Principles Of Information Systems Security

Front 1

Two fundamental requirements for every human activity:

Back 1

Coordination
Division of Labor

Front 2

Coordination of various tasks for a purposeful outcome defines the nature of organizations. What is at the crux of any coordinating activity?

Back 2

Communication

Front 3

Definition of an organization?

Back 3

A series of information-handling activities

Front 4

Information Handling can be undertaken at three levels:

Back 4

Technical - limit access
Formal - alter organizational hierarchy
Informal - security awareness program

Front 5

The system for handling information at the three levels:

Back 5

An organization's information system.

Front 6

Core Argument of System Security:

Back 6

Information systems need to be secured at a technical, formal and informal level.

Front 7

How is a formal system formed?

Back 7

When messages arrive from external parties, suppliers, customers, regulatory agencies, and financial institutions. Messages are usually very explicit and are transcribed by an organization to get its own work done.
Plays a supportive role to the largely informal setting.

Front 8

What is the information flow loop for formal systems?

Back 8

from external to internal and then to external - completed when messages are transmitted by the organization to external parties from which it originally received the messages or other additional parties.

Front 9

Informal system

Back 9

The natural means to augment the formal system. In ensuring the formal system works, people generally engage in informal communications.
the informal system represents a subculture where meanings are established, intentions are understood, beliefs are formed, and commitments and responsibilities are made, altered, and discharged.

Front 10

Base of formal systems:

Back 10

Formal systems are rule based and tend to bring about uniformity; generally insensitive to local problems and as a consequence there may often be discordance between rules advocated by the formal system and realities created by cohesive informal groupings.

Front 11

Boundary between Formal and Informal

Back 11

Best determined by decision-makers, who base their assessment on identifying those factors that can be handled routinely and those that would be best left informal.

Front 12

Technical

Back 12

The technical system essentially automates a part of the formal system; presupposes that a formal system exists at all times; plays a supportive role to the formal, perhaps bureaucratic, rule-based environment.

Front 13

Results of a lack of coordination

Back 13

Results in either substandard management practices or it opens up the organization to a range of vulnerabilities.

Front 14

Security in Threes

Back 14

Managing information system security to a large extent equates to maintaining integrity of the three systems - formal, technical, and informal.

Front 15

Control

Back 15

the use of interventions by a controller to promote a preferred behavior of a system being controlled.

Front 16

Controls can be:

Back 16

technical, formal or informal.

Front 17

Controls have ______________________ effects.

Back 17

dysfunctional

Front 18

Most important reason controls can be dysfunctional:

Back 18

isolated solutions (i.e., controls) may be provided for specific problems; tend to ignore other existing controls and their contexts.

Front 19

_______________ _______________ in each of the three categories, though important, must complement each other.

Back 19

Individual controls
Necessitates an overarching policy that determines the nature of controls being implemented and therefore provides comprehensive security to the organization.

Front 20

Focus of a security policy:

Back 20

to create a shared vision and an understanding of how various controls will be used such that the data and information is protected in an organization.

Front 21

Why does a business implement complex technological controls?

Back 21

To protect the information held in their computer systems, most of these controls have been in the area of access control and authentication.

Front 22

What are some of the authentication controls?

Back 22

Ultimately dependent on cost justification of controls.
challenge-response box technology
block ciphers
message authentication
voice analysis
digital signatures

Front 23

Reason a rule-based formal structure needs to be put in place:

Back 23

determine the consequences of misinterpretation of data and misapplication of rules in an organization and help in allocating specific responsibilities.
Should address not only the hiring procedures, but also the structures of responsibility during employment.
Helps in the attribution of blame, responsibility, accountability and authority.

Front 24

Key principle in assessing how much resources to allocate to security(technical or formal controls) is that the amount spent should be in proportion to the criticality of the system,

Back 24

cost of remedy, and the likelihood of the breach of security occurring.
Also necessary for the management of organizations to adopt appropriate controls to protect themselves from claims of negligent duty and also to comply with the requirements of data protection legislation.

Front 25

Coordination in threes refers to what three aspects of information security?

Back 25

Formal Aspect
Informal Aspect
Technical Aspect

Front 26

When an organization implements controls to limit access to buildings, rooms or computer systems, these are referred to as _________________ controls.

Back 26

Formal

Front 27

The organizational hierarchy can be considered a part of _________ controls.

Back 27

formal

Front 28

Training and an employee awareness program could be considered a part of what type of control?

Back 28

Informal

Front 29

The first step in developing good management practices and reducing the risk of a security breach is by adopting some ______________ _____________ standards

Back 29

base line

Front 30

Most breaches of information system security occur shortly _______________ the terminated employee leaves the organization.

Back 30

before

Front 31

Formal controls should address not only the hiring procedures but also the structures of ______________ during employment.

Back 31

responsibility

Front 32

Training and awareness programs are extremely important in developing a ___________________ core of members of the organization

Back 32

trusted

Front 33

An organization can therefore be defined as a series of _____________ - _______________ ________________.

Back 33

information-handling activities

Front 34

The informal system represents a _____________ where meanings are established, _____________ are understood, ____________ are formed, and _______________ and _________________ are made, altered and discharged.

Back 34

subculture
intentions
beliefs
commitments and responsibilities

Front 35

The key principle in assessing how much resources to allocate to security (technical and formal controls) is:

Back 35

the amount spent should be in proportion to the criticality of the system. cost of remedy, and the likelihood of the breach of security occurring.

Front 36

Managing security is the implementation of a __________ of ____________.

Back 36

range of controls

Front 37

____________ is “the use of interventions by a controller to promote a preferred behavior of a system being controlled”

Back 37

Control

Front 38

Authentication and access control

Back 38

Smart card technology is extensively being used in the financial firms
‘challenge-response box’ technology
Voice analysis
Digital signatures

Front 39

Implementation of technological solutions is dependent upon:

Back 39

cost justifying the controls

Front 40

Task-force’ approach at the organizational level:

Back 40

Carrying out security management
Giving strategic direction
Representatives from a wide range of functional areas

Front 41

Personnel issues

Back 41

Hiring procedures
Structures of responsibility
Sub-culture which promotes fair practices and moral leadership
Termination practices of the employees

Front 42

Security awareness is a cost effective control by:

Back 42

Increased awareness should be supplemented with an ongoing education and training program

Training and awareness are extremely important in developing ‘trusted’ core of members of the firm
Emphasizing sub-culture

An environment of developing a common belief system

Front 43

Coordination in threes still applies, but a further layer of _____________ is added when organizations establish relationships with each other.

Back 43

complexity

Front 44

A firewall is an example of a(n) _________________ control.

Back 44

technical

Front 45

The core information system security requirements of an organization are:

Back 45

confidentiality, integrity, availability, authenticity, and nonrepudiation

Front 46

Data is usually protected from ________________ such as being modified, destroyed, disclosed, intercepted, interrupted, or fabricated.

Back 46

vulnerabilities

Front 47

Perpetrators generally stick to the __________ and ______________ means of penetration.

Back 47

easiest and cheapest

Front 48

Principles of __________ ______________, ______________, and ______________________ are the basis for establishing information system security.

Back 48

easiest penetration
timeliness
effectiveness

Front 49

At a technical level, name the six threats to hardware, software, and the data that resides in computer systems - Data Security Requirements.

Back 49

Modification
Destruction
Disclosure
Interception
Interruption
Fabrication

Front 50

Name the three critical security requirements for protecting data.

Back 50

Confidentiality
Integrity
Availability

Front 51

Name two other security requirements that have become important. especially in a networked environment.

Back 51

Authentication
Nonrepudiation

Front 52

The use of the need-to-know principle is the most acceptable form of ensuring ______________.

Back 52

confidentiality

Front 53

What requirement assures that the message is from the source it claims to be from?

Back 53

Authenticity

Front 54

Denial-of-service attacks are to a large extent a consequence of which security requirement not having been adequately addressed?

Back 54

Availability

Front 55

What requirement ensures that data and programs are changed in an authorized manner?

Back 55

Integrity

Front 56

Privacy of data is ensured by what requirement?

Back 56

Confidentiality

Front 57

What requirement prevents an individual or entity from denying having performed a particular action related to data?

Back 57

Nonrepudiation

Front 58

A digital signature scheme is one means to ensure ________________.

Back 58

Authentication

Front 59

The _____________ point is considered to be the most serious vulnerability. This relates to the Principle of ______________ ________________.

Back 59

Weakest
Easiest Penetration

Front 60

Perpetrators generally stick to the ______________, ______________, _________________ means to accomplishing their objectives.

Back 60

easiest
safest
simplest

Front 61

The principle of easiest penetration suggests that organizations:

Back 61

need to systematically consider all possible means of penetration since strengthening one might make another means more attractive to a perpetrator.

Front 62

Need-to-know principle:

Back 62

Both users and systems should have access to and receive data only on a need-to-know basis. This is the most acceptable form of ensuring confidentiality.

Front 63

Confidentiality

Back 63

Requirement that ensures privacy of data
Protection mechanisms may include: encryption, lock and keys and related password mechanisms, cryptography

Front 64

Integrity

Back 64

Requirement that ensures that data and programs are changed in an authorized manor. Integrity refers to an unimpaired condition, a state of completeness and wholeness, and adherence to a code of values. "All data is present and accounted for" (irrespective of accuracy)

Front 65

Availability

Back 65

requirement that ensures proper functioning of all systems such that there is no denial of service to authorized users.

Front 66

Authentication

Back 66

requirement that assures that the message is from the source it claims to be from. Timeliness is an important attribute, since obsolete data is not nessarily true and correct.

Front 67

Nonrepudiation

Back 67

requirements that prevents an individual or entity from denying having performed a particular action related to data

Front 68

Disclosure

Back 68

when any of the access control mechanisms fail and it becomes possible to view confidential data.

Front 69

Modification

Back 69

May be a cause of loss of confidentiality , even though the information was not disclosed, but happens when someone secretly modifies the data.

Front 70

Vulnerability of Computing Resources:
Hardware
Software
Data

Back 70

Hardware - Destruction; interception; interruption
Software - Modification; interception; interruption (logic bomb - new routine inserted in the software; trojan horse, virus, trapdoor)
Data - Destruction; interception; interruption;
fabrication; modification; disclosure

Front 71

Confidentiality Attributes and Protection of Data and Software:
Confidentiality
Kinds of Controls
Possible Losses

Back 71

Confidentiality
Data - a set of rules to determine if a subject has access to an object
Software - Limited access to code
Kinds of controls
Data - Labels, encryption, discretionary and mandatory access control, reuse prevention
Software - Copyright, patents, labels, physical access control locks.
Possible Losses
Data - Disclosure, inference, espionage
Software - Piracy, trade secret loss, espionage

Front 72

Integrity Attributes and Protection of Data and Software
Integrity
Kinds of controls
Possible Losses

Back 72

Integrity
Data - Unimpaired, complete, whole, correct
Software - Unimpaired, everything present and in an ordered manner
Kinds of controls
Data - Hash totals, check bits, sequence number checks, missing data checks
Software - Hash totals pedigree checks, escrow, vendor assurance sequencing
Possible losses
Data - Larceny, fraud, concatenation
Software - Theft, fraud, concatenation

Front 73

Need-to-Withhold Principle

Back 73

default situation in business in which the information is freely available to all employees because the Need-to-Know principle can be stifling to the conduct of business

Front 74

Integrity checks

Back 74

relate to identification of missing data in fields and files, checks for variable length and number, hash total, transaction sequence checks, and so on. At a higher level, integrity is checked in terms of completeness, compatibility, consistency of performance and failure reports. 2 broad categories: prevention mechanisms and detection mechanisms.

Front 75

Prevention Mechanisms

Back 75

seek to maintain integrity by blocking unauthorized attempts to change the data or change the data in an unauthorized manner.

Front 76

Detection Mechanisms

Back 76

Simply report violations of integrity - do not stop violations from taking place; usually analyze data to see if the required constraints still hold.

Front 77

Availability Attributes and Protection of Data and Software:
Availability
Kinds of controls
Possible Losses

Back 77

Availability
Data - Present and accessible when and where needed
Software - Usable and accessible when and where needed
Kinds of controls
Data - Redundancy, backup, recovery plan, statistical pattern recognition
Software - Escrow, redundancy, backup, recovery plan
Possible losses
Data - Denial of service, failure to provide, sabotage, larceny
Software - Larceny, failure to act, interference

Front 78

Authentication Attributes and Protection of Data and Software:
Authentication
Kinds of controls
Possible Losses

Back 78

Authentication
Data - Genuine; accepted as conforming to a fact
Software - Genuine; unquestioned origin
Kinds of controls
Data - Audit log, verification validation
Software - Vendor assurances, pedigree documentation, hash totals, maintenance log, serial checks
Possible losses
Data - Replacement, false data entry, failure to act, repudiation, deception, misrepresentation
Software - Piracy, misrepresentation, replacement, fraud

Front 79

Nonrepudiation Attributes and Protection of Data and Software
Nonrepudiation:
Kinds of controls
Possible Losses

Back 79

Nonrepudiation
Data - Genuine, true, and authentic communication
Software - Genuine, true
Kinds of controls
Data - Authentiacation, validation checks
Software - Integrity controls, nonmodification controls
Possible losses
Data - Monetary, loss of identity, disclosure of private information
Software - Vulnerability of software code, fraud, misconstrued software

Front 80

Encryption

Back 80

involves the task of transforming data such that it is unintelligible to an outside observer; significantly reduces chances of outside interception and any possibility of data modification. If not used properly, may result in a limited effect on security, and the performance of the whole system may be compromised.

Front 81

Software Controls - three categories

Back 81

Software development controls
Operating system controls
Program controls
Each of the three categories of controls could be instituted at the input, processing and output levels.

Front 82

Software development controls

Back 82

essentially a consequence of good systems development; conformance to standards and methodologies helps in establishing controls that go a long way in correct specification of systems and development of software.
Good testing, coding and maintenance are the cornerstones of such controls

Front 83

Operating system controls

Back 83

Limitations built into operating systems such that each user is protected from others; many times these controls are developed by establishing extensive checklists.

Front 84

Program controls

Back 84

controls internal to the software, where specific access limitations are built into the system and include access limitations to data.

Front 85

Role of Prevention Mechanisms

Back 85

seek to maintain integrity by blocking unauthorized attempts to change the data or change the data in an unauthorized manner.

Front 86

Integrity Checks

Back 86

relate to identification of missing data in fields and files, checks for variable length and number, hash total, transaction sequence checks, and more. Higher level - checked in terms of completeness compatibility, consistency of performance and failure reports.

Front 87

Usually the most difficult attaches to detect:

Back 87

Availability attacks

Front 88

Methods of Defense:

Back 88

Encryption
Software Controls
Physical and Hardware Controls

Front 89

Principle of Timeliness

Back 89

triggers the delay in cracking a system, such that the data that a perpetrator might access is no longer useful.

Front 90

Principle of Effectiveness

Back 90

ensures the right balance between controls, such that the controls are not a hindrance to the normal workings of the business.

Front 91

Basis for establishing information system security:

Back 91

Principles of easiest penetration, timeliness, and effectiveness

Front 92

Data is usually protected from vulnerabilities such as:

Back 92

being modified, destroyed, disclosed, intercepted, interrupted, or fabricated.

Front 93

The Trusted Computer System Evaluation Criteria (TCSEC) was originally developed by ____________________.

Back 93

DoD (Department of Defense

Front 94

What are the two levels at which any function of computer-based system can be viewed?

Back 94

The user view
The implementation view

Front 95

Access controls generally address which of the three critical security requirements for protecting data?

Back 95

confidentiality
integrity
availability

Front 96

Access controls could be either _________________ or ___________________.

Back 96

mandatory
discretionary

Front 97

The notion of integrity deals with individual _____________, ______________, and _______________.

Back 97

accountability
auditability
separation of duties

Front 98

The no read up rule is one of the two axioms for which model:

Back 98

Bell La Padula

Front 99

The no write down rule dictates that a subject cannot move information from an object with a higher security _________________ to a lower security ________________.

Back 99

classification
classification

Front 100

The _________________ monitor concept was conceived so that all interactions within the computer system occur with some type of mediation that implements the security policy at all times.

Back 100

reference

Front 101

The philosophy of need-to-know is based on efforts to classify information and maintain strict segregation of people, and was developed by the military as a means of restricting _____________ access to data.

Back 101

unauthorized

Front 102

An example of a model created for a particular organization is the Bell La Padula model, and that is why it works well for the __________________ organization, because it was developed with that structure and culture in mind.

Back 102

military

Front 103

In the nonmilitary organization, ________________ of the information is key to the well being of the organization.

Back 103

integrity

Front 104

Any function of a computer based system can be viewed at two levels, one is the user view:

Back 104

elicited during requirement analysis for a system and records what a system should do.

Front 105

The second level the function of a computer based system can be viewed is:

Back 105

the view is built during system design and records how the system is to be constructed.

Front 106

Models tend to be simple, abstract, and easy to comprehend and prove mathematically, and hence have ______________ ______________ in specifying ________________ _____________ measures alone.

Back 106

limited utility
technical security

Front 107

Trusted System

Back 107

a system that disallows an unauthorized transfer of information.

Front 108

The Bell La Padula model deals with controlling ________________ to _______________ .

Back 108

access
objects

Front 109

The current access set addresses the abilities to extract or insert information in a specified object. base on four modes:

Back 109

execute - neither observe nor alter
read - Observe, but do not alter.
append - alter but do not observe.
write - observe and alter

Front 110

The Denning Information Flow model is concerned with the security of _________________ ________________.

Back 110

Information Flows

Front 111

The _______________ ________________ is the critical part of the Denning model since it determines if information will be allowed to flow from a top secret file to an existing secret file.

Back 111

flow operator

Front 112

The science of _______________________ seeks to ensure that the messages transmitted are kept confidential, their integrity is maintained, and are available to the right people at the right time.

Back 112

Cryptology

Front 113

The field of ____________________ includes methods and techniques to ensure secrecy and authenticity of message transmissions.

Back 113

Cryptography

Front 114

The range of methods used to break the encrypted messages is referred to as _________________.

Back 114

Cryptanalysis

Front 115

Once a document has been encrypted it is referred to as ________________ text.

Back 115

cipher

Front 116

A ______________ text document is any document in its native format.

Back 116

plain

Front 117

The ________________ algorithm is designed to produce a cipher text document that cannot be returned to its plain text form without the use of the algorithm and the associated key(s).

Back 117

encryption

Front 118

In __________________ encryption, a single key is used to encrypt and decrypt a document.

Back 118

symmetric

Front 119

It is the _______________ that holds the means to decrypt, and therefore it becomes important to establish a secure channel for sending and receiving it.

Back 119

key

Front 120

Ciphers that use the same key for both encrypting and decrypting plain text are referred to as ________________ ciphers.

Back 120

symmetric

Front 121

Ciphers using a different key to encrypt and decrypt the plain text are termed as ___________________ ciphers.

Back 121

asymmetric

Front 122

A brute force attack where the opponent will typically undertake a range of statistical an analyses on the text in order to understand the inherent patterns is called a _____________ text attack.

Back 122

cipher

Front 123

An attack that utilizes information regarding the placement of text, such as in the header of an accounting document or a disclaimer statement, is referred to as a ______________ text attack.

Back 123

plain

Front 124

Encryption can be carried out in two forms ________________ and ___________________.

Back 124

substitution
transposition

Front 125

In any language there are certain letters that have a high frequency of appearing together. These are referred to as _____________________.

Back 125

digrams

Front 126

Ciphers which generally convert one symbol of plain text at at time into a symbol of cipher text are referred to as _________________ ciphers.

Back 126

stream

Front 127

Ciphers that convert a group (fixed-length) block of plain text into cipher text through the use of a secret key are referred to as ____________________ ciphers.

Back 127

block

Front 128

Initially developed by IBM, ___________________ was later adopted by the US government in 1977. (Hint: It inputs a block of 64 bits, but only uses 56 bits in the encryption process).

Back 128

DES (Data Encryption Standard)

Front 129

A cryptographic _______________ function such as SHA-1 or MD4/MD5 is a one-way process that produces a fixed length digest of the original plain text document.

Back 129

hash

Front 130

The ___________________ of the identity of the sender requires verification by a third party as to the identity of the sender.

Back 130

authentication

Front 131

The ___________ (____________ ______________ ______________) model provides for authentication through a process known as a web-of-trust.

Back 131

PGP
Pretty Good Privacy

Front 132

Frames use 48-bit ___________________ addresses to identify the source and destination stations within a network.

Back 132

MAC - Medium Access Control

Front 133

Thirty-two-bit _________________ addresses of the source and destination station are added to the packets in a process called encapsulation.

Back 133

IP

Front 134

Which Transport layer standard that runs on top of IP networks has no effective error recovery service and is commonly used for broadcasting messages over the network?

Back 134

UDP - User Datagram Protocol

Front 135

A ________________ is considered the first line of defense in protecting private information and denying access by intruders to a secure system on the internal network.

Back 135

firewall

Front 136

What technique serves the dual purpose of hiding the internal IP addresses of critical systems as well as allowing multiple hosts on a private internal LAN to access the internet using a single public IP address?

Back 136

NAT Network Address Translation

Front 137

Most common break-ins exploit specific services that are running with ___________ configuration settings and are left unattended.

Back 137

default

Front 138

What technique can attackers use to identify the kinds of services that are running on the targeted hosts?

Back 138

Port Scanning

Front 139

What type of attack is the most commonly used mode of attack against an operating system?

Back 139

Password Attacks

Front 140

An advanced form of Web site-based attack where a DNS server is compromised and the attacker is able to redirect traffic of a popular Web site to another alternative Web site, where user login information is collected, is called _______________ .

Back 140

Pharming

Front 141

A packet sniffer attached to any network card on the LAN can run in a _____________ mode, silently watching all packets and logging the data.

Back 141

promiscuous

Front 142

A(n) _______________ attack relies on malformed messages directed at a target system with the intention of flooding the victim with as many packets as possible in a short duration of time.

Back 142

DOS - Denial of service

Front 143

An ___________________ attack uses multiple compromised host systems to participate in attacking a single target or target site, all sending IP address spoofed packets to the same destination system.

Back 143

distributed DoS (DDoS)

Front 144

Computer users should ensure that folders are made network sharable only on a cneed basis and are _______________ whenever they are not required.

Back 144

disabled

Front 145

From a security perspective, it is important that not all user accounts are made a member of the _________________ group

Back 145

administrator

Front 146

An account __________________ policy option disables user accounts after a set number of failed login attempts.

Back 146

lockout

Front 147

What steps should be taken to secure the file system?

Back 147

Stay Current with System Updates
Use Antivirus Software
Protect File Shares (shared folders)
Turn Off Unnecessary Services
Disable or Delete Unnecessary Accounts
Secure User Accounts
Rename or Disable Administrator Account
Limit Membership to Administrator Group
Set Account Lockout

Front 148

What steps should be taken to secure access from the Network?

Back 148

Use a Personal Firewall
Install Anti-spyware Software
disable Remote Access
Adjust Internet Application Settings
Checking Security Network Scanners

Front 149

When responsibility and authority structures are ill-
defined or not defined at all, it results in a breakdown of
the ______________ control systems.

Back 149

formal

Front 150

The most important element of interpreting structures of responsibility is the ability to understand the
underlying patterns of __________________.

Back 150

behavior

Front 151

Usually security problems are a consequence of
____________ breakdowns and lack of understanding of behaviors of various stakeholders.

Back 151

communication

Front 152

4. The security management structure looks from the
top down. Substantive actions required of members of the organization in the course of using the computer systems in place should take a(n) ______________ approach.

Back 152

bottoms up

Front 153

5. The effectiveness of the security policy is a function
of the level of support it has from an organization’s
______________ ____________________.

Back 153

executive leadership

Front 154

6. A strategy of locks and keys becomes inadequate if
people __________ the organization open those locks (i.e., subvert the controls).

Back 154

inside

Front 155

7. The security policies determine the processes and
techniques required to provide the security but not the
____________________.

Back 155

technology

Front 156

8. Following the implementation there is a constant
need to ______________ the security processes and techniques.

Back 156

monitor

Front 157

9. Staff and users also need to be ________________ on methods to identify new threats.

Back 157

trained

Front 158

10. An important aspect of the security model is the
______________ approach.

Back 158

layered

Front 159

Identification and development of _________________ ____ __________________ are a key aspect of formal information system security

Back 159

structures of responsibility

Front 160

Structures of responsibility define the _______________ ____ _____________________, which is so essential in ensuring management of access.

Back 160

pattern of authority

Front 161

_________________________ _______-____ at all levels is key to the success of the information system security program in any organization.

Back 161

Organization buy-in

Front 162

Security policies are an important ingredient of the ____________ security program.

Back 162

overall

Front 163

Proper security policy ___________________ and __________________ is essential for the success of overall security.

Back 163

formulation
implementation

Front 164

In business management practices, the term __________ was in use long before ____________ but the two are often used interchangeably, despite having very different meanings.

Back 164

Policy
Strategy

Front 165

In practice, implementing a(n) __________ can be delegated, while for implementing a(n) __________ executive judgment is required.

Back 165

policy
strategy

Front 166

At a(n) ____________ level the security strategy determines key decisions regarding investment, diversification, and integration of computing resources in line with other business objectives.

Back 166

corporate

Front 167

At a(n) __________ level, the security strategy looks into
the threats and weaknesses of the IT infrastructure.

Back 167

business

Front 168

The emphasis should be to develop a(n) __________
security vision that brings the issue of security to center stage and binds it to the organizational objectives, but this does not mean that organizations should not have any security policies sketching out __________ procedures.

Back 168

broad
specific

Front 169

Relegating IS security decisions to the operational
levels of the firm could result in lack of ______________ by top management.

Back 169

ownership

Front 170

One of the fundamental problems with respect to
security is for a firm to choose the right kind of a(n)
____________ to function in.

Back 170

environment

Front 171

8. Allocation of ______________ among competing needs can
become a critical problem in terms of strategizing about
security.

Back 171

resources

Front 172

While many organizations have engaged in identifying security issues and created relevant security policies, there is a clear mismatch between what the __________ mandates and what is done in practice.

Back 172

policy

Front 173

To a large extent high __________ processes are a
consequence of adequate planning and policy implementation.

Back 173

integrity

Front 174

Careful __________ and establishing proper checks and
balances are perhaps the cheapest of the operational-level security practices.

Back 174

planning

Front 175

Maintaining integrity of business processes is a
function of adequate ______________ and ______________ structures.

Back 175

responsibility
accountability