Managing Security Operations

Question 1

Need to Know

Answer 1

Only people with legit need to access data/info can

Question 2

Lease Privilege

Answer 2

Subjects only granted privileges needed to do their work tasks and no more

Question 3

Entitlement

Answer 3

Amount of privileges granted to users, usually when provisioning an account (least privilege)

Question 4

Aggregation

Answer 4

Number of privileges a user collects (least privilege)

Question 5

Transitive trust

Answer 5

Least privilege. All subdomains of a non-transitive trust can access objects in the other domain.

Question 6

separation of privilege

Answer 6

applies sep duties to apps, processes

Question 7

Segregation of duties

Answer 7

Sep of duties + least privilege. Related to SOX Act of 2002

Question 8

2-person rule

Answer 8

takes 2 people to do critical task

Question 9

Job Rotation

Answer 9

deterrent + less dependent on a single person

Question 10

Monitor special privileges

Answer 10

Good to do

Question 11

Managing the Info Life Cycle

Answer 11

Marking Data
Handling Data
Storing Data
Destroying data

Question 12

SLAs

Answer 12

Performance expectations for outside vendor