Security Management

Question 1

Security Management

Answer 1

Security management is primarily concerned with strategic-level activities that influence the operation of systems and the behaviour of employees.

Security management involves several key activities, including:
- Executive oversight
- Governance
- Policy, guidelines, standards, and procedures
- Roles and responsibilities
- Service level agreements
- Secure Outsourcing
- Certification and accreditation
- Internal Audit

Question 2

Security Executive Oversight

Answer 2

The support and oversight by executives of security-related activities is vital to the viability of a security program in an organisation.

Several activities are related to this oversight:

• support of policies
• Allocation of resources
• support of risk management

Question 3

Security Governance

Answer 3

The set of responsibilities and practices exercised by the board and executive management with the goal of providing strategic direction, ensuring that objectives are achieved, ascertaining that risks are managed appropriately and verifying that the enterprise’s resources are used responsibility.

Question 4

Policies

Answer 4

Security Policies describe constraints of behaviour for an organisation’s personnel as well as the acceptable use of its information systems, data and other mechanism.

They specify the activities that are required, limited or forbidden in an organisation.

Question 5

ISO 27002:2013

Answer 5

Information technology Security techniques Code of Practice for Information Security Management is a well known framework on which an organisation can build its security policy.

Question 6

Requirements

Answer 6

Refers to characteristics of an information system or business process. Requirements should reflect security policy.

Question 7

Guidelines

Answer 7

Guidelines provide information on how policy can be implemented.

Question 8

Standards

Answer 8

Statements that specify what shall be used to support security policies and guidelines.

Typically standards will comprise:
- Product standards
- Process standards
- Technology standards
- Reference configurations
- Reference Architectures

It is expected that standards will change way more frequently than policies and guidelines.

Question 9

Procedures

Answer 9

The instructions that specify how tasks are to be performed.
The purpose of a procedure is to ensure the consistent and methodical completion of repetitive tasks.