1.1 : Privacy and third Party Management

Question 1

What is privacy

Answer 1

Privacy is the protection of personal information from unauthorized disclosure, use, and distribution.

Question 2

Personal information

Answer 2

refers to a variety of elements about a private citizen, some of which are not well known,

Question 3

What organizations that collect personal information must do

Answer 3

Organizations that collect any of the previously mentioned items on behalf of customers or other constituents need to develop policies that define what the organization is permitted to do with this information.

Question 4

What to consider when outsourcing a service to a third party

Answer 4

a risk assessment should be performed to identify and characterize risks associated with this.
The use of any third-party organization should not be permitted to result in an increase of overall risk to an organization.

Question 5

Primary risk with a third-party provider

Answer 5

the service provider will have access to some of the organization’s sensitive information.

Question 6

Types of third -party access

Answer 6

• Physical access to hard copy business records
• Physical access to information systems
• Physical access to storage media such as hard drives, solid-state drives, backup tapes, and optical drives
• Logical access to information systems, sensitive data, or source code

Question 7

Risks associated with third party Access

Answer 7

• Theft of business records
• Exposure of business records to unauthorized parties • Alteration of business records
• Damage (both deliberate and accidental) to information systems hardware, software, or information • Failure to perform services in a timely manner
• Failure to perform services accurately • Failure to perform services professionally

Question 8

How to keep the level of risks low when given access to third party provider

Answer 8

By introducing countermeasures and compensating controls.

Requires that third-party provider protect data the same way the organization would do.

Question 9

Addressing Third-Party Security in Security Policy

Answer 9

An organization should have policies and processes in place to properly assess, measure, and monitor risks related to any third-party service provider.

Question 10

Measures that an organization would take to mitigate human resources -related risks

Answer 10

• Screening and background checks
• Job description
• Employment agreements
• Monitoring during employment
• Policy and Disciplinary

Question 11

What is a job decription

Answer 11

A job description is an employer’s formal statement to an employee that says, “This is what we expect and require of you to perform this job.”

Question 12

Expectation to include in the Job decription

Answer 12

• Name of the position - Job Title
• Requirements - Education, skills and work experience
• Duties and responsibilities - Tasks, projects, and other activities that the employee is expect to perform.

Question 13

What are included in the employment agreement

Answer 13

• Duties - of the position
• Roles and responsibilities - Job description
• Confidentiality - even after termination
• Compliance - laws, regulations and policies. Consequences for failing to comply must be stated.
• Termination - condition and circumstances by which the organization or the employee can server the agreement .

Question 14

What employers must do during employemnt

Answer 14

• Periodic renewal of employment agreements
• Repeat background checks
• Access changes when transferred - Remove access for the former position each time an employee is transferred from one position to another
• Awareness training

Question 15

Employees access to information systems and business premises after termination

Answer 15

All accesses should be immediately revoked

Question 16

what policies must contractors ant temporary worker subjects to

Answer 16

To the same policies that employees are required

Question 17

Computers involvement in crimes

Answer 17

• As a target of a crime - computers and its contents are the targets of a crime.
• As of Instrument in a crime - the computer used as a weapon.
• As support of a crime - Computers used to support criminal activities. (storage and transmission of stolen property, recordkeeping..)

Question 18

Social Engineer

Answer 18

usage of pretexting (pretending to be someone they aren’t) in order to get employees and private citizens to give up secrets that help them break into systems.

Question 19

script kiddies

Answer 19

Adolescents (kiddies) or simply inexperienced would-be hackers who obtain hacking tools (scripts) in order to break into computers for fun or just to pass the time.