Chapter 5

Question 1

What does “InfoSec Program” mean?

Answer 1

The effort to reduce risk to organizational assets.

Question 2

Name 4 functions needed to implement an InfoSec program:

Answer 2

• System testing.
• Risk assessment.
• Risk management.
• Policy.

Question 3

How many employees do each of these organizations need:

1- Micro enterprises or startups:

2- Small enterprises:

3- Medium-sized enterprises:

4- Large enterprises:

Answer 3

1- Micro enterprises or startups:
(fewer than 10 employees)

2- Small enterprises:
(10 to 49 employees)

3- Medium-sized enterprises:
(50 to 249 employees)

4- Large enterprises:
(250 or more people)

Question 4

What is a recommended approach to separating functions in large organizations:
(4 steps)

Answer 4

1- Functions performed by business groups.

2- Functions performed by IT groups outside InfoSec.

3- Functions performed within InfoSec department as customer service.

4- Functions performed within InfoSec as compliance.

Question 5

Compare Large, medium, and small organization in terms of security staffing:

Answer 5

1- Large organizations: Forming many internal groups and splitting functions. 5+ full time security professionals, and 15+ part-timers.

2- Medium-sized organizations: less internal groups and more functions assigned to each group. May have only 1 full-time security person, with some part-time InfoSec individuals.

3- Small organizations: 1 jack-of-all-trades security administrator, with 1 or 2 assistants. Resources are limited, which will cause security admins to use freeware/open source to lower costs.

Question 6

List 5 of wood’s reporting options:

Answer 6

1- Reporting to IT department.

2- Reporting to legal department.

3- Reporting to administrative services department.

4- Reporting to help desk.

5- Reporting to HR department.

Question 7

List 3 NIST Elements of a security program:

Answer 7

1- Physical security.
2- Cryptography.
3- Policy.

Question 8

Name and compare the 3 types of InfoSec positions:

Answer 8

1 - Definers: provide policies and guidelines.

2 - Builders: they create and install security tools.

3 - Administrators: they administrate the tools and improve the processes.

Question 9

Name and Explain 3 InfoSec roles:

Answer 9

1- CISO: the executive that oversees the InfoSec in an organization.

2- Security Consultant: independent expert.

3- Security Analyst: a hybrid of technician and manager. Has both technical and managerial skills.

Question 10

Explain what each of these InfoSec roles do:
1 - Security Technician.
2 - Security Staffers and watchstanders.
3 - Security officers and Investigators.
4 - Help Desk Personnel.

Answer 10

1 - Technical individuals who configure and implement security software.
2 - Routinely do watchstanding or administrative work.
3 - physical security.
4 - help identify InfoSec problems in user devices.