CHAPTER SUMMARY

This chapter discussed security documents that relate to each domain of a typical IT infrastructure. You learned there is more than one approach to creating standards. It is important to separate core policy language from specific technology configuration. One way to approach this is to have two separate documents, such as control standards and baseline standards. Supporting documents include procedures and guidelines. Collectively, these documents represent a comprehensive way of addressing risk.

The chapter examined both the form and substance of many standards. In fact, the volume of policy and standard topics is enormous. No one chapter could cover in detail every aspect of infrastructure policies and related controls. Policies that are well organized are likely to be better understood and more fully adopted. Early adoption of security policies can be a source of pride for both the individual and the team. Organizing this material in a searchable and useful manner is important to drive this understanding. This chapter also discussed how to categorize various documents in the library and how to describe their relationships. Finally, the chapter examined best practices that included a number of sources for policy and standard material. Organizations rarely create new policies from scratch. It is far better to leverage best practices security frameworks and related policies.

KEY CONCEPTS AND TERMS

Access control list (ACL)

Active content

Audit

Enterprise data management (EDM)

Intrusion detection system (IDS)

Intrusion prevention system (IPS)

Stateful firewall

Stateless firewall

User proxy

Web services

Workstation domain policies

CHAPTER 10 ASSESSMENT

  1. The steps to implement security controls on a firewall would be documented within which of the following?
    1. Policy
    2. Control standard
    3. Baseline standard
    4. Procedure
  2. A DMZ separates a LAN from which of the following?
    1. Phone network
    2. Internet
    3. Cellular network
    4. VoIP network
  3. Visitor control is an aspect of which of the following?
    1. Network security
    2. Personnel security
    3. Workstation security
    4. Physical security
  4. Which of the following can you use to segment LANs?
    1. Routers and firewalls
    2. Routers and gateways
    3. Gateways and servers
    4. Servers and workstations
  5. Without a policy that leads to controls that restrict employees from installing their own software on a company workstation, a company could suffer which of the following consequences?
    1. Malware on the network
    2. Lawsuits from software licensing issues
    3. Loss of productivity
    4. All of the above
  6. Good sources for security policies and standards include which of the following?
    1. U.S. government
    2. Private companies selling standards
    3. Professional organizations
    4. Vendors
    5. All of the above
  7. Two-factor authentication is a typical control used by employees to remotely access which of the following?
    1. Workstation
    2. LAN
    3. DMZ website
    4. WAN
  8. Which document outlines the specific controls that a technology device needs to support?
    1. Control standard
    2. Baseline standard
    3. Procedure
    4. Policy
  9. In information security, EDM typically refers to ________.
  10. The content for the documents in the policies and standards library should be written so they are ________ and ________.
  11. Production data should be sanitized before being used in a test environment.
    1. True
    2. False
  12. Organizations should always create new policies tailored to their needs rather than adapt industry norms found on the Internet.
    1. True
    2. False
  13. An owner of the data must obtain approval from the custodian of the resource to use the data.
    1. True
    2. False
  14. What is the difference between a stateless firewall and a stateful one?
    1. A stateful firewall looks at each packet individually, and a stateless firewall examines the packet in the context of the connection and other packets.
    2. A stateless firewall looks at each packet individually, and a stateful firewall examines the packet in the context of the connection and other packets.
    3. There isn’t a difference.
    4. A stateful firewall requires authentication, whereas a stateful firewall does not.
..................Content has been hidden....................

You can't read the all page of ebook, please click here login for view all page.
Reset
3.15.225.213