CHAPTER SUMMARY

This chapter discussed complex relationships and personality types in the workplace and how they can affect how you implement security policies. It’s important to understand different personality types in the workplace to better motivate and influence workers to embrace security policies. Proper motivation can overcome user apathy. Executive support is important to get resources and to drive the security message and visibility needed for the implementation to be successful. The chapter also discussed the importance of pulling stakeholders and control partners into the policy implementation process. This chapter also discussed the Kotter model and a minor variation of it.

Postimplementation activities are just as important as those leading to policy implementation. Success is measured by the value the security policies bring in alignment with the company’s risk tolerance. The chapter also examined how security policies are effective only if they are used. This means they must be enforced. The core values and ways to look at risk within security policies can be applied to a wide array of business situations and new technologies. Successful security policy implementations can change mindsets and an organization’s culture. They can further reduce risks as individuals are better equipped to deal with the unexpected threats.

KEY CONCEPTS AND TERMS

Apathy

Auditor

Change agent

Chief information security officer (CISO)

Compliance officer

Control partners

Data custodians

Data managers

Data owners

Data users

Division of labor

Executive

Flat organizational structure

Hierarchical organizational structure

Matrix relationships

Reduction in force

Risk tolerance

Segregation of duties (SOD)

Separation of duties (SOD)

Span of control

Tone at the top

CHAPTER 5 ASSESSMENT

  1. Which of the following is a basic element of motivation?
    1. Pride
    2. Self-interest
    3. Success
    4. B and C
    5. All of the above
  2. Which personality type often breaks through barriers that previously prevented success?
    1. Attackers
    2. Commanders
    3. Analyticals
    4. Pleasers
  3. Avoiders like to ________ and will do _______ but not much more.
  4. As the number of specialties increases, so does ________.
  5. In hierarchical organizations, the leaders are close to the workers that deliver products and services.
    1. True
    2. False
  6. User apathy often results in an employee just going through the motions.
    1. True
    2. False
  7. Which of the following is a method for overcoming apathy?
    1. Avoiding redundancy
    2. Issuing company directives
    3. Engaging in communication
    4. Requiring obedience to policies
  8. Why is HR policy language often intentionally vague?
    1. To avoid being interpreted as an unintended promise
    2. To start lawsuits
    3. To avoid being too severe for new hires
    4. To provide flexibility for interpretation
  9. In the case of policies, it is important to demonstrate to business how policies will reduce risk and will be derived in a way that keeps costs low.
    1. True
    2. False
  10. An ideal time to refresh security policies is during a reduction in force.
    1. True
    2. False
  11. Kotter’s Eight-Step Change Model can help an organization gain support for _______ changes.
  12. When a catastrophic security breach occurs, who is ultimately held accountable by regulators and the public?
    1. Company officers
    2. The CIO
    3. The ISO
    4. The data owner
  13. Which of the following are attributes of entrepreneurs?
    1. Innovators
    2. Well educated in business management
    3. More likely to take risks
    4. A and C
    5. B and C
  14. A control partner’s role includes analysis of proposed policy changes and providing an opinion on their viability.
    1. True
    2. False
  15. Which of the following is the best measure of success for a security policy?
    1. The number of security controls developed as a result
    2. The number of people aware of the policy
    3. Reduction in risk
    4. The rank of the highest executive who approved it
  16. A change agent typically will:
    1. Ensure current processes are working
    2. Ensure application code changes are well understood
    3. Challenge whether a company’s existing processes represent the best approach

ENDNOTES

1. Leapfrog, “What Percentage of Your Company’s Budget Should Be Allocated for IT Operations,” July 30, 2019, https://leapfrogservices.com/percentage-companys-budget-allocated/, accessed April 14, 2020.

..................Content has been hidden....................

You can't read the all page of ebook, please click here login for view all page.
Reset
3.147.7.154