Security Management

Question 1

ISO27000 series

Answer 1

The goal in developing the standard was to provide guidance to organisations on how to design, implement, and maintain policies, processes and technologies to manage risks to its sensitive information assets.

Industry best practise.

Question 2

ISO27001 (ISMS management)

Answer 2

ISO 27001 specifies requirements for establishing, implementing, maintaining and continually improving an information security management system (ISMS) within the context of the organization.

Question 3

ISO27002

Code of practise for information security controls

Answer 3

Code of practice for information security controls.

ISO 27002 provides a checklist of general security controls to be considered implemented/used in organizations.

Question 4

What’s the purpose of ISMS?

Answer 4

An ISMS outlines the controls that need to be put into place, and provides direction on how those controls should be managed throughout their life cycle.

Question 5

Handling personnel/ employee departure

Answer 5

Different reasons for departure:
- Voluntary, Redundancy, Termination

Different types of actions:

• Former employee may keep some privileges
• Revoke all privileges
• Escort to the exit.

Staff who lose their job due to redundancy are at greater risk to become insider attackers. To mitigate this risk:

• The redundancy process must be seen as fair
• Try to keep a good dialogue
• During exit interview, review the original employment agreement (i.e. non-compete, wrongful disclosure, etc.

Question 6

Social engineering

Answer 6

The act of tricking another person into providing confidential information by posing as an individual who is authorized to receive that information.

Question 7

Phishing attacks

Answer 7

A kind of social-engineering attack in which criminals use spoofed emails to trick people into sharing sensitive information or installing malware on their computer.

1. Sending phishing email, getting through spam-filters. Increasingly difficult to get through email filtering (SPF, DKIM, DMARC). Content must be sufficiently credible to trick the user.
2. The victim taking the suggested action in the message.
   - Got to a fake website.
   - Replying with sensitive information
   - Installing malware
3. The criminals exploiting and monetizing the stolen information

Question 8

Elements of the IS Management Cycle

Answer 8

• Planning
• Risk Assessment
• Security Controls
• Evaluation
• Reporting

Question 9

Personnel integrity

Answer 9

Preventing employees from becoming attackers

Question 10

Personnel as defence

Answer 10

Making sure personnel do not fall victim to social engineering attacks

Question 11

Cybersecurity culture in organisations

Answer 11

Stimulate behaviour which strengthens security

Question 12

Security usability

Answer 12

Making sure users operate security correctly

Question 13

Multilevel defence against social engineering attacks

Answer 13

1. Foundation level. (Policies to address SE attacks)
2. Awareness level. (Awareness training for all staff)
3. Fortress level. (Resistance training for all staff)
4. Persistence level. (Ongoing reminders)
5. Gotcha level. (Social engineering detectors)
6. Offensive level. (Incident response)

Question 14

Types of phishing

Answer 14

Mass Phishing, large-volume attack intended to reach as many people as possible.

Spear Phishing, a targeted attack directed at specific individuals or companies using gathered information to personalize the message and make the scam more difficult to detect.

Whaling, including high-profile individuals or those with a great deal of authority or access.

Clone Phishing, a spoofed copy of a legitimate and previously delivered email, with original attachments or hyperlinks replaced with malicious versions, which is sent from a forged email address so it appears to come from the original sender or another legitimate source.

Question 15

CMMI / CMM
Capability maturity Model Integration
(For information security management)

Answer 15

1. Initial / Ad Hoc
   + Processes are ad-hoc and disorganised.
   + Risks are considered on an ad hoc basis, but no formal processes exist.
2. Repeatable but intuitive
   + Processes follow a regular pattern.
   + Emerging understanding of risk and the need for security
3. Defined process
   + Processes are documented and communicated.
   + Company-
   + Awareness of security and security policy

4. Managed and measurable
\+ Processes are monitored and measured.
\+ Risks assessment standard procedures
\+ Roles and responsibilities are assigned
\+ Policies and standards are in place

5. Optimized
   + Security culture permeates organisation
   + Organisation-wide security processes are implemented, monitored and followed