Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CyberSAFE: Exam CBS-410 > Identifying Security Compliance Measures > Flashcards

Identifying Security Compliance Measures Flashcards

1
Q

What is Security Compliance?

A

The adherence to rules, regulations or practises that are related to the protection of assets that are established by a specific authority.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What are Assets?

A

Assets are anything that is considered to have Value.
E.G. Computer hardware/software People, Buildings and data.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Compliance requirements (authority) normally comes from:

A

The organisation, government or industry

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What is Security policies?

A

A set of documents that outline the physical and information security requirements for an organisation. The goal of a security policy is to protect organisations resources.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Give Examples of Security Policies

A

Password Policy

Acceptable Use Policy (AUP)

Internet Usage Policy (Can overlap with AUPs)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Define: Password Policy

A

A security policy to create a strong/complex password to prevent the possibilities of being hacked.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What is Acceptable Use Policy (AUP)

A

A security policy that govern how individuals or organisations can use a particular system or resource.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Why do we have AUPs?

A

An AUP is put in place to protect the security and integrity of the system or resource and ensure that users behave in a responsible and ethical manner.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Define: Internet Usage Policy

A

A security policy that outlines how users can use the internet in a workplace or within an organisation. (Can overlap with AUPs)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What does AUP Stand for?

A

Acceptable Use Policy

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What does PII Stand for?

A

Personally Identifiable Information

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What is PII? Give examples

A

It is data that can be used to identify a specific person, such as Social Security numbers, passport numbers, and combinations of data, such as a full name and date of birth.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What does PHI Stand for?

A

Protected Health Information

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What is PHI? Give examples

A

Information that is individually identifiable and maintained by a health care provider, health plan, or health care clearinghouse that is covered by the mandates in the Health Insurance Portability and Accountability Act (HIPAA).

Examples of PHI can be:
* Medical Records
* Health Insurance Information
* Test Results
* Prescription Information
* Medical Images
* Family history

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What are Facility Policies?

A

Facility Policies are a set of documents that specify how employees and visitors can access an organization’s physical premises.

Facility policies can include Physical barriers to manage access like guardhouses and locked doors.

Identification of authorized individuals can include badges for employees and visitors, keys for authorized employees, etc.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Incident Reporting

A

Security incident reports are an important tool for managing security incidents and improving security in the future. They help to identify vulnerabilities and gaps in security, allowing organizations to take proactive steps to prevent future incidents. This can include a description of the impact of the incident, loss of data, or disruption to operations.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

If there are no formal security policy is in place, what can you refer to?

A

If there are no formal security policies in place you can refer to:
* The Employee handbook
* Network user guide or AUP
* HR department
* IT department
* Information security (InfoSec) department
* Legal department
* Health information management department
* Website

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What are the Consequences of Non-Compliance with Organizational Requirements?

A

This can vary from organization to organization. Dependent on the severity of the violation. Can range from verbal warning to demotion, pay reduction or termination. Should be clearly outlined and available to employees. Consequences should be explained fully to all staff so that there is no misunderstandings.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Scenario: You work at That’s Cheezy Cheese Emporium. Company executives are concerned about the security of organizational assets and customer data. You are on the team that is developing a comprehensive security policy for the organization.

At the first committee meeting, it is decided that the team should establish a process for developing the security policy. What do you think should be the first step?

A

A good first step would be to collect and review any exiting organisations documentation to determine what security requirements already exist.

A thorough risk assessment is an essential first step in developing an effective security policy. It provides a foundation for understanding the organization’s security needs and developing policies and procedures that are tailored to its unique risks and requirements.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

In which type of document would you expect to include rules for entering restricted areas of the company’s central building?

A. AUP
B. Facility policy
C. Password policy
D. Internet usage policy

A

B

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Which types of protected data do you think will be of primary concern for your company? (Select two.)

A. Email address
B. Insurance ID number
C. Credit card number
D. Name
E. Name and address combined

A

C & E

22
Q

What factors do you think the team should consider as they outline disciplinary actions to be taken when someone is not compliant with the security policy?

A

When outlining disciplinary actions for noncompliance with the security policy, the team should consider the following factors:

  • Severity of the Violation/risk
  • Intent
  • Role and Responsibility
23
Q

Legal Compliance Requirements

A

Legal compliance requirements refer to the regulations and laws that organizations must follow to ensure that they operate within the bounds of the law. Failure to comply with these requirements can lead to legal action, penalties, fines, and damage to a company’s reputation.

24
Q

In the United States legal compliance requirements are generally found in laws and regulations, both of which can carry criminal or civil penalties for non - compliance. These can exist at the federal, state and local level.

What are examples of U.S. Compliance laws & regulations?

A

Compliance Laws:
* Fair Credit Reporting Act (FCRA)
* Health Insurance Portability and
Accountability Act (HIPAA)
* Sarbanes - Oxley Act (SOX)

Regulations:
* Federal Trade Commissions (FTC)
* Privacy Guidelines
* National Institute of Standards and
Technology (NIST)
* Compliance Standards
* Payment Card Industry Data Security
Standard (PCI DSS)

25
Q

Health Insurance Portability and Accountability Act (HIPAA)

Description:
Provides compliance requirements for the PHI of patients.
Uses 18 identifies to determine if information is considered PHI

A

Jurisdiction

HIPAA affects U.S. health care providers, health plans and health care clearinghouses that collect and store patients information.

26
Q

In the European Union, legal compliance requirements take the form of directives and regulations.

What is a directive?

A

A directive is a legal act that sets out specific goals or outcomes that member states must achieve. Unlike regulations, directives allow each member state to decide how to implement the requirements into their national laws, providing flexibility while ensuring harmonization across the EU. Once adopted, member states must transpose the directive into national law, and organizations operating within the EU must comply with the relevant national laws. Directives are commonly used in areas such as data protection, consumer protection, and environmental protection.

27
Q

What are some Examples of Directives?

A

Examples of directives are:

  • Network and Information System Security
    Directive (NISD)
  • ePrivacy Directive
28
Q

In the European Union, legal compliance requirements take the form of directives and regulations.

What is a regulation?

A

A regulation is a legal act that has binding force and applies directly in all member states. Unlike directives, regulations do not require individual member states to transpose them into national law because they are already binding as soon as they are adopted by the EU. This means that regulations create a more uniform set of legal requirements across the EU and leave no room for member states to interpret or implement them differently.

29
Q

What are some Examples of Regulations?

A

Examples of regulations are:

  • General Data Protection Regulations (GDPR)
  • EU Cybersecurity Act
30
Q

Sarbanes - Oxley Act (SOX)

Legal requirements for accounting and auditing

A

Jurisdiction

Publicly traded companies in the U.S.

31
Q

General Data Protection Regulation (GDPR)

Protects the privacy of individuals, including the export of personal data.
Note: From 1995 to 2016, the predecessor to GDPR was the Data Protection Directive.

A

Jurisdiction

Affects all entities that collect or process the personal data of EU citizens, even if the entity is not based in the EU.

32
Q

Network and Information Security Directive (NISD)

Protects essential services, utilities, and infrastructure.

A

Jurisdiction

Applies throughout the EU, and to two groups of organizations: operators of essential services (OES) and relevant digital service providers (RDSPs).

33
Q

ePrivacy Directive

Protects the privacy and security of personal data in electronic communications.
An ePrivacy Regulation has also been drafted and is under discussion at the time of this publication.

A

Jurisdiction

Entities in the EU that handle any electronic communications.

Note: The directive was adopted to complement the Data Protection Directive. Until the ePrivacy Regulation takes effect, the GDPR and ePrivacy Directive are key parts of the EU’s plan to protect the privacy of individuals.

34
Q

What does Resources for Maintaining Legal Security Compliance include?

A

Resources for Maintaining Legal Security Compliances include:

  • Organizational compliance documentation.
  • Government websites.
  • Your organization’s legal department.
  • Insurance providers.
  • Text of applicable legislation.
35
Q

Legal Consequences of Non-Compliance with HIPAA violations

A
  • Civil penalties: $100 per violation (annual maximum of $25,000 for repeat violations) up to $50,000 per violation (annual maximum of $1.5 million).
  • Criminal penalties: $50,000 and one year’s imprisonment up to $250,000 and 10 years’ imprisonment.
36
Q

Legal Consequences of Non-Compliance with SOX violations

A

Loss of stock exchange listing and loss of directors’ and officers’ liability insurance up to multimillion dollar fines and prison sentences for company officers (up to $5 million and imprisonment for up to 20 years).

37
Q

Legal Consequences of Non-Compliance with GDPR violations

A
  • Administrative fines: Tier 1 violations: 10 million euros or 2 percent of the organization’s annual revenue, whichever is greater. Tier 2 violations: 20 million euros or 4 percent of the organization’s annual revenue, whichever is greater.
  • Personal liability: Any individual who has suffered any sort of damage, whether material or non-material, has the right to seek compensation against the company responsible for the damages.
38
Q

Legal Consequences of Non-Compliance
NISD

A

Penalties depend on the individual member states’ legislation.
For instance, in the UK, the maximum fine is 17 million pounds.

39
Q

Legal Consequences of Non-Compliance with ePrivacy Directive violations

A

Penalties depend on the individual member states’ legislation.
For instance, in the UK, the maximum fine is 500,000 pounds.

40
Q

Scenario: You work at That’s Cheezy Cheese Emporium, a specialty food vendor with retail and web sales. As part of the ongoing effort to create a comprehensive security policy for the company, you’ve been asked to identify relevant legal compliance requirements to be referenced in the security policy.

At That’s Cheezy Cheese Emporium, although most sales occur within the U.S., there are web sales that come from all around the world. Which of the legal compliance requirements discussed in this topic would apply?

A. HIPAA
B. SOX
C. GDPR
D. NISD
E. ePrivacy Directive

A

C & E

41
Q

Industry Compliance Requirements - Generally applies to a specific industry sector:

  • Banking
  • Automotive
  • Manufacturing
A

Key Industry Compliance Requirements are:

Payment Card Industry Data Security Standard (PCI DSS)
ISO 27001 Standards
National Institute of Standards and Technology (NIST) standards

42
Q

Payment Card Industry Data Security Standard (PCI DSS)

Regulates the handling and management of payment card data to reduce fraud through the use of six control objectives.

A

PCI DSS has been implemented and followed across the globe. Any organizations that handle credit/debit cards and the information associated with them are subject to the standard.

43
Q

ISO 27001 Standards

A group of international standards for information security.
Enables any type of organization to manage the security of assets.

A

Although most countries do not require the widespread implementation of ISO 27001, some regulations do exist that require selected industries to implement the standards.

44
Q

National Institute of Standards and Technology (NIST) standards

Numerous NIST standards are in effect. Those that deal with cybersecurity include NIST SP 800-53 and the NIST Cybersecurity Framework.

A

NIST standards and frameworks are used globally, but they are mandatory only for U.S. federal agencies.

45
Q

What are the Payment Card Industry Data Security Standard (PCI DSS) Six control Objectives?

A

The six control objectives are:
1. Build and maintain a secure network and systems.
2. Protect cardholder data.
3. Maintain a vulnerability management program
4. Implement strong access control measures.
5. Regularly monitor and test networks.
6. Maintain an information security policy.

46
Q

What does PCI DSS Stand for?

A

Payment Card Industry Data Security Standard

47
Q

Resources for Maintaining Compliance with industry standards and framework includes what?

A
  • Industry association websites and guidance documents.
  • Professional group websites and guidance documents.
48
Q

What are the consequences of Non-Compliance with Industry Requirements with PCI DSS?

A
  • Fines of up to $500,000 per incident, plus written notification
    of all affected individuals.
  • Damage to your company’s reputation.
  • Possibly a loss of consumer trust.
49
Q

What are the consequences of Non-Compliance with Industry Requirements with ISO 27001 standards?

A

Nonconformities include failure to fulfill a requirement of the standards, nonconformance to a requirement of the implemented information security management system, or the inability to meet the legal, contractual, or business requirements of customers.

If an ISO 27001 audit is performed and nonconformities are discovered, the auditor may withhold the ISO 27001 certificate.

50
Q

What are the consequences of Non-Compliance with Industry Requirements with NIST?

A

Depending on the organization, effects of non-compliance with NIST standards could range from loss of business reputation to loss of eligibility for procuring U.S. government contracts.

51
Q

Scenario:
You work at That’s Cheezy Cheese Emporium, a specialty food vendor with retail and web sales. To wrap up the compliance research you have been involved with, you’ve been asked to identify relevant industry compliance requirements to be referenced in the security policy.

At That’s Cheezy Cheese Emporium, although most sales occur within the U.S., there are web sales that come from all around the world. Which of the industry compliance requirements discussed in this topic would apply?

A. PCI DSS
B. ISO 27001
C. NIST SP 800-53
D. NIST Cybersecurity Framework

A

A

CyberSAFE: Exam CBS-410 (5 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions