ais finals lesson 2 Flashcards by GARIGUEZ, Hannah Jade E.

responsible for ensuring that the IAP is developed and
implemented in accordance with regulatory and business requirements

Chief executive officer(CEO)

How well did you know this?

Not at all

Perfectly

plays a crucial role in allocating resources and fostering commitment
to the IAP

Chief executive officer(CEO)

How well did you know this?

Not at all

Perfectly

what does IAP stands for?

information assurance program

How well did you know this?

Not at all

Perfectly

AO stands for?

authorizing official

How well did you know this?

Not at all

Perfectly

ISO stands for?

Information system owner

How well did you know this?

Not at all

Perfectly

is responsible for the execution of overall IT program and
delegate authority to the CISO for the management of the IAP.

Chief information officer (CIO)

How well did you know this?

Not at all

Perfectly

is the
focal point for IT management and governance of IT portfolios

CIO

How well did you know this?

Not at all

Perfectly

carries out the CIO’s security and privacy responsibilities
under FISMA and is responsible for managing the IAP

Chief information security officer

How well did you know this?

Not at all

Perfectly

How well did you know this?

Not at all

Perfectly

How well did you know this?

Not at all

Perfectly

FISMA stands for?

Federal Information Security Management Act

How well did you know this?

Not at all

Perfectly

responsible for:
* Ensuring information security management processes are integrated with
strategic and operational planning processes.
* Ensuring trained personnel sufficient to assist in complying with the
information assurance requirements in related legislation, policies, directives,
instructions, standards, and guidelines.
* Coordinating with senior management to report annually to the head of the
federal agency on the overall effectiveness of IAP, including progress of
remedial actions

CIO

How well did you know this?

Not at all

Perfectly

is responsible for:
* Developing an organization-wide IAP that provides adequate security for
all information and information systems.
* Centralized reporting of information security-related activities.
* Developing and maintaining information security and privacy policies.
* Defining specific security requirements, tools, templates, and checklists to
support the IAP.
* Ensuring that personnel with significant system security responsibilities
are adequately trained.

CISO

How well did you know this?

Not at all

Perfectly

s appointed by the CEO and is granted the authority to formally
assume responsibility for operating an information system at an acceptable level
of risk.

Authorizing official

How well did you know this?

Not at all

Perfectly

has budgetary oversight for an information system and is
responsible for the mission/business operations supported by the system.

Authorizing official

How well did you know this?

Not at all

Perfectly

approve systems security plans (SSPs), memorandums of agreement or
understanding (MOA/MOU), and plans of action and milestones (POA&Ms

Authorizing official

How well did you know this?

Not at all

Perfectly

approve systems security plans (SSPs), memorandums of agreement or
understanding (MOA/MOU), and plans of action and milestones (POA&Ms

Authorizing official

How well did you know this?

Not at all

Perfectly

is responsible for:
* Ensuring the security posture of the Agency’s information systems is
maintained.
* Reviewing security status reports and security documents and determining if
the risk to the Agency of operating the system remains acceptable.
* Reauthorizing information systems when required.
* Assisting in response to security incidents and privacy breaches.
* Appointing, when required, a designated representative to coordinate and
carry out system security responsibilities

Authorizing official

How well did you know this?

Not at all

Perfectly

is appointed by the CEO and serves as the focal point for the information
system and is the central point of contact during the security authorization process.

Information system owner (ISO)

How well did you know this?

Not at all

Perfectly

is responsible for:
* Coordinating data protection requirements with Information Owners (IOs) that have
information stored and processed in the system.
* Deciding, in coordination with the IO and Information System Security Officer
(ISSO), who has access to the system. Determining access privileges and rights to
the system.
* Ensuring that system users and support personnel receive the required security
training
(e.g., instruction in the Rules of Behavior).
* Ensuring that the system is compliant with the required security controls.
* Appointing an ISSO for the information system to carry out the day-to-day
security responsibilities.
* Reviewing system security documents (e.g., SSP, POA&M, etc.).
* Ensuring that system-specific security training is provided to the users and
administrators of the systems.
* Ensuring that remediation activities for the system are performed as
needed to maintain the authorization status.
* Appointing an Information System Security Manager (ISSM) to coordinate
system security task and provide oversight responsibilities to ensure security
activities are performed.

ISO

How well did you know this?

Not at all

Perfectly

is an official with regulatory, management, or operational authority
for specified information and is responsible for establishing the policies and
procedures governing its generation, collection, processing, dissemination,
and disposal.

Information owner (IO)

How well did you know this?

Not at all

Perfectly

responsible for:
* Providing input to ISOs regarding the security requirements and controls for
the systems where the information is processed, stored, or transmitted.
* Retaining information in accordance with the National Archives and
Records Administration (NARA) record schedule.
* Categorizing the sensitivity level5 of the information stored and
processed in the system.
* Establishing rules for appropriate use and protection of the information.
* Coordinating with the ISO when security requirements change.
* Assisting in the response to security incidents.
* Ensuring that the PII inventory is updated

How well did you know this?

Not at all

Perfectly

is appointed by the ISO and works closely with the ISO or ISSM to
ensure that the appropriate security posture is maintained for the information
system.

information system security officer(ISSO)

How well did you know this?

Not at all

Perfectly

serves as a principal advisor on all the security related issues
of an information system.

ISSO

How well did you know this?

Not at all

Perfectly

must have the detailed knowledge and expertise required to manage the security aspects of an information system and is responsible for the day-to-day security operations of a system

ISSO

responsible for: * Ensuring system compliance with security policies and procedures. * Managing and controlling changes to the system. * Assessing the security impact of any changes. * Monitoring the system and its environment. * Developing and updating the SSP. * Coordinating with and supporting the ISO with security responsibilities. * Preparing or overseeing the preparation of system security documents7 and security activities. * Developing security policies and procedures that are consistent with IA policies. * Performing or overseeing remediation activities to maintain the authorization status. * Assisting the ISO assemble the security authorization package for submission to the AO. * Assisting in the investigation of security incidents.

ISSO

responsible for: * Monitoring compliance with Federal requirement and IA policies. * Providing guidance on the implementation of IA policies. * Providing security and privacy training. * Investigating system security and privacy incidents. * Providing support for audits and reviews. * Managing the vulnerability management program.

IAM

serves as the primary liaison for the CISO to individuals with security and privacy responsibilities and supports activities at the IAP level.

Information assurance manager(IAM)

coordinates system security task and provide oversight responsibilities to ensure security activities are performed and serves as the liaison between the Information System Security Officer (ISSO) and the Information System Owner (ISO)

information system security manager (ISSM)

responsible for: * Providing oversight of system security activities performed by the ISSO. * Acting as the liaison between the IAM and the ISSO. * Monitoring system compliance with Information Assurance policies and federal guidance

ISSM

is nominated by the Agency and assists the Contracting Officer (CO)

Contacting officer's repesentative

responsible for: Acting as a technical liaison between the CO and the contractor. * Providing technical assistance. * Performing onboarding and off boarding activities for the contractors assigned to the contract. * Ensuring that contractors have the proper background investigations before accessing information or systems. * Ensuring that contractors properly maintain information and information systems in accordance with the IAP.

COR

conducts assessments of the security controls employed within or inherited by an information system to determine the overall effectiveness of the controls

security assessment team (SAT)

responsible for: * Developing a security assessment plan for each subset of security controls that will be assessed. * Submitting the security assessment plan for approval prior to conducting the assessment. * Conducting the assessment of security controls as defined in the security assessment plan. * Providing an assessment of the severity of weaknesses or deficiencies discovered in the information system. * Recommending corrective actions to address identified vulnerabilities. * Preparing the final security assessment report containing the results and findings from the assessment

SAT

It is standard on boarding policy for new employees.

AUP

stipulates the constraints and practices that an employee using organizational IT assets must agree to in order to access to the corporate network or the internet

acceptable use policy (AUP)

outlines the access available to employees in regards to an organization’s data and information systems.

Access control policy (ACP)

items covered in this policy are standards for user access, network access controls, operating system software controls and the complexity of corporate passwords.

ACP

Additional supplementary items often outlined include methods for monitoring how corporate systems are accessed and used; how unattended workstations should be secured; and how access is removed when an employee leaves the organization.

ACP

example that is available for fair use can be found at this policy is?

SANS

An excellent example of this policy is available at IAPP

ACP

refers to a formal process for making changes to IT, software development and security services/operations.

change management policy

The goal of this program is to increase the awareness and understanding of proposed changes across an organization, and to ensure that all changes are conducted methodically to minimize any adverse impact on services and customers

Change management policy

typically high-level policies that can cover a large number of security controls.

information security policy

It is issued by the company to ensure that all employees who use information technology assets within the breadth of the organization, or its networks, comply with its stated rules and guidelines.

information security policy

This policy is designed for employees to recognize that there are rules that they will be held accountable to with regard to the sensitivity of the corporate information and IT assets

information security policy

is an organized approach to how the company will manage an incident and remediate the impact to operations

incident response policy

It’s the one policy CISOs hope to never have to use.

Incident response policy

the goal of this policy is to describe the process of handling an incident with respect to limiting the damage to business operations, customers and reducing recovery time and costs.

incident response policy

a document which outlines and defines acceptable methods of remotely connecting to an organization's internal networks.

remote access policy

This policy is a requirement for organizations that have dispersed networks with the ability to extend into insecure network locations, such as the local coffee house or unmanaged home networks

remote access policy

a document that is used to formally outline how employees can use the business’ chosen electronic communication medium.

email/communication policy

The primary goal of this policy is to provide guidelines to employees on what is considered the acceptable and unacceptable use of any corporate communication technology

email/communication policy

generally include both cybersecurity and IT teams’ input and will be developed as part of the larger business continuity plan

disaster recovery plan

will coordinate efforts across the organization and will use the disaster recovery plan to restore hardware, applications and data deemed essential for business continuity

business continuity plan (BCP)

are unique to each business because they describe how the organization will operate in an emergency

BCP

it can be as broad as you want it to be from everything related to IT security and the security of related physical assets, but enforceable in its full scope.

information assurance policy

the purpose of this policy is to Create an overall approach to information security.

information assurance policy

the purpose of this policy is to detect and preempt information security breaches such as misuse of networks, data, applications, and computer systems

information assurance policy

the purpose of this policy is to maintain the reputation of the organization, and uphold ethical and legal responsibilities.

information assurance policy

the purpose of this policy is to respect customer rights, including how to react to inquiries and complaints about noncompliance.

information assurance policy

what are the three main objective of information security?

confidentiality integrity availability

only individuals with authorization can should access data and information assets

confidentiality

data should be intact, accurate and complete, and IT systems must be kept operational

integrity

users should be able to access information or systems when needed

availability

—a senior manager may have the authority to decide what data can be shared and with whom.

hierarchical pattern

users are only able to access company networks and servers via unique logins that demand authentication, including passwords, biometrics, ID cards, or tokens. You should monitor all systems and record all login attempts

network security policy

The policy should classify data into categories, which may include “top secret”, “secret”, “confidential” and “public”. Your objective in classifying data is: * To ensure that sensitive data cannot be accessed by individuals with lower clearance levels. * To protect highly important data, and avoid needless security measures for unimportant data.

read

systems that store personal data, or other sensitive data, must be protected according to organizational standards, best practices, industry compliance standards and relevant regulations. Most security standards require, at a minimum, encryption, a firewall, and antimalware protection

data protection regulations

encrypt data backup according to industry best practices. Securely store backup media, or move backup to secure cloud storage.

Data back up

only transfer data via secure protocols. Encrypt any information copied to portable devices or transmitted across a public network.

movement of data

place a special emphasis on the dangers of social engineering attacks (such as phishing emails). Make employees responsible for noticing, preventing and reporting such attacks.

Social engineering

—secure laptops with a cable lock. Shred documents that are no longer needed. Keep printer areas clean so documents do not fall into the wrong hands.

clean desk policy

9 Best Practices for Drafting Information Security Policies

. Information and data classification . IT operations and administration . Security incident response plan SaaS and cloud policy Acceptable use policies (AUPs) Identity and access management (IAM) regulations Data security policy— Privacy regulations— Personal and mobile devices—

ais finals lesson 2 Flashcards

(75 cards)