Apply Security Governing Principles

Question 1

What is abstraction?

Answer 1

Abstraction define what types of data and object can contain, what types of functions can be performed on or by that object.

Question 2

What is a Tactical Plan and give examples?

Answer 2

Midterm plan developed to provide more details on accomplishing the goals set forth in a strategic plan, Examples: acquisition plans, hiring plans, budget plans, maintenance plans

Question 3

What is an Operational Plan, how often should it be updated and give examples?

Answer 3

Short-term, highly detailed, based on strategic and tactical plans. Must be updated often. Examples are: training plans, system deployment plans, and product plans

Question 4

What is a strategic plan, how long can it stay in effect and what should it include?

Answer 4

Long-term plan that is fairly stable, defines organization’s security purpose. Lasts about 5 years if maintained and updated. Strategic plan should include a risk assessment.

Question 5

What is the main purpose of change management?

Answer 5

Prevent unwanted reductions in security, changes are subject to documentation and auditing.

Question 6

What are the 7 major steps in creating a data classification scheme?

Answer 6

1. Identify custodian and define their responsibilities
2. Specify the evaluation criteria and how the information will be classified and labeled
3. Data owner classifies and labels each resource
4. Document exception to classification policy and integrate them into evaluation criteria
5. Select the security controls that will be applied to each classification level
6. Specify procedures for resource declassification and and transferring custody of a resource to external entity
7. Create and enterprise-wide awareness program to instruct all personnel about the classification system

Question 7

What are the five levels of military/government classification?

Answer 7

U.S. Can Stop Terrorism
Top Secret
Secret
Confidential
Sensitive but Unclassified
Unclassified

Question 8

What are the private sector classification levels?

Answer 8

Confidential
Private
Sensitive
Publ

Question 9

What is the role of the Security Professional (aka CIRT team)?

Answer 9

Writes and implements security policy,

Question 10

What is the role of the Senior Manager?

Answer 10

Responsible for security and protection of assets- must sign off on all policy issues

Question 11

What is the role of the Data Owner

Answer 11

Responsible for classifying information and protection to be applied

Question 12

What is the role of the Data Custodian?

Answer 12

Responsible for implementing the prescribed protections prescribed by Senior management and the security policies

Question 13

What is a Data User and what are their responsibilities?

Answer 13

Any user that has access to the secured system, tied to their work (least Privileges). Must follow rules/procedures, security policies, etc.

Question 14

What is the role of the Auditor?

Answer 14

Responsible for reviewing and verifying that the security policy is properly implemented and the security solutions are adequate

Question 15

What are the principles of COBIT 5 (by ISACA)?

Answer 15

1. Meet stakeholder needs
2. Cover enterprise from end to end
3. Apply a single, Integrated framework
4. Enable a holistic approach
5. Separate Governance from Management

Question 16

Define Due Care?

Answer 16

Reasonable care to protect the organization

Question 17

Define Due Diligence

Answer 17

Practicing the activities that maintain due care effort

Question 18

What are the three types of security policies?

Answer 18

Regulatory, Advisory and Informative

Question 19

Define a security Guideline

Answer 19

recommends how standards and baselines are implemented and are customizable

Question 20

Give some examples of Security Baselines?

Answer 20

NIST, Trusted Computer System Evaluation Criteria (TSEC), Information Technology Security Evaluation (ITSEC)

Question 21

What is a Security Procedure?

Answer 21

Detailed step-by-step document that describes the exact actions necessary to implement a specific security mechanism, control or solution

Question 22

What are the 4 components of security policies from Largest to smallest contributor?

Answer 22

Procedures, Guidelines, Standards, Policies