Chapter 4 HS155

False (policy)

A standard is a written instruction provided by management that informs employees and others in the workplace about proper behavior.

False (Business Continuity Plan) BCP

A(n) DR plan ensures that critical business functions continue if a catastrophic incident or disaster occurs.

False (adverse event)

A(n) alarming event is an event with negative consequences that could threaten the organization's information assets or operations

True

A(n) capability table specifies which subjects and objects users or groups can access.

False (incident)

A(n) disaster is any adverse event that could result in loss of an information asset or assets, but does not currently threaten the viability of the entire organization.

False (Hierarchical)

A(n) sequential roster is activated as the first person calls a few people on the roster, who in turn call a few other people.

False (enterprise)

A(n) strategic ​information security policy is also known as a general security policy, and sets the strategic direction, scope, and tone for all security efforts.

False (Rule based policy are more specific)

ACLs are more specific to the operation of a system than rule-based policies and they may or may not deal with users directly.

False

An attack, breach of policy, or other incident always constitutes a violation of law, requiring notification of law enforcement.

True

Managerial controls set the direction and scope of the security process and provide detailed instructions for its conduct.

True

NIST 800-14's Principles for Securing Information Technology Systems can be used to make sure the needed key elements of a successful effort are factored into the design of an information security program and to produce a blueprint for an effective security architecture.

True

NIST Special Publication 800-18 Rev. 1, The Guide for Developing Security Plans for Federal Information Systems, includes templates for major application security plans, and provides detailed methods for assessing, designing, and implementing controls and plans for applications of varying size.

True

NIST responded to a mandate and created a voluntary Risk Management Framework that provides an effective approach to manage cybersecurity risks.

False(defense in depth)

One of the basic tenets of security architectures is the layered implementation of security, which is called defense in redundancy.

False (sound-issue specific)

Systems-specific security policies are organizational policies that provide detailed, targeted guidance to instruct all members of the organization in the use of a resource, such as one of its processes or technologies.

True

Technical controls are the tactical and technical implementations of security in the organization.

True

The Computer Security Resource Center at NIST provides several useful documents free of charge in its special publications area.

True

The ISO/IEC 27000 series is derived from an earlier standard, BS7799.

False (EISP) Enterprise Information Security Policy

The ISSP is a plan which sets out the requirements that must be met by the information security blueprint or framework.

False

The complete details of ISO/IEC 27002 are widely available to everyone.

False

Within security perimeters the organization can establish security redundancies, each with differing levels of security, between which traffic must be screened.

True

You can create a single, comprehensive ISSP document covering all information security issues.

False (warm site)

A cold site provides many of the same services and options of a hot site, but at a lower cost.

True

A disaster recovery plan shows the organization's intended efforts to restore operations at the original site in the aftermath of a disaster.

False (Disk Mirroring)

A hard drive feature known as "hot swap" is a RAID implementation (typically referred to as RAID Level 1) in which the computer records all data to twin drives simultaneously, providing a backup if the primary drive fails

False (created by management)

A managerial guidance SysSP document is created by the IT experts in a company to guide management in the implementation and configuration of technology.

False

A policy should state that if employees violate a company policy or any law using company technologies, the company will protect them, and the company is liable for the employee's actions.

True

A security policy should begin with a clear statement of purpose.

False (also backup the databases)

Database shadowing duplicates data in real-time data storage, but does not back up the databases at the remote site.

True

Disaster recovery personnel must know their roles without supporting documentation, which is a function of preparation, training, and rehearsal.

True

Each policy should contain procedures and a timetable for periodic review.

False

Every member of the organization's InfoSec department must have a formal degree or certification in information security.

True

Evidence is the physical object or documented information that proves an action occurred or identifies the intent of a perpetrator.

True

Failure to develop an information security system based on the organization's mission, vision, and culture guarantees the failure of the information security program.

True

Good security programs begin and end with policy.

False (standards)

Guidelines are detailed statements of what must be done to comply with policy.

False (2014)

In 2016, NIST published a new Federal Master Cybersecurity Framework to create a mandatory framework for managing cybersecurity risk for the delivery of critical infrastructure services at every organization in the United States, based on vendor-specific technologies.

True

Security training provides detailed information and hands-on instruction to employees to prepare them to perform their duties securely.

True

Some policies may also need a(n) sunset clause indicating their expiration date.

False (has not defined)

The global information security community has universally agreed with the justification for the code of practices as identified in the ISO/IEC 17799.

False (proxy server)

The key components of the security perimeter include firewalls, DMZs (demilitarized zones), Web servers, and IDPSs.

False (it is frequently)

The operational plan documents the organization's intended long-term direction and efforts for the next several years.

True

The policy administrator is responsible for the creation, revision, distribution, and storage of the policy.

True

The recovery point objective (RPO) is the point in time prior to a disruption or system outage to which mission/business process data can be recovered after an outage.

False (other way around)

The security framework is a more detailed version of the security blueprint.

False (security blueprint)

The security model is the basis for the design, selection, and implementation of all security program elements, including policy implementation and ongoing policy and program management.

True

The stated purpose of ISO/IEC 27002 is to offer guidelines and voluntary directions for information security management.

True

To achieve defense in depth, an organization must establish multiple layers of security controls and safeguards.

True

To remain viable, security policies must have a responsible individual, a schedule of reviews, a method for making recommendations for reviews, and policy issuance and planned revision dates.

True

To remain viable, security policies must have a responsible manager, a schedule of reviews, a method for making recommendations for reviews, and a policy issuance and revision date.