IT Security and EA3 Framework Quiz

IT Security Issues and the EA3 Framework

• Security procedures training should be provided to end-users and system administrators annually or after significant security upgrade actions or incidents.
• Operational security should promote the development of SOPs for recovery from major outages or natural disasters and continuity of operations.
• Risk assessment should evaluate IT security risk at all levels of the EA3 Framework, including strategic, business process, information, and support application and IT infrastructure risks.
• Component security testing and evaluation involves identifying IT security vulnerabilities in hardware, software, and procedures, as well as auditing security-related documentation.
• Vulnerability remediation involves correcting IT security vulnerabilities found during testing and evaluation, with the selection of a security solution based on an acceptable level of risk.
• Component certification and accreditation certify that all remediation actions have been properly implemented for an EA component or integrated group of EA components.
• Disaster recovery involves assessment and recovery procedures for responding to significant disruptions or eliminations of IT operations, affecting all levels of the EA3 Framework.
• Continuity of operations refers to procedures invoked if all or part of the enterprise are unexpectedly destroyed or forced to disband, with scripted recovery responses in a Continuity of Operations Plan (COOP).
• Physical protection includes controls for facilities supporting IT processing, access control, fire protection, media storage, and disaster recovery systems.
• Building security focuses on controlling personnel access to the enterprise’s buildings where IT resources are used, affecting Business Process and Technology Infrastructure levels of the EA3 framework.
• Network operation centers, server rooms, and wiring closets control personnel access to places where EA components are physically located, mainly affecting the Business Process and Technology Infrastructure levels of the EA3 framework.
• Cable plants control personnel access to fiber and copper cable connecting the technology infrastructure, mainly affecting the Business Process and Technology Infrastructure levels of the EA3 Framework.

Enterprise Security and Privacy Program Overview

• The Security and Privacy Program aims to protect IT resources in the business and technology operating environment and supports the Enterprise Architecture (EA) program by providing requirements for standards and procedures.
• It addresses threats to information source and validity, access control, and physical environment of IT resources, and provides Standard Operating Procedures for system development, certification, operation, and security incident response.
• Key drivers for managing risk include the need to integrate processes/systems and share information while protecting resources from unauthorized access, and the Risk Management Strategy aims to find the right balance point in each area of an enterprise.
• Threats to security come in various forms including natural disasters, terrorism, hackers, and unintentional mistakes, which underscore the importance of investing in a Security and Privacy Program.
• IT security solutions are selected based on cost, level of protection needed, impact on end-users and system administrators, and the effectiveness of available technologies, acknowledging that there is no 100% proof solution for any enterprise.
• The best approach to security and privacy solutions throughout the enterprise is to set controls around key business and technology resources and services, using a "defense in depth" approach to address physical, personnel, and operational threats.
• The four key elements of the Security and Privacy Program are information security, personnel security, operational security, and physical security.
• Information security involves promoting security-conscious designs, information content assurance, source authentication, and data access control, affecting the Business Process and Information Flow levels of the EA3 framework.
• Personnel security focuses on user authentication and security awareness training, utilizing technologies like passwords, smart cards, identification badges, and biometrics, and ensuring that all end-users and administrators acknowledge IT Awareness Agreement.
• Operational security provides Standard Operating Procedures (SOPs) to organize and improve system development, certification, operation, and security incident response.
• Physical security involves protecting the physical environment where IT resources are located, including measures against threats such as fires, floods, earthquakes, and accidents.
• The Security and Privacy Program is crucial for safeguarding IT resources and ensuring the proper functioning of EA components, addressing various threats and promoting a risk-adjusted security approach.