02. Standards and Frameworks

Question 1

Standards and Frameworks

PCI-DSS

Answer 1

Payment Card Industry Data Security Standard

• Standard required if handling debit or credit cards
• it is a standard, but REQUIRED

Question 2

Standards and Frameworks

OCTAVE

Answer 2

Operationally Critical Threat, Asset, and Vulnerability Evaluation

• SELF DIRECTED Risk Management

Question 3

Standards and Frameworks

COBIT

Answer 3

Control Objectives for Information and related Technology

• GOALS for IT
• Stakeholder needs mapped to IT related goals
• REMEMBER COBIT - IT for IT
• COBIT - Operational Level
• COSO - Oganisational Level

Question 4

Standards and Frameworks

COSO

Answer 4

Committee Of Sponsoring Organisations

• GOALS for entire organisation
• REMEMBER COSO - O at the end for entire organisation
• COBIT - Operational Level
• COSO - Oganisational Level

Question 5

Standards and Frameworks

ITIL

Answer 5

Information Technology Infrastructure Library

• ITSM - IT Service Management
• Frameworks and best practices to align IT services with businesses needs

Question 6

Standards and Frameworks

FRAP

Answer 6

Facilitated Risk Analysis Process

• Analysed one business unit, application or system at a time
• Focused on one system at a time
• Brainstorming with INTERNAL employees

Question 7

Standards and Frameworks

ISO 27001

Answer 7

• Establish, Implement, Control and Improvement of ISMS
• Plan, Do Check, Act

• Organisation can be certified in ISO 27001
• Shows organisation adheres to industry best practices

Question 8

Standards and Frameworks

ISO 27002

Answer 8

• Practical Advice; How to implement security controls
• 10 Domains used for ISMS

• More indepth than ISO 27001
• Cannot be certified against
• Practical implementation

Question 9

Standards and Frameworks

ISO 27004

Answer 9

Metrics and measuring success of ISMS

Question 10

Standards and Frameworks

ISO 27005

Answer 10

Standards Based Approach to Risk Management

Question 11

Standards and Frameworks

ISO 27799

Answer 11

Directives on how to protect PHI

Protected Health Information

• Key word PROTECTED Health Information

Question 12

Standards and Frameworks

Defense in Depth

Answer 12

Layered Defense

• Implement multiple overlapping security controls to protect an asset
• Applies to physical, administrative, and logical controls
• No single security control secures an asset
• Defense in Depth improves organisations CIA

EXAMPLE;
* Getting through locked doors, security guards, locked cage
* Getting through IPS, Firewall, switches

Question 13

Standards and Frameworks

CIA

Answer 13

1. Confidentiality
2. Integrity
3. Availbility