Information Security & Risk Management Flashcards

What does the CIA triad stand for in information security?

Answer: Confidentiality, Integrity, Availability

The CIA triad is the foundational model of information security: Confidentiality (limiting access to authorized users), Integrity (ensuring data accuracy), and Availability (ensuring authorized access when needed).

What is 'information risk management'?

Answer: The systematic process of identifying, assessing, and treating risks to organizational information assets

Information risk management involves identifying threats and vulnerabilities, assessing their likelihood and impact, and applying controls to reduce risk to an acceptable level.

What is a 'data classification' scheme in information security?

Answer: A framework that categorizes information by sensitivity level to determine appropriate access controls and handling requirements

Data classification assigns labels (such as Public, Internal, Confidential, Restricted) to information based on sensitivity, guiding how data should be stored, transmitted, and shared.

In information security risk assessment, what does 'vulnerability' refer to?

Answer: A weakness in a system, process, or control that could be exploited by a threat

A vulnerability is a flaw or weakness (in software, hardware, processes, or people) that a threat actor could exploit to cause harm to information assets.

Which US law specifically regulates the protection of health information?

Answer: Health Insurance Portability and Accountability Act (HIPAA)

HIPAA establishes national standards for protecting sensitive patient health information from being disclosed without the patient's consent or knowledge.

What is 'access control' in information security?

Answer: The mechanisms and policies that regulate who can access information resources and what they can do with them

Access control encompasses the policies, procedures, and technical mechanisms that restrict access to information to authorized users based on their identity and role.