Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CompTIA Security + > Anki - Organization Security 3 > Flashcards

Anki - Organization Security 3 Flashcards

1
Q

What is Personnel Management?

A

The practice of ensuring all of an organization’s internal and external personnel complies with policy.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What are the three phases of a Personnel Management Policy?

A

Recruitment
Operation
Termination

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What department is tasked with managing personnel?

A

HR

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What are some operational policies of personnel management?

A

Communication of policies to employees E.g.

  • Privilege management
  • Data handling
  • Incident response
  • Also enforcement of disciplinary measures
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What are 5 security tasks when onboarding a new employee?

A
  1. Background check
  2. Identity and access management (IAM)
  3. Sign an NDA
  4. Asset allocation (laptop)
  5. Training/policies
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What is Separation of Duties?

A

Separation of duties states that no one person should have too much power or responsibility.

It is a way to protect against inside threats.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What is Shared Authority? What is it an example of?

A

No single user is able to make changes on their own. At least two people must authorize the change.

An example of a Separation of Duties Policy.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What is Least Privilege? What is it an example of?

A

A user is granted sufficient rights to perform their job and no more. For critical tasks, duties are divided between several people.

An example of a Separation of Duties Policy.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What are mandatory vacations? Why are they useful?

A

Forced vacations - they are useful to discover any discrepancies in employee activity once they are away.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What is job rotation? Why is it useful?

A

Employees must rotate job roles.

E.g. Firewall Administrator or Access Control Specialist.

Prevents abuse of power, reduces boredom and enhances employee’s skills!

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What are the three processes for off-boarding an employee?

A
  • IAM - Disable user account and privileges
  • Retrieve company assets - keys, laptops etc.
  • Wipe personal assets of company data

Maybe also change credentials to shared security systems, if that person had access.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What is a conduct policy?

A

A policy that defines employee conduct and respect for privacy.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What is an AUP?

A

Acceptable Use Policy, or Fair Use Policy sets what someone is allowed to use a particular service or resource for.

E..g what a company laptop may be used for.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

How can allowing employees unrestricted access to the internet in a workplace be a problem?

A

Use of social networking and file sharing can put an organization at risk of:

  • virus infection
  • systems intrusion
  • lost work time
  • copyright infringement
  • defamation

The organization could be liable.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What should be included in an employee’s handbook?

A

What browser/email/social networking/P2P software is permitted for personal use.

And what penalties exist.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What are some issues with allowing personally owned devices or software in the workplace?

A
  • Data loss
  • Transport mechanism for malware
  • Software license violations
17
Q

What is a clean desk policy?

A

Employees desk must be free from documents to prohibit sensitive info being obtained by unauthorized staff or guests.

Challenging with whiteboard/flow charts etc.

18
Q

What are the three categories of acceptable workplace surveillance of employees?

A
  • Security Assurance
  • Monitoring Data
  • Physical Monitoring
19
Q

What is Security Assurance when referring to workplace surveillance?

A

Monitoring of data communications and employee behavior e.g. Check emails, CCTV to prevent theft

20
Q

What is Monitoring Data when referring to workplace surveillance?

A

Analyzing data communications to measure an employee’s productivity. E.g. Call center might track call frequency and duration

21
Q

What is Physical Monitoring when referring to workplace surveillance?

A

Recording employee’s movement and behavior within workplace. E.g. Drug testing, CCTV

22
Q

How should an organization handle an employee’s policy violation?

A

Follow a predefined incident response procedure

  • Assess if accidental or intentional
  • Determine severity
  • Decide on disciplinary action or re-training
  • If serious, perform a forensic investigation
23
Q

What could happen if an employee faces disciplinary action/termination as a result of a policy violation?

A

Adverse Action - the employer is accused of discriminating against employee.

To prevent this, the policy violation must be backed up by evidence, and must be shown that the same policy applies equally to all employees.

24
Q

Why is Software License Compliance important?

A
  • Availability, Software vendor may suspend all licenses that are non-compliant
  • Integrity, exposes an org to large fines/penalties
25
Q

What are MLAs?

A

Master License Agreements (MLAs)

26
Q

What things should be frequently audited for software license compliance?

A

Any field devices - laptops, smartphones, tablets

Clients/Servers or VMs

27
Q

What is an SLC audit?

A

Software License Compliance Audit

Where the vendor (or a third party) may access a company’s systems to audit license usage.

28
Q

Why is it important to comply with Open Source Licensing?

A

Open source code has specific licenses, and the final product that uses the code must adhere.

29
Q

What is Client Access Type Licensing? What are the drawbacks.

A

Software licensing purchased on a per-seat or per-user model.

Companies may over-allocate seats and break the license agreement
Challenges when managing software over multiple regions and remote devices.

30
Q

Why can having too many security procedures be a problem for organizations? What is better?

A

Employees may adopt unsecure behavior e.g.

  • reusing passwords
  • users may just click through security warnings without reading them

Better to educate users about security risks and monitor behavior

31
Q

What things should be included in security awareness training?

A
  • Overview of security policies and penalties for non-compliance
  • Incident identification and reporting procedures
  • Site security procedures, safety drills, escorting guests, use of secure areas, and use of personal devices.
  • Data handling, PII, backup, encryption
  • Password and account management plus security features of PCs and mobile devices
  • Awareness of social engineering/malware/phishing etc
  • How to securely use browsers and email clients
  • Appropriate use of Internet access and social networking sites.
32
Q

What is role based training?

A

A system for identifying staff performing security sensitive roles - and the level of training they require.

33
Q

What roles require advanced security training?

A

IT and networking
Management
Software Development
Accounts

34
Q

What is a System Owner role responsible for, and therefore need to be trained in?

A

Responsible for designing and planning computer network and database systems.

Needs training in IT security and network design

35
Q

What is a Data Owner role responsible for, and therefore need to be trained in?

A

Responsible for data guardianship (possibly in conjunction with data stewards).

Needs training in compliance issues and data classification systems.

36
Q

What is a System Administrator/Data Custodian role need to be trained in?

A

Technical understanding of access controls and privilege management systems.

37
Q

What do Standard Users need to be trained in?

A

Security awareness training.

Product- or sector-specific training.

38
Q

What do Privileged Users need to be trained in?

A
  • Training on data management and PII

- Relevant regulatory or compliance frameworks

39
Q

What do Executive Users need to be trained in?

A
  • Good security awareness to avoid whale phishing and spear phishing
  • Compliance and regulatory issues
  • Secure system architecture
  • Secure supply chain management

CompTIA Security + (15 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions