IS 4550 CHAPTER 13

Question 1

In terms of information security, this refers to adding information security as a distinct layer of control. ___ security is the opposite of integrated security, in which information security controls are an integral part of the process design and not a separate distinct layer.

Answer 1

BOLT-ON

Question 2

This outlines what information is to be shared and how the information will be disseminated and is called ___.

Answer 2

COMMUNICATIONS PLAN

Question 3

Training done partly or fully on computer-based channels of communication, such as the Internet or through training software and is called ___.

Answer 3

COMPUTER-BASED TRAINING (CBT)

Question 4

Getting senior management to participate in training to improve the effectiveness of security policies is called ___.

Answer 4

EXECUTIVE MANAGEMENT SPONSORSHIP

Question 5

This is a gathering of teams to make announcements and discuss topics and is called ___.

Answer 5

TOWN HALL MEETING

Question 6

1. Which of the following indicate that the culture of an organization is adopting IT security policies?
2. Security policies are part of routine daily interaction
3. Security policies are supported by organizational committee
4. Security policies’ core values are demonstrated in workers’ instinctive reactions to situations
5. All the above

Answer 6

• Security policies are part of routine daily interaction *Security policies are supported by organizational committee
• Security policies’ core values are demonstrated in workers’ instinctive reactions to situations

Question 7

2. Effective security policies require that everyone in the organization be accountable for policy implementation.
   TRUE OR FALSE

Answer 7

TRUE

Question 8

3. A quick indicator of whether a risk committee has discussed security policies or if the topic has been delegated to lower levels is by looking at ___.

Answer 8

Committee meeting minutes

Question 9

4. Deliberate acts and malicious behavior by employees are easy to control, especially when proper deterrents are installed.
   TRUE OR FALSE

Answer 9

FALSE

Question 10

5. Which of the following is not an organizational challenge when implementing security policies?
6. Accountability
7. Surplus of funding
8. Lack of priority
9. Tight schedules

Answer 10

Surplus of funding

Question 11

6. Which type of plan is critical to ensuring security awareness reaches specific types of users?
7. Rollout plan
8. Media plan
9. Executive project plan
10. Communication plan

Answer 11

Communication plan

Question 12

7. Why should a security policy implementation be flexible to allow for updates?
8. Unknown threats will be discovered
9. New ways of teaching will be introduced
10. New technologies will be introduced
11. 1 and 3
12. All the above

Answer 12

Unknown threats will be discovered

New technologies will be introduced

Question 13

8. which of the following is the least objectionable when dealing with policies in regards to outdated technology?
9. Write security policies to best practices and issue a policy waiver for outdated technology that inherently cannot comply
10. Write security policies to the lowest, most common security standard the technology can support
11. Write different sets of policies for outdated technologies
12. All the above

Answer 13

Write security policies to best practices and issue a policy waiver for outdated technology that inherently cannot comply

Question 14

9. What is a strong indicator that awareness training is not effective?
10. A firewall breach
11. Sharing your password with a supervisor
12. Sharing a laptop with a coworker
13. A fire in the data center

Answer 14

Sharing your password with a supervisor

Question 15

10. Which of the following is a common cause of security breaches?
11. Improved training and security awareness
12. Increased employee motivation
13. Outsourced processing to vendors
14. Inadequate management and user decisions

Answer 15

Inadequate management and user decisions

Question 16

11. classroom training for security policy awareness is always the superior option to other alternatives,, such as online training.
    TRUE OR FALSE

Answer 16

FALSE

Question 17

12. To get employees to comply and accept security policies, the organization must understand the employee’ ___.

Answer 17

Motivations or needs

Question 18

13. A brown bag session is a formal training event with a tightly controlled agenda.
    TRUE OR FALSE

Answer 18

FALSE

Question 19

14. What is the best way to disseminate a new policy?
15. Hardcopy
16. Intranet
17. Brown bag session
18. All the above

Answer 19

Hardcopy
Intranet
Brown bag session

Question 20

15. Without ___, implementation of IT security policies is impossible.

Answer 20

Executive support