Implementing Compliance 7 Flashcards
Name some of the physical security control types.
Locks to prevent unauthorized access
Logging and visitor access at all entrances open to general public
Identification systems like security cards, proximity reader
Video surveillance from cctv cameras
Security guards
Signs like no trespassing
Bonded personnel to protect org from financial exposure such as cleaning services
Mantrap doors. Or deadman door is a system with a door at each end of a secure chamber. Outer closed before entering the inner door
Physical barriers fencing, barricades, secure resources should not have windows or be visible from the outside
Alarms
Motion detection placed at checkpoints
Protected distribution hardening cables with storing metallic tubing and alarms to detect tampering
What are physical security controls
Security measures that restrict, detect, and monitor access to specific areas or assets.
Can control access to building, equipment, server rooms, data centers etc
Name some environmental exposure that must be considered when evaluating the security of a building
Power fluctuations and failures
Water damage and flooding
Fires
Structural damage leading to unauthorized access
Name some environmental controls that can be implemented to help control a facility’s physical environment
Heating, ventilation, and air conditioning system HVAC. Monitor for proper running
Hot and cold isle. Controls the temp and humidity within data centers and computer rooms
EMI shielding. Prevent electromagnetic transfer from cables and devices by creating a conductive material productive barrier
Alarm control panel. Should be protected and secured from exposure
Fire prevention. Annual inspections, installing fireproof walls, use fire proof office material
Fire detection. Fire detection system should be connected to a central reporting station.
Fire suppression. Extinguishers and special gases
Why is environmental monitoring done
Regular monitoring is important to properly secure and prevent damage to resources.
Conditions that can threaten security should be monitored regularly
Why is safety important
Affects both personnel and property
Deter intruders with fencing and cctv
Protect employees with locks and proper lighting at night
Formulate an escape plan or route and perform drills
Text your controls to verify they are up to standard
Describe compliance
The practice of ensuring that the requirements of legislation, regulations, industry codes and standards and Organizational standards are met.
Review pertinent law and regulatory documentation
Review policies and other legal documents
Explain legal requirements
Organizations must consider overall legal obligations
Work with civil authorities when an incident occurs
Comply with other departmental policies
Observe legal limitations and civil rights
Consider legal issues for different groups
Must Observe generally accepted forensic practices when investigating security incidents
Evidence collection. Follow correct procedures for collecting evidence
Evidence preservation. Company must properly preserve all gather evidence for a lengthy period of time
Chain of custody. Maintain a complete inventory they shows who handled specific its please and where they have been stored.
Jurisdiction. Who has the right to investigate and prosecute an info technology criminal case
What is security policy awareness
Ensures all users comply with the guidelines.
Security policy should be accessible
Users trained with regular training sessions and security policy documentation.
What is role based training
Training based on job roles and organizational responsibilities.
Describe personally identifiable information
Information used to Identify contact or locate an individual. Can include full name, fingerprints, license plate number, phone numbers, street address, drivers license number etc
Describe Classification of information
Depends on the type of business and how data is stored
Classified as hard or soft.
Hard is concrete information. Soft is ideas thoughts and views.
Level is sensitivity
High/medium/low
Restricted/private/public
Confidential/restricted/public
Classification levels
Corporate confidential. Not provided to individuals outside of the enterprise
Personal and confidential. Personal info that needs to be protected
Private. Correspondence should be protected
Trade secret. Corporate intellectual property such as patents and processes
Client confidential. Client personal info protected.
List the three important components they ensure proper employee security education
Awareness. Of potential threats to security. An employees role to protect assets and resources
Communication remain open between employees and security professionals
Education. Train employees in security procedures practices, and expectations.
Describe user security responsibilities
Physical security. No ID no entrance to the building. No tailgating. Access in building for job purposes. Follow clean desk policies to secure documents
System Security. Use id and passwords properly and comply with requirements. Confidential files backed up and secured
Device security. Use correct procedures to log off all systems. Wireless communications must be approved. Portable devices secured and stored when not in use
Social networking security. Users aware of threats that target social networking. Follow security guidelines for social websites.
