Untitled Quiz

Risk Management and Risk Control

• Project risk management and risk analysis tracks how risks are handled against the schedule and new risks.
• Risk management identifies events affecting project outputs, assigns qualitative and quantitative weights to their possibility and consequences, generates alternative execution paths, and implements a plan for each risk identified.
• Monitoring and control of risks require a risk management plan, risk register/tracker, and risk response plan.

Business Continuity Management (BCM)

• Business Continuity Plan (BCP) is a plan for business processes to continue during accidents or emergencies.
• Organizations analyze potential risks and prepare with a BCP to ensure effective handling of issues.
• BCP development includes identifying threats stopping regular business, evaluating critical activities for continuity, and listing executives and their contact details.
• Disaster Recovery Plan (DRP) outlines how a company restarts its operation immediately after an unplanned event.

Disaster Recovery Plan (DRP)

• DRP is a recorded method for restarting operations after an unplanned event.
• The objective is to help the organization handle data loss and restore functionality.
• DRP provides step-by-step procedures to minimize disruption and quickly resume critical functions.
• Disruptions include extreme weather events, illegal activities, civil unrest, terrorism, and organizational/program failures.

Assessing Maximum Tolerable Downtime (MTD)

• MTD is the time during which a process is inaccessible causing irreparable effects.
• MTD can be measured in hours, days, or longer, depending on the process.
• Stages include: Business as usual, Disaster, Recovery, and Resume Production.
• Recovery Point Objective (RPO) specifies average data loss over time.
• Recovery Time Objective (RTO) specifies the overall manageable time to get critical services back online.

Review and Test the Plan

• Regularly review and update BCP (Business Continuity Plan).
• BCP testing uses various methods (audit strategy, walk-through test, simulation test, full recovery test).
• Vendor involvement helps in precise, reliable, and valuable feedback for improvement.
• Document test outcomes and actionable conclusions.

Testing for Disaster Recovery Plan (DRP)

• DRP testing uses various techniques; there's no "one-size-fits-all" approach.
• Testing should occur at least once a year to assess recovery from disasters.
• Active participation by various stakeholders is important and functional.
• Logging and filing are important parts of recording test and drill results.

Backing up Data

• Data backup is as important as disaster preparedness.
• Backing up data enables recovery of lost data and is analogous to rewinding a computer.
• Identify and categorize needed files (system files, directories, operating system, installed programs, temporary files) for backup and manage backup frequency based on usage patterns (daily, real-time).

Where to Back Up Your Data

• Multiple backup media options depend on backup size, setup, complexity, portability, security, and budget.
• Various examples of media options like external hard drives, USB flash drives, Network Attached Storage (NAS), and Cloud backups are mentioned.

Different Backup and Recovery Types

• Backup types include full backups (copying all data), incremental backups (copying only altered data since the last backup), and differential backups (copying everything changed since last full backup).

Phases of Incident Response

• Incident responses typically have six phases: Preparation, Identification, Containment, Eradication, Recovery, and Lessons Learned.

Guidelines for Activation Based on Case Analysis

• DRP (Disaster Recovery Plan) activation depends on specific event types,
• Assessment criteria and decision-making processes must be clear.
• Effective communication of activation is crucial.

Recovery Alternatives

• Organizations need options if their location becomes inoperable.
• Recovery methods cover dedicated business locations (e.g. a backup data center, an alternative facility), commercially rented facilities (e.g. data centers for disaster recovery), and arrangements with internal or external facilities.
• Categorizing facilities by cost (hot site, warm site, cold site, multiple sites) is helpful;

Cybersecurity in Our Country

• Cybercrime Prevention Act 2012 (CPA) and the Access Devices Regulation Act of 1998 (ADRA) define cybercrime acts.
• The Electronic Commerce Act 2000 (ECA) allows recognition of electronic records and signatures in legal proceedings.
• The 2012 Data Privacy Act (DPA) manages and safeguards personal data.

Privacy

• Privacy is a key concern in 21st-century information security.
• The 2011 Data Privacy Act outlines data security and privacy rights for organizations operating in the country.

Identity Theft

• Identity theft is a serious crime involving the unauthorized acquisition and use of someone else's identity.
• It involves acquiring and using identifying information such as name, date of birth, citizenship, address of residence, contact number, and spouse's name etc

Intellectual Property

• Intellectual property (IP) encompasses intangible creations of the human mind, such as copyrights, trademarks, patents, and trade secrets.
• IP rights protect creators' ownership and control over their works and expressions.

Philippine Copyright Law

• Philippine copyright law (Republic Act No. 8293) is based on the United States copyright law system and protects trademarks, patents, and other intellectual property types.

Ethics and Information Security

• Ethical guidelines are important when using and managing technology.
• The text provides guidelines for ethical conduct and avoidance of harming others through use of technology.
• It emphasizes ethical considerations when pursuing projects and avoiding harm.

Pre-Test/Post-Test

• The pre- and post-tests cover topics like different types of access controls, biometric recognition, logical access control solutions, and authentication types.
• Different types of authentication like knowledge, ownership, characteristics, location, and action are also covered.

Cryptography

• Cryptology deals with secure communications by making messages inaccessible to unauthorized individuals.
• Cryptography creates confidentiality; cryptanalysis breaks those systems.
• Cryptography has military ties, and a key function of cryptology is converting letters to numbers, for example, in military codes.
• Plaintext is the original message and ciphertext is encrypted message.
• Cryptography uses various methods, such as monoalphabetic and polyalphabetic systems.

Network Security

• Network security is concerned with protecting all aspects, systems, and operations for a network.
• Network design strategies involve considering budgets, availability requirements, risk tolerance, scope and future growth for the system.
• Firewalls are important for protecting network systems, controlling who can access services, and maintaining secure communications;
• Firewalls can be host-based or network-based for separate applications.
• Authentication is important for a secure network.

Auditing, Testing and Monitoring

• Security audits assess a business's info system security; comparing it to a set of standards.
• Security audits also evaluate the protection of physical configurations, processing, and user practices.
• Security audit evaluations help determine the effectiveness of security controls.
• Auditing may also involve vulnerability evaluation via secret tests/attacks, to determine whether a system can handle malicious attacks.