ISO/IEC 27002 Manager flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

Confidentiality

Property that information is not made available or disclosed to unauthorized individuals, entities or processes; protected by access control, encryption and need-to-know restrictions.

Integrity

Property of accuracy and completeness; information and processing methods are safeguarded against unauthorized modification, deletion or corruption.

Availability

Property of being accessible and usable on demand by an authorized entity; supported by redundancy, backup and resilience controls.

CIA triad

The three core information security properties: confidentiality, integrity and availability. Controls are selected based on which property they protect.

Risk

The effect of uncertainty on objectives, expressed as a combination of the likelihood of an event and its consequence; the basis for control selection.

Residual risk

The risk remaining after controls have been implemented and risk treatment applied; must be explicitly accepted by management and recorded.

Risk treatment options

Four choices: modify (apply controls), retain (accept), avoid (eliminate the activity) or share (transfer to a third party such as insurer).

Threat

A potential cause of an unwanted incident that may result in harm to a system or organization; distinct from a vulnerability, which is a weakness.

Vulnerability

A weakness of an asset or control that can be exploited by one or more threats; identified through scanning, testing and review.

ISMS

Information Security Management System: the set of policies, procedures, controls and responsibilities an organization uses to manage information security risk systematically.

PDCA cycle

Plan-Do-Check-Act: the continual improvement model underlying the ISMS, covering establishment, implementation, monitoring and improvement.

Defense in depth

Layering preventive, detective and corrective controls so that failure of one control does not lead to a single point of compromise.

Cybersecurity

Protection of networked systems, users and infrastructure in cyberspace from threats; extends information security to connected environments.

PII

Personally Identifiable Information: data relating to an identified or identifiable natural person, protected under privacy controls such as ISO/IEC 27701.

Data minimization

Privacy principle requiring collection and processing of only the PII necessary for a specified, legitimate purpose.

Statement of Applicability

Document required by ISO/IEC 27001 listing all 93 Annex A controls, justifying inclusion or exclusion and recording implementation status.

Organizational controls (A.5)

The 37 policy and governance controls in ISO/IEC 27002:2022, covering policies, roles, suppliers, incidents, continuity and compliance.

People controls (A.6)

The 8 controls covering screening, terms of employment, awareness and training, disciplinary process, remote working and event reporting.

Physical controls (A.7)

The 14 controls covering physical perimeters, entry, offices, environmental threats, equipment protection and secure disposal.

Technological controls (A.8)

The 34 controls covering access control, cryptography, logging, backup, malware, vulnerability management and secure development.

Threat intelligence (A.5.7)

Organizational control requiring collection and analysis of threat information to inform control selection and incident detection.

Cloud services security (A.5.23)

Control requiring processes for acquisition, use, management and exit of cloud services, aligned with the organization's security requirements.

Supplier agreements (A.5.20)

Control requiring security requirements to be agreed with suppliers, including incident notification, audit rights and data protection obligations.

Incident response phases

Controls A.5.24 preparation, A.5.25 assessment and decision, A.5.26 response, A.5.27 learning, and A.5.28 evidence collection.

Privileged access rights (A.8.2)

Control requiring restriction and management of privileged access, including allocation, review and removal of elevated permissions.

Secure authentication (A.8.5)

Control requiring authentication technologies and procedures based on information access restrictions and the organization's access control policy.

Cryptography policy (A.8.24)

Control requiring rules for effective use of cryptography, including key management across generation, storage, distribution, rotation and destruction.

Event logging (A.8.15)

Control requiring production, storage, protection and analysis of event logs to detect and investigate security incidents.

Monitoring activities (A.8.16)

Control requiring monitoring of networks, systems and applications for anomalous behavior, with results acted upon and logged.

Technical vulnerability management (A.8.8)

Control requiring timely identification of technical vulnerabilities, assessment of exposure and appropriate action; broader than patch management alone.

Secure coding (A.8.28)

Control requiring secure coding principles to be applied in software development, addressing common weaknesses and reducing exploitable defects.

ICT readiness (A.5.30)

Control requiring ICT readiness for business continuity, planned and tested against agreed objectives and recovery time requirements.