Information Security & Risk Management Flashcards

What is 'role-based access control' (RBAC)?

Answer: A model where access permissions are assigned to roles, and users are granted access by being assigned to appropriate roles

RBAC assigns permissions to job roles rather than individuals, so users automatically receive the access rights associated with their organizational role.

What is a 'risk register' in information security management?

Answer: A document that records identified risks, their likelihood, impact, owners, and treatment plans

A risk register is a centralized record of all identified information risks, including their assessment, priority, responsible owner, and the controls or mitigation actions planned or in place.

What does 'encryption' protect in information management?

Answer: It transforms data into an unreadable format so that only authorized parties with the decryption key can read it

Encryption converts plaintext data into ciphertext using an algorithm and key, ensuring that even if data is intercepted or stolen, it is unreadable without the correct decryption key.

What is the principle of 'least privilege' in information security?

Answer: Granting users only the minimum access rights necessary to perform their job functions

The principle of least privilege limits user access rights to only what is required for their specific job duties, reducing the risk of accidental or malicious data compromise.

What is a 'Business Continuity Plan' (BCP)?

Answer: A documented plan for maintaining or restoring essential business operations during and after a disruption

A BCP outlines the processes and procedures to ensure that critical business functions can continue during and after a disaster, minimizing downtime and data loss.

What type of security control is employee security awareness training?

Answer: Administrative (managerial) control

Security awareness training is an administrative (managerial) control—a policy, procedure, or process designed to reduce human-related security risks.