Security policy guidelines - ANSWER What rules are you following to provide CIA?
- Confidentiality, Integrity and Availability
High level strategies
- Data storage requirements, security events procedures
detailed security goals
- Appropriate Wi-Fi usage, requirements, for remote access
Security policies answer the "what" and "why"
- Technical security controls answer the "how"
information security policies - ANSWER identify the rules required to maintain
information security, such as requiring users to log off before leaving for lunch or meetings,
never sharing passwords with anyone, and changing passwords every 30 days
Acceptable Use Policy (AUP) - ANSWER A policy that defines the actions users may
perform while accessing systems and networking equipment.
Business Continuity - ANSWER The activity performed by an organization to ensure
that critical business functions will be available to customer, suppliers, regulators, and other
entities that must have access to those functions.
1
,Disaster Recovery Plan (DRP) - ANSWER The processes, policies and procedures
related to preparing for recovery or continuation of an organization's critical business
functions, technology infrastructure, systems and applications after the organization
experiences a disaster. A disaster is when an organization's critical business function(s)
cannot be performed at an acceptable level within a predetermined period following a
disruption.
security incident - ANSWER An adverse event or series of events that can negatively
affect the confidentiality, integrity, or availability of an organization's information technology
(IT) systems and data.
Incident response roles - ANSWER Incident response team
- Specialized group, trained and tested
IT security management
- Corporate support
Compliance officers
- Intricate knowledge of compliance rules
Technical staff
- The team in the trenches
User community
- They see everything
NIST SP800-61 - ANSWER National Institute of Standards and Technology
- NIST Special Publication 800-61 Revision 2
- Computer Security Incident Handling Guide
2
, The incident response lifecycle:
- Preparation
- Detection and Analysis
- Containment, Eradication, and Recovery
- Post-incident Activity
SDLC (Systems Development Life Cycle) - ANSWER The overall process for developing
information systems from planning and analysis through implementation and maintenance
Agile Life Cycle - ANSWER requirements cannot be clearly expressed, projects are
mission driven and component based, use of time-based cycles to meet target dates
Waterfall lifecycle - ANSWER Each stage of development is completed one at a time in
a linear order. Results from a completed stage are input into the next. Any previous stage
can be returned to in light of feedback, however the stages that follow need to be worked
through again.
Change Management - ANSWER The process, tools and techniques that help people
implement changes to achieve a desired outcome.
Change Management Process - ANSWER -create a change vision
-define a change strategy
-develop leadership
-build commitment
-manage people performance
-deliver business benefits
-develop culture
-design organization
3
- Confidentiality, Integrity and Availability
High level strategies
- Data storage requirements, security events procedures
detailed security goals
- Appropriate Wi-Fi usage, requirements, for remote access
Security policies answer the "what" and "why"
- Technical security controls answer the "how"
information security policies - ANSWER identify the rules required to maintain
information security, such as requiring users to log off before leaving for lunch or meetings,
never sharing passwords with anyone, and changing passwords every 30 days
Acceptable Use Policy (AUP) - ANSWER A policy that defines the actions users may
perform while accessing systems and networking equipment.
Business Continuity - ANSWER The activity performed by an organization to ensure
that critical business functions will be available to customer, suppliers, regulators, and other
entities that must have access to those functions.
1
,Disaster Recovery Plan (DRP) - ANSWER The processes, policies and procedures
related to preparing for recovery or continuation of an organization's critical business
functions, technology infrastructure, systems and applications after the organization
experiences a disaster. A disaster is when an organization's critical business function(s)
cannot be performed at an acceptable level within a predetermined period following a
disruption.
security incident - ANSWER An adverse event or series of events that can negatively
affect the confidentiality, integrity, or availability of an organization's information technology
(IT) systems and data.
Incident response roles - ANSWER Incident response team
- Specialized group, trained and tested
IT security management
- Corporate support
Compliance officers
- Intricate knowledge of compliance rules
Technical staff
- The team in the trenches
User community
- They see everything
NIST SP800-61 - ANSWER National Institute of Standards and Technology
- NIST Special Publication 800-61 Revision 2
- Computer Security Incident Handling Guide
2
, The incident response lifecycle:
- Preparation
- Detection and Analysis
- Containment, Eradication, and Recovery
- Post-incident Activity
SDLC (Systems Development Life Cycle) - ANSWER The overall process for developing
information systems from planning and analysis through implementation and maintenance
Agile Life Cycle - ANSWER requirements cannot be clearly expressed, projects are
mission driven and component based, use of time-based cycles to meet target dates
Waterfall lifecycle - ANSWER Each stage of development is completed one at a time in
a linear order. Results from a completed stage are input into the next. Any previous stage
can be returned to in light of feedback, however the stages that follow need to be worked
through again.
Change Management - ANSWER The process, tools and techniques that help people
implement changes to achieve a desired outcome.
Change Management Process - ANSWER -create a change vision
-define a change strategy
-develop leadership
-build commitment
-manage people performance
-deliver business benefits
-develop culture
-design organization
3
