Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CYSA+ > Chapter 9 Policy and Compliance > Flashcards

Chapter 9 Policy and Compliance Flashcards

1
Q

Contains a series of documents designed to describe the organization’s security program

A

Information security policy framework

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Information security policy frameworks generally include four different types of documents, what are they?

A

Policies
Standards
Procedures
Guidelines

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q
  • High-level statements of management intent
  • A statement of the importance of cybersecurity to an organization
  • Requirement that all staff and contracts take measures to protect the confidentiality, integrity, and availability of information and information systems
  • Statement of ownership of information created and or possessed by the organization Designation of the chief information security officer (CISO) or other individual as an executive responsible for cyber security issues
  • Delegation of authority granting the CISO the ability to create standards, procedures, and guidelines that implement the policy
A

Policies

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q
  • Common document that is often apart of an organization’s information security policy library
  • Provides high level of authority and guidance for the security program
A

Information security policy

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q
  • Common document that is often apart of an organization’s information security policy library
  • Provides network and system users with clear direction on permissible uses of information resources
A

Acceptable use policy

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q
  • Common document that is often apart of an organization’s information security policy library
  • Clearly states the ownership of information created or used by the organization
A

Data ownership policy

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q
  • Common document that is often apart of an organization’s information security policy library
  • Describe the classification structure used by the organization and the process used to properly assign classifications to data
A

Data classification policy

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q
  • Common document that is often apart of an organization’s information security policy library
  • Outlines what information organization will maintain and the length of time different categories of information will be retained prior to destruction
A

Data retention policy

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q
  • Common document that is often apart of an organization’s information security policy library
  • Describe the account life cycle from provisioning through active use and decommissioning
A

Account management policy

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q
  • Common document that is often apart of an organization’s information security policy library
  • Set forth requirements for password length, complexity, reuse, and similar issues
A

Password policy

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q
  • Provides mandatory requirements describing how an organization will carry out its information security policies
  • i.e. the specific configuration settings used for OS systems, controls put in place for highly sensitive information and etc
A

Standards

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Provide examples of standards

A
  • Devices must have secure configuration in place prior to deployment
  • Any deviations from defined security configurations must be approved through a change management process and documented. a process must exist to annually review deviations for continued relevance.
  • A process messages to regular check configurations at devices in alert the resource custodian of any changes
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q
  • Are detailed step-by-step processes that individuals and organizations must follow in specific circumstances
  • i.e. building new systems, releasing code to the production environment, responding to security incidents, and etc…
A

Procedures

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q
  • Common procedure doc
  • Describes how the organization will perform security monitoring activities, including the possible use of continuous monitoring technology
A

Monitoring procedures

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q
  • Common procedure doc
  • Describes how the organization will respond to subpoenas, court orders, and other legitimate request to produce digital evidence
A

Evidence production procedures

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q
  • Common procedure doc

- Describes the frequency in process of applying patches to applications and systems under the organization’s care

A

Patching procedures

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q
  • Provides best practices and recommendations related to a given concept, technology, or task
  • Not mandatory and offered as helpful advice
A

Guidelines

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What happens when an organization must deviate from a policy?

A

The policy framework should lay out the specific requirements for receiving an exception and the individual or committee with authority to approve exceptions

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Security and privacy rules that affect Healthcare Providers, Health insurances, and Health Information clearing house

A

The Health Insurance Portability and Accountability Act (HIPAA)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q
  • Provide detailed rules about the storage, processing, and transmission of credit and debit card information
  • Not a law but a contractual obligation it applies to credit card merchants and service providers
A

The Payment Card Industry Data Security Standard (PCI DSS)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q
  • Covers financial institutions, broadly defined. It requires that those institutions have a formal security program and designate an individual as having overall responsibility for that program.
A

The Gramm Leach Bliley Act (GLBA)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Applies to the financial records of publicly traded companies and requires that those companies have a strong degree of assurance around the IT systems that store and process those records

A

The Sarbanes-Oxley (SOX) Act

23
Q

Requires that educational institutions implement security and privacy controls for student educational records

A

The Family Educational Rights and Privacy Act (FERPA)

24
Q

Describe the requirements that individual states place on organizations that suffer data breaches regarding notification of individuals affected by the breach

A

Various data breach notification laws

25
Q

Responsible for developing cyber security standards across the US federal government

A

The National Institute for Standards and Technology (NIST)

26
Q

The NIST framework includes what three components?

A
  1. The Framework Core
  2. The Framework Implementation Tiers
  3. The Framework Profiles
27
Q
  • NIST framework
  • A set of five security functions that apply across all Industries and sectors; identify, protect, detect, respond, and recover.
  • The framework then divides the functions into categories, subcategories, and informative references
A

The Framework Core

28
Q
  • NIST framework
  • Assesses how an organization is position to meet cyber security objectives
  • Example is there a maturity model that describes the current and desired positioning of an organization along a continuum of progress
A

The Framework Implementation Tiers

29
Q
  • NIST framework

- Describes how a specific organization might approach the security functions covered by the framework core

A

The Framework Profiles

30
Q
  • Once the most commonly used information security standard but is now declining in popularity outside of highly regulated industries that require compliance
  • Includes control objectives covering 14 categories
A

International Organization for standardization (ISO 27001)

31
Q

Is a set of best practices for IT governance developed by the Information Systems Audit and Control Association (ISACA)

A

The Control Objectives for Information and Related Technologies (COBIT)

32
Q

COBIT divides Information Technology activities into what four domains?

A
  1. Plan and Organize
  2. Acquire and Implement
  3. Deliver and Support
  4. Monitor and Evaluate
33
Q

COBIT addresses each of the four domains of Technology by providing what five framework components?

A
  1. COBIT framework
  2. Process descriptions
  3. Control objectives
  4. Management guidelines
  5. Maturity models
34
Q

Offers an alternative model for approaching security architecture from a variety of different perspectives that map to architectural layers

A

The Sherwood Applied Business Security Architecture (SABSA) framework

35
Q
  • SABSA architectural layers

- Contextual security architecture

A

Business View

36
Q
  • SABSA architectural layers

- Conceptual security architecture

A

Designers View

37
Q
  • SABSA architectural layers

- Physical security architecture

A

Builders View

38
Q
  • SABSA architectural layers

- Component security architecture

A

Trade Treatment review

39
Q
  • SABSA architectural layers

- Security Service management architecture

A

Service Managers View

40
Q

Widely adapted approach to enterprise architecture

A

The Open Group Architecture Framework (TOGAF)

41
Q

The Open Group Architecture Framework (TOGAF) divides architecture into four domains: what are they?

A
  • Business architecture
  • Applications architecture
  • Data architecture
  • Technical architecture
42
Q
  • One of The Open Group Architecture Framework (TOGAF) domains
  • Defines governance and organization and explains the interaction between Enterprise architecture and business strategy
A

Business architecture

43
Q
  • One of The Open Group Architecture Framework (TOGAF) domains
  • Includes the applications and systems that an organization deploys, the interactions between those systems and their relation to business processes
A

Applications architecture

44
Q
  • One of The Open Group Architecture Framework (TOGAF) domains
  • Provides the organization’s approach to storing and managing information assets
A

Data architecture

45
Q
  • One of The Open Group Architecture Framework (TOGAF) domains
  • Describes the infrastructure needed to support the other architectural domains
A

Technical architecture

46
Q

Framework that offers a comprehensive approach to IT service management (ITSM) within the modern enterprise

A

The Information Technology Infrastructure Library (ITIL)

47
Q

The Information Technology Infrastructure Library (ITIL) covers what five core activities?

A
  • Service strategy
  • Service design
  • Service transition
  • Service operation
  • Continual service improvement
48
Q

Specific measures that fulfill the security objectives of an organization

A

Security controls

49
Q

Are security controls that impact the physical world

A

Physical controls

50
Q
  • Technical controls that enforce confidentiality, integrity, and availability in the digital space
  • i.e. firewall rules, Access Control lists, and choosing prevention systems, and encryption
A

Logical controls

51
Q
  • Procedural mechanisms that an organization follows to implement sound security management practices
  • i.e. user account reviews, employee background investigations, log reviews, and separation of duties policies
A

Administrative controls

52
Q

Are formal reviews of an organization’s security program or specific compliance issues conducted on behalf of a third party

A

Audits

53
Q

Less formal reviews of security controls that are typically requested by the security organization itself and an effort to engage in process Improvement

A

Assessment

CYSA+ (14 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions