01. Intro to Sec Governance Flashcards
Intro to Sec Governance
What is GOVERNANCE
Senior management exrts strategic control over business functions through
1. policies
2. objectives
3. delegation of authority
4. monitoring
33
Intro to Sec Governance
How is governance usually established
Steering committees
33
Intro to Sec Governance
9 typical processes that information security GOVERNANCE focuses on
- Personnel Management
- Sourcing
- Risk Management
- Configuration Management
- Change Management
- Access Management
- Vulnerability Management
- Incident Management
- Business Continuity P.anning (BCP)
Intro to Sec Governance
Organisations not adequately protecting their information through an information security program have a ____ problem
Business Problem
34
Intro to Sec Governance
A lack of understanding and committment by these parties is typically the reason why business have a problem protecting their information
The most typical reason why a business will have a problem implementing or putting in place an information security program to protect their information
Board of directors and Senior Management
34
Intro to Sec Governance
When information security becomes a people issue and people from each level in the organisation understand the importance, the organisation will be in a position of what
Reduced Risk
34
Intro to Sec Governance
reduction in risk results in;
1. Fewer ____
2. When they do occur, have lower ____
3. This is felt on the organisations ____ and ____
- Incidents
- Impact
- Reputation and Operations
34
Intro to Sec Governance
Information Security Governance is a set of established activities that helps management understand the state of the organisations ____, its current ____, and its direct ____
- security program
- risks
- activities
34
Intro to Sec Governance
A goal of the ____ is to continue to contribute toward the fulfilment of the security strategy
Security Program
34
Intro to Sec Governance
The security strategy will continue to align with the ____
Business and Business Objectives
34
Intro to Sec Governance
What does GOVERNANCE begin with establishing, that is translated into actions, policies, processes, procedures, and other activities down through the levels of the organisation
Top-Level Strategic Objectives
34
Intro to Sec Governance
What other program must an organisation have in place in order for the information security governance to succeed
Effective IT Governance Program
34
Intro to Sec Governance
What is the purpose of security governance
Align SECURITY PROGRAM with the NEEDS OF THE BUSINESS
35
Intro to Sec Governance
A collection of top-down activities intended to control the security of the organisation from a strategic perspective
Information Security Governance
35
Intro to Sec Governance
Desired capabilities or end states are ideally expressed in achievable, measureable terms
Artifacts and actions that flow out of a healthy security governance program
Objectives
35
Intro to Sec Governance
A plance to achieve one or more objectives
Artifacts and actions that flow out of a healthy security governance program
Strategy
35
Intro to Sec Governance
At its minimum, this should directly reflect the mission, objectives, and goals of the overall organisation
Artifacts and actions that flow out of a healthy security governance program
Policy
35
Intro to Sec Governance
These should flow directly from the organisations mission, objectives and goals. Whatever is most important to the organisation should also be essential to information security
Artifacts and actions that flow out of a healthy security governance program
Priorities
35
Intro to Sec Governance
These help drive a consistent approach to solving business challenges. The choice of these should facilitate solutions that meet the organisations needs in a cost-effective and secure manner
Artifacts and actions that flow out of a healthy security governance program
Standards
35
Intro to Sec Governance
Formalised descriptions of repeated business activities inlcuding instructions to applicable personnel.
Artifacts and actions that flow out of a healthy security governance program
Processes
35
Intro to Sec Governance
Formal descriptions of critical activities to ensure desired outcomes
Artifacts and actions that flow out of a healthy security governance program
Controls
35
Intro to Sec Governance
These should be organised and performed in a consistent manner that reflects the business priorities and supports the business
Artifacts and actions that flow out of a healthy security governance program
Programs and project management
35
Intro to Sec Governance
Formal measurements of processes and controls so that management understands and can measure them
Artifacts and actions that flow out of a healthy security governance program
Metrics / Reporting
35
Intro to Sec Governance
What 2 things must the information security manager understand withn the business concerning confidentiality, integrity, and availability (CIA)
Appetite and priority
36
Intro to Sec Governance
Management will ensure that risk assessments are performed to identify risks in information systems and supported processes
Activities required to protect the organisation which senior management will ensure are in place to support the business operations
Risk Management
36
Intro to Sec Governance
Management will ensure this activity is conducted when key changes are made which result in security improvements
Activities required to protect the organisation which senior management will ensure are in place to support the business operations
Process Improvement
36
Intro to Sec Governance
Management will put technologies and processes in place to ensure that security incidents will be identified as quickly as possible
Activities required to protect the organisation which senior management will ensure are in place to support the business operations
Event Identification
36
Intro to Sec Governance
Management will put this in place to reduce the impact and probability of incidents, and improve response capabilities to minimize their impact
Activities required to protect the organisation which senior management will ensure are in place to support the business operations
Incident response
36
Intro to Sec Governance
Management will identify all applicable laws, regulations and standards and carry out activities to confirm the organisation and attain and maintain compliance
Activities required to protect the organisation which senior management will ensure are in place to support the business operations
Improved Compliance
37
Intro to Sec Governance
Management define objectives and allocate resources to develop a plan in the event of major business disruption
Activities required to protect the organisation which senior management will ensure are in place to support the business operations
Business Continuity and Disaster Recoery Planning
37
Intro to Sec Governance
Management will establish processes to measure key security events such as incidents, policy changes and violations, audits, and training
Activities required to protect the organisation which senior management will ensure are in place to support the business operations
Metrics
37
Intro to Sec Governance
The allocation of workforce, budget, and other elements to meet the security objectives
Activities required to protect the organisation which senior management will ensure are in place to support the business operations
Resource Management
37
Intro to Sec Governance
An effective security governance program will resul tin better strategic decisions in IT organisation that keep risks at an acceptably low level
Activities required to protect the organisation which senior management will ensure are in place to support the business operations
Improved IT Governance
37
Intro to Sec Governance
The 2 key results of an effective security governance program
Increased Trust
Customers, suppliers etc. trust the organisation more when they see security is managed effectively
Improved Reputation
Business community will hold the organisation in higher regard
37
Intro to Sec Governance
An organisations information security program needs to do what with the rest of the organisation
Align
37
Intro to Sec Governance
To be business aligned, people in the security program need to be aware of and understand the 5 following components
- Culture
- Asset Value
- Risk Tolerance (appetite)
- Legal Obligations
- Market Conditions
38
Intro to Sec Governance
The term used to define a scenario where individuals or groups bypass corporate IT and procure their own computing services putting the organisation at a greater risk of data leakage
Shadow IT
38
Intro to Sec Governance
The level of risk that an organisation is willing to accept while pursuing its mission, strategy, and objectives before taking action to treat the risk
Risk Appetite
