Chapter 16

Question 1

Operational security

Answer 1

• Need to know - Limit access to and knowledge of info
• Least privilege - Limit access to and actions to info/data
• Segregation (or separation) of duties
• Two-person control - e.g. split knowledge, or use 2 keys, etc.
• Job rotation
• Mandatory vacations

Question 2

Asset management

Answer 2

Inventory assets
Track assets
Secure and protect assets

Question 3

Software assets - inventory and track licenses; protect from being stolen

Question 4

MTTF - time to failure if will not repair
MTBF - time between failures if will repair

Question 5

Change Management

Answer 5

Primary goal - ensure changes do not cause outages

Process:
1. Request change
2. Review change
3. Approve change
4. Test change
5. Schedule & implement
6. Document

Question 6

Patch Managementf

Answer 6

Process:
1. Evaluate patch
2. Test
3. Approve
4. Deploy
5. Verify deployment