Quick Tips Chapter 12: Operations Security

Front 1

• Facilities that house systems that process sensitive information should have
physical access controls to limit access to authorized personnel only.

Back 1

• Data should be classified, and the necessary technical controls should be put
into place to protect its integrity, confidentiality, and availability.

Front 2

• Hacker tools are becoming increasingly more sophisticated while requiring
increasingly less knowledge by the attacker about how they work.

Back 2

• Quality assurance involves the verification that supporting documentation
requirements are met

Front 3

• Quality control ensures that an asset is operating within accepted standards.

Back 3

• System and audit logs should be monitored and protected from unauthorized
modification.

Front 4

• Repetitive errors can indicate lack of training or issues resulting from a poorly
designed system.

Back 4

• Sensitive data should not be printed and left at stand-alone printers or fax
devices.

Front 5

• Users should have the necessary security level to access data and resources, but
must also have a need to know.

Back 5

.• Clipping levels should be implemented to establish a baseline of user activity
and acceptable errors.

Front 6

• Separation of responsibilities and duties should be in place so that if fraud
takes place, it requires collusion.

Back 6

• Sensitive information should contain the correct markings and labels to
indicate the corresponding sensitivity level.

Front 7

• Contract and temporary staff members should have more restrictive controls
put upon their accounts.

Back 7

• Access to resources should be limited to authorized personnel, applications,
and services and should be audited for compliance to stated policies.

Front 8

• Change control and configuration management should be put in place so
changes are approved, documented, tested, and properly implemented.

Back 8

• Activities that involve change management include requesting a change,
approving a change, documenting a change, testing a change, implementing a
change, and reporting to management.

Front 9

• Systems should not allow their bootup sequences to be altered in a way that
could bypass operating system security mechanisms.

Back 9

• Potential employees should have background investigations, references,
experience, and education claims checked out.

Front 10

• Proper fault-tolerant mechanisms should be put in place to counter
equipment failure.

Back 10

• Antivirus and IDS signatures should be updated on a continual basis.

Front 11

• System, network, policy, and procedure changes should be documented and
communicated.

Back 11

• When media is reused, it should contain no residual data.

Front 12

• Media holding sensitive data must be properly purged, which can be
accomplished through zeroization, degaussing, or media destruction.

Back 12

• Life-cycle assurance involves protecting a system from inception to
development to operation to removal.

Front 13

• The key aspects of operations security include resource protection, change
control, hardware and software controls, trusted system recovery, separation
of duties, and least privilege.

Back 13

• Least privilege ensures that users, administrators, and others accessing a
system have access only to the objects they absolutely require to complete
their job.

Front 14

• Vulnerability assessments should be done on a regular basis to identify new
vulnerabilities.

Back 14

• The operations department is responsible for any unusual or unexplained
occurrences, unscheduled initial program loads, and deviations from
standards.

Front 15

• Standards need to be established that indicate the proper startup and
shutdown sequence, error handling, and restoration procedures.

Back 15

• A teardrop attack involves sending malformed fragmented packets to a
vulnerable system.

Front 16

• Improper mail relay configurations allow for mail servers to be used to
forward spam messages.

Back 16

• Phishing involves an attacker sending false messages to a victim in the hopes
that the victim will provide personal information that can be used to steal
their identity.

Front 17

• A browsing attack occurs when an attacker looks for sensitive information
without knowing what format it is in.

Back 17

• A fax encryptor encrypts all fax data leaving a fax server.

Front 18

• A system can fail in one of the following manners: system reboot, emergency
system restart, and system cold start.

Back 18

• The main goal of operations security is to protect resources.

Front 19

• Operational threats include disclosure, theft, corruption, interruption, and
destruction.

Back 19

• Operations security involves balancing the necessary level of security with ease
of use, compliance, and cost constraints.