Domain 5: Summarize elements of effective security governance Flashcards
Guidelines
Guidelines provide structured recommendations and principles that serve as a framework for guiding decision-making and behavior
Policies
policies create a rigid prescriptive framework of what needs to be done to ensure guidelines are me
Acceptable use policy
An AUP sets the ground rules for how employees and stakeholders can utilize an organization’s resources. It outlines acceptable and unacceptable behaviors, such as appropriate use of email, internet access, and social media, while emphasizing the importance of responsible and ethical use.
Information security policies
Information security policies are policies that define the procedures and controls that protect sensitive information from unauthorized access, data breaches, and cyber threats. They encompass aspects such as access control, data encryption, and password management to ensure data confidentiality, integrity, and availability.
Business continuity Plan
BCP policies provide a roadmap for organizations to sustain essential operations in the face of disruptions, whether caused by natural disasters, cyberattacks, or other unforeseen events. These policies outline strategies for data backup, disaster recovery, and continuity of critical functions. These policies go together with Continuity-of-Operations Plans (COOPs), outlining strategies for data backup, disaster recovery, and the continuous operation of critical functions.
Software development cycle
An SDLC policy establishes the methodologies and best practices for creating, testing, and deploying software applications. This policy ensures that software projects are managed efficiently, with an emphasis on quality, security, and compliance
Change Management
Change management policies facilitate the adoption of new technologies, processes, or organizational changes. They help maintain stability by defining how changes are proposed, evaluated, and implemented. Effective change management policies minimize disruption and ensure that changes align with strategic objectives.
Software development cycle stages
As shown in the diagram, the first stage is software development. It is important to use the most secure programming language for the task at hand
In the next stage of the cycle, the Test block in the diagram, a secure coding freelancer carries out regression testing on the final version of the code to ensure that the application is fit for purpose, meaning the software application meets its intended goals and requirements.
The next phase is Staging, which is the point at which the code becomes an application (though quality assurance must be carried out before it can be rolled out to production). In this stage, the new application is tested with real data in a sandbox environment to ensure that the application meets the original specifications and that all necessary reports are available and complete. Vulnerability scanning is also conducted at this stage, any required changes or patches are applied, and, if quality assurance has been fulfilled, the application is signed off and moved to the next stage.
Finally, in the Production stage, the final block in the diagram, the application is deployed to its end users.
Standards
Standards provide a common framework for security practices to ensure consistency and alignment with industry best practices and regulatory requirements. Adhering to these standards promotes a security-conscious environment and establishes a foundation for measuring and enhancing security posture.
ISO 27001 Security
This is a comprehensive and internationally recognized framework for Information Security Management Systems (ISMSs) that has seen global acceptance, making it a valuable credential for organizations operating on a global scale.
ISO 27002 Guidance on Best Practices
ISO 27002 is a collection of security controls and best practices that organizations can implement to secure their information assets
ISO 22701 Privacy
ISO 27701 is designed to help organizations manage and enhance their privacy practices effectively. It builds upon the foundation of ISO 27001, which is the globally recognized ISMS, a framework for protecting information through policies and controls. It has a privacy-centric approach, recognizing that data privacy is not an afterthought but a fundamental requirement in today’s data-driven world.
Privacy Information Management System (PIMS),
Is an organizational framework designed to effectively manage and protect individuals’ personal and sensitive information, ensuring compliance with privacy laws and regulations.
ISO/IEC 27017 Cloud Security:
ISO/IEC 27017 is the standard for cloud security, focusing on information security controls for cloud services. It provides cloud-specific guidelines for both Cloud Service Providers (CSPs) and cloud service customers and addresses shared security responsibilities between the CSP and the customer to ensure clarity on security measures. The standard also emphasizes risk assessment and management to help organizations identify and mitigate cloud-specific risks effectively. ISO/IEC 27017 aligns with other ISO/IEC standards (such as ISO 27001), streamlining the integration of cloud security into an organization’s broader information security management system.
ISO/IEC 27018 Privacy:
This is a vital standard for cloud computing, specifically addressing data privacy concerns. It provides guidelines for safeguarding personal data in the cloud, including policies that outline the need for transparency, obtaining consent to access data, data access controls, and secure handling of PII. Compliance with these guidelines instills trust in the organization, assuring customers that their data is protected and all privacy regulations are met.
