Information Security Management Flashcards

What is the purpose of encryption in information security?

Answer: To convert data into an unreadable format for unauthorized users

Encryption converts readable data (plaintext) into an unreadable format (ciphertext) that can only be decoded by authorized parties with the correct key.

A risk assessment in information security involves:

Answer: Identifying, analyzing, and evaluating potential threats to information assets

A risk assessment systematically identifies potential threats, analyzes their likelihood and impact, and evaluates appropriate mitigation strategies.

Which security control type is a password policy?

Answer: Administrative control

Password policies are administrative controls — documented rules and procedures that govern how people behave to maintain security.

What is social engineering in the context of information security?

Answer: Manipulating people psychologically to divulge confidential information

Social engineering exploits human psychology rather than technical vulnerabilities to manipulate individuals into revealing sensitive information or granting unauthorized access.

What does the principle of least privilege mean in information security?

Answer: Users are granted only the minimum access needed to perform their job

The principle of least privilege limits user access rights to only what is strictly necessary to perform their specific job functions.

What is a security audit?

Answer: A systematic evaluation of an organization's security controls and practices

A security audit systematically reviews an organization's security policies, controls, and practices to identify vulnerabilities and ensure compliance.