1.2

Question 1

gap analysis

Answer 1

a comprehensive appraisal that helps organizations determine the
difference between the current state of their information security to specific industry requirements guidance and best practices

Question 2

why must you conduct gap
analysis?

Answer 2

To know where you are and where you need to go as a secure organization

Question 3

common security gaps:

Answer 3

• Weak and/or shared credentials
• Lack of tested patch management
• Violation of the least privilege principle
• Having no/unenforced acceptable use policies
• Poor physical security
• Configuration and deployment errors due to lack of change and configuration management
• Poor visibility and lack of proper auditing