Information Security Governance

Question 1

Is a guideline discretionary or mandatory?

Answer 1

A guideline is discretionary.

Question 2

Is a policy discretionary or mandatory?

Answer 2

A policy is mandatory.

Question 3

All policies should contain what basic components?

Answer 3

Purpose.
Scope.
Responsibilities.
Compliance.

Question 4

What is the purpose of a policy?

Answer 4

The need for the policy, typically to protect the confidentiality, integrity, and availability of protected data.

Question 5

What is the scope of a policy?

Answer 5

The scope describes what systems, people, facilities, and organizations are included in the policy. To avoid confusion, any related entities not in scope should be documented.

Question 6

What is the responsiblities of a policy?

Answer 6

Responsibilities include responsibilities of the information security staff, policy, and management teams as well as all members of the organization.

Question 7

What is compliance in terms of being one of the basic components of a policy?

Answer 7

Compliance describes two related issues: how to judge the effectiveness of the policies (how well they are working), and what happens when policy is violated (the sanction). All policy must have “teeth”: a policy that forbids accessing explicit content on the Internet is not useful if there are no consequences for doing so.

Question 8

Are procedures mandatory or discretionary?

Answer 8

Procedures are mandatory.

Question 9

What is a procedure?

Answer 9

A procedure is a step by step guide for accomplishing a task.

Question 10

Are standards mandatory or discretionary?

Answer 10

Standards are mandatory.

Question 11

Why are standards important and necessary?

Answer 11

Standards lower the Total Cost of Ownership of a safeguard. Standards also support disaster recovery.

Question 12

Are guidelines mandatory or discretionary?

Answer 12

Guidelines are discretionary.

Question 13

What is a guideline and what is an example?

Answer 13

A guideline is a recommendation or advice. An example of a guideline is “to create a strong password, take the first letter of each word in a sentence, and mix in some numbers and symbols.”

Question 14

What is a baseline?

Answer 14

Baselines are uniform ways of implementing a standard. “Harden the system by applying the Center for Internet Security Linux benchmarks” is an example of a baseline. The system must meet the baseline described by those benchmarks.

Question 15

Besides technical risks, what else can pose the biggest risk to an organization?

Answer 15

People can pose the biggest risk to an organization.

Question 16

Besides technical risks, what else can be considered the biggest risk to an organization?

Answer 16

People can be considered the biggest risk.

Question 17

What are ways to mitigate the risk users pose to an organization?

Answer 17

Background checks should be performed, contractors need to be securely managed, and users must be properly trained and made aware of security risks. Controls such as Non-Disclosure Agreements and related employment agreements are a recommended personnel security control.

Question 18

What is the difference between security awareness and training?

Answer 18

Security awareness modifies the behavior of users while training provides a skill set.

Question 19

What is an example of awareness?

Answer 19

Reminding users never to share accounts or write their passwords down.

Question 20

What types of checks should be done against an individual before hiring them?

Answer 20

Criminal records check should be conducted as well as verification of employment history, education, and certifications. Lying or exaggerating about education, certifications, and related credentials is one of the most common examples of dishonesty in regards to the hiring process. More thorough background checks should be done for roles with heightened privileges, such as access to money or classified information. These checks can include a financial investigation, a more thorough criminal records check, and interviews with friends, neighbors, and current and former coworkers.

Question 21

What types of checks should be done against an individual before hiring them?

Answer 21

Criminal records check should be conducted as well as verification of employment history, education, and certifications. Lying or exaggerating about education, certifications, and related credentials is one of the most common examples of dishonesty in regards to the hiring process. More thorough background checks should be done for roles with heightened privileges, such as access to money or classified information. These checks can include a financial investigation, a more thorough criminal records check, and interviews with friends, neighbors, and current and former coworkers.

Question 22

What should be done immediately when an employee is terminated?

Answer 22

Termination should result in immediate revocation of all employee access.

Question 23

What does a fair termination process look like?

Answer 23

A progressive discipline process includes:

• Coaching
• Formal discussion
• Verbal warning meeting, with Human Resources attendance (perhaps multiple warnings)
• Written warning meeting, with Human Resources attendance (perhaps multiple warnings)
• Termination

Question 24

Why is it important to consider how a vendor with access to multiple organizations’ systems manage access?

Answer 24

Many vendors will re-use the same credentials across multiple sites, manually synchronizing passwords. This increases the risk of stolen, guessed, or cracked credentials being reused to access the organization.

Question 25

Why is it important to consider how a vendor with access to multiple organizations’ systems manage access?

Answer 25

Many vendors will re-use the same credentials across multiple sites, manually synchronizing passwords. This increases the risk of stolen, guessed, or cracked credentials being reused to access the organization.

Question 26

Is training third party personnel for security awareness necessary? What about background checks?

Answer 26

Yes, third party personnel with access to sensitive data must be trained and made aware of risks, just as employees are. Background checks may also be required depending on the level of access. Information security polcies, procedures, and other guidance should apply as well. Additional policies regarding ownership of data and intellectual property should be developed. Clear rule dictating where and when a 3rd party may access or store data must be developed.

Question 27

Is training third party personnel for security awareness necessary? What about background checks?

Answer 27

Yes, third party personnel with access to sensitive data must be trained and made aware of risks, just as employees are. Background checks may also be required depending on the level of access. Information security polcies, procedures, and other guidance should apply as well. Additional policies regarding ownership of data and intellectual property should be developed. Clear rule dictating where and when a 3rd party may access or store data must be developed.

Question 28

What are ways of mitigating the risk of vendor systems in an organizations site?

Answer 28

The same process of hardening systems within the organization should be done on the vendor’s systems. However, it should be discussed with the vendor who should be responsible for this task. Who is responsible for patching and securing vendor systems that exists onsite at the client?

Question 29

What is outsourcing?

Answer 29

Outsourcing is the use of a third party to provide Information Technology support services that were previously performed in-house.

Question 30

What is outsourcing?

Answer 30

Outsourcing is the use of a third party to provide Information Technology support services that were previously performed in-house.

Question 31

What is offshoring?

Answer 31

Offshoring is outsourcing to another country.

Question 32

What is the advantage of outsourcing?

Answer 32

Outsourcing can lower the Total Cost of Ownership by providing IT services at a lower cost. The may enhance the information technology resources and skill set and resources available to a company (especially a small company), which can improve confidentiality, integrity, and availability of data.

Question 33

What is the risk of outsourcing?

Answer 33

Outsourcing to offshore resources can raise privacy and regulatory issues. For example, a U.S. company that offshores data to Australia where there is no HIPAA, SOX, or GLBA.

Question 34

What can be done to mitigate the risks of outsourcing?

Answer 34

A thorough and accurate Risk Analysis must be performed before outsourcing or offshoring sensitive data. If the data will reside in another country, you must ensure that laws and regulations governing the data are followed, even beyond the laws of the offshored jurisdiction. This can be done contractually: the Australian company can agree to follow HIPAA via contract, for example.