A

1. “AAA of access control”

2. Acceptable usage policy (AUP)

   1. authorized security controls

   2. change regulations

   3. consequences of violations

   4. copyright infringement

   5. data

   6. goals

   7. machines

   8. misuse

   9. organization’s IT equipment and data

   10. overview

   11. personal usage

   12. privacy

   13. privacy disclaimers

   14. protect confidential data

   15. rollout

   16. sanctions

   17. scope

   18. security

   19. social media

   20. use of IT resources

3. Access control

   1. defining

   2. effectiveness

   3. tools

4. Accountability

5. Account reset mechanism

6. Address Resolution Protocol (ARP)

7. Adjacent systems

8. Administrative access

9. Administrative controls

   1. application security

   2. asset management

   3. change control

   4. CMM

   5. documented processes

   6. machines

   7. policies

   8. record and media management

   9. security policy document

   10. verbal work culture

10. Adversarial risk

    1. advanced threats

    2. bare-minimum threat

    3. cyber-criminals

    4. cyber-militants

    5. FAIR

1. FBI cyber-crime

2. hacktivist

3. malicious insiders

4. Microsoft Windows vulnerabilities

5. NSA

6. power-ups

7. proximity of attacker

8. sample qualitative risk

9. sample quantitative risk

10. technical capability

11. techniques

12. time

1. Adversarial risk

1. ALS

1. American Institute of Certified Public Accountants (AICPA)

2. Annualized loss expectancy (ALS)

3. Anti-business complaints

4. Anti-counterfeiting tool

5. Anti-theft software agents, laptop

6. Antivirus software

7. Antivirus solutions

8. Application attacks

9. Application barriers

10. Application whitelisting

11. Approved scanning vendor (ASV)

12. Assassin, open source spam

13. Asset management

14. Asset value assessment

    1. examples of

    2. information classification

    3. internal and valuing information

15. Association for Certified Fraud Examiners

16. Assume breach mindset

    1. attackers

    2. failure of security

    3. over—residual risk

    4. rigid security policies

    5. security professionals

17. Assumptions examples

18. Attachment filtering, e-mail

19. Attacker incentives

    1. monetization schemes

    2. personal

    3. political

20. Attackers

21. Attacking techniques

    1. exfiltration

    2. kill chain

    3. stealing authentication

22. Audited organization’s role

23. Auditor

    1. auditing

    2. external

    3. internal

       1. competence

       2. independence

       3. training classes

    4. role

24. Audits

    1. antivirus software

    2. audited organization’s role

    3. and auditors

    4. auditor’s role

    5. background checks

    6. bolted-on security controls

    7. business-to-business

    8. business transactions

    9. change control

    10. control objectives

    11. customer intellectual property

    12. definition

    13. disagree with auditor’s findings

    14. document review

    15. evidence

    16. explicit

    17. as forcing function

    18. guide for

    19. industry audit certifications

    20. IT organizations

    21. IT security controls

    22. IT security program

    23. lawsuit

    24. misconceptions

    25. onsite review

    26. PCI DSS

    27. period of

    28. pre-assessment

    29. regulated industries

    30. scope

    31. scope control barriers

    32. security program, checklist

    33. SOC 1

    34. SOC 2/3

    35. SSAE 16 audits

    36. SSAE 16 reports

    37. standards types

        1. ISO 27001

        2. PCI DSS

        3. The SSAE 16

    38. surveillance audits

    39. third-party roles

    40. Type 1

    41. Type 2

    42. URLS

    43. workflow

25. Authentication

    1. electronic

    2. firewall

    3. multi-factor

    4. problem

    5. sample standards and procedures

    6. standards

    7. tokens

26. Authenticator

    1. tokens

    2. types of

27. Authorization

    1. limit administrative access

    2. privileges

    3. problems

    4. role-based access control

    5. service accounts

       1. sample authorization standards

       2. system authorization

28. Availability service principle

B

1. Backup policy

2. Badges, visitor

3. Biometrics

4. Botnet

5. BOYD

1. Bridge letters

2. Bring your own device (BOYD)

3. Business continuity policy

4. Business impact analysis (BIA)

   1. business continuity plan

   2. disaster impact scenarios

   3. facilities

   4. normal business operations

   5. sample scenario overview

   6. threat mapping with FMEA to generalized threats

5. Business model

   1. agility/ability of organization

   2. BYOD

   3. challenges

   4. communication problems

   5. communication with customers and entities

   6. consumer trust

   7. course of action

   8. expertises

   9. goods and services

   10. intellectual property

   11. organization’s secrets

   12. problems

   13. research

   14. risk explanation

6. Business-to-business (B2B)

C

1. Capability Maturity Model (CMM)

2. Cardholder data (CHD)

3. Cardholder data environment (CDE)

4. Challenge-response fashion

5. Change control standards

6. Change control tracking

7. CHD

1. Chemical Facility Anti-Terrorism Standards (CFATS)

2. Chesterton’s fence

3. Chief Technology Officer (CTO)

4. Child pornography

5. Children’s Online Privacy Protection Act (COPPA)

6. Cisco Security report

7. City of Gotham Department of Accounting Services and Computer Services

8. Clean desk policies, office

9. Cobra effect

10. Combined technical barriers

11. Commercial Off The Shelf software (COTS)

12. Common Vulnerability Scoring Standard (CVSS)

13. Completely Automated Public Turing test to tell Computers and Humans Apart (CAPTCHA)

14. Compliance impacts

    1. NERC and FTC

    2. PCI and HIPAA

15. Computing technology

16. Confidentiality service principle

17. Control design

    1. best practices

    2. compensating controls

    3. control failure modes

    4. cost of controls

    5. documentation

    6. financial information

    7. firewall filters

    8. flexibility

    9. functionality

    10. functions and failures

    11. GAIT principles

    12. hard dollar costs

    13. IRS

    14. key controls

    15. legacy systems

    16. minimum standard of care

    17. reasonable standard of care

    18. risk

    19. standardization and measurement

    20. standards bodies and organizations

    21. technical controls

    22. technical professionals

    23. workstation antivirus blocks

18. Control effectiveness

19. Control Objectives for Information and Related Technology (COBIT)

20. Critical internal IT services

21. Cryptography

    1. failures

    2. infrastructure

22. Cryptosystem

23. Custom controls, Internet services security

24. Customer-facing IT services

25. Cyber-criminals

26. Cyber-militants

27. Cybernetic memory

D

1. Database administrative access standards

2. Data breaches

   1. ALE

   2. Privacy Rights Clearinghouse

   3. Verizon Data Breach Investigations Report

3. Data/digital loss/leak prevention (DLP)

4. Data encryption, Internet services security

   1. hard

   2. storage crypto policy and standards

   3. tokenization

   4. viability against threats

5. Data-erasure software applications

6. Defense in depth

7. Defensive tools, specialized

8. Demilitarized zone (DMZ)

9. Deming Cycle

10. Denial-of-service (DoS)

11. DiffieHellman’s Iron Box

12. Diffusion of responsibility

13. Disaster recovery planning

14. DNS Security Extensions (DNSSEC)

15. DNS security, Internet services security

16. DomainKeys Identified Mail (DKIM) signatures

17. Domain Name Server (DNS)

E

1. Eidetic memory

2. Electronic authentication

3. Electronic personal health information (EPHI)

4. Elevated system access

5. E-mail security, Internet services security

   1. attachment filtering

   2. mail verification

   3. sample policy

   4. spam prevention

6. Empathy

7. Encryption, laptop

8. Enhanced Mitigation Experience Toolkit (EMET)

9. ENISA Cloud Computing Security Risk Assessment guide

10. Executive management, audit

11. Exfiltration

12. External auditors

13. External DNS server

14. External feedback mechanism

15. External vulnerability scans

F

1. Factor analysis of information risk (FAIR)

   1. defined

   2. risk modeling

2. Failover systems

3. Failure mode and effects analysis (FMEA)

   1. breakdown of personnel

   2. essence of

   3. example of facilities

   4. International Standard IEC 60812

   5. Internet banking system

4. Failure modeling

   1. analysis

   2. description

   3. internet banking system

5. FAIR

1. Fair and Accurate Credit Transaction Act (FACTA)

2. Fear Uncertainty and Doubt (FUD)

3. Federal Financial Institutions Examination Council (FFIEC)

4. Federal Information Security Management Act (FISMA)

5. Federal Rules of Civil Procedure (FRCP)

6. Federal Trade Commission (FTC)

7. Federated identity systems

8. FEMA

1. File Transfer Protocol sites (FTP)

2. Firewall access rules, standard

3. Firewall authentication

4. Flood Hazard map (FEMA)

5. FMEA

1. Formal disaster declaration

2. For-profit business

3. Fort Pulaski

   1. exploit technology

   2. Gilmore’s shore cannons

   3. gun ranges

   4. ownership changes hand

   5. Savannah river

   6. US Army Corps of Engineers

4. FTC

1. Function analysis

   1. description

   2. factors

G

1. Global services for customer service centers

2. Governance

   1. asset custodian

   2. asset owner

   3. asset user

   4. auditor

   5. audit role

   6. control objectives

   7. CSO

   8. departmental heads and roles

   9. effectiveness and appropriateness

   10. executive sponsorship

   11. formal CSO role

   12. frameworks

   13. internal policy statements

   14. ISMS charter

   15. ISMS committee

   16. ISMS Governance Strategy

   17. ISMS Steering Committee

   18. IT personnel

   19. IT security

   20. leadership

   21. management

   22. Puget Regional Bank ISMS charter

   23. risk acceptance

   24. risk and controls

   25. risk elimination

   26. risk reduction with controls

   27. risk transfer

   28. risk treatment

   29. roles and responsibilities diagram

   30. security departments

   31. statement of applicability

   32. tactics vs . strategy

3. Gramm-Leach-Bliley Act (GLBA)

H

1. Hackers

   1. amateur

   2. cyber-crimes

   3. disgruntled sysadmin

   4. ideology

   5. motivations

2. Hacktivist

3. Harvesting attacks

4. Hash

   1. password

5. Health Information Technology for Economic and Clinical Health Act (HITECH)

6. Health Information Trust Alliance (HITRUST)

7. Health Insurance Portability and Accountability Act (HIPAA)

8. Heating ventilation and air conditioning (HVAC) systems

9. Heat maps

   1. risk

   2. simple two-dimensional qualitiative risk map

10. Host-based IDS (HIDS)

    1. transmission encryption

11. Hosted systems

12. Human Resource Security Policy

    1. agreements

    2. background screening

    3. confidential information and systems

    4. credit checks

    5. disciplinary process

    6. educational and professional certification

    7. employee on boarding and off boarding

    8. modern building management companies

    9. passport verification

    10. person’s past actions

    11. pre-employment screen

    12. security and compliance requirements

    13. security and sanity’s sake

    14. security vulnerability

    15. serious background checks

    16. showstoppers

    17. SLA

    18. training

    19. urgent terminations

    20. user management

    21. vendor support

I, J

1. ICMP Redirect

2. Identification

3. Impact calculation

   1. See alsoIndirect impacts

   2. assessment

   3. assets

   4. compliance

1. customer confidential records

2. IT asset inventory

3. legal/compliance department

4. SLAs

1. Incident response policy

2. Indicator of compromise (IOC)

3. Indirect impacts

   1. IT resources

   2. law enforcement, management and regulation bodies

   3. loss of user productivity

   4. public leakage attacks

4. Information classification

5. Information security management system (ISMS)

6. Information Security Risk Management

7. Initial Report on Compliance (IROC)

8. Insiders

9. Internal audit

   1. plan

   2. process

      1. ISO standard for measurement

      2. measuring control

      3. publish to management

      4. records

   3. role of

      1. auditor competence

      2. auditor independence

      3. external audit findings

      4. organization’s security

   4. sample organization chart

10. Internal feedback mechanisms

11. International Organization for Standardization/International Electrotechnical Commission standard (ISO 27001)

12. Internet banking system

13. Internet services security

    1. building custom controls

    2. data encryption

       1. hard

       2. storage crypto policy and standards

       3. tokenization

    3. DNS security

    4. e-mail security

       1. attachment filtering

       2. mail verification

       3. sample policy

       4. spam prevention

    5. malware controls

       1. anti-malware policy and standards

       2. defense

    6. Web services

       1. Web application attacks

       2. Web stack

14. Intrusion detection systems (IDS)

15. Intrusion prevention systems (IPS)

16. IP address

17. IPsec virtual private networks

18. ISMS

1. ISMS charter

2. ISMS steering committee

3. ISO 27001 audit

4. ISO training institutions, internal auditor

5. IT department

   1. access control

   2. authentication standards

   3. challenges

   4. controls

   5. dragging projects

   6. high-value targets

   7. IKEA effect

   8. infinitely long IT work queue

   9. vs . IT security

   10. perpetual design

   11. poor hygiene

   12. risk analysis

   13. security champions

   14. security roles

       1. builder

       2. hiring for

       3. responder

       4. testers

   15. security-savvy developer

   16. technical expertise

6. IT systems, complexity

   1. attackers

   2. DNS

   3. fallacy of composition

   4. internet calls

   5. IP address

   6. ISPs sending

   7. ports and protocols

   8. standards, web transaction

   9. TCP handshake

   10. vulnerability

   11. web of code

K

1. Key management, data encryption

2. Kill chain

   1. command and control

   2. delivery

   3. description

   4. exploitation

   5. install

   6. reconnaissance

   7. weaponization

L

1. Laptop security

2. Legacy, encryption

3. Likelihood

   1. common IT security threats

   2. description

   3. examples of threats

   4. vulnerability factors

4. Logical access barriers

5. Logical access control

   1. accountability

   2. authentication

1. authorization

1. components

2. organization

1. Logical access controls

2. Log repository

M

1. Mail verification

2. Malware controls, Internet services security

   1. anti-malware policy and standards

   2. defense

3. Malware-infected hosts

4. Mandiant Intelligence Center Report

5. Man-in-the-middle attack

6. Media Access Control (MAC)

7. Media and portable media controls

   1. laptop controls

   2. media destruction

8. Media files, e-mail attached

9. Media-shredding companies

10. Memorandums of Understanding (MOU)

11. Microsoft Security Intelligence Report

12. Mobile banking project

13. Modern operating systems

14. Morris worm

15. Multifactor authentication

N

1. National Hurricane Center Storm Surge map

2. National Institute of Standards

3. National Security Agency’s (NSA)

4. Natural disasters

5. Natural hazards

   1. determination

   2. gravitational constant

   3. for North America, research

   4. quantitative risk analysis

   5. Seattle Hazard Explorer

   6. types

6. Natural vs . man-made risks

7. Negative error cultures

8. NERC

1. Network Access Control (NAC) system

2. Network address translation (NAT)

3. Network barriers

4. Network File System (NFS)

5. Network Security

   1. acceptable encryption methods

   2. commercial Internet usage

   3. console encryption

   4. cryptographic modules

   5. drive-by-download attacks

   6. exfiltration of data

   7. firewall

      1. designs

      2. management

   8. hardening standards

   9. HIDS

   10. IDS deployment

   11. impersonation

   12. IT security attacks

   13. jump hosts and firewalls

   14. man-in-the-middle

   15. Morris worm

   16. network attacks and impacts

   17. network controls

   18. network denial of service

   19. networking technology

   20. network worm

   21. ORGANIZATION

   22. procedures

   23. remote exploits

   24. remote password guessing

   25. self-replicating malware

   26. sniffing attacks

   27. virtual private networks

   28. web encryption

   29. wireless encryption

6. Network Time Protocol (NTP)

7. Network worms

8. Neutron stars

9. Nmap

10. NOAA Severe Storm Labs

11. Non-company standard browsers

12. Non-repudiation

13. North American Electric Reliability Corporation (NERC)

O

1. OCTAVE Cyber Risk and Resilience Management

2. Offices, security in

   1. clean desk policies

   2. locked doors

   3. NAC

   4. screen saver lockouts

3. Operational failure mode

4. Order takers and refunds

5. Organization

   1. logical access control

   2. passwords for authentication

   3. physical security policy

   4. two-factor authentication

P

1. Packet filter firewalls

2. PAN

1. “Paperless office”

2. Passwords

   1. hash

   2. policy

   3. rotation scheme for

   4. standards

3. Payment Application Data Security Standard (PA-DSS)

4. Payment Card Industry Data Security Standard (PCI DSS)

5. People

   1. administrative rights

   2. customer

   3. DLP

   4. employment agreements

   5. Human Resource Security Policy

1. ISMS committee

2. monitoring

3. policy violations

4. security policy

5. security professionals

6. security training

7. segregation of duties

8. threat of malicious insiders

9. user management

1. Personal identification numbers (PINs)

2. Personal incentives

3. Personally identifiable information (PII)

4. Personnel security

   1. training

   2. visitor security

5. Phishing/social engineering

6. Physical barriers

7. Physical security

   1. and IT security controls

   2. in offices

      1. clean desk policies

      2. locked doors

      3. NAC

      4. screen saver lockouts

   3. media controls

      1. laptop controls

      2. media destruction

   4. personnel security

      1. training

      2. visitor security

   5. physical controls and their defeat

   6. physical risk assessments

   7. policy

   8. problems

   9. risk assessments

   10. secured facilities controls

       1. access to

       2. alarms

       3. cameras

       4. environmental controls

       5. guards

       6. racks and cages

8. PII

1. PIN Transaction Security (PTS) Standard

2. Plan-Do-Check-Act (PDCA)

3. Point-of-Sale (POS) terminals

4. Poisoning attacks

5. Policy

   1. amendment process

   2. AUP

1. encryption methods

2. ISMS charter

3. and the Law

4. non-technical people

5. organizational security

6. potty

7. procedures and standards

8. records

9. security policy

   1. authority

   2. components of

   3. goals

   4. governance

   5. ISMS

   6. objectives

   7. risk management

   8. scope and limitations

   9. user behavior

   10. WISP

10. standards

1. Political incentives

2. POS

1. Post audit improvement

   1. audit report

   2. bridge letters

   3. controls improvement

   4. deliberate actions

   5. direct and indirect costs

   6. expectations

   7. ideas and examples

   8. implementation/operation

   9. Internet age

   10. plans

   11. policy constraints

   12. quality of controls

   13. risk analysis framework

   14. root cause analysis

   15. sample security incident register

   16. security awareness training

   17. security policy violation

   18. security program

   19. shearing layers

   20. temporary solutions and work-arounds

2. Power Outage Data Explorer

3. Primary account number (PAN)

4. Privacy disclaimer

5. Privacy principle

6. Process barriers

7. Processing integrity principle

8. Promiscuous mode

9. Proxy firewalls

Q

1. Qualified security assessors (QSA)

2. Qualitative analysis

   1. clarifying impact, example of

   2. clarifying likelihood, example of

   3. heat maps

1. high impact and low likelihood

2. low impact and high likelihood

3. medium impact/likelihood

4. simple risk list

5. subject matter experts

6. vague/misleading

1. Quantitative analysis

   1. data breaches

1. example of analysis

R

1. RACI diagram

2. Real-time Blackhole Lists (RBL)

3. Recovery time objective (RTO)

4. Redesigned processes

5. Reflection denial-of-service attack

6. Remote Desktop Protocol (RDP)

7. Report on Compliance (ROC)

8. Reputation blacklisting

9. Request for proposal (RFP) process

10. Response controls

    1. after action analysis

    2. backup and failover

    3. business continuity planning

    4. incident response plan

    5. incidents

    6. logging

11. Risk analysis

    1. fuzziness of

    2. GAIT principles

    3. gap analysis

    4. impact calculation

1. IT security information

2. likelihood and impact

3. likelihood, calculation of

4. qualitative

1. quantitative

1. realistic, actionable and reproducible

2. Robert Courtney Jr., first law

3. security decisions

1. Risk modeling

   1. cyber-criminals/malicious insiders

   2. likelihood and impact

   3. likelihood and potential damaging events

   4. list of risks

   5. natural vs . man-made

2. Role-based access control

3. Root cause analysis

S

1. SaaS

1. SAD

1. Safety, culture of

2. Sample security incident register

3. Sarbanes-Oxley Act of 2002 (SOX)

4. Schneier’s Law

5. Scope

   1. adjacent systems

   2. barriers

      1. application

      2. combined technical

      3. logical access

      4. network

      5. physical

      6. process

      7. technical

   3. controls

   4. double check

   5. effectiveness and efficiency, controls

   6. examples of

   7. hints

      1. but not too small

      2. simplification

      3. start small and expand

   8. IT security program

   9. logical, physical, operational and human factors

   10. non-IT departments

   11. overlapping

   12. PCI DSS

   13. PII

   14. public sources

   15. SaaS company

   16. SSAE 16 SOC 1

   17. third-party process dependencies

6. Scope containment

7. Screen saver lockouts

8. Seattle Hazard Explorer

9. Secondary authentication systems

10. Secured facilities

    1. access to

    2. alarms

    3. cameras

    4. environmental controls

    5. guards

    6. racks and cages

11. Secure Shell (SSH) sites

12. Security department

    1. access control

    2. authentication standards

    3. two-factor authentication

13. Security incident

14. Security policy

    1. Internet

    2. violation

15. Security professionals

16. Security service principle

17. Security solutions

18. Self-Assessment Questionnaire (SAQ)

19. Self-enrollment system

20. Semi-critical internal IT services

21. Sender Policy Framework (SPF)

22. Sensitive authentication data (SAD)

23. Servers, DNS

24. Service level agreements (SLA)

25. Service Organization Controls (SOC)

26. Session hijacking

27. Shorter rotation cycles

28. Simple Network Management Protocol (SNMP)

29. Simple Syndication (RSS)

30. Single sign-on (SSO) tools

31. SLA

1. Sniffing attacks

2. Social engineering

   1. incentive

   2. ring of familiarity

   3. story

   4. urgency

3. Software-as-a-Service (SaaS)

4. Software objects

5. Software service accounts

6. Someone else’s problem

7. Spam-filtering solutions

8. Spamhaus Project

9. Spam prevention, e-mail

10. Spam-relaying malware

11. Span ports

12. Standards for Attestation Engagements 16 (SSAE 16)

13. Stateful inspection firewalls

14. Statement of applicability (SoA)

15. Static web sites

16. StuxNet malware

17. Surf pornography

18. Symantec Security Threat Report

19. System administrative access standards

20. System administrators

21. System authorization

T

1. TCP/IP protocol

2. Technical barriers

3. Third party process dependencies

4. Third-party roles

5. Third-party security

   1. agreement

   2. audit reports

   3. authentication and authorization

   4. control gap analysis approach

   5. controls

   6. critical systems

   7. e-commerce

   8. getting answers

   9. IT and security department

   10. IT security programs

   11. management process

   12. maturity and effectiveness

   13. network controls

   14. organization

   15. problems

   16. responsibility

   17. risk analysis

   18. security service agreements

   19. software procurement

   20. technical controls

   21. vulnerability and risk monitoring

6. Tokens, authentication

7. Tools, access control

8. Top-down approach

9. Trivial File Transfer Protocol (TFTP)

10. Two-factor authentication

U

1. UDP protocol

2. Unix operating systems

3. Unsolicited e-mail

4. Untrained internal audit team

5. Users

   1. antivirus software works

   2. automated process

   3. complexity

   4. confidential data leakage

   5. contextual shift

   6. culture clashes

   7. empathy

   8. intention and vision of controls

   9. manual process

   10. organizations

   11. paradigm and goals

   12. powerful techniques

   13. problems faced by

   14. security awareness training

   15. security system

   16. standards

       1. access control

       2. authentication

   17. with work

   18. work flow

6. User self-help tool

7. USGS Earthquakes maps

8. USGS Natural Hazards map

V

1. VERIS Community Database

2. Verizon Data Breach Investigations Report

3. Virtual LANs (VLANs)

4. Virtual Private Network (VPN)

5. Visitor security

6. VPN tunnel

7. Vulnerability management

   1. activities

   2. application security testing

   3. automatic patching routines

   4. breakdown of responsibilities

   5. description

   6. exploitable security vulnerabilities

   7. hardening standards

   8. higher priority

   9. lower priority

   10. network port scanner software

   11. notification

   12. patching

   13. PCI DSS requirements

   14. penetration testing

   15. physical and virtual machines

   16. prioritization and risk

   17. scanning

   18. unpatched hole

8. VulnPryer engine

W, X, Y, Z

1. Watering hole attack

2. Web application firewalls

3. Web server

4. Web services, Internet services security

   1. Web application attacks

   2. Web stack

5. Web sites

   1. static

   2. three-tier architecture for

6. Wi-Fi Protected Access (WPA)

7. Written Information Security Program (WISP)