Cissp Domain 1-2

Question 1

isc2 code of ethics

Answer 1

Protect society, the common good, necessary public trust and confidence, and the infrastructure.
Act honorably, honestly, justly, responsibly, and legally.
Provide diligent and competent service to principals.
Advance and protect the profession.

Question 2

Policy

Answer 2

high level statements
to communicate rules
and provide direction
standards,guidelines,procedures, baselines
are too support policy
policies must be approved by the executive management

Question 3

Information security policy

Answer 3

highlevel statements to protect
information and information assets
ensuring the C I A

Question 4

Three main types of policies exist:

Answer 4

Organizational (or Master) Policy.
System-specific Policy.
Issue-specific Policy.

Question 5

Organizational (or Master) Policy.

Answer 5

The master security policy can be thought of as a blueprint for the whole organization’s security program. It is the strategic plan for implementing security in the organization.

Question 6

System-specific Policy

Answer 6

A System-specific policy is concerned with a specific or individual computer system.

Question 7

Issue-specific policy

Answer 7

An Issue-specific policy is concerned with a certain functional aspect that may require more attention.
Change Management Policy.
Physical Security Policy.
Email Policy.
Encryption Policy.
Vulnerability Management Policy.
Media Disposal Policy.
Data Retention Policy.
Acceptable Use Policy.
Access Control Policy.

Question 8

Policy attributes

ERR or
AT
AD ward E IN entine

Answer 8

>endorsed
>relevant
>realestic
>attainable
>Adaptable
>Enforceable
>Inclusive

Question 9

policy Lifecycle

developer publo adow reviw korbe

Answer 9

> Develop
Publish
Adopt
Review

Question 10

Advisory Policy

Answer 10

The job of an advisory policy is to ensure that all employees know the consequences of certain behavior and actions. Here’s an example advisory policy:

Illegal copying: Employees should never download or install any commercial software, shareware, or freeware onto any network drives or disks unless they have written permission from the network administrator. Be prepared to be held accountable for your actions, including the loss of network privileges, written reprimand, probation, or employment termination if the Rules of Appropriate Use are violated.

Question 11

Informative Policy

Answer 11

This type of policy isn’t designed with enforcement in mind; it is developed for education. Its goal is to inform and enlighten employees. The following is an example informative policy:

In partnership with Human Resources, the employee ombudsman’s job is to serve as an advocate for all employees, providing mediation between employees and management. This job is to help investigate complaints and mediate fair settlements when a third party is requested.

Question 12

Regulatory Policy

Answer 12

These policies are used to make certain that the organization complies with local, state, and federal laws. An example regulatory policy might state:

Because of recent changes to Texas State law, The Company will now retain records of employee inventions and patents for 10 years; all email messages and any backup of such email associated with patents and inventions will be stored for one year.

Question 13

Standards

Answer 13

Standards are much more specific than policies. Standards are tactical documents because they lay out specific steps or processes required to meet a certain requirement. As an example, a standard might set a mandatory requirement that all email communication be encrypted. So although it does specify a certain standard, it doesn’t spell out how it is to be done. That is left for the procedure.

Question 14

baseline

Answer 14

A baseline is a minimum level of security that a system, network, or device must adhere to. Baselines are usually mapped to industry standards. As an example, an organization might specify that all computer systems comply with a minimum Trusted Computer System Evaluation Criteria (TCSEC) C2 standard. TCSEC standards are discussed in detail in Chapter 5, “System Architecture and Models.”

Question 15

guideline

Answer 15

Guidelines are practical instructions and recommendations targeting all levels of staff in the organization. These instructions are considered as operational guides on how to apply and enforce the standards and baselines.
Appendix A: Password Construction Guidelines
Acceptable Methods to Create a Strong Password
Use a minimum of 10 characters. Generally, the more characters you can use, the harder a password is to be cracked or guessed.
Choose a password that is easy for you to remember but would be hard for another to guess. One useful approach is to use a sentence or saying to create a “passphrase” by using the first letters, capitalization, and special characters as substitutes. For example, “One ring to rule them all, one ring to bind them” may be used to create a passphrase like “1R2rtAor2Bt” that can be used as a very strong password.
Passwords must include at least three of the four following types of characters
English uppercase letters (A through Z).
English lower case letters (a through z).
Numbers (0 through 9).
Special characters and punctuation symbols (Example: _, -. +, =,!, @, %, *, &, ”, :, ., or /).
Do not use the following characters \ , ~ or < .
Do not use a space or tab.