IT Governance and Compliance Flashcards
(41 cards)
Data classification - what are the 4 classifications
- top secret
- secret
- sensitive
- public
What are the 4 principles and activities in an Information Security Policy
Roles and responsibilities
Risk management
Security processes - defined by security policy: vulnerability and incident mngt, swft dev, hiring, vendor mngt
Acceptable use
Security policy and security mngt should be separate from what 2 items?
IT mngt and IT policy
Data classification policy sets levels of sys security that correspond to —————
Data classification
Who correctly classifies a document or data’s classification policy?
Data owner
Site classification policy, dimensions to set levels of phys security:
(5)
Criticality of staff there
Criticality of business perf there
Value of assets
Sensitivity of data
Siting risk of location
3 social media policy dimensions
Personal
Professional
Disclosure of company info
3 other tech policies
Equipment control and use
Data destruction
Moonlighting
Processes and procedures (sop)
The “how”
3Ds and R contained in a procedure document:
Document/process owner
Doc revisions
Reviews and approvals
Dependencies
Standards
Which is not valid? Tech standards Protocol standards Controls standards Supplier standards Methodology Configure Architecture
Controls
Methodology standards?
Including:
software dev,
sys administration
Network engineering
End user support
Laws and regulations: what do you evaluate to gauge impact? 4
Enterprise architecture
Controls
Processes
Personnel
What is the standard for storage and transmission of credit card data?
PCI-DSS
Payment card industry data security standard
Risk mngt
4 risk actions (treatments)
Accept
Mitigate or reduce
Share or transfer
Avoid
Risk mngt program
Examples of objectives
Reduce network penetrations
Reduce incidents
Risk mngt program
1- Example of scope
2- What is authority
3- Example of resources
4- What is the remaining dimension needed?
1- What business units are involved?
2 - who said to establish the program? What is their support?
3- budget, software, staff
4- policies, procedures and records
Risk mngt lifecycle
What comes after asset identification?
Risk analysis
Risk IT Framework has 3 components:
Risk G——-
Risk E——-
Risk R——-
Risk governance
Risk evaluation
Risk response
Risk IT Framework has 3 things
Risk g
Risk e
Risk r
Governance
Evaluation
Response
Sources of asset data for risk management
Financial systems a——- I——
Financial system asset inventory
Other sources of asset data
Interviews
IT systems portfolio (is what?)
Docs around major applications.
Online data
Asset management system
Risk analysis formula
What is FAIR?
Risk = probability x impact
Factor analysis of information risk
Threat analysis is to ID all possible/reasonable threats.
Natural
Man made
Severe storms Flooding Fire Labor issues Power outage Criminal Errors
What is a logical threat analysis?
Malware
All that aren’t physical
