Chapter6

Question 1

Success of security policy program is dependent on?

Answer 1

Strong upper-management support
Practical security policies & procedures
Properly implemented controls
Quantifiable performance metrics and analysis

Question 2

The least expensive, and most difficult to implement?

Answer 2

Policies

Question 3

Basic Rules to follow when shaping policy:

Answer 3

Never conflict with the law
Stand up in court
Properly supported & administered
Contribute to the success of the organization
Involve end users of information systems
Adequate sharing of responsibility for proper use of information systems

Question 4

Policies should be:

Answer 4

Short
To the point
Signed off by senior management
Generic Enough

Question 5

For policies to be effective, they must be:

Answer 5

Properly disseminated
Read by all employees
Understood by all employees
Formally agreed to
Developed using industry-accepted practices

Question 6

3 types of information security policies:

Answer 6

Enterprise Information Security Policy
Issue-specific Information Security Policy
Systems-specific Information Security Policy

Question 7

What is the purpose of the Enterprise Information Security Policy (EISP)?

Answer 7

1- Sets the strategic direction, scope, and tone of organization’s security effort
2- Assigns responsibility for various areas of info security
3- Guides development, implementation, and management requirements of the information security program
4- Supports the mission and vision

Question 8

Components of the EISP?

Answer 8

1- Statement of the purpose
2- Information technology security elements
3- Need for information technology security
4- Information technology security responsibility & roles
5- References information technology standards & guidelines

Question 9

What is the purpose of Issue-Specific Security Policy (ISSP)?

Answer 9

1- Provides guidance to secure use of tech systems
2- Serves to protect employee/org from ambiguity
3- Documents how technology-based system is controlled
4- Serves to compensate organization against liability for illegal system use

Question 10

What Issue-Specific Security Policy (ISSP) topic should include?

Answer 10

Email
Use of Internet
Specific configurations of computers to defend against malware
Home use of company-owned computer equipment
Use of personal equipment on company network
Use of photocopy equipment

Question 11

System-Specific Policies (SysSPs) can be separated into:

Answer 11

Management guidance
Technical Specifications
Combined in a single policy document