Chapter 11 Implementing policies to mitigate risks Flashcards
Implementing policies to mitigate risks
What are the general policy categories?
Personnel management, data protection, training for personnel to raise security awareness, mitigate risk and reduce incidents.
When it comes to computers and network what kind of policy is it?
Personnel policy, acceptable use policy, how to use them, responsibilities.
What is the purpose of mandatory vacations? what type of policy is it? What other similar ideas achieve the same goal?
Personnel policy, it helps to detect when employees are involved in malicious activity such as fraud or embezzlement. Other: Separation of duties (>1 required for certain jobs) and job rotation
Only having the rights that you need to perform tasks, nothing more.
Principle of least privilege. A personnel policy
An attacker sees an important document on a workers desk as he walks past. He takes it and this isn’t found out til much later in the day. What would have prevented this?
Personnel policy of clean desk spaces. Protects sensitive data.
During the interview process you know there is something important to inform the participant of, what does policy suggest you need to do before they are hired?
Background checks.
What is on and offboarding?
Onboarding = getting individuals access to organization’s resources AFTER hiring.
Offboarding: removing the access when they leave the company, and collecting any equipment
Using a personal facebook account has implications for work? true or false? why?
True, social media analysis, can affect work, work can monitor employee activity, which can also occur during background checks.
What are the 3 different types of third party agreements?
SLA - service level agreement, stipulates performance expectations, minimum up and down time. etc. $$ penalties.
MOU - memorandum of understanding - indicates their intention to work together on a common goal. Less formal than SLA. Doesn’t include penalties ($$)
BPA - Business partners agreement (BPA) - written agreement, details relationship between business partners, identifies shares of profits or losses partners take, their responsibilities, etc.
Security incident vs data breach
SI - any adverse event that affects confidentiality, integrity or availability of data/systems.
Data breach - unauthorized entities access data (attacker ).
A formal, coordinated plan that personnel can use when responding to a security breach? and what are 3 things it might include? general description
Incident response plan. Incident plans depending on incident type (real vs suspected), a response team outline, roles and responsibilities of each member.
What is the purpose of a communication plan within an incident response plan?
To communicate issues related to an incident. Created before an incident. Should inclide 1) First responders 2) Internal communication (Senior staff) 3) Reporting requirements (to external entities, if applicable) 4) external communication (Who can say what to media etc, or refer internally) 5) Law enforcement (help, security tools etc) 6) Customer communication (inform of breach etc)
What are some common phases of an incident response process?
Preparation, identification, containment, eradication, recovery, lessons learned.
What is involved within the preparation stage of an incident response process?
Preparation - guidance to personnel on how to respond (establishing and maintaining an incident response plan and procedures to prevent - such as security controls
If an incident occurs, a response process tells us we first need to?
validate whether it is actually a security incident. This is identification, false positive? or real?
What is and which step is isolating an incident?
containment step 3, protect critical systems while maintaining business operations. A device might be quarantined or removed from the network.
After isolating, what step is necessary to take?
eradication, removing all componenets from the attack, such as malware etc. Or deleting/disabling all involved accounts.
What are the last two steps of an incident response process?
Recovery and lessons learned. We return all affected systems back to normal operation, verify it. Patch any vulnerabilities etc.
Then perform a reflection/review, how does this modify things in the future or do we need additional training etc.
What can SOAR tools do? why might they be used by organizations?
Secure orchestration, automation and response. They can respond automatically, freeing up time from other staff. It is a combination of tools to detect and respond to suspicious activity. This can be from phishing emails, network traffic etc. It’s like a centralized place for all many security tools that work together. Uses a playbook and runbook)
Playbook vs runbook
playbook (depends what it is on) for example, a PB on phishing - Checklist of what to check. It is general guidelines for each thing it is associated with.
A runbook incluydes the technical details, implementing the guidelines using tools available. Might quarantine or delete a suspected phishing email, or forward it’s attachment to a sandbox and run it to check. Runbook automates or it might assign it to an administrator to investigate.
