5.3 Organizational Security Policies

Question 1

Define acceptable use policy

Answer 1

Provides rules for how organization technology can be used

Question 2

Security benefit of job rotation

Answer 2

Prevents discovery of security risks by one person doing a specific task for too long

Question 3

Security benefit of mandatory vacations (3)

Answer 3

1. Allows another person to make sure everything is functioning as expected
2. Limits ability of one person to commit a fraud
3. Not common, typically only found in very high security environments

Question 4

Define separation of duties

Answer 4

Completing a task requires the knowledge of 2 people and helps prevent breaches initiated by a single person

Question 5

Security benefit of clean desk policy

Answer 5

Employees must secure sensitive information before leaving their desk to prevent access to it by an unauthorized party

Question 6

Define capture the flag

Answer 6

Competition for red team to practice their skills and try to breach a system

Question 7

Security risks with third-parties (4)

Answer 7

1. Must evaluate the security of any third-parties provided information or access
2. Vendors
3. Supply chain
4. Business partners

Question 8

Define memorandum of understanding (MOU)

Answer 8

An informal letter that is not a binding contract but sets forth expectations of both parties

Question 9

Define measurement systems analysis (MSA) (2)

Answer 9

1. Used as part of a quality management system, such as Six Sigma
2. A process for ensuring that the processes that produce data used as the basis for important decisions is accurate

Question 10

Define business partnership agreement (BPA) (4)

Answer 10

A document outlining the details of business partnership including:
1. Owners stakes
2. Financial stakes
3. Decision makers
4. Contingency plans

Question 11

Define end of life (EOL)

Answer 11

A vendor stops selling a product but continues to provide updates & patches

Question 12

Define end of service life (EOSL)

Answer 12

End of life except vendor also stops providing updates & patches

Question 13

Define steward and data management (2)

Answer 13

1. Organizations must have processes and procedures in place to manage data securely and in accordance with laws/regulations
2. Steward is person/group in charge of this data governance and classification

Question 14

Define governance relative to data management

Answer 14

Setting procedures and policies regarding organizational data including classification and retention

Question 15

Define classification relative to data management

Answer 15

Classifying data that is subject to laws/regulations to ensure proper handling by the organization

Question 16

Define retention relative to data management

Answer 16

Ensuring that data is retained in accordance with laws/regulations and the organization’s requirements