Flashcards
2.3 Security, Privacy, Policies and Procedures
Cards in this deck (33)
- 1What is a top-down business approach?Where the management initiates, supports and directs the security program.
- 2What is a bottom-up business approach?Where staff members develop a security program prior to receiving direction and support from management.
- 3What is legal advocacy?The process carried out by or for an org that aims to influence public policy, economic and social systems and institutions.
- 4What does the Sarbanes-Oxley (SOX) act affect?- Any organization that is publicly traded.
- Regulates accounting and financial reporting. - 5What does the Health Insurance Portability and Accountability (HIPPA) act affect?- Health care facilities, health insurance companies and healthcare clearing houses.
- Provides standards for storing medical information and healthcare data. - 6What is an RA?Risk Assessment
- 7What does an RA provide?Tool used in risk mangement to identify vulnerabilities and threats and assess their impact.
- 8How many steps are part of an RA and what are they?- 4 steps
- Identify assets and asset value
- Identify vulnerabilities and threats
- Calculate threat probability and business impact
- Balance threat impact with countermeasure cost. - 9What is an SOA?Statement of Applicability
- 10What does an SOA provide?Identifies the controls chosen by an organization and explains how and why the controls are appropriate.
- 11What is BIA?Business Impact Analysis
- 12What does a BIA provide?A functional analysis that occurs as part of business continuity and disaster recovery.
- 13How many steps are part of a BIA and what are they?- 4 Steps
- Identify critical processes and resources
- Identify outages impacts and estimate downtime
- Identify resource requirements
- Identify recovery priorities - 14What terms define how critical an asset is?-MTD
- MTTR
- MTBF
- RTO
- WRT
- RPO - 15What does MTD(MPTD) stand for?- Maximum Tolerable Downtime
- Maximum Period Time of Disruption - 16What is MTD?The maximum amount of time that an org can tolerate a single resource being down.
- 17What does MTTR stand for?- Mean Time To Repair
- 18What is MTTR?The average time required to repair a single resource or function when a disaster occurs.
- 19What does MTBF stand for?- Mean Time Between Failures
- 20What is MTBF?The estimated amount of time a device will operate before failure occurs.
- Calculated by device vendor. - 21What does RTO stand for?Recovery Time Objective
- 22What is RTO?The shortest time period after a disaster which a resource or function must be restored to avoid unacceptable consequences.
- Should be smaller than MTD - 23What does WRT stand for?Work Time Recovery
- 24What is WRT?The difference between RTO and MTD.
- 25What does RPO stand for?Recovery Point Objective
- 26What is RPO?The point in time to which the disrupted resource must be returned.
- 27What are the organizational resource importance levels?- Critical
- Urgent
- Normal
- Non essential - 28What is an Interoperability Agreement (IA)?An agreement to allow information exchange between two or more organizations.
- 29What is an Interconnection Security Agreement (ISA)?An agreement between two organizations laying out the detail for connecting IT systems.
- 30What is split knowledge?When two or more people are required to complete a certain task.
- 31What is DAC?Discretionary Access Control
- Lets people control access to content they own. - 32What is RBAC?Role Based Access Control
- Separates responsibilities based on assigned roles. - 33What are 6 steps on the Incident Response plan?- Detect
- Respond
- Report
- Recover
- Remediate
- Review
Information
- Description
- Compare security, privacy, policies and procedures based on organizational requirements.
- Created by
- DJ Perrone
- Views
- 22
- Tags
- Rating