Security Part 2

Question 1

Both the AICPA’s description and control criteria state that an entity’s cybersecurity risk assessment procedures should include what?

Answer 1

• An ongoing process for identifying changes that would cause additional risks or alter existing risks
• Ex: changes in technology use

Question 2

What are the different types of intrusion detection systems?

Answer 2

• Network based
• Host based
• Protocol based
• Application protocol based

Question 3

What is a network-based intrusion detection system?

Answer 3

• They examine all traffic on the network
• They include 2 subtypes: Wireless IDS and network behavior analysis

Question 4

What are administrative controls in a defense-in-depth strategy?

Answer 4

• They include policies and procedures implemented by an organization to control access to the system and train employees

Question 5

What is defense in depth?

Answer 5

It is a strategy to cybersecurity in which 3 different control categories are used to protect an organization’s assets:
1) Physical
2) Technical
3) Administrative

Question 6

What are the trust services criteria?

Answer 6

They are used to benchmark controls in attestation and risk advisory engagements that evaluate the trust services CATEGORIES of:
- Security
- Availability
- Processing integrity
- Confidentiality
- Privacy

Question 7

What is the COMMON CRITERIA of the TRUST SERVICES CRITERIA?

Answer 7

It is linked to the 17 COSO principles and apply to trust services criteria
- Risk assessment is part of the common critiera and it involves identifying and analyzing risks

Question 8

What is the SUPPLEMENTAL CRITERIA of the TRUST SERVICES CRITERIA?

Answer 8

• Change Management
• Logical access controls
• Systems operations

Question 9

What makes up LAYERED SECURITY?

Answer 9

• Human security
• Perimeter security
• Network security
• Endpoint security
• Application security
• Data security

Question 10

Layered security is part of which control in defense-in-depth?

Answer 10

Technical controls

Question 11

What is the big picture idea behind layered security?

Answer 11

• This approach creates overlapping protective LAYERS so that if 1 security measure fails, deeper layers will stop or slow an attack

Question 12

What must all SOC 2 engagements include?

Answer 12

The security trust services category

Question 13

Which of the following types of trust services criteria apply to a SOC 2 examination for the security trust services category?

Answer 13

Common
Supplemental