Section 30: Policies and Procedures Flashcards
Data Owner
Responsible for labeling the asset and ensuring that it is protected with appropriate controls
Data Steward
A role focused on the quality of the data and associated metadata. Works for the data owner.
Data Custodian
A role responsible for handling the management of the system on which the data assets are stored.
Privacy Officer
A role responsible for the oversight of any PII, etc. assets managed by the company
SOX
Affects publicly traded US corporations and requires certain accounting methods and financial reporting requirements
GLBA
Act that affects financial institutions and PII.
FISMA Act of 2002
All about cybersecurity and to create more across the federal government.
PCI DSS
Contractual obligation if you want to be in compliance for payments
Deidentification
Methods and technologies that remove identifying information from data before it is distributed
Data Masking
placing generic labels in place of the real stuff. It’s like covering it up
Tokenization
A deidentification method where a unique token is substituted for real data
Acceptable Use Policy
Defines the rules that restrict how a computer, network, or other systems may be used
Change Management Policy
Defines the structured way of changing the state of a computer system, network, or IT procedure
Separation of Duties
Sort of like a checks and balances system where you separate out different things so one person doesn’t have to much power
Job Rotation
Different users are trained to perform the tasks of the same position to help prevent and identify fraud that could occur if only one employee had the job
Due Care
Mitigation actions that an organization takes to defend against the risks that have been uncovered during due diligence.
Due Process
A legal term that refers to how an organization must respect and safeguard personnel’s rights
Security Awareness Training
Used to reinforce to users the importance of their help in securing the organization’s information
Security Training
Used to teach the organization’s personnel the skills they need to perform their job in a more secure manner (more general in nature)
Memorandum of Understanding (MOU)
Formal version of a gentleman’s agreement, except people sign it. Letter of intent.
Service-Level Agreement (SLA)
An agreement concerned with the ability to support and respond to problems within a given timeframe and continuing to provide the agreed upon level of service to the user
Five steps of Disposal
define what equipment will be disposed
pick a place for it to live
analyze equipment and what’s going to be done with it
sanitize the drives, etc.
Throw away or recycle the device
Five steps of Disposal
define what equipment will be disposed
pick a place for it to live
analyze equipment and what’s going to be done with it
sanitize the drives, etc.
Throw away or recycle the device
Center for Internet Security (CIS)
Tells us “What are the things we should be using in order to be up to snuff for security?”
Risk Management Framework (RMF)
A process that integrates security and risk management activities into the system development life cycle through an approach to security control selection and specification.
Cybersecurity Framework 5 steps
Identify
Protect
Detect
Respond
Recover
ISO 27001
An international standard basic cybersecurity framework
