Deck 3 Flashcards
Get That MONEY!!!
Pass and Advanced
- When is a computer system operating in the multilevel security mode?
When it provides a capability permitting various categories and types of classified materials to be stored and processed concurrently in a computer system and permitting selective access to such material concurrently by un-cleared users and users having differing security clearances and need-to-know.
Pass and Advanced
- When is a computer system operating in the controlled security mode?
When at least some personnel (users) with access to the system have neither a security clearance nor a need-to-know for all classified material then contained in the computer system.
Pass and Advanced
- What data is unclassified data that requires special protection?
Sensitive unclassified data.
Pass and Advanced
- What Act imposes numerous requirements upon federal agencies to prevent the misuse of data about individuals, respect its confidentiality, and preserve its integrity?
The Privacy Act of 1974.
Pass and Advanced
- What are the major provisions of the Privacy Act that most directly involve computer security?
Limiting disclosure of personal information to authorized persons and agencies; requiring accuracy, relevance, timeliness, and completeness of records; and requiring the use of safeguards to ensure the confidentiality and security of records.
Pass and Advanced
- What has the Navy established to assure protection for AIS processing of sensitive unclassified data?
The limited AIS access security mode. ‘
Pass and Advanced
- When is a computer system or network operating in the limited access security mode?
When the type of data being processed is categorized as unclassified and requires the implementation of special access controls to restrict the access to the data only to individuals who by their job function have a need to access the data.
Pass and Advanced
- Why is AIS media protection important?
Because it is where data, information and programs are stored.
Pass and Advanced
- What does the amount of protection depend on?
The classification of data, the type of AIS storage media used, the value of the material on it, and the ease with which the material can be replaced or regenerated.
Pass and Advanced
- What items are considered AIS media?
Magnetic tapes, disks, diskettes, disk packs, drums, cathode-ray tube (CRT) displays, hard copy (paper), core storage, mass memory stoarage, printer ribbons, carbon paper, and computer output microfilm and microfiche.
Pass and Advanced
- For purposes of control, AIS media can be divided into what two types or categories?
Work copy media and finished media.
Pass and Advanced
- What media is temporary in nature?
Work copy media.
Pass and Advanced
- How long is working copy media retained?
180 days.
Pass and Advanced
- What procedures are designed to ensure that an adequate level of protection is provided?
Your activity?s standard operating procedures (SOPs).
Pass and Advanced
- Why is it important for your activity to have procedures for making AIS media?
To protect the media from unauthorized, accidental, or intentional disclosure, modification, destruction, or loss.
Pass and Advanced
- What must each magnetic tape, diskette, and disk pack be externally marked with?
A stick-on label with the overall security classification and a permanently assigned identification number.
Pass and Advanced
- When the tapes, diskettes, and disk packs are to be declassified by degaussing, when are all external labels indicating the classification not removed?
Not unless the media will be immediately used to store information of the same classification.
Pass and Advanced
- To what degree must the media be destroyed?
Beyond recognition.
Pass and Advanced
- What provides the basis for an AIS security program?
The risk analysis and higher authority instructions.
Pass and Advanced
- What are the steps to take that will help in planning an AIS security program?
Perform preliminary planning, perform a preliminary risk analysis, select and implement urgent ?quick fix? security measures, perform and document a detailed risk analysis, justify costs and document action plans, carry out the approved action plans, and repeat the detailed risk analysis and subsequent steps regularly, at least annually.
Pass and Advanced
- How can the AIS technical manager determine what changes, if any, should be made in the security program to keep it effective?
By evaluating changes in command mission, the local environment, the hardware configuration, and tasks performed.
Pass and Advanced
- What should you have a thorough knowledge of before implementing any security plan?
How numerous higher authority instructions relate to physical security, data protection, and security in general.
Pass and Advanced
- What are the instructions and manuals you can refer to in learning about AIS security and when making security decisions?
The Department of the Navy Automatic Data Processing Security, OPNAVINST 5239.1 with enclosures, Guidelines for Automatic Data Processing Risk Analysis, FIPS PUB 65 (enclosure 3 to OPNAVINST 5239.1), Department of the Navy Information Security Program Regulation, SECNAVINST 5510.36, and Department of the Navy Information Systems Security (INFOSEC) Program, SECNAVINST 5239.3.
Pass and Advanced
- When planning a security program, what things should the AIS technical manager be aware of?
The types of threats that may be encountered.
Pass and Advanced
- What should the AIS facility upper management begin development of the security program with?
A risk analysis.
Pass and Advanced
- What is a risk analysis as related to AIS security?
The study of potential hazards that could threaten the performance, integrity, and normal operations of an AIS facility.
Pass and Advanced
- What is the first step to consider when preparing the risk analysis?
Estimate the potential losses to which the AIS facility is exposed.
Pass and Advanced
- What is the objective of the loss potential estimate?
To identify critical aspects of the AIS facility operation and to place a monetary value on the loss estimate.
Pass and Advanced
- What is the second step of the risk analysis?
Evaluate the threats to the AIS facility.
Pass and Advanced
- What is the third step in the risk analysis?
Combine the estimates of the value of potential loss and probability of loss to develop an estimate of annual loss expectancy.
Pass and Advanced
- What is the criteria to use when selecting specific remedial measures?
The annual cost is to be less than the reduction in expected annual loss that could be caused by threats, and 2) The mix of remedial measures selected is to be the one having the lowest total cost.
Pass and Advanced
- What should be a key part of the AIS faciIity?s security program?
Fire safety.
Pass and Advanced
- What elements should fire safety include?
Location, design, construction, and maintenance of the AIS facility to minimize the exposure to fire damage, measures to ensure prompt detection of and response to a fire emergency, provision for quick human intervention and adequate means to extinguish tires; and provision of adequate means and personnel to limit damage and effect prompt recovery.
Pass and Advanced
- What is the first factor to consider in evaluating the fire safety of an AIS facility?
The tire exposure results from the nature of the occupancy (material) of adjacent buildings and the AIS facility building.
Pass and Advanced
- What does the degree of hazard associated with a given occupancy (material) depend on?
The amount of combustible materials, the ease with which they can be ignited, and the likelihood of a source of ignition.
Pass and Advanced
- What are the second and third fire safety factors?
The design and construction of the building.
Pass and Advanced
- What is the approximate destruction time of a heavy timber construction?
l plus hours.
Pass and Advanced
- What is the approximate destruction time of a wood frame construction?
Minutes.
Pass and Advanced
- What is the fourth factor in fire safety?
The way in which the building is operated.
Pass and Advanced
- What should be taken into consideration in the location and spacing of an effective fire detection system?
The direction and velocity of air flow, the presence of areas with stagnant air, and the location of equipment and other potential tire sites.
Pass and Advanced
- Fire extinguishment may be accomplished by using what four methods?
Portable or hand extinguishers, hose lines, automatic sprinkler systems, or volume extinguishant systems.
Pass and Advanced
- What is the minimum temperature required to activate an automatic sprinkler system?
13 5?F .
Pass and Advanced
- To ensure the effectiveness of portable extinguishers, what are the measures to be observed?
Extinguishers should be placed in readily accessible locations, not in corners or behind equipment, each location should be marked for rapid identification, and each extinguisher should have inspection tags.
Pass and Advanced
- What are power fluctuations, usually caused by inclement weather, that causes unpredictable results on hardware, logic, and data transfer referred to as?
Transients.
Pass and Advanced
- How can the effects of internal transients be minimized?
By isolating the AIS hardware from other facility loads.
Pass and Advanced
- If the AIS facility is in a remote area, what is usually required as a backup power source?
An uninterrupted power supply (UPS).
Pass and Advanced
- Depending on the ampere-hour capacity of the battery (or batteries), how long can the UPS support its load without the prime power source?
A maximum of 45 minutes.
Pass and Advanced
- If the risk analysis shows a major loss from power outages lasting 30 to 45 minutes or beyond, what can be installed?
An onsite generator.
Pass and Advanced
- Is the physical protection of an AIS facility as stringent for an AIS facility that processes unclassified data as it is for an AIS facility that processes classified data?
No.
Pass and Advanced
- When the threat analysis indicates the need to protect the property boundary of the AIS facility, how can this be accomplished?
By installing fences or other physical barriers, outside lighting, or perimeter intrusion detectors, or by using a patrol force.
Pass and Advanced
- What should be taken into account in evaluating the need for perimeter protection?
The possibility that electromagnetic or acoustic emanations from AIS hardware may be intercepted.
Pass and Advanced
- What system provides a means of detecting and announcing proximity or intrusion that endangers or may endanger the security of a command?
The intnision detection system (IDS).
Pass and Advanced
- What are the physical and personnel security requirements for the central computer facility area based upon?
The overall requirements of the total AIS system.
Pass and Advanced
- What are the remote terminal area requirements based upon?
The highest classified and most restrictive category and type of material that will be accessed through the terminal under system constraints.
Pass and Advanced
- The approval and authority to authorize temporary exceptions to security measures for the DOD component?s system in the network requires how many components?
Two.
Pass and Advanced
- What person conducts au annual security survey of the AIS facility area?
The AIS technical manager.
Pass and Advanced
- What is prepared and executed for the accomplishment of the command?s specific mission?
Operation plans and the command?s organizational manual.
Pass and Advanced
- What are the three types of contingency plans that make up a COOP security program for an AIS facility?
Emergency response, backup operations, and recovery.
Pass and Advanced
- In reference to AIS security, what term is used to refer to steps taken immediately after an emergency occurs to protect life and property and to minimize the impact of the emergency?
Emergency response planning.
Pass and Advanced
- If evacuation of work are as is ordered or likely, how should all personnel be instructed?
1)Put working papers and other unclassified material in desks or file cabinets and close them, 2) Turn off equipment, but leave room lights on, and 3) Close doors as areas are evacuated, but ensure that locks and bolts are not secured.
Pass and Advanced
- What should be defined in the loss control plan? `
The steps to be taken, assign responsibilities for general and specific steps, and provide any needed materials and equipment in handy locations.
Pass and Advanced
- What factors should be considered to evaluate alternate backup modes and offsite facilities?
AIS hardware usage, transportation of military and civil service personnel with needed supplies and materials, maintenance personnel at the offsite location, and overtime cost factor for civil service personnel.
Pass and Advanced
- What is a plan for backup operation that is not expected to extend much beyond the cause of delay which forces a shift to the backup operation?
Minimum duration plan.
Pass and Advanced
- What is a plan for backup operation for as long as it takes to reconstruct the AIS facility after total destruction?
A worst-case plan.
Pass and Advanced
- Each COOP backup plan should cover what five basic areas?
Performance specifications, user instructions, technical requirements for each AIS task, computer system specifications, and administrative information.
Pass and Advanced
- What should be the final element of the AIS security program for every naval AIS facility?
A review or inspection process.
Pass and Advanced
- What are the major factors to consider in determining the frequency of internal inspections?
The frequency of external inspections, the rate of change of the AIS, the amount and adequacy of controls, the threats that face the facility, the results of previous inspections, and the directions of higher authority.
Pass and Advanced
- What is one of the main principles in selecting an inspection team?
Members should not be responsible for AIS operations.
Pass and Advanced
- What does the size of the inspection team depend upon?
The size of the facility and the scope of the inspection.
Pass and Advanced
- What must be developed to properly conduct an internal inspection of security?
A comprehensive inspection plan.
Pass and Advanced
- What is the first step of an inspection plan?
To examine the security policy for the AIS facility.
Pass and Advanced
- What type of inspection is designed to test on a no-notice basis certain elements of security and control?
A surprise inspection. -
Pass and Advanced
- When a scheduled inspection is conducted, what is normally the first step?
. An interview with AIS personnel.
Pass and Advanced
- When is a good time for the inspection team to convene to review progress and to compare notes?
At the end of each day?s activity.
Pass and Advanced
- What information is included in the inspection report?
An executive summary, a description of the inspection, a detailed report of observations made, conclusions drawn from the observations, and recommendations for corrective actions, as appropriate. t
Pass and Advanced
- Who is responsible for implementing an inspection follow-up?
The commanding officer (CO) of the command.
Pass and Advanced
- What instruction provides guidelines for use by all Navy organizations in implementing any security safeguards that they must adopt to implement the Privacy Act?
The Department of the Navy Information Systems Security (INFOSEC) Program, SECNAVINST 5239.3.
Pass and Advanced
- What instruction implements the Privacy Act and personal privacy and rights of individuals regarding their personal records?
The Department ofthe Navy Privacy Act (PA) Program, SECNAVINST 5211.5.
Pass and Advanced
- Who is responsible for administering and supervising the execution of the Privacy Act and SECNAVINST 5211.5 within the Department of the Navy and is designated as the principal Privacy Act coordinator for the Department of the Navy?
The Chief of Naval Operations.
Pass and Advanced
- What is data integrity?
The state existing when data agrees with the source from which it is derived, and when it has not been either accidentally or maliciously altered, disclosed, or destroyed.