04. Info Sec Gov: Policies, procedures, guidelines, and frameworks

Question 1

Policies, procedures, guidelines, and frameworks

Policies

Answer 1

• Mandatory
• High Level, non specific

• May contain patches, updates, strong encryption
• Will not be specific to OS or encryption type, vendor technology
• Strategic, typically delivered by C-Level

POLICIES, STANDARDS, GUIDELINES, PROCEDURES

Question 2

Policies, procedures, guidelines, and frameworks

Standards

Answer 2

• Mandatory
• Specific use of technology

• All windows laptops will be windows 10 for example, 64bit, 8 gig mem
• Management level typically involved here
• Tactical

POLICIES, STANDARDS, GUIDELINES, PROCEDURES

Question 3

Policies, procedures, guidelines, and frameworks

Guidelines

Answer 3

• Non-Mandatory
• Recommendations, discretionary

• Suggests how something could be implemented
• Tactical

POLICIES, STANDARDS, GUIDELINES, PROCEDURES

Question 4

Policies, procedures, guidelines, and frameworks

Procedures

Answer 4

• Mandatory
• Low level step by step

• Will contain OS and encryption type, vendor technology
• Tactical

POLICIES, STANDARDS, GUIDELINES, PROCEDURES

Question 5

Policies, procedures, guidelines, and frameworks

Baseline

Answer 5

• Mandatory
• Minimum requirements

• Tactical

POLICIES, STANDARDS, GUIDELINES, PROCEDURES

Question 6

Policies, procedures, guidelines, and frameworks

Personnel Security

Answer 6

Users pose largest security risk

Question 7

Policies, procedures, guidelines, and frameworks

Personnel Security:
Awareness

Answer 7

Change user behaviour

Question 8

Policies, procedures, guidelines, and frameworks

Personnel Security:
Training

Answer 8

Provide users with skillset

Question 9

Policies, procedures, guidelines, and frameworks

Personnel Security:
Hiring Practices

Answer 9

Background checks

Question 10

Policies, procedures, guidelines, and frameworks

Personnel Security:
Employee Termination Practices

Answer 10

Coach and Train employees before firing
Coordinate with HR

Question 11

Policies, procedures, guidelines, and frameworks

Personnel Security:
Vendors, Consultants, Contractor

Answer 11

• Ensure outsiders are train how to handle data
• Their systems need to be secure in accordance with our policy

Question 12

Policies, procedures, guidelines, and frameworks

Personnel Security:
Outsourcing and Offshoring

Answer 12

• A 3rd party doing all or in part your IT work
• Perform thorough risk anlysis
• Offshoring - may not have to comply with same data protection standards

• Outsource - someone else close by
• Offshoring - someone else far away