Podcast
Questions and Answers
Which of the following is NOT one of the 'six P's' of information security management?
Which of the following is NOT one of the 'six P's' of information security management?
- Policy
- Protection
- Planning
- Performance (correct)
Incident response planning is considered a type of InfoSec plan.
Incident response planning is considered a type of InfoSec plan.
True (A)
What does the acronym ISSP stand for in the context of information security policies?
What does the acronym ISSP stand for in the context of information security policies?
Issue-specific security policy
A security education, training, and awareness program is also known as a ______ program.
A security education, training, and awareness program is also known as a ______ program.
Match the category of policy with its description:
Match the category of policy with its description:
Which of the following is an example of how protection is executed in information security?
Which of the following is an example of how protection is executed in information security?
Technology is not as important as people, in information security.
Technology is not as important as people, in information security.
In project management for information security, what is required to meet the project requirements?
In project management for information security, what is required to meet the project requirements?
In project management terms, the resources needed to complete a project involve a temporary ______ of resources.
In project management terms, the resources needed to complete a project involve a temporary ______ of resources.
Match the types of connections with their primary role in managing information boundaries
Match the types of connections with their primary role in managing information boundaries
Which element is considered the most critical in an information security program?
Which element is considered the most critical in an information security program?
Project management is unnecessary for information security programs.
Project management is unnecessary for information security programs.
What is the purpose of 'planning' as a part of InfoSec management?
What is the purpose of 'planning' as a part of InfoSec management?
A complete physical security program includes fire protection, physical access control, and ______.
A complete physical security program includes fire protection, physical access control, and ______.
Match the type of InfoSec plan with the corresponding situation:
Match the type of InfoSec plan with the corresponding situation:
In the context of the 'six P's', which element focuses on the application of risk assessment and specific controls within an information security plan?
In the context of the 'six P's', which element focuses on the application of risk assessment and specific controls within an information security plan?
All aspects of information security can be managed as projects.
All aspects of information security can be managed as projects.
What is the primary purpose of an Enterprise Information Security Policy (EISP)?
What is the primary purpose of an Enterprise Information Security Policy (EISP)?
Identifying and controlling the resources applied to projects is a key part of ______ management.
Identifying and controlling the resources applied to projects is a key part of ______ management.
Match the following terms with the context of Info Security Management:
Match the following terms with the context of Info Security Management:
Flashcards
The Six P's
The Six P's
Extended characteristics of information security which includes Planning, Policy, Programs, Protection, People, Project Management.
Planning (InfoSec)
Planning (InfoSec)
Activities to support the design, creation, and implementation of information security strategies.
Policy
Policy
A guiding principle or set of rules designed to influence and determine all major decisions and actions.
Programs (InfoSec)
Programs (InfoSec)
Signup and view all the flashcards
Protection (InfoSec)
Protection (InfoSec)
Signup and view all the flashcards
People (InfoSec)
People (InfoSec)
Signup and view all the flashcards
Project Management
Project Management
Signup and view all the flashcards
Enterprise Information Security Policy (EISP)
Enterprise Information Security Policy (EISP)
Signup and view all the flashcards
Issue-Specific Security Policy (ISSP)
Issue-Specific Security Policy (ISSP)
Signup and view all the flashcards
System-Specific policies (SysSPs)
System-Specific policies (SysSPs)
Signup and view all the flashcards
Study Notes
- The extended characteristics of information security are known as the six P's
The Six P's
- Planning
- Policy
- Programs
- Protection
- People
- Project Management
Planning
- Planning is part of InfoSec management
- Planning is included in the InfoSec planning model
- Activities are necessary to support the design, creation, and implementation of information security strategies
Planning Types of InfoSec plans
- Incident response
- Business continuity
- Disaster recovery
- Policy
- Personnel
- Technology rollout
- Risk management
- Security program
- Security programs include education, training, and awareness
Policy
- Policies are organizational guidelines dictating certain behaviors
- Policies are sets of organizational guidelines that dictate certain behavior within the organization
Three general categories of policy
- Enterprise information security policy (EISP)
- Issue-specific security policy (ISSP)
- System-specific policies (SysSPs)
Programs
- InfoSec operations are specifically managed as separate entities
- A security education training and awareness (SETA) program is an example
Other Program Types
- Physical security
- Includes fire safety, physical access control via gates and guards
Protection
- It is executed through risk management activities
- It includes risk assessment and control, protection mechanisms, technologies, and tools
- Each mechanism represents some aspect of the management of specific controls in the overall information security plan
People
- This the most critical link in the information security program
- Managers must recognize the crucial role that people play in the information security program
- Includes security personnel and the security of personnel, as well as aspects of a SETA program
Project Management
- Identifying and controlling the resources applied to the project
- Measuring progress
- Adjusting the process as progress is made
Project Management Aspects
- Each element of an information security program must be managed as a project
- Some aspects of information security are not project-based, they are managed processes (operations)
- Each element of an information security program must be managed as a project
- A continuous series, or chain, of projects
Project Management Definition
- The application of knowledge, skills, tools, and techniques to project activities to meet project requirements
- Accomplished through the use of processes such as initiating, planning, executing, controlling, and closing
- Involves the temporary assemblage of resources to complete a project
- Some projects are iterative, occurring regularly
Managing Information Boundaries
- Intranet connections to other business units
- Extranets to business partners
- Remote connections to staff working off-site
- Virtual Private Networks (VPN's)
- Customer networks
- Supplier chains
- Service Level Agreements, outsourcing contracts, arrangements
- Third-party access
Info Security Management Context
- Includes the public, internal management, customers, employees, stakeholders, and internal auditors
- It also includes integrity, confidentiality, availability, and risk
- The outer ring includes litigation
Studying That Suits You
Use AI to generate personalized quizzes and flashcards to suit your learning preferences.
