CIS 286 Quiz 3
blueprint
SP 800-14, Generally Accepted Principles and Practices for Securing Information Technology Systems, provides best practices and security principles that can direct the security team in the development of a security ____.
domains
Security ______ are the areas of trust within which users can freely communicate.
de jure
Standards may be published, scrutinized, and ratified by a group, as in formal or __________ standards.
EISP
The ______ is the high-level information security policy that sets the strategic direction, scope, and tone for all of an organization's security efforts.
tactical planning
The actions taken by management to specify the intermediate goals and objectives of the organization are ____________.
operational planning
The actions taken by management to specify the short-term goals and objectives of the organization are ________.
standard
A detailed statement of what must be done to comply with management intent is known as a __________.
framework
An information security _______ is a specification of a model to be followed during the design, selection, and initial and ongoing implementation of all subsequent security controls, including information security policies, security education, and training.
identify and prioritize for improvement within the context of a continuous and repeatable process
In early 2014, in response to Executive Order 13636, NIST published the Cybersecurity Framework, which intends to allow organizations to _____________.
guideline
Nonmandatory recommendations the employee may use as a reference is known as a _______.
Regulatory compliance by using information security knowledge and infrastructure to support minimum standards of due care
The goals of information security governance include all but which of the following?
people
The spheres of security are the foundation of the security framework and illustrate how information is under attack from a variety of sources, with far fewer protection layers between the information and potential attackers on the _______ side of the organization.
management
The stated purpose of ISO/IEC 27002:2013 is to give guidelines for organizational information security standards and information security __________ practices.
The global information security community had already defined a justification for a code of practice, such as the one identified in ISO/IEC 17799.
When ISO 17799 first came out, several countries, including the United States, Germany, and Japan, refused to adopt it, claiming that it had fundamental problems. Which of the following is NOT one of those problems?
The application of the principle and practices of corporate governance to the information security function.
Which of these best defines information security governance?
Managerial
____ controls cover security processes that are designed by strategic planners and implemented by the security administration of the organization.
Operational
_____ controls address personnel security, physical security, and the protection of production inputs and outputs.
SysSPs
_____ often function as standards or procedures to be used when configuring or maintaining systems.
Defense in depth
_________ is a strategy for the protection of information assets that uses multiple layers and different types of controls (managerial, operational, and technical) to provide optimal protection.
Reduncancy
___________ is a strategy of suing multiple types of controls that prevent the failure of one system from compromising the security of informaiton.