Module 2
National Information Infrastructure Protection Act of 1996 modified which Act?
Computer Fraud and Abuse Act
The CPMT conducts the BIA in three stages but does not
Determine mission/business processes and recovery criticality, identify recovery priorities for system resources, identify resources requirements.
The ______ is based on and directly supports the mission, vision, and direction of the organization and sets the strategic direction, scope, and tone for all security efforts.
EISP
The ____ attempts to prevent trade secrets from being illegally shared.
Economic Espionage Act
This act is a collection of statues that regulate the interception of wire, electronic, and oral communications.
Electronic Communications Privacy Act
_______ is the legal obligation of an entity that extends beyond criminal or contract law.
liability
The state purposes of ISO/IEC 27002 is to "offer guidelines and voluntary directions for information security________
managment
The Privacy of Customer Information Section of the common carrier regulation states that any proprietary information shall be used explicitly for providing services, and not for any _______ purpose.
marketing
The _____ of an organization are the intermediate states obtained to achieve progress toward a goal or goals.
objectives
_____ controls address personnel security, physical security, and the protection of production inputs and outputs.
operational
The spheres of security are the foundation of the security framework and illustrate how information is under attack from a variety of sources, with far fewer protection layers between the information and potential attackers on the __________ side of the organization.
people
Managerial directives that specify acceptable and unacceptable employee behavior in the workplace are known as __________.
policies
___________ law regulates the structure and administration of government agencies and their relationships with citizens employees, and other government.
public
A ______ plan is a plan for the organization's intended strategic efforts over the next severl years.
strategic
Some policies may need a(n) ____________________ indicating their expiration date.
sunset clause
The ______ of 1999 provides guidance on the use of encrypiton and provides protection form goverment intervention.
Security and Freedom through Encryption Act.
Which country reported the least tolerant attitudes toward personal use of organizational computing resources?
Singapore
_____ often function as standards or procedures to be used when configuring or maintaining systems.
SysSPs
When BS 7799 first came out, several countries, including the United States, Germany, and Japan, refused to adopt it, claiming that it had fundamental problems. Which of the following is NOT one of those problems
The global information security community had already defined a justification for a code of practice, such as the one identified in ISO/IEC 17799
The SETA program is a control measure designed to reduce the instances of ______ security breaches by employees.
accidental
It is good practice, however, for policy _____ to solicit input both form technically adept information security experts and from business-focused managers in each community of interest when making revisions to security policies.
administrators
A ________ is a document containing contact information for the people to be notified in the event of an incident.
alert roster
A fundamental difference between a BIA and risk management is that risk management focuses on identifying the threats, vulnerabilities, and attacks to determine which controls can protect the information, while the BIA assumes _____
controls have been bypassed, ineffective and failed
______ are the fixed moral attitudes or sutoms of a particular group.
cultural mores
The difference between a policy and a law is the ignorance of a law is an acceptable defense. (T/F)
flase
A security ________ is and outline of the overall information security strategy for the organizations and a roadmap for planned changes to the information security environment of the organizations.
framework.
The Computer _________ and Abuse Act of 1986 is the cornerstone of many computer related federal laws and enformcment efforts.
fraud
In early 2014, in response to Executive Order 13636, NIST published the Cybersecurity Framework that intends to allow organization to _____.
identify and prioritize opportunities for improvement within the context of a continuous and repeatable process
A ______ is a plan or course of action that conveys instructions from and organizations senior managments to those who make decisions, take actions, and perform other duties
policy
_______ is a strategy of using multiple types of technology that prevent the failure of one system from compromising the security of information
redundancy
RAID is an acronym for a _____ array of independent disk drives that stores information across multiple units to spread out data and minimize the impact of a single drive failure.
redundant
According to NIST SP 800-14's security principles, security should ________.
support the mission of the organization, require a comprehensive and integrated approach, and be cost-effective
___________-specific serurtiy policies often function as standards or procedures to be used when configuring or maintaining systems.
systems
According to the National Information Infrastructure Protection Act of 1996, the severity of the penalty for computer crimes depth on the value of the information obtained and whether the offense is judged to have been committed for each of the following except______-
to harass
Good security programs begin and end with policy. (T/F)
true
You can create a single comprehensive ISSP document covering all infomation security issues. (T/F)
true
Criminal laws addresses activities and conduct harmful to society and is categorized as private or public. (T/F)
True
Due care and due diligence require that an organization make a valid effort to protect others and continually maintain this level of effort, ensuring these actions are effective. (T/F)
True
Each policy should contain procedures and a timetable for periodic review. (T/F)
True
A standard is a plan or course of action that conveys instructions from an organization's senior management to those who make decisions, take actions, and perform other duties. (T/F)
False
For policy to become enforceable it only needs to be distributed, read, understood, and agreed to. (T/F)
False
The ISSP sets out the requirements that must be met by the information security blueprint or framework. (T/F)
False
The key difference between laws and ethics is that ethics carry the authority of a governing body and laws do not. (T/F)
False
Laws and policies and their associated penalties only deter if the following conditions are present.
Fear of penalty, probability of being caught and of being administered.
Laws pliciesm and their associated penalties only provide deterrence if three conditions are present. List and describe them
Fear of penalty: potential offenders must fear the penalty. Probability of being apprehended: potential offenders must believe there is a strong possibility of being caught. Probability of penalty being applied: potential offenders must believe that the penalty will be administrated.
What is the subject of the Computer Security Act>
Federal Agency Information Security
The subject of the Sarbanes-Oxley Act
Financial Reporting
Is also known as the Gramm-Leach_Bliley Act
Financial Services Modernization Act
Redundancy can be implemented at a number of points throughout the security architecture, such as in _______.
Firewalls, proxy servers and access controls
What is the purpose of security education, training. and awareness (SETA)?
Improve awareness of the need to protect system resources, developing skills and knowledge so computer users can perform their jobs more securely.
The Health Insurance Portability and Accountability Act of 1996, also known as the _____ Act, protects the confidentiality and security of health care data by establishing and enforcing standards and by standardizing electronic data interchange.
Kennedy-Kessebaum
_______ controls cover security processes that are designed by strategic planners and implemented by the security administration of the organization.
Managerial
The goals of information security governance include all but
Regulatory compliance by using information security knowledge and infrastructure to support minimum standards of due care
The _____ defines stiffer penalties for prosecution of terrorist crimes.
USA Patriot Act
What three purposes does the ISSP serve?
1. Addresses specific areas of technology, such as authorized and prohibited usage of equipment, policies, liability, and systems management. 2. Requires frequent updates. 3. Contains a statement on the organization's position on specific issues.
List the five fundamental principles of HIPAA.
1. Consumer control of medical information 2. Boundaries on the use of medical information 3. Accountability for the privacy of private information 4. Balance of public responsibility for the use of medical information for the greater good measured against impact to the individual 5. Security of health information
This acts defines and formalizes laws to counter threats from computer related acts and offenses.
Computer Fraud and Abuse Act of 1986
What are the requirements for a policy to become enforceable?
Dissemination (distribution)- the organization must be able to demonstrate that the relevant policy has been made readily available for review by the employee. Review (reading)- The organization must be able to demonstrate that it disseminated the document in an intelligible form, including versions for illiterate, non-English reading. and reading-impaired employees Comprehension (understanding)- The organization must be able to demonstrate that the employee understood the requirements and content of the policy. Compliance (agreement)- The organization must be able to demonstrate that the employee agrees to comply with the policy, through act or affirmation. Uniform enforcement- The organization must be able to demonstrate that the policy has been uniformly enforced, regardless of employee status or assignment.
The transfer of large batches of data to an off-site facility is called ____.
electronic vaulting
SP 800-14, Generally Accepted Principles and Practices for Securing Information Technology Systems, provides best practices and security principles that can direct the security team in the development of a security ____.
blueprint
Individuals with authorization and privileges to manage information within the organization are most likely to cause harm or damage _______.
by accident
____ law comprises a wide variety of laws that govern a nation or state.
civil
A _____ site provides only rudimentary services and facilities.
cold
Incident _________ is the rapid determination of the scope of the breach of the confidentiality, integrity, and availability of information and information assets during or just following an incident.
damage assessment
Standards may be published, scrutinized, and ratified by a group, as in formal or ____ standards.
de jure
____ is a strategy for the protection of information assets that uses mulitple layers and different types of controls (managerial, operational, and technical) to provide optimal protection.
defense in depth.
Security _____ are the areas of trust within which users can freely communicate.
domains
Criminal or unethical ____ goes to the state of mind of the individual performing the act.
intent
The Council of Europe adopted the Convention of CyberCrime in 2001 to oversee range of security functions associated with ____ activities
internet
"Long arm _____" refers to the long arm of the law reaching across the country or around the world to draw an accused individual into its court systems whenever it can establish jurisdiction.
jurisdiction
__________ are rules that mandate or prohibit certain behavior and are enforced by the state
laws
