Chapter 5 - Developing the Security Program

Question 1

Information Security Program

Answer 1

The entire set of activities, resources, personnel, and technologies used by an organization to manage the rsisks to its information assets.

Question 2

Which variable is most influential in how an organization chooses to structure its InfoSec program?

Answer 2

Organizational culture

Question 3

What are all the variables that determine how an organization structures its InfoSec program?

Answer 3

Organizational culture, size, security, personnel budget, and security capital budget.

Question 4

How is InfoSec security in large organizations different from small organizations?

Answer 4

InfoSec departments in large organizations tend to be divided among groups, whereas there are fewer groups (or just one) in smaller organizations.

Question 5

What are the functions performed within the InfoSec department as customer service to the organization and its external partners?

Answer 5

Risk assessment; Systems testing; Incident response planning; Disaster recovery planning; Performance measurement; Vulnerability assessment

Question 6

What are the functions performed within the InfoSec department as compliance enforcement?

Answer 6

Policy; Compliance/audit; Risk management

Question 7

According to Kosutic, what are the three options for placing the CISO and their security group in an organization?

Answer 7

1 - In a separate group reporting directly to the CEO/President (most common in large organizations); 2 - Under a divisionor department with no conflict of interest (most common in mid-to-large organizations); 3 - As an additional duty for an existing manager or executive (most common in smaller organizations).

Question 8

What are the most critical components of an InfoSec program?

Answer 8

Personnel and their expectations, roles, responsibilities, and credentials

Question 9

Chief Information Officer (CIO)

Answer 9

Typically considered the top information technology officer in an organization. The CIO is usually an executive-level position, and frequently the person in this role reports to the CEO.

Question 10

Chief Information Security Officer (CISO)

Answer 10

Typically considered the top information security officer in an organization. The CISO is usually not an executive-level position, and frequently the person in this role reports to the CIO.

Question 11

Chief Security Officer (CSO)

Answer 11

In some organizations, an alternative title for the CISO; in others, the title is most commonly assigned to the most senior manager or executive responsible for both information and physical security.

Question 12

Security Administrator

Answer 12

A hybrid position comprising the responsibilities of both a security technician and a security manager.

Question 13

Security Analyst

Answer 13

A specialized security administrator responsible for performing systems development life cycle (SDLC) activities in the development of a security system.

Question 14

Security Manager

Answer 14

In larger organizations, a manager responsible for some aspect of information security who reports to the CISO; in smaller organizations, this title may be assigned to the only or senior security administrator.

Question 15

Security technician

Answer 15

A technical specialist responsible for the implementation and administration of some security-related technology.

Question 16

Security watchstander

Answer 16

An entry-level InfoSec responsible for the routine monitoring and operation of a particular InfoSec technology. Also known as a security staffer.

Question 17

What are the most common paths to an InfoSec career?

Answer 17

Military, Law Enforcement, IT, and InfoSec college graduates

Question 18

Security Awareness

Answer 18

The portion of the SETA program dedicated to keeping users conscious of key InfoSec issues through the use of newsletters, posters, trinkets, and other methods.

Question 19

Security Education

Answer 19

The portion of the SETA program based on formal delivery of knowledge of InfoSec issues and operations, usually through institutions of higher learning

Question 20

Security Education, Training, and Awareness (SETA)

Answer 20

A managerial program designed to improve the security of information assets by providing targeted knowledge, skills, and guidance for organizational employees.

Question 21

Security Training

Answer 21

The portion of the SETA program focused on providing users with the knowledge, skill, and/or ability to use their assigned resources wisely to avoid creating additional risk to organizational information assets.

Question 22

What are the three ways that SETA seeks to enhance security?

Answer 22

1 - By building in-depth knowledge, as needed, to design, implement, or operate security programs for organizations and their information assets; 2 - By developing skills and knowledge so that computer users can perform their jobs while using information assets more securely; 3 - By improving awareness of the need for and methods to protect information assets.

Question 23

What issues must an InfoSec educational program address?

Answer 23

1 - The InfoSec educational components required of all InfoSec professionals; 2 - The general education requirements that all IT professionals must have; 3 - General foundational knowledge that all business professionals must understand.

Question 24

Project Management

Answer 24

The process of identifying and controlling the resources applied to a project as well as measuring progress and adjusting the process as progress is made toward the goal.

Question 25

Scope Creep

Answer 25

The expansion of the quantity or quality of project deliverables from the original project plan.

Question 26

What are the project management knowledge areas?

Answer 26

Communications, Cost, HR, Integration, Procurement, Quality, Risk, Scope, Stakeholder, and Time.

Question 27

Critical Path Method (CPM)

Answer 27

A diagramming technique, similar to PERT, designed to identify the sequence of tasks that make up the shortest elapsed time needed to complete a project.

Question 28

Gantt Chart

Answer 28

A diagramming technique named for its developer, Henry Gantt, which lists activities on the vertical axis of a bar chart and provides a simple timeline on the horizontal axis.

Question 29

Program Evaluation and Review Technique (PERT)

Answer 29

A diagramming technique developed in the late 1950s that involves specifying activities and their sequence and duration.

Question 30

Projectitis

Answer 30

A situation in project planning in which the project manager spends more time documenting project tasks, collecting performing measurements, recording project task information, and updating project completion forecasts in the project management software than accomplishing meaningful project work.

Question 31

Work Breakdown Structure (WBS)

Answer 31

A list of the tasks to be accomplished in the project; the WBS provides details for the work to be accomplished, the skill sets or even specific individuals to perform the tasks, the start and end dates for the task, the estimated resources required, and the dependencies between and among tasks.