Chapter 4

Question 1

What are standards?

Answer 1

more detailed statements of what must be done to comply with policy

Question 2

Define the practice triangle.

Answer 2

Policies
Standards
Guidelines
Procedures
(Step by step instructions)

Question 3

Types of policies?

Answer 3

Enterprise Information Security Policies NIST
Issue-specific security policies
System-specific security policies

Question 4

What is the iso 27000 series of standards?

Answer 4

The ISO/IEC 27000 family of standards helps organizations keep information assets secure.

Question 5

EISP?

Answer 5

Enterprise Information Security Policy.
Sets strategic direction, scope, and tone for all security efforts within the organization.
Drafted by the CIO of the organization.
Typically addresses compliance in two areas, ensure meeting requirements to establish program and responsibilities.

Question 6

EISP Components?

Answer 6

Statement of purpose
Defines information security
Importance of info sec

Question 7

ISSP?

Answer 7

Issue-Specific Security Policy

Question 8

What does ISSP do?

Answer 8

Addresses specific areas of technology
Requires frequent updates
Contains statement on organization’s position on specific issue

Question 9

List approaches of ISSP

Answer 9

Create a number of independent ISSP documents
Create a signle comprehensive ISSP document
Create a modular ISSP document

Question 10

What are some of the components of ISSP?

Answer 10

Statement of Policy
Authorized Access and Usage of Equipment
Prohibited use of Equipment

Question 11

What is SysSP?

Answer 11

Systems-Specific Policy

Question 12

What does SysSP do?

Answer 12

It functions as standards and procedures used when configuring or maintaining systems.

Question 13

What is policy management and how is it used?

Answer 13

Policies must be managed as they constantly change.
To remain viable, security policies must have:
Individual responsible for the policy
A schedule of reviews
Method for making recommendations for reviews.
Specific policy issuance and revision date.
Automated policy management.
Sunset clause - expiry date.

Question 14

What is ISO 27000 series?

Answer 14

One of often discussed security models.

Purpose is to give recommendations for information and security management.

Question 15

What is BIA?

Answer 15

Business Impact Analysis.

Question 16

What does BIA do?

Answer 16

Investigation and assessment of the impact that various attacks can have on the organization.
Assumes security controls have been bypassed, have failed, or have proven ineffective, and attack has succeeded.

Question 17

Stages of BIA?

Answer 17

Threat attack identification
Business unit analysis
Attack success scenario development
Potential damage assessment
Subordinate plan classification
Continuity strategies.