Information Security & Risk Management Flashcards

What is 'data loss prevention' (DLP) in information security?

Answer: A set of tools and policies designed to detect and prevent unauthorized transmission or exfiltration of sensitive data

DLP solutions monitor, detect, and block sensitive data from being sent outside the organization through email, web uploads, removable media, or other channels.

In information security, what is 'multi-factor authentication' (MFA)?

Answer: An authentication method requiring users to verify identity using two or more independent factors (something you know, have, or are)

MFA requires users to present at least two different types of credentials—such as a password plus a one-time code or biometric—making unauthorized access significantly harder.

What is a 'security audit' in information management?

Answer: A systematic evaluation of an organization's information security policies, controls, and practices against established standards

A security audit is an independent review that assesses whether security policies and controls are in place, functioning correctly, and compliant with relevant regulations and standards.

What does 'data integrity' mean in information security?

Answer: Ensuring data is accurate, complete, and has not been altered without authorization

Data integrity means ensuring that data remains accurate and unmodified—either accidentally or maliciously—throughout its lifecycle.

What is a 'privacy impact assessment' (PIA)?

Answer: A systematic process for evaluating how a project or system collects, uses, and protects personal information, and identifying privacy risks

A PIA is a risk management tool that identifies potential privacy risks of a new project or system and recommends controls to mitigate those risks before implementation.

Under the US Federal Information Security Management Act (FISMA), what are federal agencies required to do?

Answer: Develop, document, and implement an information security program to protect federal information and systems

FISMA requires federal agencies to develop and maintain a comprehensive information security program, undergo annual independent evaluations, and report to NIST and OMB.