Organizational Security Flashcards
What does quantitative risk analysis include?
Quantitative risk analysis includes intangible factors such as a loss of potential business in determining costs.
What is quantitative risk analysis.
Quantitative risk analysis is a dollar amount calculation of the exact cost of the loss due to a disaster.
How do you calculate in your Annual Loss Expectancy (ALE)?
ALE is calculated by multiplying the Annual Rate of Occurrence (ARO) in the single loss expectancy [SLE].
What is a false positive?
A false positive is a legitimate action that is perceived as a risk or threat.
What is a false negative?
A false-negative is a security issue that has passed your security controls as a legitimate action.
what is an acceptable use policy?
An acceptable use policy is a set of established guidelines for the appropriate use of computer networks within an organization.
What should be done once a user has been terminated?
All user access including physical and network access controls needs to be disabled for an employee once they’ve been terminated this prevents the employee from accessing the facility or the network.
After a few incidents where customer data was transmitted to a third-party, your organization is required to create and adhere to a policy that describes the distribution protection and confidentiality of customer data which policies do you create?
A privacy policy is created.
You are performing a risk analysis for a complex web-based application. Based on your conclusions regarding the probability, impact, and mitigation cost of an attack based on DNS manipulations or poisoning against your web domain, you decide to place the responsibility of the risk on your ISP, which handles your DNS service. Which risk-management option is this an example of?
Transference.
Is the centralize management location from which you provide Internet-based application services to several external clients, which policy do you provide to your clients as an agreement for service uptime?
Service level agreement [SLA]
There is a suspicion that a specific employee is performing illegal activities on your computer’s networks. In an effort to gather evidence about his activities, which principle and technique could you employ?
Mandatory vacation
As part of a risk analysis of a very large and extensive back end database, you need to calculate the probability and impact of data corruption to the data. Which impact factor allows you to calculate your annual loss due to data corruption?
Annual loss expectancy [ALE] describes how much money you expect to lose on an annual basis because of the impact from the occurrence of a specific risk.
You need to create an overall policy for your organization that describes how your users can properly make use of company communications services, such as Web browsing, email and FTP services which policy do you implement?
Acceptable use policy
After the initial configuration of an anti-spam email filtering appliance on your network, users are complaining that too many legitimate messages are being flagged as spam in their mailbox. Which concept is this an example of?
False positive
Your organization deals with sensitive health insurance information for patients that is covered by the HIPAA compliance policies. Which DLP security technologies would you implement to help protect the confidentiality and privacy of your patient’s health insurance data when communicating the information between healthcare facilities?
Encryption of outbound data containing health insurance information.
It has been discovered that a former member of the IT department who switched to the development team still has administrative access to many major network infrastructure devices and servers. Which mitigation techniques should be implemented to help reduce the risk of this event reoccurring?
Regular user permission and rights reviews.
A high-level executive has been terminated due to sharing company confidential data with competitors. Which action should be immediately performed?
Change the password and disable all user accounts for the user.
What is a privacy policy?
A privacy policy concerns the protection and distribution of private customer data. Any company, especially one engaged in online activities or e-commerce, has a responsibility to adopt and implement a policy for protecting the privacy of individually identifiable information.
What is a service level agreement [SLA]?
A service level agreement is an understanding among a supplier of services and the clients of those services that the service in question will be available for a specific percentage of time.
What is a zero day attack?
A zero day attack takes advantage of existing software security vulnerabilities before a security fix his been developed or applied.
Name the three risk control types
1 management - An ongoing high-level function within your organization
2 operational - how you conduct your daily organizational business to minimize the security risks to your organization and its business activities.
3 technical -actual technical measures used to prevent security risks in your organization
Name the four access control policies
1 least privilege
2 separation of duties
3 job rotation
4 mandatory vacation
