IS Governance Flashcards
How can a Legal team stay up to date on new laws and regulations concerning information security and privacy?
Subscribe to a service that publishes updates on new and changing laws and regulations.
What is the most effective way in conveying the status of an organization’s security program to executive management?
Key risk indicators (KRIs)
Explain the different between policies, standards, guidelines, and procedures.
Policies are overarching assertions of acceptable actions. Standards establish an acceptable level of attainment or quality. Procedures explain how to perform a process and a guideline, which is optional determines a recommended course of action.
What metrics would best show progress on a new SIEM implementation?
% of log sources sending log data and number of use-cases developed.
Define the term Information Security Governance
A process, or set of processes, where senior management exerts strategic control over business functions through policies, objectives, delegation of authority, monitoring, and reporting.
What is the best way to determine tailgating at a building with card readers?
Observe employee behavior using video surveillance
Which member of a cyber risk steering committee should have veto power for specific cyber-risk decisions?
The business owner for a relevant business process or system
Name the CMMI levels
Initial, repeatable, defined, managed, optimizing
Name the elements of a business case
Description of current state, desired state, success criteria, requirements, constraints, approach, and plan.
What is the purpose of an information security steering committee?
Ensure alignment of the information security program with current and future business needs.
What should inform a CISO of new 3rd party service providers?
IT, Legal, and Procurement
What is FAIR?
Factor Analysis of Information Risk is a taxonomy of the factors that contribute to risk and how they affect each other. It is primarily concerned with establishing accurate probabilities for the frequency and magnitude of data loss events. The taxonomy takes a risk and breaks it down into 2 branches of a decision tree called Loss Event Frequency and Loss Magnitude
What is NIST 800-30?
NIST 800-30 is a framework meant to provide guidance for conducting risk assessments of federal information systems and organizations, amplifying the guidance in Special Publication 800-39
What is ISO 27001?
A framework for management of an information security management system
Which of the following is the norm for frequency of security awareness training?
At the time of hire and annually thereafter
What is CIS?
Critical Security Controls, a comprehensive but more lightweight controls framework
What is the ISACA Code of Ethics
- Support the implementation of, and encourage compliance with, appropriate standards and procedures for the effective governance and management of enterprise information systems and technology, including: audit, control, security and risk management.
- Perform their duties with objectivity, due diligence and professional care, in accordance with professional standards.
- Serve in the interest of stakeholders in a lawful manner, while maintaining high standards of conduct and character, and not discrediting their profession or the Association.
- Maintain the privacy and confidentiality of information obtained in the course of their activities unless disclosure is required by legal authority. Such information shall not be used for personal benefit or released to inappropriate parties.
- Maintain competency in their respective fields and agree to undertake only those activities they can reasonably expect to complete with the necessary skills, knowledge and competence.
- Inform appropriate parties of the results of work performed including the disclosure of all significant facts known to them that, if not disclosed, may distort the reporting of the results.
- Support the professional education of stakeholders in enhancing their understanding of the governance and management of enterprise information systems and technology, including: audit, control, security and risk management.
What is the information security governance flow?
Business vision > business strategy > business objectives > IT strategy > IT security strategy > security policy > security standards > security processes > security metrics
What does GRC stand for?
Governance: Generating tools and strategies needed to ensure that personnel follow established policies and procedures
Risk Management: Manage risk to acceptable levels
Compliance: Monitoring and reporting on the policies, procedures, and mechanisms necessary to adhere to regs and mandates from authorities
What are security relationships to business goals?
Enhance profitability, gain market share, increase stock price, expand to new areas, attract new customers, and beat competitors to market
What is a KGI?
Key goal indicators. Retroactively telling management if IT processes have met goals
What is a KPI
Key performance indicators. Tests how processes are performing in reaching goals
What is a KRI
Key risk indicator. Measures that indicate when an org is subject to risk beyond established residual risk
What is BMIS?
Business model for InfoSec. People, Process, Technology triad with Organization at the apex.
In BMIS, how are People and Process connected through a Dynamic Interconnection (DI)?
Emergence
In BMIS, how are People and Technology connected through a Dynamic Interconnection (DI)?
Human Factors
In BMIS, how are Technology and Process connected through a Dynamic Interconnection (DI)?
Enabling and Support
In BMIS, how are People and Organization connected through a Dynamic Interconnection (DI)?
Culture
In BMIS, how are Organization and Technology connected through a Dynamic Interconnection (DI)?
Architecture
In BMIS, how are Organization and Process connected through a Dynamic Interconnection (DI)?
Governing
What is the Zachman Framework?
Systems and environments are described at a high functional level and then in increasing detail, encompassing systems
What is TOGAF
The Open Architecture Framework. A life cycle enterprise architecture framework used for designing, planning, implementing, and governing an enterprise technology architecture.
What are the 6 types of loss in FAIR?
- Productivity
- Response
- Replacement
- Competitive advantage
- Fines
- Reputation
What is FRAP?
Facilitated Risk Analysis Process
What is Safe Harbor
Privacy principles that become obsolete in 2016 and was overridden by Privacy Shield
What is Privacy Shield?
Used by US organizations to choose to self-attest their compliance to GDPR. A framework for regulating data exchanges between the EU and the US. Supersedes Safe Harbor
What are Binding Corporate Rules?
Principles used in multinational orgs’ compliance to GDPR for the protection of internally transferred PII (aka HR data).
