Chapter 6 - Roles And Responsibilities

Question 1

What does the cop had to consider if he builds a facility in a rural setting?

Answer 1

Ensure creating robust, redundant utility connections for connectivity and power services

Question 2

What needs to be considered when building a dc?

Answer 2

Proximity to customer, attractiveness for personnel, natural disasters

Question 3

Cool ensuring secure hardware components

Answer 3

Need to consider BIOs Installation (Firmware flashed into professor) , proper installation of virtualization tools and TSM (treuester platform standard = dictates how processor can be used for cryptographic functions)

Question 4

What does provider has to consider regarding physical plant

Answer 4

Secure hardware components, hardware configuration, hardware logging, computer contingent composition (Muli tenancy vs exclusive host), Renoir Admin access

Question 5

Cp responsibility secure logical framework elements

Answer 5

Secure virtual os installation ( including virtualization management tools), secure configuration for virtualize elements

Question 6

Cp responsibilities secure networking

Answer 6

Firewalls, ids/ips (Monitor Network), honeypots, vulnerability assessment (only known are detected, attacks on unkown = zero-day attacks), communication protection (data in transit via encryption, vpn, strong authentication)

Question 7

What are the shared responsibilities by service type?

Answer 7

IaaS: Secure infrastructure
PaaS: Platform Security (cc Updates and patches Apps and cp must make sure that app and Security functions properly afterwards)
SaaS: Application security (cp for app and cc for access)

Question 8

Shared responsibilities is, middleware our applications

Answer 8

Establish hardening by implementing a Baseline configuration to have the same setup on all machines

Question 9

How can shared responsibilities for data access take place?

Answer 9

Cc does it himself (logs onto machine)
Cp takes this task and only verifies with cc
Casb takes over the task, verifies with cc and logs onto machine

Question 10

Who created the SSAE of which SOC ist part of?

Answer 10

AICPA (American Institute of certified public accountants)

Question 11

What Are the the soc report categories?

Answer 11

SOC 1: financial (type one and two)
SOC 2: organization controls
SOC 2 type 1: how control is designed in the organization
SOC 2 type 2: how controls are implemented and maintained (most useful!!)
SOC 3: Seal of approval