Course 2 - 204 - Managing Vendor Resources Flashcards
Why is there such a critical need to protect our data? How has that need evolved? What can we expect moving forward?
Critical data no longer rests safely in fortified data centers. Instead, that information is scattered throughout the organization, across remote office networks, and often on employee laptops and hand-held devices. Safeguarding company data has become a formidable challenge. Data is everywhere and must be protected.
What is the ultimate goal of Data Security?
“Information security” can carry different meanings for different people, and depending on your position in the company and specific area of responsibility, definitions and objectives can vary substantially.
What are the two most critical components of a strong security policy?
1) Corporate management supports the policy; and
2) The policy aligns information security with the core objectives of the business.
What are some common subject areas typically found in an information security policy?
Employee/Management Roles and Responsibilities
Guidelines for Acceptable and Unacceptable Use of Company Resources (i.e. Internet and Email)
Acceptable Use of Company Software and Hardware
Non-Compliance Issues
Incident Management
Remote Access and Mobile Computing
Information Classification Guidelines
User ID and Password Standards and Management
Physical Security
Data Archiving (how often each user should copy information to an archive file) and Backup Requirements
A framework and foundation for governance
What are the key principles of a sound data security plan?
First, take stock in what you have—know what information you have access to in your files and on your computer. Second, limit access to only the information you need. Limit exposures by managing accessibility (for example, store sensitive information on a company server or other secure location rather than your laptop), and properly secure or dispose of what you no longer need. Next, keep information in your care locked down and protected by controlling access to the “front door” by monitoring and restricting access to your equipment.
Finally, plan ahead. Have a plan to respond to security incidents if they occur. Knowing how to react and respond will help to limit exposures and minimize potential risks and damage. O
What are some additional security tips that we should follow on a daily basis?
eep operating systems updated as necessary and appropriate. The most recent version of any operating system is generally the safest. Protect systems by downloading the latest security updates to limit vulnerabilities.
Backup important data on a regular basis, and store it in a separate location to minimize risks of data loss. Any data that hasn’t been backed up is at risk. Audit data storage by periodically conducting trial restores to ensure the data is actually being backed up.
Install firewalls on computer systems. A firewall is a combination of software and/or hardware that provides a protective barrier between a computer or computer network and the public Internet. Essentially firewalls protect your online gateway and block unauthorized access to your computer or computer network.
Use anti-virus software on computers. A computer virus is a program designed to copy itself into other programs stored in a computer, infecting and potentially damaging the files that receive it. Some viruses are mild, while others are very destructive and can wipe out a computer’s memory or even cause more severe damage. Anti-virus software continuously scans your computer looking for viruses, and also checks incoming email and websites for potential threats. Updates must be performed regularly to stay current and effective.
Use spyware protection on computers. Spyware is computer software that is covertly used to gather personal information and monitor user activity and surfing habits, but can also have other potentially harmful consequences such as installing additional software, redirecting Web browser activity, accessing websites blindly, changing computer settings, slowing connection speeds, and otherwise damaging or interfering with user control. Spyware protection must also be updated regularly to remain effective.
Protect passwords! Weak password protocols are a common security flaw that can increase risks. Change passwords frequently and use a “strong” password that is difficult to guess or decipher. Use a combination of letters, numbers, and other characters. Do not share passwords with others, and resist saving passwords when prompted.
Do not open attachments in emails from people or sources you do not know. Filter out unwanted spam email using spam filter programs when possible. Don’t click on anything in a spam email, even to unsubscribe. If possible don’t even open it.
Take precautions when sending sensitive or proprietary information via email. Password protect documents when necessary.
Only allow staff access to the information needed to do their job. For example, as employees move within an organization, access privileges can follow and quickly mount. Ensuring employees only have access to information appropriate for their current position can be an essential step in avoiding manipulation and/or loss of data.
Do not use shared devices (for example, hotel computers) to access information that should be protected.
When possible, encrypt any personal information held electronically if it might cause damage or threat if lost or stolen. Encryption is the changing of data into code, a procedure that renders the content of a message or file unreadable to anyone not authorized to read it.
Audit data storage for security policy enforcement, access control, and proper destruction of appropriate content on a regular basis. Delete information that is no longer necessary, and disable unneeded functionality. Do not dispose of old computers until all pertinent information has been securely removed (by authorized technology or destroying the hard disk). Ensure that computers and other equipment are appropriately cleansed (of information, software, etc…) before it is allocated to another employee.
Always lock your computer when you are away from it. Log off and shut down your computer prior to leaving for the day.
Develop and implement appropriate security protocols regarding the use of removable storage devices (such as external hard drives, flash drives, etc.). Such devices can hold significant amounts of information, and should be carefully monitored and tightly controlled.
Know how to notify appropriate parties immediately in the event digital devices or assets (phones, laptops, confidential documents, etc.) are lost or stolen. Understand the appropriate policies and practices, and maintain access to an emergency contact number.
Recognize information security is not just about protecting the technology—it’s also about protecting physical assets, communications, access controls, and every aspect of our information networks. This would include the physical security of company premises, proper disposal of confidential paper waste, etc. It is also about ensuring that your staff is adequately trained and responsibilities clearly communicated.
What are some important questions that we should consider when constructing our data security systems?
What data is used and stored on the system?
Who uses or otherwise has access to the system?
How do users access the system?
What functions does the system provide, and what is the relative importance of those functions?
Are there other networks, programs or users that share the system? What is the potential connectivity to other networks and/or users?
Where is the system physically located?
How are data backups made, how frequently, and where are they stored? Who has access to them?
Are there any regulatory or statutory requirements that we have to consider?
What are the primary components of an access control system?
The primary component of any access control system is the development of criteria by which access levels to both areas and individuals are assigned.
In terms of computer security, what are the three essential services of access control?
i) Identification & Authentication
ii) Authorization
iii) Accountability
What is authentication? Name some examples of common authenticators…
This determines who can log on to a system. It is the process of verifying a user’s identity for the purposes of using the system, during which time an “authenticator” is established.
Something you know, such as a password or personal identification number (PIN). This assumes only the owner of the account knows the password or PIN necessary to access the account.
Something you have, such as an access card or token. Once again, this assumes only the owner of the account has access to the card or token.
Something you are, which might involve fingerprint identification, voice recognition, retina scans, or other devices.
Where you are, for example whether inside or outside the company firewall.
What is authorization?
This determines what you can do once you are in the system.
What is a Data Center?
A Data Center is a centralized facility used for the acquisition, storage, processing, analysis, management, and dissemination of data pertaining to a particular business.
What are some of the steps that are typically taken to manage the physical environment of the Data Center?
It generally includes redundant/backup power supplies, data communications connections, and special security devices and considerations. The physical environment of a Data Center is rigorously controlled. Facilities typically include air conditioning systems, fire prevention and suppression equipment and systems, uninterruptible power supplies, backup generators, and other equipment intended to protect and maintain a controlled environment.
Why is it important to have such strict controls over our Data Centers?
As Data Centers continue to grow in size and importance, the need for physical security at our facilities is every bit as important as the cyber-security of our system networks. Individuals who falsify their identity or intentions and those who otherwise gain unauthorized and mal-intended access to our systems can cause tremendous damage, from physically disabling critical equipment, to launching a software attack at an unsecured keyboard, to theft of sensitive and critical information.
The objective of our physical controls should answer what fundamental questions?
Who are you? This question causes most of the difficulty in designing automated security systems. Current technologies all attempt to assess identity one way or another, with varying levels of certainty—and related costs. (For example, card access systems provide a certain level of identity protection, but how do we ensure that the owner of the card is the user of the card? An iris scanner provides a high degree of certainty, but can be very expensive…) Finding an acceptable compromise between certainty and expense lies at the heart of our decision making.
Why are you here? What is the reason you need access to this area and/or information? This question might be implied once we have established an individual’s identity, or can be determined in a variety of different ways.
What do you need to know? How much access do you really need to have to accomplish your objectives? Access to extremely sensitive areas may be granted to specific people for a specific purpose. Determining access requirements may depend on specific purposes or job functions.
The design of the security system for our data centers should include what basic considerations?
Cost of equipment - Budget considerations often limit extensive use of high-confidence identification methods and equipment. The typical approach is to utilize a variety of techniques that are appropriate to the various needs, functionality, and security levels.
Combining technologies - The reliability of our identification methods at any level can be heightened by combining lower cost technologies with the innermost (highest security) levels enjoying the combined protection of all the outer perimeters that contain it.
User acceptance - Ease of use and reliability of identification are important for preventing the system from becoming a source of frustration and a temptation for subversion.
Scalability – Can the design of our system be easily modified to achieve increased functional demands when necessity, funding and confidence in the technology increase?
What is Defense in Depth?
Defense in Depth is the coordinated use and strategic layering of multiple security countermeasures in our protection plans
What are some of the tools commonly used to help protect our Data Centers?
i) Access Tools
ii) Camera Systems
iii) Security Guards
iv) Sensors & Alarms
v) Visitor Control
Why should an active document retention and destruction policy be considered a priority for any business?
The retention of an infinite number of documents may become extremely expensive and impractical. The potential expenses relating to storage and management of these documents alone would be extremely prohibitive. Organizational concerns, categorization, and filing systems also result in control and systemic difficulties.
The premature destruction of certain documents may lead to the loss of valuable information and result in organizational obstacles and inconveniences which impact the operation and success of the business.
Legal and regulatory requirements mandate the retention of certain documents for minimum periods of time, and the destruction of certain documents once their purpose has been fulfilled.
The premature destruction or elimination of certain documents could leave the appearance of impropriety, or may otherwise lead to the eradication of documents that could support or defend the company against legal and/or civil claims (For example, the Sarbanes-Oxley Act addresses the destruction of business records, and has turned the intentional destruction of documents into a process that must be carefully monitored).
As it pertains to electronic records, it is always important to consider the inevitable issue of hardware, software and media obsolescence. There will be incidents when records must either be migrated to new versions, or the old hardware/software must be retained to read the records. System or hardware migration may also cause records to change or lose their format, necessitating quality control procedures to ensure all information retains its original content, context, and structure.
What are some important tips for developing and maintaining a Document Retention and Destruction program?
A good starting point is to define what constitutes a “business record” and a means to categorize specific records. Records are created for a variety of reasons, but whatever the reason, whenever a record is created there is a useful life of that record. Having a definition and a means of categorizing documents will make operational record keeping decisions easier and more efficient.
The company’s technology (IT) department should be involved in decisions regarding the policy and methods for enforcement when those policies involve electronic or other related venues and documents.
There should be a clear schedule identifying the minimum and maximum retention periods for all documents covered within the program.
Numerous statutes, regulations, and regulatory instruments impose record keeping requirements on retail organizations and other business entities, generally applicable to specific categories of records. Such requirements may involve what, where, how, and for how long these records must be maintained. All pertinent practices and requirements should be maintained and reviewed on a regular and consistent basis to ensure compliance.
There should be a framework for administration of the program to include training and education, assigning monitoring responsibilities, capability assessments, and a schedule for updating the program so that it reflects current legal requirements and business needs.
Appropriate security and privacy controls must be established to ensure the protection of sensitive/confidential documents. Every company is bound by contract, law, or practice to treat certain information as confidential, and every effort should be made to maintain that trust at all times. This would include security of the storage medium as well as the establishment of stringent procedures and protections when such documents are destroyed. Protection and control should be of paramount concern up to and including document destruction.
The program should be documented, published, and appropriately communicated to enhance understanding, limit confusion, and increase efficiencies.
Clear accountability should be established for enforcement of the program. Involved employees should be properly educated as to the importance of the policies and held accountable for following established guidelines. Routine (scheduled and unscheduled) audits should be conducted to ensure compliance.
There may be instances when the suspension of records destruction is necessary due to incidents such as imminent or current litigation, receipt of subpoenas, government inquiries, audits, or other types of related events that might warrant such action. When such records may be needed beyond the defined retention period, a methodology should be in place which immediately notifies all appropriate personnel of these actions, to include legal counsel, records managers, department managers, IT managers, and operations and loss prevention executives when necessary and appropriate.
What is Caesar’s Cipher?
Caesar used what is now known as Caesar’s cipher, a very simple encryption technique. This was a substitution cipher in which each letter of the text is replaced by a letter a certain fixed number of positions down the alphabet (for example, with a shift of 3, “a” would be replaced with “d”, “b” would be replaced with “e”, and so on).
What are some of the primary business objectives that our information security programs should strive to accomplish?
Information Availability - Our systems should address the processes, policies, and controls used to ensure authorized users have prompt access to information. This serves to protect against intentional or accidental attempts to deny appropriate user access to information or systems that are necessary for the legitimate operations of the business.
Integrity of Data Systems - This relates to the processes, policies, and controls used to ensure information has not been altered without legitimate authorization, and that systems are free from unauthorized manipulation that could compromise accuracy, completeness, and reliability.
Data & System Confidentiality - This involves the processes, policies, and controls employed to protect both company and customer information against unauthorized access or use.
Accountability - This entails the processes, policies, and controls necessary to trace actions back to their source. Accountability directly supports legitimate access while deterring unauthorized intrusion, providing for better security monitoring, assisting recovery efforts, and enhancing the legal admissibility of data records.
Confidence - This addresses the processes, policies, and controls used to ensure technical and operational security measures work as intended. As part of the system design, this would support availability, integrity, confidentiality, and accountability, and highlights the notion that secure systems provide intended functions while preventing undesired actions.
