CHAPTER SUMMARY
You learned in this chapter how to break up policies into seven domains. You examined each of the domains to learn why they exist, looked at related business concerns, and learned how to mitigate common risks. Security policies have to be aligned to the business. Most important, security policies can highlight regulatory and leading practice to guide the business in controlling these risks.
This chapter examined the changing nature of business through technologies such as wireless and handheld devices. You read about the differences between access methods such as RBAC and ABAC. It is important that security policies keep pace with changing technologies. You also saw what happens when security policies are not effective, as when more than 4.2 billion customer records were exposed in 2019. You should better understand the expanding role of the LAN to establish global connectivity through WANs. You also learned about techniques that keep this communication protected and private, such as VPN. Finally, you learned about the importance of having a DLP program defined in your security policies and about the drivers for DLP, including BYOD programs. DLP programs help organizations reduce the likelihood of data loss.
KEY CONCEPTS AND TERMS
CHAPTER 4 ASSESSMENT
- Private WANs must be encrypted at all times.
- True
- False
- Which of the following attempts to identify where sensitive data is currently stored?
- Data leakage protection inventory
- DLP encryption key
- Data loss protection perimeter
- DLP trojans
- Voice over Internet Protocol (VoIP) can be used over which of the following?
- LAN
- WAN
- Both
- Neither
- Which of the following is not one of the seven domains of typical IT infrastructure?
- Remote Access domain
- LAN domain
- World Area Network domain
- System/Application domain
- Which of the seven domains refers to the technical infrastructure that connects the organization’s LAN to a WAN and allows end users to surf the Internet?
- One key difference between RBAC and ABAC is which of the following?
- ABAC is dynamic, and RBAC is static.
- ABAC is static, and RBAC is dynamic.
- No difference; these are just different terms to mean the same thing.
- A ________ is a term that refers to a network that limits what computers can say and how they are able to talk to each other.
- A LAN is efficient for connecting computers within an office or groups of buildings.
- True
- False
- What policy generally requires that employees lock up all documents and digital media at the end of a workday and when not in use?
- Acceptable use policy
- Clean desk policy
- Privacy policy
- Walk out policy
- What employees learn in awareness training influences them more than what they see within their department.
- True
- False
- What kind of workstation management refers to knowing what software is installed?
- Inventory management
- Patch management
- Security management
- Discovery management
- Always applying the most strict authentication method is the best way to protect the business and ensure achievement of goals.
- True
- False
- Generally, remote authentication provides which of the following?
- Fewer controls than if you were in the office
- The same controls as if you were in the office
- More controls than if you were in the office
- Less need for controls than in the office
- Remote access does not have to be encrypted if strong authentication is used.
- True
- False
- Where is a DMZ usually located?
- Inside the private LAN
- Within the WAN
- Between the private LAN and public WAN
- Within the mail server
- Dedicated network devices whose only function is to create and manage VPN traffic are called VPN ________.
- What is a botnet?
- A piece of software the end user loads onto a device to prevent intrusion
- A piece of software a company loads onto a device to monitor its employees
- A piece of software a hacker loads onto a device without user knowledge
- A piece of software used to communicate between peers
- The minimum standard in authentication for businesses is the use of ________.
ENDNOTES
1. Marr, Bernard, “How Much Data Do We Create Every Day? The Mind-Blowing Stats Everyone Should Read,” Forbes, https://www.forbes.com/sites/bernardmarr/2018/05/21/how-much-data-do-we-create-every-day-the-mind-blowing-stats-everyone-should-read/#3ad8b75b60ba, accessed April 13, 2020.
2. Ch., Radoslave, “Cloud Computing Statistics 2020,” Techjury, March 28, 2019, https://techjury.net/stats-about/cloud-computing/, accessed April 13, 2020.
3. Columbus, Louis, “Public Cloud Soaring to $331B by 2022 According to Gartner,” Forbes, https://www.forbes.com/sites/louiscolumbus/2019/04/07/public-cloud-soaring-to-331b-by-2022-according-to-gartner/#39bdacfb5739, accessed April 13, 2020.
4. McAfee, “12 Must-Know Statistics on Cloud Usage in the Enterprise,” March 9, 2017, https://www.skyhighnetworks.com/cloud-security-blog/12-must-know-statistics-on-cloud-usage-in-the-enterprise/, accessed April 13, 2020.