Question 1

Why it measurement prioritization and selection important?How can it be achieved?

Accepted Answer

The answer of Why it measurement prioritization and selection important?How...

Question 2

An assessment of the performance of some action or process against which futureperformance is assessed.

Accepted Answer

A baseline is a reference point used to measure and compare the performance of an action or process over time, serving as a standard for future assessments.

Question 3

Those security efforts that are considered among the best in theindustry.

Accepted Answer

Best security practices are considered among the best in the industry as they represent the most effective and efficient methods for achieving security objectives.

Question 4

A common approach to a Risk ManagementFramework (RMF)for InfoSec practice.

Accepted Answer

NIST SP 800-37 provides a comprehensive approach for implementing RMF for InfoSec practice. It includes steps such as categorizing information systems, selecting security controls, implementing controls, assessing the effectiveness of controls, authorizing the system to operate, and monitoring the system continuously. The other options (A, B, C, D, E, F, G, H, I) are all components of RMF, but do not provide a complete and structured framework like NIST SP 800-37.

Question 5

The actions that demonstrate that an organization has made a valid effort to protect othersa requirement and that the implementedstandards continue to provide the required level of protection.

Accepted Answer

Due diligence refers to the efforts made by an organization to ensure that they are complying with legal and ethical standards, which includes protecting others and maintaining the required level of protection.

Question 6

Before beginning the process of designing,collecting,and using measures,the CISO should be prepared to answer the following questions posed by Kovacich.List four of these questions.

Accepted Answer

The answer of Before beginning the process of designing,collecting,and using...

Question 7

A comprehensive assessment of a system's technical and nontechnical protectionstrategies,as specified by a particular set of requirements.

Accepted Answer

Certification involves a comprehensive assessment of a system's protection strategies to ensure they meet specified requirements.

Question 8

The process of implementing a performance measures program recommended by NIST involves six phases.List and describe them.

Accepted Answer

The answer of The process of implementing a performance measures...

Question 9

Compare and contrast accreditation and certification.

Accepted Answer

The answer of Compare and contrast accreditation and certification....

Question 10

An attempt to improve information security practices by comparing anorganization's efforts against practices of a similar organization or an industry-developedstandard to produce results it would like to duplicate.

Accepted Answer

Benchmarking involves comparing an organization's efforts against practices of a similar organization or an industry-developed standard to produce results it would like to duplicate. It is commonly used to improve information security practices.

Question 11

Those procedures that provide a superior level of security for an organization's information.

Accepted Answer

The answer of Those procedures that provide a superior level...

Question 12

Describe the three tier approach of the RMF as defined by NIST SP 800-37.

Accepted Answer

The answer of Describe the three tier approach of the...

Question 13

Why must you do more than simply list the InfoSec measurements collected when reporting them?Explain.

Accepted Answer

The answer of Why must you do more than simply...

Question 14

List the four factors critical to the success of an InfoSec performance program,according to NIST SP 800-55,Rev.1.

Accepted Answer

The answer of List the four factors critical to the...

Question 15

The authorization of an IT system to process,store,or transmit information.

Accepted Answer

Accreditation is the process of evaluating the security controls of an IT system to ensure that they meet the established set of security requirements. Once the system is found compliant, it receives formal authorization to process, store, or transmit information.

Answer: D
 Certification is the process of assessing the security features of an IT system against a set of predefined criteria, such as security standards, guidelines, or best practices. Once the system meets the criteria, it is officially certified as secure.

Answer: J
 NIST SP 800-37 is a guideline from the National Institute of Standards and Technology (NIST) that outlines a risk management framework for federal IT systems. The guideline includes a step-by-step process for assessing, implementing, and monitoring security controls, which can ultimately lead to formal authorization or accreditation of the system.

Question 16

On what do measurements collected from production statistics greatly depend?Explain your answer.

Accepted Answer

The answer of On what do measurements collected from production...

Question 17

The data or the trends in data that may indicate the effectiveness ofsecurity countermeasures or controls-technical and managerial-implemented in theorganization.

Accepted Answer

Performance measurements allow organizations to track and analyze trends in their data to determine the effectiveness of their security controls and countermeasures. It involves setting specific performance metrics and goals, collecting data, and analyzing the results to identify areas for improvement. This approach provides a quantitative way to evaluate the success of security measures and make data-driven decisions to enhance security posture. The other options such as accreditation, certification, and due diligence are related to establishing the legitimacy or compliance of security measures, while benchmarking and best security practices focus on identifying industry standards or best practices. NIST SP 800-37 is a framework for risk management that can guide organizations in developing their security measures but does not directly provide a way to measure performance.

Question 18

What are the two major activities into which the InfoSec measurement development process recommended by NIST is divided?

Accepted Answer

The answer of What are the two major activities into...

Question 19

A legal standard that requires an organization and its employees to actas a reasonable and prudent individual or organization would under similar circumstances.

Accepted Answer

The term "standard of due care" refers to the legal requirement for organizations to act in a way that a reasonable and prudent individual or organization would under similar circumstances. This standard is often used in legal cases to determine whether an organization acted appropriately in regards to security, privacy, or other areas of risk management.

Quiz 9: Security Management Practices