3.5

Question 1

Whats Privileged user agreement?

Answer 1

It’s an agreement between the company and the admin. a Network administrator has access to almost everything but hes expected to use non-privileged methods when appropriate. But admin needs to use privileged access only for assigned duties and sign an agreement.

Question 2

What are password policies?

Answer 2

It’s a Written policy (all passwords expire every 30 days, 60 days, etc). Critical systems might change more frequently but the recovery process should not be trivial.

Question 3

What is on-boarding?

Answer 3

It’s the policy of bringing a new person into the organization. In this process the IT agreements need to be signed. Then a new account needs to be created that associates the user with the proper groups and departments and then provide the required IT hardware.

Question 4

Whats off-boarding?

Answer 4

These are the process to go through when someone is no longer with a company. These processes are pre-planned and usually that user gets deactivated since they might have important info under that account.

Question 5

Why is licensing restriction important?

Answer 5

There are a lot of licenses which use different methods to renew. Everything works great until a license gets expired and sometimes that can cause issues with integrity.

Question 6

What are International export controls?

Answer 6

These are the rules and policies set not only on shipment if physical items, but also the transfer of software or info. These laws need to be checked withe legal team.

Question 7

Whats DLP?

Answer 7

(Data Loss Prevention) These will be policies that dictate how your organization will be handling social security numbers, credit card numbers, or any other type of personally identifiable information. Many organizations will deploy data loss prevention technologies on their servers and their networks to watch for this data going across the network.

Question 8

What are remote access policies?

Answer 8

Policies to define the management of remote access for everyone including the third party access when they are not in the building. They require very specific technical requirements.

Question 9

What are security incidents?

Answer 9

These are policies that specifies the following:

1. how is the incident identified?(alarming, alerting, automated monitoring)
2. How is the incident categorized?
3. Who responds to an incident?
4. What process is followed?(formal process)

Question 10

Whats the BYOD policy?

Answer 10

(bring your own device/technology) Policies in regard to employee owns the device but that device needs to meet the company’s requirements, but its difficult to secure.

Question 11

Whats AUP?

Answer 11

(Acceptable use policies)

1. Whats acceptable use of company assets?
2. Covers many topics like internet use, telephone use, computers and mobile devices.
3. These policies are used by an organization to limit legal liability.

Question 12

Whats NDA?

Answer 12

(non-disclosure agreement) It is used to prevent the use and dissemination of confidential information. It can be Internal(by the company we are working in) or external(third party).

Question 13

Whats a system life cycle?

Answer 13

Policies that explain the management of asset disposal and it can sometimes become a legal issue. We dont want critical info. in the trash so security of recycling becomes a concern.

Question 14

What are safety procedures and policies?

Answer 14

policies that define the following:

1. Equipment safety
2. Personal safety
3. Handling of toxic waste
4. refer to MSDS/SDS
5. Local government regulations