2. where can a security administrator find information on established security frameworks?

1. How can a security framework assist in the design and implementation of a security infrastructure?

Nội dung chính Show

What is the ISO 27000 series of standards which individual standards make up the series?
Who is ultimately responsible for managing a technology who is responsible Forenforcing policy that affects the use of a technology?
What is the ISO 27000 framework?
What are the differences between a policy a standard and a practice where would each be used?

Designing a working plan for securing the organization s information assets begins by creating or validating an existing security blueprint for the implementation of needed security controls to protect the information assets. A framework is the outline from which a more detailed blueprint evolves. The blueprint is the basis for the design, selection, and implementation of all subsequent security policies, education and training programs, and technologies. The blueprint provides scaleable, upgradeable, and comprehensive security for the coming years. The blueprint is used to plan the tasks to be accomplished and the order in which

…show more content…
Call to Action, define the responsibilities and Information System Audit and Control Association (ISACA

Who in the organization should plan for it?

In order to effectively implement security governance, the Corporate Governance Task Force (CGTF) recommends that organizations follow an established framework, such as the IDEAL framework from the Carnegie Mellon University Software Engineering Institute. This framework, which is described in the document “Information Security Governance: Call to Action,” defines the responsibilities of (1) the board of directors or trustees, (2) the senior organizational executive (i.e., CEO), (3) executive team members, (4) senior managers, and (5) all employees and users. This important document can be found at the Information Systems Audit and Control Association (ISACA) Web site at www.isaca.org/ContentManagement/ContentDisplay.cfm?ContentID=34997.

2. Where can a security administrator find information on established security frameworks?

A security administrator can look to the Information Technology- Code of Practice for Information Security Management, ISO 17799/BS 7799 as well as ISO 17799/BS 7799, the NIST Security Models including the SP 800-12, 14, 18, 26, and 30, and the VISA International Security Model are just a few of the established security frameworks available.

3. What is the ISO 27000 series of standards? Which



Summarize

Quiz

Quiz 1

How can a security framework assist in the design and implementation of a security infrastructure? What is information security governance? Who in the organization should plan for it?

Standard framework for information security that states organizational security policy is needed to provide management direction and support.
It is the executive management's responsibility to provide strategic direction,

Quiz 2

Where can a security administrator find information on established security frameworks?

At the security blueprint

Quiz 3

What is the ISO 27000 series of standards? Which individual standards make up the series?

One of the most widely referenced security models - Standard framework for information security that states organizational security policy is needed to provide management direction and support - Purpose is to give recommendations for information security management - Provides a starting point for developing organizational security

Quiz 4

What are the issues associated with adopting a formal framework or model?

Each environment is unique, framework may not be the best solution.

Quiz 5

What documents are available from the NIST Computer Security Resource Center, and how can they support the development of a security framework?

SP-800 series

Quiz 6

What benefit can a private, for-profit agency derive from best practices designed for federal agencies?

Quiz 7

What Web resources can aid an organization in developing best practices as part of a security framework?

Quiz 8

Briefly describe management, operational, and technical controls, and explain when each would be applied as part of a security framework.

Management controls: strategic
Operational controls: address personnel and physical security
Technical controls: tactical and technical implementations related.

Quiz 9

What are the differences between a policy, a standard, and a practice?

Policy: general, from high-ups
Standard: minimum specification for compliance
Practice: how to comply in detail

What are the three types of security policies? Where would each be used? What type of policy would be needed to guide use of the Web? E-mail? Office equipment for personal use?

Enterprise info SP: guides the dev, implementation nad managment of the SP
Issue Specific SP: specific area of tech
Sys Specific SP: standards for configuring and maintaining systems

Quiz 10

Who is ultimately responsible for managing a technology? Who is responsible for enforcing policy that affects the use of a technology?

The Champion
policy administrator or manager

Quiz 11

What is contingency planning? How is it different from routine management planning?What are the components of contingency planning?

plan to anticipate, react to, and recover from advert events and restore BC.
Incident response P, disaster recovery P, and business continuity P are components of contingency planning.

Quiz 12

When is the IR plan used?

As soon as an incident in progress has been identified.

Quiz 13

When is the DR plan used?

If an incident escalates or is disastrous, focuses on restoring systems at the original site.

Quiz 14

When is the BC plan used?

Used concurrently with the disaster recovery plan when the damage is major, creates long-term consequences, or requires more than simple restoration of information and information resources.

Quiz 15

What are the elements of a business impact analysis?

Quiz 16

What are Pipkin’s three categories of incident indicators?

Quiz 17

What is containment, and why is it part of the planning process?

Isolating the affected channels, processes, services, or computers, and stopping the losses such as taking down the entire system, servers, and network.
Containment of incident’s scope or impact is first priority

Quiz 18

When should law enforcement be involved in an IR or DR action? What are the issues associated with law enforcement involvement?

Quiz 19

What is an after-action review? When is it performed? Why is it done?

Quiz 20

List and describe the six site and data contingency strategies identified in the text.

Exclusive options:
- Hot site: “plugin and use”
- Warm site: has some equipment but not all
- Cold site: just the empty site
Shared options:
- Time-share: multiple companies rent the same site
- Service bureaus: third party providing the backup sites
- Mutual agreements: companies being backup sites of each other

What is the ISO 27000 series of standards which individual standards make up the series?

The ISO/IEC 27001 family of standards, also known as the ISO 27000 series, is a series of best practices for improving an organization's information security policies and procedures, giving it a framework to address risks and capitalise on opportunities as it moves into the future.

Who is ultimately responsible for managing a technology who is responsible Forenforcing policy that affects the use of a technology?

Policy has the ultimate responsibility for managing technology. System administrators and users are responsible for enforcing policy. Based on NIST Special Publication 800-14, there are three types of information security policies.

What is the ISO 27000 framework?

What Is ISO/IEC 27000? Also known as the ISO 27000 Family of Standards, it's a series of information security standards that provide a global framework for information security management practices.

What are the differences between a policy a standard and a practice where would each be used?

Policy - Written instructions that describe proper behavior. Standard - Detailed statement of what must be done to comply with policy. Practice - Examples of actions that would comply with policy.

Information security resources NIST website Security