5.2 Importance of regulations, standards, frameworks that impact security posture

Question 1

Security regulation & standards: what is GDPR?

Answer 1

Data protection & privacy for individual in EU.

Data: name, address, photo, email address, bank details, posts on social media networking websites, medical info, computer’s IP etc

Question 2

Security regulation & standards: what is PCI DSS?

Answer 2

Payment Card Industry Data Security Standard is a standard for protecting credit cards

Question 3

Security regulation & standards: what are the controls of PCI DSS?

Answer 3

6 control objectives:
- Build and maintain a secure network & systems
- Protect cardholder data
- Maintain a vulnerability management program
- Implement strong access control measures
- Regularly monitor and test networks
- Maintain an information security policy

Question 4

Security frameworks: what is the CIS CSC?

Answer 4

Center for Internet Security Critical Security Controls for Effective Cyber Defense

Question 5

Security frameworks: what is the NIST RMF?

Answer 5

NIST Risk Management Framework helps to handle data. It’s a 6 step process:
- Categorize - define the env
- Select - pick appropriate controls
- Implement - Define proper implementation
- Assess - determine if controls are working
- Authorize - make a decision to authorize a system
- Monitor - check for ongoing compliance

Question 6

Security frameworks: what is the NIST CFS?

Answer 6

NIST Cybersecurity Framework with framework core (identify, protect, detect, respond, recover), framework implementation, framework profile (alignment of standards, and practices to the framework core)

Question 7

Security frameworks: what is the ISO/IEC?

Answer 7

• ISO/EIC 27001: Information Security Management System
• ISO/EIC 27002: Practice for information security controls

Question 8

Security frameworks: what is the SSAE SOC 2?

Answer 8

Audit standard focuses on topic such as firewall, intrusion detection, and multi factor authentication

Question 9

Security configuration: where to find hardening guides ?

Answer 9

Hardening guides are specific to the software or OS, so you can get it from the manufacturer or on internet

Question 10

Security configuration: how to harden a web server?

Answer 10

• Manage permission
• Configure SSL: manage and install certificates
• Log files: monitor access and error logs

Question 11

Security configuration: how to harden OS?

Answer 11

• Ensure OS is updated
• Set up password complexity and permission
• Limit network access
• Monitor antivirus/ malware

Question 12

Security configuration: how to harden network infrastructure?

Answer 12

• Configure authentication (don’t use defaults credentials)
• Check with the manufacturer for security updates