IT Governance and Compliance Flashcards
Data classification - what are the 4 classifications
- top secret
- secret
- sensitive
- public
What are the 4 principles and activities in an Information Security Policy
Roles and responsibilities
Risk management
Security processes - defined by security policy: vulnerability and incident mngt, swft dev, hiring, vendor mngt
Acceptable use
Security policy and security mngt should be separate from what 2 items?
IT mngt and IT policy
Data classification policy sets levels of sys security that correspond to —————
Data classification
Who correctly classifies a document or data’s classification policy?
Data owner
Site classification policy, dimensions to set levels of phys security:
(5)
Criticality of staff there
Criticality of business perf there
Value of assets
Sensitivity of data
Siting risk of location
3 social media policy dimensions
Personal
Professional
Disclosure of company info
3 other tech policies
Equipment control and use
Data destruction
Moonlighting
Processes and procedures (sop)
The “how”
3Ds and R contained in a procedure document:
Document/process owner
Doc revisions
Reviews and approvals
Dependencies
Standards
Which is not valid? Tech standards Protocol standards Controls standards Supplier standards Methodology Configure Architecture
Controls
Methodology standards?
Including:
software dev,
sys administration
Network engineering
End user support
Laws and regulations: what do you evaluate to gauge impact? 4
Enterprise architecture
Controls
Processes
Personnel
What is the standard for storage and transmission of credit card data?
PCI-DSS
Payment card industry data security standard
Risk mngt
4 risk actions (treatments)
Accept
Mitigate or reduce
Share or transfer
Avoid
Risk mngt program
Examples of objectives
Reduce network penetrations
Reduce incidents
Risk mngt program
1- Example of scope
2- What is authority
3- Example of resources
4- What is the remaining dimension needed?
1- What business units are involved?
2 - who said to establish the program? What is their support?
3- budget, software, staff
4- policies, procedures and records
Risk mngt lifecycle
What comes after asset identification?
Risk analysis
Risk IT Framework has 3 components:
Risk G——-
Risk E——-
Risk R——-
Risk governance
Risk evaluation
Risk response
Risk IT Framework has 3 things
Risk g
Risk e
Risk r
Governance
Evaluation
Response
Sources of asset data for risk management
Financial systems a——- I——
Financial system asset inventory
Other sources of asset data
Interviews
IT systems portfolio (is what?)
Docs around major applications.
Online data
Asset management system
Risk analysis formula
What is FAIR?
Risk = probability x impact
Factor analysis of information risk
Threat analysis is to ID all possible/reasonable threats.
Natural
Man made
Severe storms Flooding Fire Labor issues Power outage Criminal Errors
What is a logical threat analysis?
Malware
All that aren’t physical
Vulnerability IDentification
Missing or broken antivirus
Weak passwords
Missing audit logs
Building entrance that permits tailgating
Probability analysis that a threat will actually be realized
Impact analysis is …
A realized threat will have some effect on org. Must know how an asset impacts business processes. Must have a h m l rating
Imagine act analysis must also have what?
Statement ——-//
If impact
Qualitative risk analysis
In scope assets, threat vulnerability (and ——-/) and statement of —
And severity
Statement of impact
Quantitative risk analysis
Risk are expressed with financial measure
Standard quantitative risk analysis requires values for
A—- E—— S—expectancy ARO ALE
Asset Value
Exposure Factor: AV-salvage
Single loss expectancy: AVxEF
Annualized rate of occurrence: times per year
Annualized loss expectancy: SLE x ARO
ALEs
Can be added together for identification
But separated for treatments
How do you transfer risk?
With insurance policy
Avoidance by remote bing asset or practice
Residual risk formula
Original risk -mitigated risk-transferred risk = residual risk
PCI-DSS
Payment Card Industry - Data Security Standards
Ofac
Office of Foreign Asset Control
Offsite local
Offsite remote
Personnel are near the office in community
Personnel are in another community but in country
ITIL
Information Technology Infrastructure Library
Risk with outsourcing
Errors and omission - data breaches? Higher than expected costs Poor quality and performance Loss of control Lowered employee morale Audit and compliance right to audit Time zone difference
Leverage for outsourcing
Money
Bad/good reviews
Mitigating outsourcing risks
SLA
Security policy and controls -right to audit Quality - error rates Vet backgrounds Who owns intellectual property Schedule Regulations Warranty Dispute resolution Payments
Outsourcing governance
Can’t outsource accountability
Contracts and work orders
Sow contains details
Change management
Security - they must have security controls
Quality standards
Metrics
Audits
ITIL 5 volumes
See strat Serb design Serb transition Service operation Continual service improvement
