Chapter 6 - IT Security Policy Frameworks

Question 1

An information security program charter defines four elements:

Answer 1

1 - The program’s purpose and mission

2 - The program’s scope within the organization

3 - Assignment of responsibilities for program implementation

4 - Compliance management

Question 2

Three industry-standard policy frameworks that stand out because of their scope and wide acceptance within the security community are:

Answer 2

1 - COBIT

2 - ISO/IEC 27000 series

3 - NIST Special Publications

Question 3

Which of the following is the first step in establishing an information security program?

A - Adoption of an information security policy framework or charter

B - Development and implementation of an information security standards manual

C - Development of a security awareness training program for employees

D - Purchase of security access control software

Answer 3

A - Adoption of an information security policy framework or charter

Question 4

________ are best defined as high-level statements, beliefs, goals, and objectives.

Answer 4

Policies

Question 5

What is the difference between risk appetite and risk tolerance?

A - Risk tolerance measures impact and likelihood, whereas risk appetite measures variance from a target goal.

B - Risk appetite measures impact and likelihood, whereas risk tolerance measures variance from a target goal.

C - There is no difference between the two.

Answer 5

B - Risk appetite measures impact and likelihood, whereas risk tolerance measures variance from a target goal.

Question 6

__________________ indicates how specific the policy is regarding resources or rules.

Answer 6

Granularity

Question 7

__________________are formal documents that establish:

Uniform criteria that you can evaluate and measure

Methods to accomplish a goal

Repeatable processes and practices for compliance with policies

Answer 7

Standards

Question 8

An ________________ standard focuses on an area of current relevance and concern to your company.

Answer 8

issue-specific

Question 9

The six basic components for issue-specific or baseline standards are:

Answer 9

1 - Statement of an issue

2 - Statement of the organization’s position

3 - Statement of applicability

4 - Definition of roles and responsibilities

5 - Compliance

6 - Points of contact

Question 10

A ______________ standard, or ____________ standard, is focused on the secure configuration of a specific system, device, operating system, or application.

Answer 10

system-specific, baseline

Question 11

A _____________ is a written instruction on how to comply with a standard.

Answer 11

procedure

Question 12

Procedures should be:

Answer 12

Clear and unambiguous
Repeatable
Up to date
Tested
Documented

Question 13

TF: A single standard often requires multiple procedures to support it.

Answer 13

True

Question 14

A _______________ is typically one that has not been used for an extended period of time.

Answer 14

dormant account

Question 15

_______________ are generally not mandatory—failing to follow them explicitly does not lead to compliance issues. Rather, they assist people in developing procedures or processes with best practices that other people have found useful.

Answer 15

Guidelines

Question 16

The ___________ establishes and maintains security and risk management programs for information resources

-CISO

-Information resources manager

-Information resources security officer

Answer 16

CISO

Question 17

The ____________________ maintains policies and procedures that provide for security and risk management of information resources

-CISO

-Information resources manager

-Information resources security officer

Answer 17

Information resources manager

Question 18

The _________________ directs policies and procedures designed to protect information resources, identifies vulnerabilities, and develops security awareness program

-CISO

-Information resources manager

-Information resources security officer

Answer 18

Information resources security officer

Question 19

_________________ are responsible for carrying out the program that uses the resources. This does not imply personal ownership. These individuals may be regarded as program managers or delegates for the owner.

Answer 19

Owners of information resources

Question 20

_______________ provide technical facilities, data processing, and other support services to owners and users of information resources.

Answer 20

Custodians of information resources

Question 21

______________ provide technical support for security of information resources.

Answer 21

Technical managers (network and system administrators)

Question 22

________________ conduct periodic risk-based reviews to ensure the effectiveness of information resources security policies and procedures.

Answer 22

Internal auditors

Question 23

_______________ are typically in areas such as compliance and operational risk. they ensure that security policies result in operational compliance with risk appetite and regulatory requirements.

Answer 23

Control partners

Question 24

_______________ have access to information resources in accordance with the owner-defined controls and access rules

Answer 24

Users

Question 25

To meet information assurance needs, your framework should include policies for the following 5 items:

Answer 25

1 - Automation of security controls, where possible 2 - Implementation of appropriate accounting and other integrity controls 3 - Controls that handle potential conditions that appear when a system is operating 4 - Development of systems that detect and thwart attempts to perform unauthorized activity 5 - Assurance of a level of uptimne of all systems