Protection Needs Elicitation (PNE)

Question 1

PNE

Answer 1

The determination of security requirements is also known as Protection Needs Elicitation

Question 2

PNE begins

Answer 2

discovery of assets that need to be protected from

unauthorized access and users.

Question 3

IATF

Answer 3

Information Assurance Technical Framework

IATF) is a set of security guidelines that covers Information Systems Security Engineering (ISSE

Question 4

PNE is the first step of IATF to

Answer 4

Engage the customer, Information management modeling, Identify least privilege applications, Conduct threat modeling and analysis, Prioritize based on customer needs, Develop information protection policy, and Seek customer acceptance.

Question 5

PNE activities

Answer 5

Brainstorming, Surveys (Questionnaires and Interviews), Policy Decomposition, Data Classification, Subject-Object Matrix, Use Case & Misuse Case Modeling.

Question 6

Brainstorming

Answer 6

the quickest and most unstructured method to glean

security requirements.

Question 7

Brainstorming shortcomings

Answer 7

high degree of likelihood that the brainstormed ideas don’t directly relate to the business, technical and security context of the software; can either lead to ignoring certain critical security considerations or going overboard on a non-trivial security aspect of the software; very subjective.

Question 8

Surveys (Questionnaires and Interviews)

Answer 8

Surveys are effective means to collect functional and assurance requirements. The effectiveness of the survey is dependent on how applicable the questions
in the surveys are to the audience that is being surveyed.

Question 9

Questionnaires cover

Answer 9

business risks, process (or project) risks and technology (or product) risks.

Question 10

Policy Decomposition

Answer 10

a crucial step in the process of gathering requirements and an appropriate level of attention must be given to this process.

Question 11

Policy Decomposition process

Answer 11

Policy documents internal & external (e.g. PCI DSS); high level objectives (e.g. confidentiality); security requirements (e.g. Identify Management); software security requirements (e.g. Input Validation).

Question 12

high level objectives

Answer 12

CFG – Configuration management; SEG – Segregated environments; SOD – Separation of duties; DAT – Data protection; PRC – Production readiness checking and CRV – Code review.

Question 13

Types of Data

Answer 13

primarily designated as structured data (e.g. database) or unstructured data (e.g. image, video, email) for the purposes of classification.

Question 14

Data classification

Answer 14

the conscious effort to assign labels (a level of sensitivity) to information (data) assets, based on potential impact to confidentiality, integrity and availability (CIA), upon disclosure, alteration or destruction.

Question 15

Data classification objective

Answer 15

to lower the cost of data protection and maximize the return on investment when data is protected.

Question 16

NIST SP800-18

Answer 16

Guide for developing security plans for Federal Information system. It provides a framework
for classifying information assets based on impact to the CIA.

Question 17

Business owner / Data owner

Answer 17

decision to classify data, who has access and what level of access, etc

Question 18

Business/data owner responsibility

Answer 18

assets are appropriately classified; validate that security controls are implemented as needed by
reviewing the classification periodically; define authorized list of users and access criteria based on
information classification; ensure appropriate backup and recovery mechanisms are in place; delegate as needed the classification responsibility, access approval authority, backup and recovery duties to a data custodian.

Question 19

data custodian responsibility

Answer 19

Perform the information classification exercise; Perform backups and recovery as specified by the data owner; Ensure records retention is in place according to regulatory requirements or organizational retention policy.

Question 20

DLM

Answer 20

Data Lifecycle Management - a policy-based approach, involving procedures and practices, to protect data throughout the information life cycle: from the time it is created to the time it is disposed or deleted.

Question 21

First component of DLM

Answer 21

Data classification, once data is organized into appropriate categories (or tiers) appropriate controls
can be applied to protect the confidentiality, integrity and availability of data.

Question 22

Secure memory management

Answer 22

prevents disclosure of data when data is processed.

Question 23

Cryptographic protection

Answer 23

encryption and hashing, in conjunction with end-to-end secure communication protocols operating in the transport (e.g., SSL/TLS) or network (e.g., IPSec) layer protects data when it is transmitted.

Question 24

DLP

Answer 24

Data Leakage Prevention technologies come in

handy to protect against unauthorized disclosures when data is transmitted.

Question 25

Database encryption

Answer 25

a control that is useful to protect sensitive or private data during storage. E.g. Hierarchical Storage
Management (HSM) represents different types of storage media, ranging from Redundant Array of Inexpensive Disks (RAID) systems, optical storage, or tape, solid state drives.

Question 26

Secure disposal

Answer 26

deletion or physically destruction of the data, additionally, the media in which the data was stored must be sanitized.

Question 27

Subject (or role)/Object Matrix

Answer 27

used to identify allowable actions between subjects (or role) and objects based on use cases.

Question 28

Use Case Modeling

Answer 28

a mechanism by which software functional and security requirements can be determined, it models the intended behavior of the software or system.

Question 29

Misuse Case Modeling

Answer 29

known as abuse cases (intentional or accidental) help identify security requirements by modeling negative scenarios, it is an unintended behavior of the system, one that the system owner does not want to occur within the context of the use case.

Question 30

SQuaRE

Answer 30

Secure Quality Requirements Engineering methodology consists of nine steps that generate a final deliverable of categorized and prioritized security
requirements.

Question 31

RTM

Answer 31

Requirements Traceability Matrix - a table of
information that lists the business requirements in the left most column, the functional requirements that address the business requirements are in the next column. Next to the functional requirements are the testing requirements.

Question 32

RTM benefits

Answer 32

Ensures that No scope creep occurs; Assures that the design satisfies the specified security requirements; Ensures that implementation does not deviate from secure design; Provides a firm basis for defining test cases.