A network that does not have servers - so each device simultaneously functions as both a client and a server to all other devices connected to the network.
Peer-To-Peer (P2P) Network
A policy that outlines how the organization uses personal information it collects.
Privacy Policy
A written document that states how an organization plans to protect the company’s information technology assets.
Security Policy
Grouping individuals and organization into cluster or groups based on a like affiliation.
Social Networking
Web sites that facilitate linking individuals with common interests like hobbies - religion - politics - or school or work contacts.
Social Networking Sites
A type of action that has the potential to cause harm.
Threat
A person or element that has the power to carry out a threat.
Threat Agent
A flaw or weakness that allows a threat agent to bypass security.
Vulnerability
The likelihood that the threat agent will exploit the vulnerability.
Risk
An event that - in the beginning - is considered to be risk yet turns out not to be.
False Positive
List and describe the 3 strategies for controlling risks.
1- privilege management- is the process of assigning and revoking privileges to objects; it covers the procedures of managing object authorizations
2- change management- refers to a methodology for making modifications and keeping track of those changes
3- incident management- is defined as the “framework” and functions required to enable incident response and incident handling within an organization.
A subject’s access level over an object - such as a user’s ability to pen a payroll file.
Privilege
Periodic reviewing of a subject’s privileges over an object - in which the objective is to determine if the subject has the correct privileges.
Privilege Auditing
What is a CMT and what is is duties?
Change Management Team
1- review proposed changes
2- ensure risk and impact of the planned changes are understood
3- recommend approval - disapproval - deferral - withdrawal of a requested change
4- communicate proposed and approved changes to coworkers
The planning - coordination - communications - and planning functions that are needed in order to resolve an incident in an efficient manner.
Incident Handling
The components required to identify - analyze - and contain an incident.
Incident Response
What are the functions of an organization’s information security policy?
1- it can be an overall intention and direction. A security policy is a vehicle for communicating an organization’s information security culture and acceptable information security behavior.
2- it details specific risks and how to address them - and provide controls that executives can use to direct employee behavior.
3- it can help to create a security-aware organization culture
4- it can help to ensure that employee behavior is directed and monitored to ensure compliance with security requirements.
What must an effective security policy balance?
Trust and Control
What are the 3 approaches to trust?
1- Trust everyone all of the time- easiest model to enforce because there are not restrictions; impractical because it leaves system vulnerable to attacks
2- Trust no one at any time- most restrictive model; impractical because few employees would work for an organization that did not trust them
3- Trust some people some of the time- this approach exercises caution in the amount of trust given; access is provided as needed with technical controls to ensure the trust is not violated.
A collection of requirements specific to the system or procedure that must be met by everyone.
Standard
A collection of suggestions that should be implemented.
Guideline
A document that outlines specific requirements or rules that must be met.
Policy
What is the three-phase cycle in the development and maintenance of a security policy?
1- vulnerability assessment
2- create the security policy using information from risk management study
3- compliance monitoring and evaluation
What does a vulnerability assessment attempt to identify?
1- asset identification (what needs to be protected)
2- threat identification (what the pressures are against it)
3- vulnerability appraisal (how susceptible the current protection is)
4- risk assessment (what damages could result from the threats)
5- risk mitigation (what to do about it)
