8.2) Controls for information security (policies and procedures)

Question 1

In summer 2021, retail giant Amazon’s financial records revealed that officials in Luxembourg issued a €___ million ($877 million) for breaches of the GDPR. According to a blog post by cybersecurity vendor Tessian, the full reasons behind the fine haven’t yet been confirmed, but it is believed to involve cookie consent. Amazon is said to be appealing the fine, with a spokesperson stating, “There has been no ____ breach, and no customer data has been exposed to any third party.”

Answer 1

746
no

Question 2

Retail pharmacy group Dis-Chem has been found guilty of contravening various sections of the Protection of Personal Information Act (_______) after a cyber-attack compromised the personal records of more than ______ million South Africans last year. The Information Regulator has now given the retailer instructions to ensure people’s personal information is sufficiently safeguarded, or face a fine of up to R___ million or even imprisonment.

Answer 2

POPIA
Three
10

Question 3

What are information security controls?

Answer 3

Information security controls are measures and mechanisms put in place to protect the confidentiality, integrity, and availability of information assets.

Question 4

What role does information security controls play?

Answer 4

Information security controls play an indispensable role in safeguarding valuable information assets, assuring the CIA triad requirements are met.

Question 5

True or false, In the current relentless battle against cyber threats, organizations require a solid and advanced platform that empowers them to fortify their information security defenses effectively.

Answer 5

True

Question 6

What are the three primary categories of information secuirty controls? (3)

Answer 6

1. Preventive controls
2. Detective Controls
3. Response controls

Question 7

What are the types of preventive coontrols? (3)

Answer 7

1) Administrative controls
2) Process controls
3) IT solution

Question 8

What are administrative controls? (4)

Answer 8

• Developing policies and procedures [e.g., GDPR,POPIA]
• Offering information security training
• Creation of cybersecurity awareness culture
• Change controls and change management

Question 9

What are process controls? (4)

Answer 9

• User access control
• Penetration testing
• Backup and recovery plans
• Log analysis

Question 10

What are IT solution controls? (3)

Answer 10

• Anti-malware
• Network access controls
• Encryption

Question 11

What are the types of detective controls? (2)

Answer 11

1) Phyical security controls
2) Intrusion detection controls

Question 12

What are physical security controls? (3)

Answer 12

• Surveillance systems: installing CCTV cameras and other monitoring devices
• Locks and biometric systems
• Secured fences and Guards

Question 13

What are intrusion detection controls? (4)

Answer 13

• Network-based Intrusion Detection Systems (NIDS)
• Host-based Intrusion Detection Systems (HIDS)
• Anomaly Detection Systems (ADS)
• Hybrid Intrusion Detection Systems (HIDS)

Question 14

What are Network-based Intrusion Detection Systems (NIDS)

Answer 14

• Systems that monitor network traffic to identify real-time anomalies

Question 15

What are Host-based Intrusion Detection Systems (HIDS)?

Answer 15

Systems that installed on servers or workstations to detect unauthorized malicious behavior

Question 16

What are Anomaly Detection Systems (ADS)?

Answer 16

• Systems that use artificial intelligence and machine learning to detect anomalies in network traffic thereby creating a multi-layered protection.

Question 17

What are Hybrid Intrusion Detection Systems (HIDS)?

Answer 17

Systems that combines the outputs of an anomaly-based detector and a signature-based detector to detect DDoS attacks

Question 18

What are the types of response controls? (2)

Answer 18

• Computer Security Incident Response Teams (CSIRT)
• Chief Information Security Officer (CISO)

Question 19

What are Computer Security Incident Response Teams (CSIRT)?

Answer 19

• CSIRT, is a group of IT professionals that provides an
  organization with services and support surrounding the
  assessment, management and prevention of cybersecurityrelated emergencies
• The mission of CSIRT is to provide an immediate, effective, and skillful response to any unexpected incident with information security implications

Question 20

What are Chief Information Security Officer (CISO)? (2)

Answer 20

• CISO is a senior-level executive who is responsible for the security of an organization’s computer systems, databases, and cybersecurity
• As a response mechanism, the CISO role indludes:
• Develops information security strategies
• Oversees information security governance

Question 21

What policies identify personal information protection? (3)

Answer 21

• General Data Protection Regulation (GDPR)
• Protection of Personal Information Act No. 4 of
  2013
• Cybercrimes Act No. 19 of 2020

Question 22

The GDPR is comprehensive data ________ law enacted by
the European Union (EU) in May 2018

Answer 22

privacy

Question 23

What is the primary objective of the General Data Protection Regulation (GDPR)?

Answer 23

The primary objective of the GDPR is to harmonize data
protection regulations across the EU member
states, as well as to provide greater protection and
control over personal data for EU citizens.

Question 24

What are the principles of the GDPR? (8)

Answer 24

Question 25

What is the Protection of Personal Information Act No. 4 of 2013? (2)

Answer 25

• POPIA is a comprehensive data protection law enacted in South Africa
• It aims to regulate the processing of personal information by public and private bodies in order to protect the privacy rights of individuals

Question 26

What are the key principles of POPIA? (8)

Answer 26

Question 27

What is the Cybercrimes Act No. 19 of 2020? (2)

Answer 27

• Cybercrimes Act No. 19 of 2020 aims to address the evolving challenges posed by cyber threats and to strengthen the legal framework for combating cybercrimes in South Africa.
• The Act t also helps law enforcement to enforce the law and hopefully protect the people of South Africa from criminals.

Question 28

What are the key principles of the Cybercrimes Act No. 19 of 2020? (7)

Answer 28