Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Security+ (SY0-701) > Lesson 14: Summarize Security Governance Concepts > Flashcards

Lesson 14: Summarize Security Governance Concepts Flashcards

1
Q

Define ‘security policies’

A

Authoritative documents defining the organization’s security commitment.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Define ‘security standards’

A

Specify the methods used to implement technical and procedural requirements.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Define ‘security procedures’

A

Detailed step-by-step instructions describing how to complete specific tasks and align to the requirements provided in standards.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What is the purpose of organizational policies?

A

Establishes effective governance and ensures organizational compliance for operations, decision-making, and behaviors by defining rules and procedures as well as consequences.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Define ‘governance’

A

The processes used to direct and control an organization, including the processes for decision-making and risk management to ensure compliance with regulations.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What are polices in relation to governance?

A

Policies are the outputs of governance.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Define ‘compliance’

A

Describes how well an organization adheres to regulations, policies, standards, and laws relevant to its operation.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Define an ‘Acceptable Use Policy (AUP)’

A

A policy that governs employees’ use of company equipment and Internet services. ISPs may also apply AUPs to their customers.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What rules and polices are addressed in an Acceptable Use Policy (AUP)?

A

Browsing behavior, appropriate content, software downloads, and handling sensitive information.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What is the goal of implementing an ‘Acceptable Use Policy (AUP)’?

A

To ensure that users do not engage in activities that could harm the organization or its resources; Detail the consequences for non compliance.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What should be included in an Acceptable Use Policy (AUP) to ensure compliance is met by users?

A

Details regarding how compliance is monitored and require employees to acknowledge their comprehension of the AUP’s rules via signature.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Define ‘Information Security Policies’

A

A document or series of documents enlisting rules and guidelines detailing requirements for protecting technology and information assets from threats and misuse.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Define ‘Business Continuity’/’Continuity of Operations Plans (COOP)’

A

A collection of processes that enable an organization to maintain normal business operations in the face of some adverse event.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Define ‘Disaster Recovery Policies’

A

Details the steps required to recover from a catastrophic event such as a natural disaster, major hardware failure, or a significant security breach.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Define ‘incident response policies’

A

Outlines the processes to be followed after a security breach; Details the steps for identifying, investigating, controlling, and mitigating the impact of incidents, including procedures for communicating about the incident to internal and external sources.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Define ‘Software Development Life Cycle (SDLC) policies’

A

Governs the processes of planning, analysis, design, implementation, and maintenance of software and software development.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Define ‘Change management polices’

A

Outlines how changes to IT systems and software are requested, reviewed, approved, and implemented, including all documentation requirements.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Define a ‘Guideline’

A

Best practice recommendations that steer actions in a particular job role or department to achieve goals and complete tasks effectively.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What is the purpose of a guideline?

A

To help individuals understand the required steps to comply with a policy or improve effectiveness.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What is the difference between polices and guidelines?

A

Policies are mandatory and define strict rules; Guidelines provide recommendations and allow for more individual judgment and discretion.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

What are the 3 phases of ‘personnel management’ that involves HR?

A
  1. Recruitment (hiring)
  2. Operation (working)
  3. Termination (firing/retiring)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Define ‘onbarding’

A

The combined IT and HR process of bringing in a new employee, contractor, or supplier.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Define an ‘organizational playbook’

A

A central repository of company policies and procedures.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

In a change management policy, what should be induced for major changes?

A

Organizations should attempt to trial the change first.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

In a change management policy, what should be included to mitigate a failed/harmful change?

A

A rollback (or remediation) plan, so that the change can be reversed.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

Define ‘offboarding’

A

Process of ensuring that all HR and other requirements are covered when an employee leaves an organization.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

Define a ‘standard’

A

Defines the expected outcome of a task, such as a particular configuration state for a server, or performance baseline for a service.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

What is the primary reason for adopting a standard?

A

To adhere to industry regulatory requirements.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

Define the ‘ISO/IEC 27001’ standard

A

International standard that provides an information security management system (ISMS) framework.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

Define the ‘ISO/IEC 27002’ standard

A

A companion standard to ISO 27001 and provides detailed guidance on specific controls to include in an ISMS.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

Define the ‘ISO/IEC 27017’ standard

A

Extension to ISO 27001 and specific to cloud services.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

Define the ‘NIST (National Institute of Standards and Technology) Special Publication 800-63’ standard

A

A US government standard for digital identity guidelines, including password and access control requirements.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

Define the ‘PCI DSS (Payment Card Industry Data Security Standard)’ standard

A

For organizations that handle credit cards from major card providers, including requirements for protecting cardholder data.

34
Q

Define the ‘FIPS (Federal Information Processing Standards)’ standard

A

Developed by NIST for federal computer systems in the United States that specify requirements for cryptography.

35
Q

How do regulatory standards facilitate auditing?

A

By providing a benchmark for evaluating organizational compliance and security practices.

36
Q

What is the difference between standards and policies?

A

Standards focus on implementation, whereas policies focus on business practices.

37
Q

What is the purpose of an internal password standard set by an organization?

A

Describes he specific technical requirements required to design and implement authentication systems as well as how passwords are managed within those systems.

38
Q

What should be outlined in a password standard?

A

Hashing algorithms; Salting mechanisms; Secure password transmission; Password resets; Use of Password managers.

39
Q

What is the purpose of an internal access control standard set by an organization?

A

To ensure that only authorized individuals can access the systems and data they need to do their jobs; Protects sensitive data and prevents accidental change/damage.

40
Q

What should be outlined in an access control standard?

A

Access control models; Acceptable methods to verify identities; Privilege Management; Authentication Protocols; Session management; Auditing of access.

41
Q

What is the purpose of internal physical security standards?

A

To define the protection of the infrastructure comprising the IT environment.

42
Q

What should be outlined in a physical security standard?

A

Building security/physical access controls; Workstation security; Datacenter/server room security; Equipment disposal; Visitor management.

43
Q

What is the purpose of internal encryption standards?

A

To identify the acceptable cipher suites and expected procedures needed to provide assurance that data remains protected.

44
Q

What should be outlined in an encryption standard?

A

Encryption Algorithms; Key Length; Key Management.

45
Q

Define ‘Due dilligence’

A

A legal term meaning that responsible persons have not been negligent in discharging their duties.

46
Q

Define the ‘Sarbanes-Oxley Act (SOX)’ law

A

Dictates requirements for the storage and retention of documents relating to an organization’s financial and business operations.

47
Q

Define ‘Federal Information Security Management Act (FISMA)’

A

Governs the security of data processed by federal government agencies.

48
Q

Define ‘General Data Protection Regulation (GDPR)’

A

Provisions and requirements protecting the personal data of European Union (EU) citizens.

49
Q

What is the purpose of General Data Protection Regulation (GDPR)?

A

EU citizens personal data cannot be collected, processed, or retained without the individual’s informed consent, unless there are other overriding considerations.

50
Q

Define ‘informed consent’ in regards to General Data Protection Regulation (GDPR)

A

Data must be collected and processed only for the stated purpose, and that purpose must be clearly described to the user in plain language, not legal jargon.

51
Q

How does General Data Protection Regulation (GDPR) protect subjects?

A

By giving data subjects (users) rights to withdraw consent, and to inspect, amend, or erase data held about them.

52
Q

Define the ‘California Consumer Privacy Act (CCPA)’ and its purpose

A

Provides California residents the right to know what personal information businesses collect about them, the purpose of collecting this data, and with whom they share it.

53
Q

Define ‘centralized security governance’

A

Decision-making authority primarily rests with a single core group or department that establishes policies, procedures, and guidelines.

54
Q

Define ‘decentralized security governance’

A

Distributes decision-making authority to different groups or departments to facilitate security-focused decisions based on localized needs and priorities.

55
Q

Define a ‘hybrid security governance’

A

Specific security processes and decisions are centralized, while others are delegated to business units or departments.

56
Q

What is the role of a governance committee?

A

SMEs and operational leaders that focus on specific issues, such as security, risk management, audit, or compliance providing in-depth analysis, recommendations, and operational support to the governance board to help drive decisions.

57
Q

What is the role of a governance board?

A

Executives with the ultimate decision-making authority and is responsible for setting the strategic direction and policies of the organization.

58
Q

What are the 4 roles of security/data governance?

A
  1. Owner
  2. Controller
  3. Processor
  4. Custodian
59
Q

Define the role of an ‘owner’ in security/data governance

A

An executive role that identifies what level of classification and sensitivity the data has, decides who should have access to it, and what level of security should be applied.

60
Q

Define the role of a ‘controller’ in security/data governance

A

The entity ensures data processing activities adhere to all legal requirements; Helps maintain legal and regulatory compliance.

61
Q

Define the role of a ‘processor’ in security/data governance

A

An entity trusted with a copy of personal data to perform storage and/or analysis on behalf of the data collector; Ensures that data is handled securely and in accordance with the rules established by the owner and controller roles.

62
Q

How do processors adhere to security/data governance?

A

By maintaining records of their processing activities, cooperate with supervisory authorities, and implement appropriate security measures to protect the data they handle.

63
Q

Define the role of a ‘custodian’ in security/data governance

A

Data steward - implements and enforces the security controls established by the data owner and controller; Responsible for managing the system on which data assets are stored, including being responsible for enforcing access control, encryption, and backup/recovery measures.

64
Q

What must be included when proposing a change request in change management?

A

Documentation, including details describing what will be changed, the reasons for the change, any potential impacts, and a rollback plan in case the change does not work as planned.

65
Q

When assessing a change request, what must be considered?

A

Each change must be subject to risk assessment to identify potential security impacts.

66
Q

What the role of an ‘owner’ in change management

A

Project managers/team leaders accountable for ensuring change is implemented as planned, risks are managed effectively, and there’s a clear plan for communication/training associated with the change.

67
Q

Define a ‘stakeholder’

A

A person who has a business interest in the outcome of a project or is actively involved in its work.

68
Q

Define ‘impact analysis’

A

Change management process of identifying and assessing the potential implications of a proposed change.

69
Q

How do test results affect change management?

A

Test results provide valuable insight into the likelihood of success and help identify potential issues without impacting business operations.

70
Q

How do ‘back out plans’ affect change management?

A

A well-defined back out plan helps to minimize downtime and reduces the risk of data loss or other severe impacts.

71
Q

What is the role of maintenance windows in change management?

A

A predefined, recurring time frame for implementing changes.

72
Q

How do ‘Standard Operating Procedures (SOPs)’ affect change management?

A

Written instructions that describe how to carry out routine operations or changes to ensure that changes are implemented consistently and effectively.

73
Q

Define an ‘allow list’ in regards to change management

A

A list of approved software, hardware, and specific change types that are not required to go through the entire change management process.

74
Q

Define a ‘deny list’ in regards to change management

A

Includes explicitly blocked software, hardware, and specific change types or high-impact changes that must always go through the full change management process, or individuals who are not authorized to implement or approve changes.

75
Q

Define ‘Version control’

A

Tracking and controlling changes to documents, code, or other important data.

76
Q

How can automation be used for security management?

A

Monitoring for threats, applying patches, maintaining baselines, or responding to incidents.

77
Q

What is the role of orchestration in security management?

A

Enhances automation by coordinating and streamlining the interactions between automated processes and systems.

78
Q

Define a ‘workforce multiplier’

A

A tool or automation that increases employee productivity, enabling them to perform more tasks to the same standard per unit of time.

79
Q

Define ‘Operator fatigue’

A

The mental exhaustion experienced by cybersecurity professionals.

80
Q

Define ‘technical debt’

A

Costs accrued by keeping an ineffective system or product in place, rather than replacing it with a better-engineered one.

Security+ (SY0-701) (22 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions