To help review or design security controls, they can be classified by several criteria. One of these criteria is based on time. According to this criteria, which of the following controls are intended to prevent an incident from occurring?
Preventive controls are the security controls that are intended to prevent an incident from occurring, e.g., by locking out unauthorized
Answer C is incorrect. Detective controls are intended to identify and characterize an incident in progress, e.g., by sounding the
intruder alarm and alerting the security guards or police.
Answer A is incorrect. Corrective controls are intended to limit the extent of any damage caused by the incident, e.g., by recovering the
organization to normal working status as efficiently as possible.
Answer B is incorrect. There is no such categorization of controls based on time.
Which of the following processes does the decomposition and definition sequence of the Vee model include? Each correct answer represents a part of the solution. Choose all that apply.
Decomposition and definition sequence includes the following processes:
System security analysis
Security requirements allocation
Software security requirements analysis
High level software design
Detailed software design
Answer A is incorrect. This process is included in the integration and verification sequence of the Vee model.
Which of the following NIST Special Publication documents provides a guideline on questionnaires and checklists through which systems can be evaluated for compliance against specific control objectives?
NIST SP 800-26 (Security Self-Assessment Guide for Information Technology Systems) provides a guideline on questionnaires and checklists
through which systems can be evaluated for compliance against specific control objectives.
Answer A, E, C, D, and F are incorrect. NIST has developed a suite of documents for conducting Certification & Accreditation (C&A).
These documents are as follows:
NIST Special Publication 800-37: This document is a guide for the security certification and accreditation of Federal Information
NIST Special Publication 800-53: This document provides a guideline for security controls for Federal Information Systems.
NIST Special Publication 800-53A. This document consists of techniques and procedures for verifying the effectiveness of security
controls in Federal Information System.
NIST Special Publication 800-59: This document is a guideline for identifying an information system as a National Security System.
NIST Special Publication 800-60: This document is a guide for mapping types of information and information systems to security
objectives and risk levels.
A number of security patterns for Web applications under the DARPA contract have been developed by Kienzle, Elder, Tyree, and Edwards-Hewitt. Which of the following patterns are applicable to aspects of authentication in Web applications?b Each correct answer represents a complete solution. Choose all that apply.
The various patterns applicable to aspects of authentication in the Web applications are as follows:
Account lockout: It implements a limit on the incorrect password attempts to protect an account from automated password-guessing
Authenticated session: It allows a user to access more than one access-restricted Web page without re-authenticating every page. It
also integrates user authentication into the basic session model.
Password authentication: It provides protection against weak passwords, automated password-guessing attacks, and mishandling of
Password propagation: It offers a choice by requiring that a user's authentication credentials be verified by the database before
providing access to that user's data.
Answer B and C are incorrect. Secure assertion and partitioned application patterns are applicable to
software assurance in general.
Which of the following steps of the LeGrand Vulnerability-Oriented Risk Management method determines the necessary compliance offered by risk management practices and assessment of risk levels?
Assessment, monitoring, and assurance determines the necessary compliance that are offered by risk management practices and assessment
of risk levels.