1
Q
Describe GAP ANALYSIS
A
- A study of where we are vs where we want to be.
2
Q
General Process of a GAP ANALYSIS.
A
- This may require extensive research
- Can take an extensive amount of time in order to collect emails, gather data, and perform technical research.
3
Q
What is the first step in initiating a GAP ANALYSIS?
A
- Working towards a known baseline which will give a goal to work towards.
4
Q
What are some BASELINES organizations can use when performing a GAP ANALYSIS?
A
- Protecting Controlled Unclassified Information in Non Federal Systems and Organizations by the National Institute of Standards and Technology (NIST).
- ISO/IEC 2700, Information Security Management Systems
5
Q
What are some appropriate actions to perform when evaluating the people for a GAP ANALYSIS?
A
- Getting a baseline of the people and processes.
- Understand their current training, their formal experience, and knowledge of securities policies and procedures.
6
Q
What are some considerations when assessing the current processes for a GAP ANALYSIS?
A
- Research existing IT systems.
- Evaluating existing security policies.
7
Q
Describe the process in performing the COMPARE AND CONTRAST step of a GAP ANALYSIS.
A
- Evaluate existing systems and identify weakness, determine effective processes.
- Create a detailed analysis.
8
Q
What is involved in a DETAILED ANALYSIS portion of COMPARE AND CONTRAST step?
A
- Examine broad security categories.
- Break those into smaller segments.
9
Q
Describe THE ANALYSIS AND REPORT step.
A
- A document of final comparisons with everything that was discovered.
- Detail the baseline objectives with a clear view of the current state.
- Determine the path to get from the current security to the goal.
10
Q
What is involved in the final step of a GAP ANALYSIS?
A
- Creating a gap analysis report which is a formal description of the current state.
- Provides recommendations for meeting the baseline.
Security Comp TIA 701
flashcards
Decks in class (75)
# Cards
-
Security Controls 1.142
-
THE CIA/AIC Triad 1.214
-
Non-Repudiation 1.27
-
Authentication, Authorization, & Account 1.211
-
Gap Analysis 1.210
-
Zero Trust 1.215
-
Physical Security 1.210
-
Deception and Disruption 1.25
-
Change Management 1.318
-
Technical Change Management 1.316
-
Public Key Infrastructure 1.48
-
Encrypting Data 1.411
-
Key Exchange 1.44
-
Encyrption Technologies 1.48
-
Obfuscation 1.48
-
Hashing and Digital Signatures 1.413
-
Blockchain Technology 1.43
-
Certificates 1.414
-
Threat Actors 2.114
-
Common Threat Vector 2.220
-
Phishing 2.26
-
Impersonation 2.26
-
Watering Hole Attacks 2.23
-
Misinformation and Disinformation 2.23
-
Memory Injections 2.32
-
Buffer Overflows 2.32
-
Race Condition 2.32
-
Malicious Updates 2.31
-
Operating System Vulnerabilities 2.32
-
SQL Injection 2.34
-
Cross Site Scripting 2.34
-
Hardware Vulnerabilities 2.38
-
Virtualization Security 2.310
-
Cloud-Specific Vulnerabilities 2.35
-
Supply Chain Attack 2.36
-
Misconfiguration Vulnerabilities 2.39
-
Mobile Device Vulnerabilities 2.35
-
Zero-Day Vulnerabilities 2.32
-
An Overview of Malware 2.47
-
Virus and Worms 2.49
-
Spyware and Bloatware 2.45
-
Other Malware Types 2.48
-
Physical Attacks 2.45
-
Denial of Service 2.45
-
DNS Poisoning 2.48
-
Wireless Attacks 2.49
-
On-path Attacks 2.46
-
Replay Attacks 2.410
-
Malicious Code 2.42
-
Application Attack 2.411
-
Cryptographic Attacks 2.45
-
Password Attacks 2.46
-
Indicators of Compromise 2.414
-
Segmentation and Access Control 2.513
-
Mitigation Techniques 2.517
-
Hardening Technique 2.517
-
Cloud Infrastructure 3.15
-
Data Types and Classifications 3.320
-
Resiliency 3.43
-
Recovery Testing 3.46
-
Hardening Targets 4.117
-
Vulnerability Remediation 4.320
-
Firewalls 4.510
-
Web Filtering 4.515
-
Access Control 4.610
-
Multi-factor Authentication 4.64
-
Incident Planning 4.88
-
Log Data 4.916
-
Security Policies 5.124
-
Data and Responsibilities 5.13
-
Risk Analysis 5.217
-
Business Analysis Impact 5.25
-
Agreement Types 5.310
-
Compliance 5.422
-
Penetration Testing 5.59
