Pre-Contract: InfoSec Questionnaire Flashcards
Cyber Intake
Now what do you do?
Access to determine Residual Risk
Using a risk-based approach
-Assuming there are triggers in the IRQ, then you use those triggers to determine residual risk and the risk based approach. How much effort you’re going to don on an ongoing basis
Info-Sec Questionnaire
-Data protection
-Encryption
-Server Security
-Application Security
-Application Programing Interface (API)
-Network Security
-Security Administration
-Physical/Environmental Security
-Incident Response
-Change Management
-Technology Oversight
Info-Sec Questionnaire:
Data protection
Evaluation of controls around data governance, data loss prevention, data recovery, and data integrity.
-Set of controls around data governance, data loss, data loss prevention, data integrity
Info-Sec Questionnaire:
Encryption
Evaluation of controls around encryption protocol, key management, and password storage.
-protocols, password storage
Info-Sec Questionnaire:
Sever Security
Evaluation of controls related to patch management, server configuration, and technology refresh activities.
-hardware, patch management
Info-Sec Questionnaire:
Application Security
Evaluation of controls related to application testing, patch management, and access controls
Info-Sec Questionnaire:
Application Programming Interface (API)
Evaluation of controls around data collection, rate limits, and API service definitions.
-Two apps talk to each other the way they can talk to each other
Info-Sec Questionnaire:
Network Security
Evaluation of controls around patch management, penetration testing, network segmentation, & firewall rules.
Info-Sec Questionnaire:
Security Administration
Evaluation of controls around access reviews & logon attempts.
-Access reviews, login attempts
-Access reviews elevated access or access that should be cut off
Info-Sec Questionnaire:
Physical/Environmental Security
Evaluation of controls around physical & environmental security.
-handling paper documents
Info-Sec Questionnaire:
Incident Response
Evaluation of controls around incident response plans and testing.
-Critical in third party space
-How the vendor does incident response
Info-Sec Questionnaire:
Change Management
Evaluation of controls around development & testing.
-How they do development and testing
Info-Sec Questionnaire:
Technology Oversight
Evaluation of controls around technology governance.
-How they do technology governance, governance around controls in technology
TEST
Question on how you figure out what your next step is. Your evaluated on how you access controls
