Fundamentals of Information Systems Security Ch 6 - Security Operations and Administration

Memorandum of understanding (MOU)

AKA letter of intent, an agreement between two or more parties that expresses areas of common interest that result in shared actions. Less enforceable than a formal agreement but more formal than an oral agreement.

Three primary means to ensure compliance

Event logs Compliance liaison Remediation

Service-level agreement (SLA)

Formal contract between organization and the outside firm that details the specific services the firm will provide. Communicates the expectations on both the organization and outside firm and anticipates the needs of both parties.

Responsibilities of security administration

Handling events that affect computers and networks, including incidents, disasters, and other interruptions.

Advantages of outsourcing security

High level of expertise that your organization might not have because they only deal with security.

Four aspects of access control.

Identification Authentication Authorization Accountability

Regulatory compliance

Laws and government regulations

Organizational compliance

Organization policies, audits, and standards

Disadvantages of outsourcing security

Outsourcing firm might not know your organization well and your organization cannot develop in-house expertise or talent and will continue to pay for services.

Main concerns for outsourcing security

Privacy Risk Data security Ownership Adherence to policy

Offboarding

Process to follow when terminating a relationship with outsourced resources. Defines how to transfer control of data and other assets, terminate communications, and complete open transactions.

Most common documentation requirements:

Sensitive assets list Organization's security process Authority of people responsible for security Policies, procedures, and guidelines adopted by organization

Blanket purchase agreement (BPA)

Streamlined method of meeting recurring needs for supplies or services, creates preapproved accounts with qualified suppliers to fulfill recurring orders for products or services. Helpful in simplifying the process of recurring purchases.

Emergency operations group

Team managed by the security administration team. Responsible for protecting sensitive data in the event of natural disasters and equipment failure, among other potential emergencies.

Security administration

The group of individuals responsible for planning designing, implementing, and monitoring an organization's security plan.

Onboarding

The negotiation process and creation of agreements. Provides time before a problem occurs, as well as the opportunity to clearly communicate goals and expectations for all parties.

Interconnection security agreement (ISA)

Usually an extension of MOU, serves as an agreement that documents the technical requirements of interconnected assets. Most often used to specify technical needs and security responsibilities of connected organizations.