2 - Personnel Security and Risk Management Flashcards
(36 cards)
What is the weakest link of any security solution?
Humans
What is the difference between job description and a role description?
Roles typically align a rank or level of privilege. Job descriptions map to specifically assigned responsibilities and tasks.
What is Separation of Duties?
Where critical tasks are divided among several individual administrators. Prevents one person from having the ability to undermine security mechanisms
What are Job Responsibilities?
The specific work tasks an employee is required to perform on a regular basis.
What is Job Rotation?
Rotating employees amomg multiple positions. Provides knowledge redundancy and reduces risk of fraud, data misuse of information, etc.
What is Privilege creep?
The continued collection of privileges, permissions, etc. without the removal unncessary rights along the way.
What is a Background Check?
Obtaining a candidate’s work, educational history, checking references, interviewing people in their lives, checking for a record, etc.
What is an NDA?
A document used to protect the confidential information within an organization from being disclosed by a former employee. Violations are met with strict penalties.
Why are Mandatory Vacations necessary/important?
It allows an audit of work tasks and privileges of eomployees.
What is Onboarding?
The process of adding new employees to the identity and access management system. Also used when when an employee’s role changes.
What is Offboarding?
The removal of an employee’s identity from an IAM system once they leave the organization.
What is the proper procedure for Terminations?
They should take place with at least one witness (manager or security), terminated person needs to be escorted off the premises immediately, and all access related materials need to be collected and revoked.
What is an Exit Interview?
To review the liabilities and restrictions placed on the former based on employee agreement, NDA, and other security related docs.
What is a Service Level Agreement?
The levels of performance, expectation, compensation, and consequences for entities, persons, or organizations that are external to the primary organization.
What are the commonly adressed issues in SLA’s?
- System Uptime
- Maximum Consecutive Downtime
- Peak Load
- Average Load
- Responsibility for Diagnostics
- Failover Time
- Financial and/or contractual remedies that kick in if agreement is not maintained.
What is Compliance?
The act of conforming to or adhering to rules, policies, regulations, standards, or requirements
What is Privacy?
- Active prevention of unauthorized access to information that is personally identifiable.
- Freedom from unauthorized access to information deemed personal or confidential.
- Freedom from being observed, monitored, or examined without consent or knowledge.
What is PII?
Personally Identifiable Information (PII) is any data that can be easily and/or obviously traced back to the person of origin or concern:
- Phone number
- Email address
- Mailing Address
- Social Security Number
- Name
- Can vary by country
What is Security Governance?
The collection of practices related to supporting, defining, and directing the security efforts of an organization.
What is Third-Party Governance?
The system of oversight that may be mandated by law, regulation, industry standards, contractual obligation, or licensing requirements. Generally involves an outside invstigator or auditor.
What is Documentation Review?
The process of reading the exchanged materials and verifying them against standards and expectations.
What is Risk Management?
A detailed process of identifying factors that could damage or disclose data and implementing cost-effective solutions for mitigating or reducing risk.
What is Risk Analysis?
Examining an environment for risks, evaluating each threat event as to its likelihood of occuring and cost of damage, assessing cost of countermeasure, and creating a cost/benefit report for safeguards to present to upper management.
What are some common terms for Risk?
- Asset: Anything within an environment that should be protected.
- Asset Valuation: A dollar value assigned to an asset based on actual cost and nonmonetary expenses.
- Threats: Any potential occurrence that may cause an undesirable or unwanted outcome for an organization or for a specific assest.
- Vulnerability: The weakness in an asset or the absence or the weakness of a safeguard or countermeasure.
- Exposure: Being susceptible to asset loss because of a threat; the possibility that a vulnerability will be exploited by a threat agent.
- Risk: The possibility or likelihood that a threat will exploit a vulnerability to cause harm to an asset.
- Safeguards: (security control, Countermeasure) Anything that removes or reduces a vulnerability or protects against one or more specific threats.
- Attack: The exploitation of a vulnerability by a threat agent.
- Breach: The occurrence of a security mechanism being bypassed or thwarted by a threat agent.
