ITS 3050 - Security Policies and Auditing

Review for Third Test

The following questions are provided to help you study for the third test. Do not expect to see these exact questions on the test.

1. The text tells us there are seven domains that contain all the elements of our enterprise. Which one includes acceptable use policies and social networking policies?
   
   
2. Which domain includes policies for network connectivity devices?
   
   
3. Why does the text suggest that we need redundant controls to enforce a policy that we have made very clear to employees?
   
   
4. Explain why security policies must be coordinated with human resource policies.
   
   
   
   
5. With regard to a policy framework, what is a baseline?
   
   
6. What is an organization's risk tolerance?
   
   
7. Why is it important to establish a security program charter? Who must grant the authority to administer this charter?
   
   
8. What are some well established security program framework models? Which one's are international standards?
   
   
9. The text cautions us that the standards we develop should be measured on four scales. Why is each important?
   
• clearly written
• repeatable
• pursuing a known goal
• applicable to the people following them
  
  
  
10. Which element of a policy framework contains more specific instructions than a standard? Why might one be needed?
    
    
11. Chapter six lists five risks our security framework should address. What is meant by each of them?
    
• unauthorized access
• unauthorized use
• unauthorized disclosure
• disruption of services
• destruction of assets
  
  
12. Why should we inform the entire staff of our organization about the creation and any changes to our security framework?
    
    
13. What does the text call a framework model that has low service integration and low standardization? Is this label a signal of trouble?
    
    
14. What does the text call a framework model that has high service integration and low standardization?
    
    
15. What does the text call a framework model that has low service integration and high standardization?
    
    
16. What does the text call a framework model that has high service integration and high standardization?
    
    
17. Since chapter seven repeats some information from the text, let's consider it again. What do each of these kinds of controls do that is different from the others?
    • Deterrent controls
      
    • Preventive controls
      
    • Detective controls
      
    • Corrective controls
    • Compensating controls
    • Mitigating controls
    • Recovery controls
      
      
18. Name four branches of your organization, outside IT security, that should be consulted when you develop an new security policy.
    
    
    
19. What is another phrase that probably means the same thing as a security event?
    
    
20. According to the text, which security policy framework model is usually chosen by government agencies?
    
    
21. What guideline does the text offer to help you choose the right model, if you are not in government or auditing?
    
    
22. Which model is written from the perspective of entities that take credit card payments?
    
    
23. What are the stated shortcomings of the COBIT and ISO models?
    
    
24. Why should changes to security processes be reviewed by people other than your security staff?
    
    
25. How do layers of approval fit in the concept of having governance over system changes?
    
    
26. What does the principle of separation of duties tell us to do about processes that could be exploited by employees?
    
    
27. What is the purpose of the technique called three lines of defense? How is it better than a simpler layered approach?
    
    
28. What is typically done once a model is chosen for an organization?