Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CompTIA Security Notes > CH30 Policies and Procedures > Flashcards

CH30 Policies and Procedures Flashcards

1
Q

What are policies?

A

Policies defines the role of security in an organization and establishes the desired and state of the security program

For the exam : Policies are generic. Procedures are specific

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What are Organizational Policies?

A

provide general direction and goals, a framework to meet the business goals, and define the roles, responsibilities, and terms

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What are System-specific policies?

A

address the security needs of a specific technology, application, network, or computer system

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What are Issue-specific policies?

A

built to address a specific security issue, such as email privacy, employee termination procedures, or other specific issues

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What are 3 Information Security policy categories?

A
  1. Regulatory – mandatory standards and laws that are going to affect the organization.
  2. Advisory – guidance on what is and what is not considered acceptable activity. (Ex: Acceptable Use Policy – AUP)
  3. Informative – focuses on a certain topic and it’s designed to be educational in nature.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What are Procedures in regards to Policies and Procedures ?

A

detailed step-by-step instructions that are created to ensure personnel can perform a given action

For the exam : Policies are generic. Procedures are specific

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What is Data Classifications?

A

Category based on the value to the organization and the sensitivity of the information if it were to be disclosed.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What is Sensitive Data?

A

Any information that can result in a loss of security, or loss of advantage to a company, if accessed by unauthorized persons

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What are the 4 classification levels of Commercial business ?

A

a. Public – has no impact to the company if released and is often posted I the open-source environment.

b. Sensitive – might have a minimal impact if released.

c. Private – contains data that should only be used within the organization

d. Confidential – highest classification level that contains items such as trade secrets, intellectual property data, source code, and other types that would seriously affect the business if disclosed.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What are the 5 classification levels of Government Organization?

A

a. Unclassified – can be released to the public

b. Sensitive but Unclassified – items that wouldn’t hurt national security if released but could impact those whose data is contained in it.

c. Confidential – Data that could seriously affect the government if unauthorized disclosure were to happen.

d. Secret – data that could seriously damage national security if disclosed.

e. Top Secret – data that could gravely damage national security if it were known to those who are not authorized for this level of information

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Who is Data Owner?

A

a senior (executive) role with ultimate responsibility for maintaining the confidentiality, integrity, and availability of the information asset. He is responsible for labeling the asset and ensuring that it is protected with appropriate controls

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Who is Data Steward?

A

a role focused on the quality of the data and associated metadata

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Who is Data Custodian?

A

a role responsible for handling the management of the system on which the data assets are stored.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Who is Privacy Officer?

A

a role responsible for the oversight of any PII/SPI/PHI assets managed by the company

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What is PII

A

PII = Personally Identifiable Information

a piece of data that can be used either by itself or in combination with some other pieces of data to identify a single person. (Ex: full name, driver license number, social security number, date of birthday, places of birth, biometric data, financial account number, address, email address, social media usernames)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What is Privacy Act of 1972 ?

A

Affects U.S government computer systems that collects, stores, uses, or disseminates personally identifiable information.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What is Health Insurance Portability and Accountability Act (HIPAA) ?

A

Affects healthcare providers, facilities, insurance companies, and medical data clearing houses

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What is Sarbanes-Oxley (SOX) ?

A

affects publicly-traded U.S. corporations and requires certain accounting methods and financial reporting requirements

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What is Gramm-Leach-Bliley Act (GLBA) ?

A

affects banks, mortgage companies, loan offices, insurance companies, investment companies, and credit card providers. Prohibits sharing of financial information of an individual with any third parties

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What is Federal Information Security Management (FISMA) Act of 2002 ?

A

Requires each agency to develop, document, and implement an agency-wide information systems security program to protect their data

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

What is Payment Card Industry Data Security Standard (PCI DSS)?

A

a contractual obligation. An agreement that any organization who collects, stores, or processes credit card information for a customer to follow

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

What is Help America Vote Act (HAVA) of 2002

A

provides regulations that govern the security, confidentiality, and integrity of the personal information collected, stored, or processed during the election and voting process

23
Q

What is SB 1386?

A

requires any business that stores personal data to disclose a breach. If their PII got hacked, they must notify the affected people about the data breach

24
Q

Privacy vs Security

A

Security controls focus on the CIA attributes of the processing system.
Ex: if I say this data is encrypted, then that is a security control. That’s confidentiality.

If I say this data has been hashed so I have a digital finger print of it, that tells me we have integrity of it.

Privacy – a data governance requirement that arises when collecting and processing personal data to ensure the rights of the subject’s data.

25
Q

What is General Data Protection Regulation (GDPR)?

A

Personal data cannot be collected, processed, or retained without the individual’s informed consent. GDPR also provides the right for a user to withdraw consent, to inspect, amend, or erase data held about them. GDPR requires data breach notification within 72 hours

26
Q

What is Deidentification?

A

methods and technologies that remove identifying information from data before it is distributed. It is often implemented as part of database design

27
Q

What is deidentification method called Data Masking ?

A

a deidentification method where generic or placeholder labels are substituted for real data while preserving the structure or format of the original data

28
Q

What is deidentification method called Tokenization?

A

a deidentification method where a unique token is substituted for real data

29
Q

What is deidentification method called Aggregation/Banding?

A

deidentify the people by gathering the data and generalizing it to protect the individuals involved. (ex : out of 100 people, 90 people didn’t have any effect)

30
Q

What is deidentification method called Reidentification?

A

an attack that combines a deidentified dataset with other data sources to discover how secure the deidentification method is. anonymization doesn’t work if you can look through the clues and find who the person was.

31
Q

What is Privacy policies?

A

govern the labeling and handling of data

32
Q

What is AUP?

A

AUP = Acceptable Use Policy

Defines the rules that restrict how a computer, network, or other systems may be used. (Ex : No gaming while at work)

33
Q

What is Change Management Policy?

A

Defines the structured way of changing the state of a computer system, network, or IT procedure. It makes sure that you’re going to get the changes that you want in a secure and methodical manner.

34
Q

What is Separation of Duties?

A

preventative type of administrative control

35
Q

What is Job Rotation ?

A

different users are trained to perform the tasks of the same position to help prevent and identify fraud that could occur if only one employee had the job

36
Q

What is Onboarding and Offboarding policy?

A

Dictates what type of things need to be done when an employee is hired, fired, or quits

37
Q

What is Due Diligence ?

A

Ensuring that IT infrastructure risks are known and managed properly

38
Q

What is Due Care?

A

Mitigation actions that an organization takes to defend against the risks that have been uncovered during due diligence

39
Q

What is Due Process?

A

a legal term that refers to how an organization must respect and safeguard personnel’s rights.

For the exam : Due process is used to protect a person from the government, but it can also protect your organization from frivolous lawsuits

40
Q

What is NDA?

A

NDA = Non-disclosure agreement (NDA)

agreement between 2 parties that defines what data is considered confidential and cannot be shared outside of the relationship. It is often used by organizations to protect their intellectual property.

NDAs are a legally binding contract

41
Q

What is MOU?

A

MOU = Memorandum of Understanding

a non-binding agreement between two or more organizations to detail an intended common line of action. It is often referred to as a letter of intent. MOUs can be between multiple organizations. However, it is not legally binding

42
Q

What is SLA?

A

SLA = Service-Level Agreement

an agreement concerned with the ability to support and respond to problems within a given timeframe and continuing to provide the agreed upon level of service to the user

43
Q

What is ISA?

A

ISA = Interconnection Security Agreement

an agreement for the owners and operators of the IT systems to document what technical requirements each organization must meet

44
Q

What is BPA?

A

BPA = Business Partnership Agreement

Conducted between two business partners that establishes the conditions of their relationship. It can also include security requirements

45
Q

What is Degaussing process in regards to disposal policies?

A

exposes the hard drive to a powerful magnetic field which in turn causes previously-written data to be wiped form the device

46
Q

What is Purging (Sanitizing) in regards to disposal policies?

A

act of removing data in such a way that it cannot be reconstructed using any known forensic techniques

47
Q

What is Clearing in regards to disposal policies?

A

removal of data while a certain amount of assurance that it cannot be reconstructed

48
Q

What are 4 IT Security Frameworks?

A
  1. Sherwood Applied Business Security Architecture (SABSA) – risk driven architecture. It seeks to consider the security problem by thinking about the what, where, when, why, who and how of a problem. They think about this as it intersects with six different layers : The operational, component, physical, logical, conceptual, and contextual layers.
  2. Control Objectives for Information and Related Technology (COBIT) – A security framework that divides IT into four domains : Plan and Organize, Acquire and Implement, Deliver and Support, and Monitor and Evaluate.
  3. NIST SP 800-53 – a security control framework developed by the Dept. of Commerce. Each control is placed into one of three categories : technical, operational, or management.
  4. Information Technology Infrastructure Library (ITIL) – focuses on service operations and security of your network. It is the de facto standard for IT service management. It also includes all sorts of other service based connections that we have with our organizations to provide value to our end users.

For the exam : you’re not going to be asked a lot of questions about frameworks. But you should know that there are frameworks that exist such as SABSA, COBIT, the NIST special publications, ISO 27000, and ITIL. Know that we use frameworks as a basis for our policies, our procedures, and our standards

49
Q

What is Center for Internet Security (CIS) ?

A

Consensus-developed secure configuration guidelines for hardening (benchmarks) and prescriptive, prioritized, and simplified sets of cybersecurity best practices (configuration guides)

50
Q

Risk Management Framework (RMF) ?

A

a process that integrates security and risk management activities into the system development life cycle early on to security control selection and specification that considers effectiveness, efficiency, and constraints due to applicable laws, directives, Executive Orders, policies, standards, or regulations.

RMF was developed for the deferral government’s use.

For the exam : Just know that Risk management framework is made by NIST and it’s used in federal government systems

51
Q

What is Cybersecurity Framework (CSF)?

A

Cybersecurity Framework (CSF). – a set of industry standards and best practices created by NIST to help organizations manage cybersecurity risks.

CSF has 5 basic functional areas
1. Identify
2. Protect
3. Detect
4. Respond
5. Recover

For the exam : Just know that CSF, the Cyber Security Framework is made by NIST. Know 5 category functional areas

52
Q

What is ISO 27001?

A

International standard that details requirements for establishing, implementing, maintaining and continually improving an information security management system (ISMS).

For the exam : Just know that this is a basic procedure for cybersecurity, and it is an international standard.

53
Q

What is SOC?

A

SOC = SYSTEM and Organization Controls

a suite of reports produced during an audit which is used by service organizations to issue validated reports of internal controls over those information systems to the users of those services.

CompTIA Security Notes (32 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions