Lecture 12

Question 1

What is social engineering?

Answer 1

Psychological manipulation to trick people into making security mistakes or giving away sensitive information.

Question 2

Who was Kevin Mitnick?

Answer 2

Once known as the world’s most-wanted hacker, later became a security consultant; famous for using social engineering.

Question 3

According to Kevin Mitnick, what is the biggest threat to a company’s security?

Answer 3

The human element, not technology.

Question 4

What is Information Security Governance?

Answer 4

Information Security Governance is the system by which an organization directs and controls its information security efforts.

Question 5

What is COBIT?

Answer 5

A framework to help organizations develop, implement, and monitor IT governance and management.

Question 6

Name two examples of COBIT control practices.

Answer 6

Using unique user IDs and conducting regular reviews of user access rights.

Question 7

What is the difference between effective and non-effective security governance?

Answer 7

Effective governance involves active senior management participation and accountability; non-effective governance neglects information security.

Question 8

What is a security policy?

Answer 8

A high-level, broad statement outlining an organization’s security goals and objectives.

Question 9

What are procedures and processes in security?

Answer 9

Step-by-step instructions on how to implement security policies.

Question 10

What are standards in security management?

Answer 10

Mandatory elements detailing how a policy is to be enforced.

Question 11

What are guidelines in security management?

Answer 11

Recommended but not mandatory steps related to a policy.

Question 12

What should an organizational security policy address?

Answer 12

Scope, purpose, IT security requirements, risk management, incident handling, training, and business continuity.

Question 13

What is the role of an IT Security Officer?

Answer 13

Oversees security strategies, policies, incident handling, and awareness programs.

Question 14

What are examples of organizational security policies?

Answer 14

Acceptable use policy, access control policy, data protection policy, physical security policy.

Question 15

What are the four steps of the policy lifecycle?

Answer 15

Plan, Implement, Monitor, and Evaluate.

Question 16

What is IT Security Management?

Answer 16

A process to protect critical assets in a cost-effective manner by identifying risks and applying safeguards.

Question 17

Who is responsible for security management?

Answer 17

Management, IT security staff, IT staff, users, third parties.

Question 18

Name a few information security job roles.

Answer 18

Chief Security Officer, Information Security Manager, Physical Security Manager, Security Technician.

Question 19

What is the purpose of security awareness programs?

Answer 19

To inform employees about security responsibilities and promote a security-conscious culture.

Question 20

What is ISO 27002?

Answer 20

A code of practice providing guidelines for organizational information security management and controls.

Question 21

What is ISO 27001?

Answer 21

Specifies the requirements for establishing and maintaining an Information Security Management System (ISMS).

Question 22

What is the difference between ISO 27001 and ISO 27002?

Answer 22

ISO 27001 defines how to manage security controls; ISO 27002 provides best-practice security controls.

Question 23

Why is asset management important?

Answer 23

To understand what needs protection and how much investment it requires.

Question 24

What are key elements of human resource security?

Answer 24

Background checks, security training, proper termination procedures.

Question 25

What is the goal of security during hiring?

Answer 25

Ensure new hires understand security responsibilities and reduce risks like theft or misuse.

Question 26

What must employment agreements include?

Answer 26

Confidentiality agreements, acknowledgment of security policies, employee responsibilities.

Question 27

What are essential during employment?

Answer 27

Awareness programs, least privilege, separation of duties, and reducing human error risks.

Question 28

What is important during termination of employment?

Answer 28

Removal of access rights, retrieval of assets, and notifying security departments.

Question 29

What are concerns related to email and Internet use policies?

Answer 29

Productivity loss, malware risk, inappropriate online conduct.

Question 30

Why have security incident response procedures?

Answer 30

For quick recovery, legal compliance, and learning from incidents.

Question 31

What is physical security?

Answer 31

Measures like fences, locked doors to protect access to sensitive areas.

Question 32

What is access control?

Answer 32

Managing and restricting access to data, services, and systems.

Question 33

Why consider security during systems development and maintenance?

Answer 33

To maintain operational security through patches, secure support, and proper project management.

Question 34

What is business continuity planning?

Answer 34

Measures ensuring operations can continue after major failures or disasters.

Question 35

What is compliance in security management?

Answer 35

Meeting legal, regulatory, and contractual obligations while minimizing business process disruptions.

Question 36

What is PCI-DSS?

Answer 36

A standard for organizations that handle credit card data, ensuring secure payment processing.

Question 37

What is IT Security Operations?

Answer 37

Managing daily operations to ensure security of people, applications, and assets post-implementation.

Question 38

What is a Security Operations Center (SOC)?

Answer 38

A facility for monitoring, assessing, and protecting enterprise IT systems and networks.