IS4550 CHAPTER 5 Flashcards
A STATE OF INDIFFERENCE, OR THE SUPPRESSION OF EMOTIONS SUCH AS CONCERN, EXCITEMENT, MOTIVATION AND PASSION is called ___.
APATHY
An individual accountable for assess ing the design and effectiveness of security policies and may be internal or external to an organization is called ___.
AUDITOR
An individual accountable for monitoring adherence to laws and regulations is called ___.
COMPLIANCE OFFICER
An individual responsible for the day-to-day maintenance of data and the quality of that data. May perform backups and recover data as needed. Also grants access based on approval from the data owner is called ___.
DATA CUSTODIAN
An individual who establishes procedures on how data should be handled is called ___.
DATA MANAGER
An individual who approves user access rights to information that is needed to perform day-to-day operations is called ___.
DATA OWNER
The end user of an application. Is accountable for handling data appropriately by understanding security policies and following approved processes and procedures is called ___.
DATA USER
How various tasks are grouped into specialties to enhance the depth and quality of work product is called ___.
DIVISION OF LABOR
A senior business leader accountable for approving security policy implementation, driving the security message within an organization, and ensuring that policies are given appropriate priority is called ___.
EXECUTIVE
An organization with few layers separating the leaders from the bottom ranks of workers is called ___.
FLAT ORGANIZATIONAL STRUCTURE
An organization with multiple layers of reporting, which separates leaders from the bottom ranks of workers is called ___.
HIERARCHICAL ORGANIZATIONAL STRUCTURE
An individual accountable for identifying, developing, and implementing security policies and corresponding security controls is called ___.
INFORMATION SECURITY OFFICER (ISO)
Relates to the number of areas of control achieved through the number of direct reports found in an organization is called ___.
SPAN OF CONTROL
- Which of the following is a basic element of motivation?
- Pride
- Self-interest
- Success
- 2 and 3
- All the above
ALL THE ABOVE
Pride
Self-interest
Success
- Which personality type often breaks through barriers that previously prevent success?
- Attackers
- Commanders
- Analyticals
- Pleasers
Commanders
- Avoiders like to ___ and will do ___ but not much more.
Be in the background; precisely what is asked of them
- As the number of specialties increases so does ___.
The cost of business
- In hierarchical organizations, the leaders are close to the workers that deliver products and services.
TRUE OR FALSE
FALSE
- User apathy often results in an employee just going through the motions.
TRUE OR FALSE
TRUE
- Which of the following is a method for overcoming apathy?
- Avoiding redundancy
- Issuing company directives
- Engaging in communication
- Requiring obedience to policies
Engaging in communication
- Why is HR policy language often intentionally vague?
Vague avoids language that could be interpreted as an employment contract or unintended promise.
Vague allows managers and lawyers the flexibility to interpret and apply policies broadly.
- In the case of policies, it is important to demonstrate to business how policies will reduce risk and will be derived in a way that keeps costs low.
TRUE OR FALSE
TRUE
- Interpreting security policies against new business situations and new technologies ensures the business gets the maximum benefit from the policies over time.
TRUE OR FALSE
TRUE
- Kotter’s EightStep Change Jodel can help an organization gain support for ___ changes.
Security policy
- When a catastrophic security breach occurs, who is ultimately held accountable by regulators and the public?
- Company officers
- The CIO
- The ISO
- The data owner
Company officers
- Which of the following are attributes of entrepreneurs?
- Innovators
- Well educated in business management
- More likely to take risks
- 1 and 3
- 2 and 3
1 & 3
Innovators
More likely to take risks
- A company can have two sets of enterprise security policies, if necessary, to address the needs of individual business units.
TRUE OR FALSE
FALSE
- Which of the following is the best measure of success for a security policy?
- Number of security controls developed as a result
- The number of people aware of the policy
- Reduction in risk
- The rank of the highest executive who approved it
Reduction in risk
