Governance Flashcards
IT Governance
A comprehensive security management framework
Policy (Security)
*Defines the role of security inside of an organization
*Establishes the desired end state for that program
Organizational Policy (Security)
*Meet business goals
*Define the roles, responsibilities, and terms associated with it
System-specific Policy (Security)
Addresses the security o a specific technology, application, network, or computer
Issue-specific Policy (Security)
Addresses a specific security issue *Email privacy,
*Employee termination procedures *Other specific issues
Standard (Sec Policy)
Implements a policy in an organization
Baseline (Sec Policy)
Creates a reference point in network architecture and design
Guideline (Sec Policy)
Recommended action that allows for exceptions in unique situations
Procedure (Sec Policy)
Detailed step-by step instructions to perform a give task or series of actions
Change Management
Structured way of changing the state of a computer system, network, or IT procedure
Incident Response Plan
Instructions to detect, respond to , and recover from security incidents
Steps of an Incident Response Plan
- Preparation
- Identification
- Containment
- Eradication
- Recovery
- Lessons learned
Business Continuity Plan
- How a business will continue operating during an unplanned disruption
- Long-Term
- Contains a Disaster Recovery Plan
System Life Cycle Plan
Describes the approach to maintaining an asset from creation to disposal
Planning
Planning and requirement analysis for a system, including architecture outlining risk identification
Standard Operating Procedure
Step-by-step instructions to carry out routine operations
Memorandum of Understanding (MOU)
Non-binding agreement between two or more organization to detail what common actions they intend to take
Service-Level Agreement (SLA)
Documents the quality, availability, and responsibilities agree upon by a service provider and a client
Baseline Configuration
Set of specifications for
*Information system
*Configuration item within a system
That has been formally reviewed and agreed upon
Physical Network Diagram
Shows the actual physical arrangement of network components
Logical Network Diagram
Illustrates the flow of data across a network and how devices communicate with each other
Wiring Diagram
Labels which cables are connected to which ports
Radio Frequency (Wireless) Site Survey
Planning/designing a wireless network to deliver the required wireless solution
Wired Site Survey
Determines if a site has the right amount of power, space, and cooling to support a new upgrade or installation
Audit and Assessment Report
Delivered after a formal assessment has been conducted
Sensor
Monitors a device’s temperature, CPU usage, and memory, which could indicate if it is operating properly or about to fail
Minor Temperature Threshold
Set off an alert when a rise in temperature is detected but hasn’t reached dangerous levels
Major Temperature Threshold
Used to set off an alarm when temperature reaches dangerous conditions
Safe temperature range for network devices
between 50 and 90 F
Network Availability
*How well a network can respond to connectivity and performance demands
*Measured as Uptime:
Time network was up ÷ time network was down in a monitoring period
Mean Time to Repair (MTTR)
Average time it takes to repair a device
Mean Time Between Failures (MTBF)
Average time between when failures occur on a device
Cloud Site
Allows for the creation of a recovery version of an organization’s enterprise network in the cloud
Recovery Time Objective (RTO)
Time and service level within which a business process must be restored to avoid unacceptable consequences
Recovery Point Objective (RPO)
Time during a disruption before data lost exceeds the maximum allowable threshold or tolerance
Full Backup
Complete backup of every single file on a machine
Backs up data that changed since last backup
Incremental Backup
Snapshot
Read-only copy of data frozen in time
Power Distribution Unit (PDU)
Distributes electric power to rack of computers and networking equipment located in a data center
Pre-Action System
A detector actuation like a smoke detector and sprinkler must be tripped prior to water being released
Statement of Work (SOW)
A document that outlines all the work that is to be performed, as well as the agreed-upon deliverables and timelines.
(not on going like SLA)
Policy vs. Standard
- Policies are plans that describe the goal of an established procedure (Acceptable use, Physical Security, or VPN access)
- Standards are the mechanisms implemented to achieve that goal. VPN and HTTPS are examples of protocols and industry standards.
