Overig uit slides

Question 1

What is an Audit?

Answer 1

“Auditing is the systematic process of objectively obtaining and evaluating evidence regarding assertions about economic activities and events to ascertain the degree of correspondence between the assertions and established criteria, and communicate the results to interested users”

“audit is testing to a norm”

Question 2

Rule-based vs principle-based

Answer 2

Rule-based: “the speed limit is 120 km/h”

Principle-based: “drive responsibly when it is snowing”

Question 3

3 types of control measures

Answer 3

• Preventative measures: make risk (nearly) impossible to occur
• Detective measures: make sure no risks go unnoticed
• Corrective measures: when detected, react appropriately (respond and recover)

Question 4

There are three kinds of IT audits:

Answer 4

• Design: system is adequate for its purpose
• Implementation: design is effectively implemented and operational; procedures are known and used.
• Operating effectiveness: system is effectively operational, for full duration of period

Question 5

PDCA in risk management

Answer 5

• Company sets objectives (plan)
• Company executes business processes (do)
• Process outcomes are recorded (KPIs) and compared to norms reflecting the objectives (check)
• In case of deviation, introduce control measures (act)

Question 6

What are the 4 problems of key management

Answer 6

• key distribution: make sure only authorized people have key
• secrecy: how to keep keys secret
• useability: how to make sure people do not forget (e.g. key phrases)
• storage: on a special device (smart card), stored encrypted. …?

Question 7

4 reasons to protect data

Answer 7

• Privacy: Right to be let alone
• protect citizens: limit the power of states or companies
• autonomy: right to shape one’s own life
• control: right to correct mistakes

Question 8

What are the 6 enterprise information security key questions?

(guest lecture)

Answer 8

1. How secure do we want to be?
2. Which risks do we want to mitigate?
3. Which risks to accept?
4. how secure are we anyway?
5. Are we as secure as we want to be?
6. How much money to spend on information security?

Question 9

Name and explain the 7 main steps of the guest lecture

Answer 9

1. Criticality of business activities: Create an overview of the activities and business assets that need protection, and determine the level of criticality of those assets

2. Operational conditions: Describe the policy and conditions that need to be filled in for the business activities to continue without interruption

3. Risk analysis and risk appetite: Create an overview of the initial business risks and determine the risk appetite of the organization.

4. Enterprise security requirements: Define the business security requirements, the level of protection required for the business assets, based upon the risk appetite of the organization

5. Security architecture: Define security architecture, describing the controls and measures requirement to comply to the enterprise security requirements.

6. Gap and risk analysis: Determine this discrepancies between the requires situation as described in the security architecture and the actual situation. Determine the risks caused by these discrepancies.

7. Management of remaining risks: Decide how to handle the remaining risks. Three main choices: accept, repair, insurance.

Question 10

4 types of hacker actors

Answer 10

Nation state

Hacktivists

Organized Crime

Insiders

Question 11

3 parts of cyber kill chain

Answer 11

Preparation

intrusion

controlled breach