Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Cybersecurity Policy > Chapter 3 > Flashcards

Chapter 3 Flashcards

1
Q

What are the keywords for chapter 3?

A

authorities, external organizations, organizational structure, reporting structure, roles and responsibilities

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What are the key factors in determining the security organizational structure of a company?

A

mission, risk appetite, culture, size, budget

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

It an org’s mission the most important factor to determine it’s security structure?

A

yes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What are the risk-appetite factors of a risk-averse org?

A

more technical controls, higher tech cost, large security organization, emphasis on asset governance and management

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

smaller number of assets to protect, outsourcing of asset hosting, smaller staff, more emphasis on asset governance is characteristic of what risk level?

A

risk willing

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What are the two types of cultures that determine an org’s security structure?

A

authoritative culture and open-minded/free culture

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Characteristics of an authoritative culture are

A

large org with a variety of security tools, high data protection measures, high protection against malware and attacks, heavy emphasis on following compliance and regulations

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Characteristics of an open-minded/free culture are

A

work from home/byod policies, no unified OS or app use, heavy collaboration between disparate teams, Open source intellectual properties, free intellectual property, emphasis on availability and integrity of assets more than protection of them, smaller staff, importsant assets are assets with code

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What are the org sizes that determine a security team’s structure?

A

small organization and large organization

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Characteristics of a small organization are

A

limited budgets, lack of specialized teams and roles, jack of all trade team members, great dependence on vendor support for difficult problems and large projects

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Characteristics of large organizations are

A

teams and roles segmented by product and specialty, larger budgets, less reliance on vendor support

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

characteristics of small budgets are

A

usually associated with small orgs, cost to equip and train have to be low, may be staffed by volunteers and students

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

what are the characteristics of a large budget?

A

multiple levels of staff and clear organizational hierarchy, heavy cost to support and train large teams , need to ensure rules and responsibilities are clear

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

what are the organizational options for security teams to report to?

A

cep, cio, GRC (governance, risk, and compliance),cso, ciso , legal department, cfo, cto, coo

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What are the best organization positions that the security team should report to?

A

CSO and CISO

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Why are CSO and CISOs the best positions for the security team to report to?

A

Brings direct support to security teams and removes the need for the security team to compete for a seat at the decision table

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Why is reporting to the CEO and CIO the worst option for the security team?

A

Having opposing IT and security team viewpoints reporting to the same CIO could lead to conflict between the teams.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Should the security team hamper business? Why or why not?

A

Security teams should not hamper business. If the security team looks obstructionist it could lead to the business not taking the security team’s advice. Don’t say no, say Let me see how I can help you securely achieve that goal”.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

How can reporting to the GRC (government , risks, and compliance) impede the security team?

A

GRC tends to favor regulatory and risk perfection which could slow the completion of security projects and task achievement

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

How can reporting to the GRC (government, risks, and compliance) help the security team?

A

helps align security team’s task with business objectives and give the team quick access to risk identification

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

What organizational support is needed for a security team to be effective?

A

executive management support, funding, skilled team members, clear security goals and roadmap

22
Q

How many direct reports can a manager manage before they become ineffective?

A

5

23
Q

What is the span of control?

A

The number of people that can be managed by one person before management becomes ineffective

24
Q

How do you calculate the headcount for an organization’s management

A

total count of workers in the organization / 5

25
Q

Who does the CISO normally report to?

A

CSO (chief security officer)

26
Q

What is an information security committee?

A

key stakeholders and management with direct responsibility for security

27
Q

What does an information security committee do?

A

review metrics to analyze security day to day operations, provide guidance and oversight for the security team, resolve complex issues and problems

28
Q

What do risk teams use to monitor risk and progress of risk resolution?

A

risk registers

29
Q

What does the privacy team do?

A

Ensures an org aligns with regulatory and legal private requirements

30
Q

Who determines what data is beholden to regulations?

A

privacy team

31
Q

What is a common privacy regulation?

A

Health Insurance Portability and Accountability Act (HIPPA)

32
Q

Who provides breach notification laws in each state?

A

National Conference of State Legislatures

33
Q

What is a data steward?

A

Individuals responsible for managing and maintaining org data and meta data;p including policies for data use and high level org alignment with data policies

34
Q

What is a data custodian

A

Individuals with control over data access granting, who work with data owners , who provide guidance for new tech/procedures, insures data policies are followed

35
Q

What are data owners?

A

individuals responsible for the creation, use, and deletion of data , can give and deny access to data they are directly responsible for , help develop data governance and processes, tells how data must be used

36
Q

What is a data user?

A

customers or orgs, ensure stored and used data is securely handled and maintained, weakest link in security chain, complex to develop security policy and governance for

37
Q

what is the importance of maintaining relationships with companies in the same industry?

A
  • can provide data relevant to you since it is a similar org
  • standing on shoulders of giants effect
  • can gauge probable effect of new tech and cyber issues for your org
38
Q

What are the downsides of maintaining relationships with companies in the same industry?

A

vulnerabilities more likely to be revealed to the public

39
Q

What is the name for industry sharing bodies?

A

Information Sharing and Analysis Centers (ISACs)

40
Q

What are the downsides of auditors?

A
  • if auditor is not skilled, they will overlook needed remediations
  • they could judge security norms against a different set of standards than they were modeled after
41
Q

What is a key local version of scamming that local enforcement can assist with?

A

scimmers

42
Q

Which federal agencies handle cyber crime

A

FBI and Secret Service

43
Q

What is the FBI’s flash alert?

A

a service that notifies the public about new and current cyber attack mechanisms

44
Q

What are international investigations conducted through?

A

local country of targeted entity

45
Q

An organizational statement of intent is :

A

a policy

46
Q

what legal acts regulate security

A
  • Sarbanes Oxley (SOX)
  • Gramm-Leach Biley ACT
  • Payment-Card industry (PCI)
  • Health and Insurance Accountability and Portability Act (HIPPA)
47
Q

What are the types of information security policies?

A

organizational policy, standards,

48
Q

What are organizational policies?

A
  • highest policy level in a company
  • the parent policy for all child policy in an org
  • mandatory and reflected in managerial requirements
  • product and solution agnostic
49
Q

What do standards provide?

A

information control needed to meet regulatory requirements

50
Q

Who developed Control Objectives for Information and Technology (COBIT)

A

The Information Systems Audit and Control Association (ISACA)

Cybersecurity Policy (1 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions