5
votes
Accepted
Does "crypto offloading" require the use of ASICs? Can the concept be applied elsewhere?
Simply put, not, crypto offloading does not require ASICs. To expand:
Crypto-offloading simply means removing the computational burden of encryption operations from a general purpose system, and ...
- 36k
5
votes
What's a practical example of encryption "in use" or "in process"?
Lets first define what encryption-in-use is. Its a capabilitiy that lets you run your computation on encrypted data or run encrypted application.
There are two ways to do this. There are pros and cons ...
- 51
4
votes
What's the difference between "load testing" and "stress testing" within the context of a security audit?
There's a few different definitions, however the one I go with is that Load Testing is taking an application up to its expected maximum load level to make sure it performs. Stress testing is ...
- 17.5k
3
votes
What's the difference between "Organization normative framework" and "Application normative framework"?
Organization normative framework (ONF) is essentially organizational or Company guidelines/matrix/repository on securing applications controls and process.
Application normative framework is a ...
- 29
3
votes
Accepted
Is it reasonable to consider logs as a "technical control"?
Logs are a detective control - they allow you to detect activities that you would like to control. Obviously, they do it in an electronic fashion, making them a technical control by the definition ...
- 73.3k
3
votes
What's the difference between an API gateway and XML gateway?
A bit of an artificial distinction in my view. I am guessing that they are considering XML gateways to be document-based whereas they are considering API gateways to be record based. But this really ...
- 7,152
3
votes
Accepted
What's the difference between an "application-aware firewall" and a "web application firewall"?
An application-aware firewall understands not only ports, but that specific applications listen to specific ports. They are indeed host based (installed on a user workstation or a server) and prevent ...
- 36k
3
votes
What's a practical example of encryption "in use" or "in process"?
Protecting data at rest
Data at rest is data on disk rather than in memory. This data is typically protected using disk encryption, file encryption, database encryption or encryption of the specific ...
- 3,169
3
votes
How is cryptoshredding a "sole pragmatic option for data disposal in the cloud"?
Without the additional context of the rest of your training materials, it's hard to say for sure -- I don't think there's a textbook definition of "cryptoshredding". However, if we use the Wikipedia ...
- 16.1k
2
votes
Accepted
Why would a goal of DLP solution implementation include "loss of mitigation"?
This was probably a typo. Data Loss mitigation is obviously a goal of DLP. Elasticity, as you said, is not a goal of DLP.
- 36
2
votes
What's a practical example of how volatile information can be preserved in a digital forensics investigation?
Shutting the system down is closer to the end of the collection process.
Capturing volatile data involves capturing the following items:
Memory dump/core dump,
Network connections & traffic,
...
- 939
2
votes
Accepted
Is this description of the term "event" accurate within the context of Business Continuity and Disaster recovery?
Totally depends on the context.
A cybersecurity event may simply be an action taken without inherent goodness or badness (user logged in, user failed authentication, logs were rotated, etc.).
A ...
- 132k
2
votes
Accepted
Does a SOC 2 SSAE report not come with a "seal of approval" from a certified auditor?
SOC 2 report includes a description of the tests performed by the auditor and
the results of those tests and the auditor’s opinion of the effectiveness of the individual
controls and systems. SOC 3 ...
- 169
1
vote
Is there a difference between "risk tolerance" and "risk appetite"?
Risk appetite is general (organizational level) level of risk acceptance your organization pursue, in other words It’s an amount or type of risks the organizations decided to live with. Risk appetite ...
- 2,037
1
vote
Is there a difference between "risk tolerance" and "risk appetite"?
The best way to distinguish the two can be using mathematics.
Risk Appetite is the target level of loss exposure that the organization views as acceptable, given business objectives and resources. ...
1
vote
How/why can Cloud Access Security Brokers be superior to managing access controls locally?
One of the main reasons to utilize a third-party CASB, or any third-party provider, would be to ensure the offering is done "right." In this case, a CASB would have the necessary resources to supply ...
- 21
1
vote
Is there a difference between "Maximum Tolerable Downtime" and "Maximum Allowed Downtime"?
They are not the same thing. MTD is the time allowed before the entire business becomes at risk (e.g. the company may go out of business), whereas MAD is the time at which an actual business impact ...
- 740
1
vote
Accepted
What's the difference between "directory services" and "identity repositories"?
The really simple version:
Directory services are the means to access structured data (including protocols) + a structured data repository.
The repository may contain all sorts of information, not ...
- 1,253
1
vote
Are there any standards that *require* companies to use specific Uptime Institute Tiers for data centers?
This really ties into the organizations BIA results and what are considered "critical" resources, specifically to that organization. The only real standard (not official, but consistent with other ...
- 21
1
vote
Accepted
Are there any standards that *require* companies to use specific Uptime Institute Tiers for data centers?
Are there standards that explicitly state "thou shalt use a minimum of Tier X datacenters!"
You won't find any standards or government rules on that. You might find similar language in contracts ...
- 3,850
1
vote
Are there general guidelines (or better yet, compliance standards) for assessing the risks of a cloud-based API?
I'm not aware of any standard that would apply specifically to an API. I think the assessment of whether it's good enough will need to be driven by the purpose of the API. If the API is used to gather ...
- 726
1
vote
Accepted
What drives security controls in cloud models: Business requirements? Or SLAs?
Business Requirements mandates everything. Even insecure, expensive, outdated or even illegal options. Business defines the SLA, defines the architecture, defines what they will disclose and what they ...
- 55.5k
1
vote
What drives security controls in cloud models: Business requirements? Or SLAs?
The SLA is in place to mandate that service levels are achieved in order to meet Business Requirements. Business Requirements trumps everything else. I get your reasoning above but SLAs are not ...
- 3,169
Only top scored, non community-wiki answers of a minimum length are eligible