Post-Class Quiz: Information Security

Study Notes

Information Security and Risk Management Domain

The Information System Security Officer (ISSO) is vital for daily security administration, ensuring systems meet security requirements, and following security procedures.
Security management emphasizes the continuous protection of company assets, data, and security-related hardware/software.
Ultimate responsibility for information security lies with Senior Management, making them accountable for security policies and practices.
Risk refers to the likelihood of a threat exploiting a vulnerability, while exposure indicates an instance of loss exposure.
Deviating from an organization's security policy necessitates a risk acceptance process.
Threats cannot be entirely eliminated but can be mitigated; they are fundamental in shaping security policies.
A "top-down approach" to security programs stems from Senior Management, underlining the importance of leadership commitment.
Single Loss Expectancy (SLE) quantifies potential loss; the exposure factor (EF) reflects the percentage of that loss.
Correct calculation of SLE uses asset value in monetary terms multiplied by exposure factor percentage.
Qualitative risk analysis relies on subjective judgment instead of concrete probability percentages.
Effective safeguards must provide cost-effectiveness and ensure benefits outweigh costs; a cost/benefit analysis is often necessary.
Total risk is the aggregation of all identified risks, particularly where safeguards may be inadequate.
Residual risk refers to any remaining risk after implementation of security measures.
Risk handling methods include transferring, accepting, mitigating, and avoiding risks, but correcting actions are focused on reducing attack likelihood.
Regular independent reviews of security controls are mandated every three years based on OMB Circular A-130 guidelines.
Proper user account management involves periodic reviews and tracking of access authorizations while rotating users out of specific roles is not encouraged.
High confidentiality protection is needed for systems holding proprietary or sensitive data, especially under threat of exposure.
Standards constitute directives from management for information security and should detail the implementation of policies.
Understanding risk encompasses assessing threats, vulnerabilities, impacts, and applying controls.
Security administrators are tasked with authorizing and implementing security rules while ensuring local policies are approved by management.
Risk assessment stands as the foundational process in risk management methodologies.
Goals of risk mitigation focus on establishing acceptable risk levels and reducing risk accordingly to that threshold.
Single Loss Expectancy (SLE) conveys the potential monetary loss from a threat, while Annualized Loss Expectancy (ALE) estimates yearly expected losses by multiplying SLE with its Annual Rate of Occurrence (ARO).
Appropriate security management practices include monitoring access logs, employee performance, and promoting security awareness, but not general monitoring of employee performance unrelated to security.