial environments is a(n)____ model.

A) confidentiality
B) integrity
C) availability
D) None of these