Security+ Exam Chapter 16

Front 1

Information Security Policy Framework

Back 1

Contains a series of documents designed to describe the organization’s cybersecurity program. It includes:

Policies

Standards

Procedures

Guidelines

Front 2

Policies

Back 2

High level statements of management intent. Compliance with policies is mandatory and includes:

- Statement of importance

- Requirement that all staff and contracts protect the CIA of information and systems

- Statement of information ownership

- Designation of CISO or executive responsible for cybersecurity issues

- Delegation of authority so CISO can create standards, procedures and guidelines that implement the policy

Front 3

Information Security Policy

Back 3

Provides high level authority and guidance for security program

Front 4

Acceptable Use Policy

Back 4

Provides network and system users with clear direction on permissible uses of information

Front 5

Data Governance Policy

Back 5

States the ownership of information created or used by the organization

Front 6

Data Classification Policy

Back 6

Describes the classification structure used by the organization and the process used to properly assign classifications to data

Front 7

Data Retention Policy

Back 7

Outlines what information the organization will maintain and the length of time different categories of work product will be retained prior to destruction

Front 8

Credential management Policy

Back 8

Describes the account lifecycle from provisioning through active use and decommissioning.

Front 9

Password Policy

Back 9

Sets forth requirements for password length, complexity, reuse, and similar issues

Front 10

Continuous Monitoring Policy

Back 10

Describes the organization’s approach to monitoring and informs employees that their activity is subject to monitoring in the workplace.

Front 11

Code of Conduct/Ethics

Back 11

Describes expected behavior of employees and affiliates and covers situations not specifically addressed in policy.

Front 12

Change Management and Change Control Policy

Back 12

Describes how the organization will review, approve, and implement proposed changes to information systems in a manner that manages both cybersecurity and operational risk

Front 13

Asset Management Policy

Back 13

Describes the process that the organization will follow for accepting new assets into inventory, tracking those assets over their lifetime, and properly disposing of them at the end of their useful life.

Front 14

Standards

Back 14

Mandatory requirements describing how an organization will carry out its information security policies. This may include configuration settings for OS, controls for highly sensitive information. These are approved at a lower organizational level and may change more regularly

Front 15

Procedures

Back 15

Detailed, step by step processes that individuals and organizations must follow in specific circumstances. These ensure a consistent process for achieving a security objective. Compliance with procedures is mandatory.

Front 16

Monitoring Procedures

Back 16

Describe how the organization will perform security monitory activities.

Front 17

Evidence Production Procedure

Back 17

Describes how the organization will respond to subpoenas, court orders, and other legitimate requests to produce digital evidence

Front 18

Patching Procedure

Back 18

Describes the frequency and process of applying patches to applications and systems under the organization’s care

Front 19

Guidelines

Back 19

Best practices and recommendations related to a given concept, technology, or task. Compliance with guidelines is not mandatory.

Front 20

Compensating Controls

Back 20

Mitigate the risk associated with exceptions to security standards. They balance the fact that it simply isn’t possible to implement every required security control in every circumstance with the desire to manage risk to the greatest feasible degree.

Front 21

Least Privilege

Back 21

Individuals should be granted only the minimum set of permissions necessary to carry out their job functions.

Front 22

Privilege Creep

Back 22

Occurs when an employee moves from job to job within the organization, accumulating new privileges, but never has the privileges associated with past duties revoked.

Front 23

Separation of Duties

Back 23

For extremely sensitive job functions, creates a rule that no single person may have the privileges required to perform both tasks.

Front 24

Two Person Control

Back 24

Similar to separation of duties, instead of preventing the same person from holding two different privileges that are sensitive when used together, two person control requires the participation of two people to perform a single sensitive action.

Front 25

Job Rotation

Back 25

Take employees with sensitive roles and move them periodically to other positions in the organization. This is due to fraud typically requiring ongoing concealment activities.

Front 26

Mandatory Vacations

Back 26

Forcing employees to take annual vacations of a week or more consecutive time and revoking their access privileges during that vacation time.

Front 27

Clean Desk Space

Back 27

Limiting the amount of paper left exposed on unattended employee desks.

Front 28

Onboarding and Offboarding

Back 28

Organization retains control of its assets and handles the granting and revocation of credentials and privileges in an orderly manner.

Front 29

Background Checks

Back 29

Used to uncover criminal activity or other past behavior that may indicate that a potential employee poses an undetected risk to the organization.

Front 30

Non disclosure Agreement

Back 30

Employees protect any confidential information that they gain access to in the course of their employment.

Front 31

Role Based Training

Back 31

Individuals receive the appropriate level of training based on their job responsibilities.

Front 32

Phishing Simulations

Back 32

Send users fake phishing messages to test their skills. Users who click on the simulated phishing message are sent to a training program designed to help them better recognize fraudulent messages

Front 33

Master Service Agreement

Back 33

It is an umbrella contract for the work of a vendor over an extended time.

Front 34

Scope of Work

Back 34

Each time a new project is created with a vendor this details the specifics of the project and is part of the Master Service Agreement

Front 35

Service Level Agreement

Back 35

Specify the conditions of the service that will be provided by the vendor and the remedies available to the customer if the vendor fails to meet the Service Level Agreement. These fails are mainly availability, data durability, and response time.

Front 36

Business Partnership Agreements

Back 36

Two organizations agree to do business with each other in a partnership

Front 37

HIPAA

Back 37

Security and privacy rules that affect health-care providers, insurers, and health information clearinghouses in the US.

Front 38

PCI DSS

Back 38

Provides detailed rules about the storage, processing, and transmission of credit and debit card information. It is not a law but a contractual obligation that applies to credit card merchants and service providers worldwide.

Front 39

Gramm-Leach-Bliley Act (GLBA)

Back 39

Covers US financial institutions and requires them to have formal security programs and designate an individual who has overall responsibility for that program.

Front 40

Sarbanes-Oxley Act (SOX)

Back 40

Applies to financial records of US publicly traded companies and requires that they have a strong degree of assurance for the IT systems that store and process those records.

Front 41

General Data Protection Regulation (GDPR)

Back 41

Security and privacy requirements for the personal information of European Union resident worldwide.

Front 42

Family Educational Right and Privacy Act (FERPA)

Back 42

Educational institutions implement security and privacy controls for student educational records.

Front 43

Data Breach Notification Laws

Back 43

Individual states have their own requirements on notification of individuals affected by a breach.

Front 44

National Institute for Standards and Technology (NIST)

Back 44

Responsible for developing cybersecurity standards across the US federal government. It is very applicable to the private sector due to its availability to public domains and its very high quality. It helps organizations:

- Describe their current cybersecurity posture

- Describe their target state for cybersecurity

- Identify and prioritize opportunities for improvement

- Assess progress toward the target state

- Communicate to internal and external stakeholders about cybersecurity risk

Front 45

NIST Framework Core

Back 45

Set of 5 security functions:

Identify

Protect

Detect

Respond

Recover

Front 46

NIST Framework Implementation

Back 46

Assesses how an organization is positioned to meet cybersecurity objectives often through a maturity model

Front 47

NIST Framework Profiles

Back 47

Describe how a specific organization might approach the security functions covered by the Framework Core. Organizations use it to describe its current state and desired future state.

Front 48

NIST Risk Management Framework (RMF)

Back 48

Provides a formalized process that federal agencies must follow to select, implement, and assess risk based security and privacy controls. Along with that it describes the process for authorizing system use.

Not used in the private sector

Front 49

International Organization for Standardization (ISO)

Back 49

Series of standards that offer best practices for cybersecurity and privacy. The 4 most common are:

ISO 27001

ISO 27002

ISO 27701

ISO 31000

Front 50

ISO 27001

Back 50

Document for Information technology, Security Techniques, Information security management systems, and Requirements. It has the following categories:

Information security policies

Organization of information security

Human resource security

Asset management

Access control

Cryptography

Physical and environmental security

Operations security

Communications security

System acquisitions, development, and maintenance

Supplier relationships

Information security incident management

Information security aspects of business continuity management

Compliance with internal requirements, such as policies, and with external requirements, such as laws

Front 51

ISO 27002

Back 51

Goes beyond control objectives and describes the actual controls that an organization may implement to meet cybersecurity objectives. Controls include:

Select information security controls

Implement information security controls

Develop information security management guidelines

Front 52

ISO 27701

Back 52

Contains standard guidance for managing privacy controls.

Front 53

ISO 31000

Back 53

Provides guidelines for risk management programs

Front 54

Center for Internet Security (CIS)

Back 54

Industry organization that publishes hundreds of benchmarks for commonly used platforms

Front 55

Quality Control Procedures

Back 55

Verifies that an organization has sufficient security controls in place and that those security controls are functioning properly. Includes procedures for conducting regular internal tests of security controls and formal evaluations of the organizations security program through assessments and audits

Front 56

Audits

Back 56

Formal reviews of an organization’s security program or specific compliance issues conducted on behalf of a third party. They may be conducted by internal audit groups at the request of management or by external audit firms.

Front 57

Assessments

Back 57

Less floral reviews of security controls requested by the organization itself as an effort to engage in process improvement. An assessor gathers information by interviewing employees and taking them at their word

Front 58

SOC 1

Back 58

Assess the organization’s controls that might impact the accuracy of financial reporting.

Front 59

SOC 2

Back 59

Assess the organization’s controls that effect the security and privacy of information stored in a system. Results are confidential.

Front 60

SOC 3

Back 60

Assess the organizations controls that affect the security and privacy of information stored in a system. Results are intended for public disclosure

Front 61

SOC Type 1 Reports

Back 61

Provide the auditor’s opinion on the description provided by management and the suitability of the design of the controls.

Front 62

SOC Type 2 Report

Back 62

Goes further than Type 1 Reports. Provide the auditors opinion on the operating effectiveness of the controls. The auditor confirms that the controls are functioning properly.