5.1 Security Standards

Question 1

What do standards in the technology industry provide?

Answer 1

Extensive documentation for handling different situations and reducing risk in environments.

Question 2

What are two organizations that provide a set of security standards?

Answer 2

• ISO (International Organization for Standardization)
• NIST (National Institute of Standards and Technology)

Question 3

What is a key aspect of password security standards?

Answer 3

Defining what a good password is and the appropriate password complexity for an organization.

Question 4

What might a password policy standard define?

Answer 4

• Frequency of password changes
• Secure storage of passwords
• Acceptable types of password managers

Question 5

What does access control determine?

Answer 5

What type of information someone can access and when they can access it.

Question 6

True or False: A discretionary access control policy is always required by organizations.

Answer 6

False

Question 7

What might be required to determine user access type?

Answer 7

• Management sign-off
• Completion of a course

Question 8

What are some reasons for removing user access?

Answer 8

• Security issues
• Account expiration
• User leaving the organization
• Contract expiration

Question 9

What is an important consideration for physical security standards?

Answer 9

Securing the property, especially with many people coming in and out.

Question 10

What might physical security standards require from users?

Answer 10

Presenting an ID badge for access through electronic door locks.

Question 11

Fill in the blank: An organization might have standards defining the type of __________ that are in use.

Answer 11

electronic door locks

Question 12

What could be an example of a requirement for electronic door locks?

Answer 12

Biometric aspects for additional security.

Question 13

What documentation is recommended for encryption technologies?

Answer 13

Well-documented standards on how encryption should be used.

Question 14

What are different states of data that might have different encryption requirements?

Answer 14

• Data at use
• Data in transit
• Data at rest

Question 15

What is a good practice for storing passwords?

Answer 15

Storing them as a hash or a salted hash.

Question 16

What should standards define regarding password storage?

Answer 16

The exact hashing algorithm required.

Question 17

What does encryption aim to protect?

Answer 17

The confidentiality of information being stored.

Question 18

What might require ongoing monitoring in an organization?

Answer 18

Physical security measures.

Question 19

True or False: Standards for offboarding are the same across all organizations.

Answer 19

False

Question 20

What is the purpose of security standards in organizations?

Answer 20

To keep everyone safe and prevent unauthorized access.