Chapter 11 - Implementing Policies to Mitigate Risks Flashcards
Separation of duties
prevents any single person or entity from controlling all the functions of a critical or sensitive process by dividing tasks between employees. Helps prevent potential fraud such as a single person printing and signing checks
Job rotation
a concept that has employees rotate through different jobs to learn the processes and procedures in each job; it helps prevent or expose dangerous shortcuts or even fraudulent activity. People would understand there is going to be some oversight if different people are rotating in and out of a certain role.
Supply chain
includes all the elements required to produce and sell products and services, and your supply chain can become an attack vulnerability.
Vendor diversity
policy that provides cybersecurity resilience. Using more than one vendor for the same supply reduces the organization’s risk if that vendor can no longer provide the product or service.
EOL
End of life
Generally refers to the date when a product will no longer be available for sale, ie a product’s shelf life
EOSL
End of service life
indicates the date when you expect a lack of vendor support because vendors no longer create patches or upgrades to resolve vulnerabilities for the product.
SLA
Service level agreement
Ab agreement between a company and a vendor that stipulates performance expectations, such as minimum uptime and maximum downtime levels. Used when contracting services from service providers such as ISPs, and many SLAs include a monetary penalty if the vendor cannot deliver.
MOU
Memorandum of understanding
Sometimes called a memorandum of agreement (MOA), expresses an understanding between 2 or more parties indicating their intention to work together toward a common goal. Less formal than an SLA and does not include monetary penalties.
BPA
Business partners agreement
A written agreement that details the relationship between business partners, including their obligations towards the partnership. Can help settle conflicts when they arise.
MSA
Measurement systems analysis
Evaluates the processes and tools used to make measurements. Uses various methods to identify variations within a measurement process that can result in invalid results. A measurement system should produce the same values when measuring the same sample, otherwise it results in inaccurate data.
Incident response process
- Preparation
Occurs before an incident and provides guidance to personnel on how to respond to an incident, including establishing the incident response plan. - Identification
All events aren’t security incidents, so when a potential incident is reported, personnel take the time to verify it is an actual incident. - Containment
After identifying an incident, security personnel attempt to isolate or contain it and protect critical systems while maintaining business operations. - Eradication
After containing the incident, it’s often necessary to remove components from the attack, such as malware installed on systems. May need to delete or disable compromised accounts. - Recovery
Admins return all affected systems to normal operation and verify they are operating normally. Might include rebuilding systems from images, restoring data from backups, and installing updates. Also need to remove vulnerabilities. - Lessons learned
Security personnel performs a lesson learvned review
SOAR
Security Orchestration, Automation and Response (SOAR) tools are used to respond to low-level security events automatically.
A SOAR platform is typically a combination of tools that can work together to detect and respond to suspicious activirt.
Playbooks and runbooks
A SOAR platform uses playbooks and runbooks. Playbooks provide general guidelines, and a run book provides the technical detail to implement the playbook guidelines.
EX:
Playbook documents the steps of formal procedures to follow for well-known incidents.
A runbook would implement the guidelines documented in the playbooks using the available tools within the organization, ie implementing a rule to quarantine or delete a phishing email if it has discrepancies in its header.
Chain of custody
Process that provides assurances that evidence has been controlled and appropriately handled after collection. Forensic experts establish a chain of custody when they first collect evidence to ensure the evidence presented in court is the same evidence the professionals collected.
The chain of custody documents who handled the evidence and when they handled it.
*A tag is placed on evidence items when they are identified.
Legal hold
refers to a court order to maintain different types of data as evidence, ie a court ordering a company to maintain digital and paper documents for the past 3 years related to a case.
Data retention policies apply here - if a policy is in writing to delete emails older than 6 months, that is ok if admins are following it. But if they didn’t follow it and have emails from 2 years ago, those need to be maintained.
