Deck 9: Security Management Practices

Question 1

The biggest barrier to baselining in InfoSec is the fact that many organizations do notshare warnings with other organizations.____________

Answer 1

False - benchmarking

Question 2

One question you should ask when choosing among recommended practices is "Can your organization afford to implement the recommended practice?"

Answer 2

True

Question 3

One of the critical tasks in the measurement process is to assess and quantify what willbe measured and how it is measured.____________

Answer 3

True

Question 4

Problems with benchmarking include all but which of the following?

A) Organizations don't often share information on successful attacks
B) Organizations being benchmarked are seldom identical
C) Recommended practices change and evolve, thus past performance is no indicator of future success
D) Benchmarking doesn't help in determining the desired outcome of the security process

Question 5

Attaining certification in security management is a long and difficult process,but once attained,an organization remains certified for the life of the organization.

Question 6

Creating a blueprint by looking at the paths taken by organizations similar to the one whose plan you are developing is known as which of the following?

A) benchmarking
B) best practices
C) baselining
D) due diligence

Question 7

Using a practice called baselining,you are able to develop policy based on the typical practices of the industry in which you are working.

Question 8

Recommended practices are those security efforts that seek to provide a superior level of performancein the protection of information.____________

Question 9

A comprehensive assessment of a system's technical and nontechnical protectionstrategies,as specified by a particular set of requirements is known as ​accreditation.____________

Question 10

Data or the trends in data that may indicate the effectiveness ofsecurity countermeasures or controls-technical and managerial-implemented in theorganization are known as programmeasurements.____________

Question 11

A company striving for 'best security practices' makes every effort to establish security program elements that meet every minimum standard in their industry.

Question 12

Which of the following is a possible result of failure to establish and maintain standards of due care and due diligence?

A) Baselining
B) Legal liability
C) Competitive disadvantage
D) Certification revocation

Question 13

Which of the following is NOT a question to be used as a self-assessment for recommended security practices in the category of people?

A) Do you perform background checks on all employees with access to sensitive data,
Areas, or access points?
B) Are the user accounts of former employees immediately removed on termination?
C) Would the typical employee recognize a security issue?
D) Would the typical employee know how to report a security issue to the right people?

Question 14

What are the legal requirements that an organization adopt a standard based on what a prudent organization should do,and then maintain that standard?

A) Certification and accreditation
B) Best practices
C) Due care and due diligence
D) Baselining and benchmarking

Question 15

Standardization is an an attempt to improve information security practices by comparing anorganization's efforts against those of a similar organization or an industry-developedstandard to produce results it would like to duplicate.____________

Question 16

Performance measurements are seldom required in today's regulated InfoSec environment. ​

Question 17

The authorization by an oversight authority of an IT system to process,store,ortransmit information is known as certification.____________

Question 18

Which of the following is NOT a consideration when selecting recommended best practices?

A) Threat environment is similar
B) Resource expenditures are practical
C) Organization structure is similar
D) Same certification and accreditation agency or standard

Question 19

Aperformance measure is an an assessment of the performanceof some action or process against which futureperformance is assessed._____________

Question 20

Astandard of due process is a legal standard that requires an organization and its employees to actas a "reasonable and prudent" individual or organization would under similar circumstances.____________

Question 21

In security management,which of the following is issued by a management official and serves as a means of assuring that systems are of adequate quality?

A) Accreditation
B) Certification
C) Performance measurement
D) Testimonial

Question 22

According to NIST SP 800-37,which of the following is the first step in the security controls selection process?

A) Categorize the information system and the information processed
B) Select an initial set of baseline security controls
C) Assess the security controls using appropriate assessment procedures
D) Authorize information system operation based on risk determination

Question 23

InfoSec measurements collected from production statistics depend greatly on which of the following factors?

A) Types of performance measures developed
B) Number of systems and users of those systems
C) Number of monitored threats and attacks
D) Activities and goals implemented by the business unit

Question 24

Which of the following InfoSec measurement specifications makes it possible to define success in the security program?

A) Development approach
B) Establishing targets
C) Prioritization and selection
D) Measurements templates

Question 25

When choosing from among recommended practices,an organization should consider a number of questions.List four.

Question 26

A practice related to benchmarking is ____________,which is a measurement against a prior assessment or an internal goal.

Question 27

Which of the following terms is described as the process of designing,implementing,and managing the use of the collected data elements to determine the effectiveness of the overall security program?

A) Performance management
B) Baselining
C) Best practices
D) Standards of due care/diligence

Question 28

The InfoSec measurement development process recommended by NIST isis divided into two major activities.Which of the following is one of them?

A) Regularly monitor and test networks
B) Identification and definition of the current InfoSec program
C) Maintain a vulnerability management program
D) Compare organizational practices against organizations of similar characteristics

Question 29

Which of the following is NOT a factor critical to the success of an information security performance program?

A) Strong upper level management support
B) High level of employee buy-in
C) Quantifiable performance measurements
D) Results oriented measurement analysis

Question 30

Organizations must consider all but which of the following during development and implementation of an InfoSec measurement program?

A) Measurements must yield quantifiable information
B) Data that supports the measures needs to be readily obtainable
C) Only repeatable InfoSec processes should be considered for measurement
D) Measurements must be useful for tracking non-compliance by internal personnel

Question 31

Best security practices balance the need for user _____________ to information with the need for adequate protection while simultaneously demonstrating fiscal responsibility.

Question 32

Which of the following is Tier 3 (indicating environment of operation)of the tiered risk management approach?

A) Mission/business process
B) Information system
C) Accounting/logistics
D) Organization

Question 33

The last phase in the NIST performance measures implementation process is to apply ______________ actions which closes the gap found in Phase 2.

Question 34

Which of the following is the last phase in the NIST process for performance measures implementation?

A) Apply corrective actions
B) Obtain resources
C) Document the process
D) Develop the business case

Question 35

____________________ encompasses a requirement that the implemented standards continue to provide the required level of protection.

Question 36

Which of the following is NOT one of the three types of performance measures used by organizations?

A) Those that determine the effectiveness of the execution of InfoSec policy
B) Those that determine the effectiveness and/or efficiency of the delivery of InfoSec services
C) Those that evaluate the compliance of non-security personnel in adhering to InfoSec policy
D) Those that assess the impact of an incident or other security event on the organization
Or its mission

Question 37

The Authorize step of the NIST six-step approach to the risk management framework involves all but which of the following tasks?

A) Prepare the plan of action and develop milestones
B) Assemble the security authorization package
C) Determine if the cost/benefit ratio is acceptable
D) Determine the risk to organizational operations

Question 38

Which of the following is the first phase in the NIST process for performance measurement implementation?

A) Develop the business case
B) Obtain resources
C) Prepare for data collection
D) Identify corrective actions

Question 39

Which of the following is NOT a question a CISO should be prepared to answer,about a performance measures program,according to Kovacich?

A) Why should these measurements be collected?
B) Where will these measurements be collected?
C) What affect will measurement collection have on efficiency?
D) Who will collect these measurements?

Question 40

A goal of 100 percent employee InfoSec training as an objective for the training program is an example of a performance __________.

Question 41

Why it measurement prioritization and selection important?How can it be achieved?

Question 42

a.accreditation
b.baseline
c.benchmarking
d.certification
e.due diligence
f.best security practices
g.recommended business practices
h.standard of due care
i.performance measurements
j.NIST SP 800-37
An assessment of the performance of some action or process against which futureperformance is assessed.

Question 43

a.accreditation
b.baseline
c.benchmarking
d.certification
e.due diligence
f.best security practices
g.recommended business practices
h.standard of due care
i.performance measurements
j.NIST SP 800-37
Those security efforts that are considered among the best in theindustry.

Question 44

a.accreditation
b.baseline
c.benchmarking
d.certification
e.due diligence
f.best security practices
g.recommended business practices
h.standard of due care
i.performance measurements
j.NIST SP 800-37
A common approach to a Risk ManagementFramework (RMF)for InfoSec practice.

Question 45

a.accreditation
b.baseline
c.benchmarking
d.certification
e.due diligence
f.best security practices
g.recommended business practices
h.standard of due care
i.performance measurements
j.NIST SP 800-37
The actions that demonstrate that an organization has made a valid effort to protect othersa requirement and that the implementedstandards continue to provide the required level of protection.

Question 46

Before beginning the process of designing,collecting,and using measures,the CISO should be prepared to answer the following questions posed by Kovacich.List four of these questions.

Question 47

a.accreditation
b.baseline
c.benchmarking
d.certification
e.due diligence
f.best security practices
g.recommended business practices
h.standard of due care
i.performance measurements
j.NIST SP 800-37
A comprehensive assessment of a system's technical and nontechnical protectionstrategies,as specified by a particular set of requirements.

Question 48

The process of implementing a performance measures program recommended by NIST involves six phases.List and describe them.

Question 49

Compare and contrast accreditation and certification.

Question 50

a.accreditation
b.baseline
c.benchmarking
d.certification
e.due diligence
f.best security practices
g.recommended business practices
h.standard of due care
i.performance measurements
j.NIST SP 800-37
An attempt to improve information security practices by comparing anorganization's efforts against practices of a similar organization or an industry-developedstandard to produce results it would like to duplicate.

Question 51

a.accreditation
b.baseline
c.benchmarking
d.certification
e.due diligence
f.best security practices
g.recommended business practices
h.standard of due care
i.performance measurements
j.NIST SP 800-37
Those procedures that provide a superior level of security for an organization's information.

Question 52

Describe the three tier approach of the RMF as defined by NIST SP 800-37.

Question 53

Why must you do more than simply list the InfoSec measurements collected when reporting them?Explain.

Question 54

List the four factors critical to the success of an InfoSec performance program,according to NIST SP 800-55,Rev.1.

Question 55

a.accreditation
b.baseline
c.benchmarking
d.certification
e.due diligence
f.best security practices
g.recommended business practices
h.standard of due care
i.performance measurements
j.NIST SP 800-37
The authorization of an IT system to process,store,or transmit information.

Question 56

On what do measurements collected from production statistics greatly depend?Explain your answer.

Question 57

a.accreditation
b.baseline
c.benchmarking
d.certification
e.due diligence
f.best security practices
g.recommended business practices
h.standard of due care
i.performance measurements
j.NIST SP 800-37
The data or the trends in data that may indicate the effectiveness ofsecurity countermeasures or controls-technical and managerial-implemented in theorganization.

Question 58

What are the two major activities into which the InfoSec measurement development process recommended by NIST is divided?

Question 59

a.accreditation
b.baseline
c.benchmarking
d.certification
e.due diligence
f.best security practices
g.recommended business practices
h.standard of due care
i.performance measurements
j.NIST SP 800-37
A legal standard that requires an organization and its employees to actas a reasonable and prudent individual or organization would under similar circumstances.