Module 1 - Intro to Legal and Ethics

Question 1

Three aspects of securing computer

Answer 1

balance between confidentiality, integrity, and availability.

Question 2

Regulations

Answer 2

Combination of policies and laws

Question 3

Demonstrate Compliance with Regulations Through…

Answer 3

Verification, validation, and reporting

Question 4

3 Examples of legislation to protect financial investments in IS systems

Answer 4

Clinger-Cohen Act E-Government Act FISMA

Question 5

FISMA (acronym)

Answer 5

Federal Information System Management Act

Question 6

E-Government Act (purpose)

Answer 6

promote and use: - E-Government services - and use of Internet and technology by U.S. citizens and its government agencies

Question 7

FISMA (implications)

Answer 7

• Title III of E-Government Act - intro. series of controls and oversight to help secure government IS. - Tactical decisions left up to individual agencies (result is each Federal agency and Department at various levels of compliance through risk mitigation)

Question 8

OMB Circular A-130 (background & result)

Answer 8

Office of Management and Budget - built on Computer Security Act of 1987 - ties budget review to compliance with Info security controls.

Question 9

E-Government Act (Findings)

Answer 9

• Use of computers and Internet rapidly transforming societal interactions and the relationships among citizen, businesses, and Government - Federal Gov. has had uneven success in applying technology to enhance functions and services - most Gov services have been developed and presented separately.

Question 10

Privacy Impact Assessments

Answer 10

• Required by E-Gov Section 208 So as to : - document and justify why PII is collected - identify what type of PII collected - identify security plans to protect PII

Question 11

FISMA (Purpose)

Answer 11

provide comprehensive framework for ensuring effectiveness of information security controls

Question 12

Information Security (definition)

Answer 12

protecting information and information systems from unauthorized access, use, disclosure, disruption, modification or destruction in order to provide: integrity confidentiality availability

Question 13

national security system (definition)

Answer 13

any information system (including any telecommunications system) used or operated by an agency or by a contractor of an agency, or other organization on behalf of an agency

Question 14

Agency Director Responsibilities Under FISMA

Answer 14

1 - implementation of policies and guidelines on information security 2 -to identify and provide information security protections commensurate with the risk 3 -coordinating the development of standards and guidelines under section 20 of the National Institute of Standards and Technology Act 4 - overseeing agency compliance 5 - reviewing at least annually and approving IS programs 6 - coordinating IS policies and procedures with management policies and procedures 7 -overseeing the operation of the Federal information security incident center 8 - reporting to Congress on compliance

Question 15

Evaluation Requirement (FISMA)

Answer 15

Each year - independent evaluation of the information security program and practices to determine effectiveness.

Question 16

OMB Circular A-130 (Appendix III) (Result)

Answer 16

established a minimum set of required controls for Federal Information Systems

Question 17

Major Application (under OMB A-130)

Answer 17

An application that requires special attention to security due to the risk and magnitude of the harm resulting from the loss, misuse, or unauthorized access to or modification of the information in the application.

Question 18

General Support System (Under OMB A-130)

Answer 18

An interconnected set of information resources under the same direct management control which shares common functionality.

Question 19

OMB A-130 Responsibilities for DoC

Answer 19

Department of Commerce:

• develop standards and guidance
• review guidelines for traiing
• guidance in security planning
• cost-effect control for interconnecting
• coordinate incident response activities
• evaluate new technologies for security vulnerabilities

Question 20

OMB A-130 Responsibilities for DoD

Question 21

OMB A-130 Responsibilities for DOJ

Answer 21

• guidance on legal remedies regarding security incidents
• pursue legal actions

Question 22

OMB A-130 Responsibilities for GSA

Answer 22

• guidance on security considerations for acquitsition
• facilitate contract vehicles
• provide security services