Security Management Framework

Question 1

ISO/IEC 27000

Answer 1

A series of Information Security standards or best practices to help organisations improve their information security.

Published by the International Organization for Standardization (ISO) and the International Electrotechnical Commission (ICO), the ISO 27000 standards set out comprehensive information security management system (ISMS) requirements.

Question 2

ISMS

Answer 2

An Information Security Management System consists of all of the administrative, technical and operational controls that address information security within an organisation.

Question 3

ISO 27000 twelve domains

Answer 3

• Risk assessment
• Security Policy
• Organisation of Information Security
• Asset management
• Physical and environmental security
• Communications and operations management
• Information systems acquisition, development and maintenance
• Access Control
• Information security incident management
• Business continuity management
• Compliance

Question 4

What is the difference between the ISO cybersecurity model and the Open System Interconnection (OSI) model?

Answer 4

The structure of this ISO cybersecurity model differs from the Open System Interconnection (OSI) model in that it is a peer model that uses domains rather than layers to describe the security categories. Each domain has a direct relationship with the other domains.

Question 5

Risk assessment

Answer 5

This is the first step in the risk management process, which determines the quantitative and qualitative value of risk related to a specific situation or threat.

Question 6

Security policy

Answer 6

This document addresses the constraints and behaviours of individuals within an organisation and often specifies how data can be accessed, and what data is accessible by whom.

Question 7

Organisation of Information Security

Answer 7

This is the governance model set out by an organization for information security.

Question 8

Asset management

Answer 8

This is an inventory of and classification scheme for information assets within an organization.

Question 9

Human resources security

Answer 9

This refers to the security procedures in place that relate to employees joining, moving within and leaving an organization.

Question 10

Physical and environmental security

Answer 10

This refers to the physical protection of an organisation’s facilities and information.

Question 11

Communications and operations management

Answer 11

This refers to the management of technical security controls of an organisation’s systems and networks.

Question 12

Information systems acquisition, development and maintenance

Answer 12

This refers to security as an integral part of an organisation’s information systems.

Question 13

Access Control

Answer 13

This describes how an organization restricts access rights to networks, systems, applications functions and data in order to prevent unauthorised user access.

Question 14

Information Security Incident Management

Answer 14

This describes an organisation’s approach to the anticipation of and response to information security breaches.

Question 15

Business Continuity Management

Answer 15

This describes the ability of an organisation to protect, maintain and recover business-critical activities following a disruption to information systems.

Question 16

Compliance

Answer 16

This describes the process of ensuring conformance with information security policies, standards and regulations.

Question 17

Control Objectives ISO 27001

Answer 17

Control objectives define the high level requirements for implementing a comprehensive information security management system within an organisation, and usually provide a checklist to use during an ISMS audit.

Question 18

Controls ISO 27002

Answer 18

Controls set out how to accomplish an organisation’s control objectives.
They establish guidelines for implementing, maintaining and improving the management of information security in an organisation.

The ISO controls specifically address security objectives for data in each of the three states:
- in process
- at rest
- in transit

Question 19

SOA

Answer 19

Statement Of Applicability allows the organisation to tailor the available control objectives and controls to best meet its priorities around Confidentiality, Integrity and availability.

Question 20

NIST

Answer 20

The National Institute of Standards and Technologies created the National Cybersecurity Workforce Framework to support organisations seeking cybersecurity professionals.

Question 21

The National Cybersecurity Workforce Framework

Answer 21

The framework organizes cybersecurity work into seven categories, outlining the main job roles, responsibilities and skills needed for each one.

Question 22

Operate and Maintain

Answer 22

Provides the support, administration and maintenance required to ensure effective and efficient IT system performance and security.

Question 23

Protect and Defend

Answer 23

Identifies, analyses and mitigates threats to internal systems and networks.

Question 24

Investigate

Answer 24

Investigates cybersecurity events and/or cyber attacks involving IT resources.

Question 25

Collect and Operate

Answer 25

Provides specialised denial and deception operations and collection of cybersecurity information.

Question 26

Analyse

Answer 26

Performs highly specialized review and evaluation of incoming cybersecurity information to determine its usefulness for intelligence.

Question 27

Oversee and Govern

Answer 27

Provides leadership, management, direction or development and advocacy so an organization may effectively conduct cybersecurity work.

Question 28

Securely provision

Answer 28

Conceptualises, designs, procures or builds secure IT systems.

Question 29

Basic Controls

Answer 29

Organizations with limited resources and cybersecurity expertise available should implement:
- Inventory and control of hardware assets
- Inventory and control of software assets
- Continuous vulnerability management
- Controlled use of administrative privileges
- Secure configurations for hardware and software
- Maintenance, monitoring and analysis of audit logs

Question 30

Foundational Controls

Answer 30

Organisations with moderate resources and cybersecurity expertise available should implement the basic controls as well as:
- Email and web browser protections
- Malware defense
- Limitation and control of network ports, protocols and services
- Data recovery capabilities
- Secure configurations for network devices
- Boundary defense
- Data protections
- Controlled access based on the ‘need to know’ principle
- Wireless access control
- Account monitoring and control

Question 31

Organisational Controls

Answer 31

Organisations with significant resources and cybersecurity expertise available should implement the basic and foundational controls, as well as:
- A security awareness and training program.
- Application software security
- Incident response and management
- Penetration tests and red team exercises (simulated attack exercises to gauge an organisation’s security capabilities)

Question 32

CSA

Answer 32

The Cloud Security Alliance provides security guidance to any organisation that uses cloud computing or wants to assess the overall security risk of a cloud provider.

Question 33

CCM

Answer 33

The Cloud Control Matrix is a cybersecurity control framework that maps cloud-specific security controls to leading standards, best practices and regulations. It is composed of 197 control objectives that are structured in 17 domains covering all aspects of cloud technology, including governance and risk management, human resources and mobile security.

The CCM is considered a de-facto standard for cloud security assurance and compliance.

Question 34

SSAE

Answer 34

Statement on Standards for Attestation Engagements.

This is an independent audit of an organization’s reporting controls as they relate to the security, availability, processing integrity, confidentiality and privacy of a system. An attestation report will confirm that controls are in place at a specific point in time (Type I) or managed over a period of at least six months (Type II). These reports provide assurance to a client organisation that there are controls in place and operating to protect sensitive data.

Question 35

CMMC

Answer 35

Cybersecurity Maturity Model Certification.

This certification is aimed at any organisations providing a service to the U.S. Department of Defense (DoD) and verifies that these organisations have adequate cybersecurity practices and processes in place to ensure ‘basic’ cyber hygiene at a minimum.

The CMMC establishes five certification levels that range from ‘basic cyber hygiene practices’ to ‘enhanced practices that provide more sophisticated capabilities to detect and respond to APTs.’ It is likely that service providers will have to achieve the appropriate CMMC requirement in order to be considered for a DoD contract award.