Security Management - Standards

Question 1

What is Risk Management about?

Answer 1

1) Risk identification(easy)
2) Risk assessment (easy)
3) Risk treatment (hard)
4) Risk mitigation plan
5) Implementation
6) Review and evaluation

Question 2

What is ISMS?

Answer 2

Information Security Management System

Question 3

What is ISMS about?

Answer 3

It is a systematic approach to managing sensitive company information so that it remains secure that Includes people, processes, documents, and IT systems by applying a risk management process.

Question 4

What is ISO 27002:2013?

Answer 4

Guidelines for organizational information security standards and management practices.

Question 5

Name a few groups of ISO 27002:2013

Answer 5

1) Information security policies
2) Organization of information security
3) Human resource security
4) Asset management
5) Access control
6) Cryptography
7) Physical and environmental security
8) Operations security
9) Communications security
10) Systems acquisition, development and maintenance
11) Supplier relationships
12) Information security incident management
13) Information security aspects of business continuity management
14) Compliance

Question 6

Name some of the elementary threats listed in the BSI base protection

Answer 6

• Fire, water, local events/catastrophes
• Loss of service by supplier (e.g. power, connectivity)
• Electromagnetic emanation, wiretapping, espionage
• Theft, destruction, loss of devices

Question 7

What should be considered if a employee joins/leaves the organization?

Answer 7

1) Background checks (prediction of future behaviour based on past)
2) Access management (configuration of access rights matching to current tasks/position)

Question 8

How can you prevent that adversaries access facilities, resources or information stored on physical media?

Answer 8

1) restrict access to buildings, rooms, equipment(guards, locks, escorts, surveillance)
2) Restriction of movement of equipment, storage media(locks, trackers)

Question 9

What is CVE?

Answer 9

CVE Common Vulnerabilities and Exposures

This is a list of identifiers and descriptions for discovered vulnerabilities

Question 10

Decribe the process of a CVE entry assignment.

Answer 10

1. ) Discovery of potential vulnerability or exposure
   2) Assignment of CVE ID by numbering authority
   - Description
   - References
   3) Posting of CVE entry t o list by primary numbering authority