CHAPTER SUMMARY
This chapter examined the risk associated with the User domain, one of the seven domains of an IT infrastructure. As the number of users grows on the network, their diverse needs also grow. Security policies are a structured way of managing the user-related risks in this complex environment. The chapter reviewed the many different types of users and discussed unique roles such as administrator, security, and auditor. With these roles often come elevated privilege and enormous responsibilities.
Security policies are an effective way to reduce risks and govern users. They help identify the higher risk activities such as those performed by systems administrators. The policies are based on principles that help apply security consistently. These principles include core concepts such as least access privileges and best fit access privileges. The principles lay out risk choices and must strike a balance between cost to maintain and risks to control. In the end, security policies can educate users, reduce human error, and be used to better understand how incidents occurred.
KEY CONCEPTS AND TERMS
CHAPTER 9 ASSESSMENT
- Pretexting is what happens when a hacker breaks into a firewall.
- True
- False
- You can use a(n) _______ process to grant temporary elevated rights.
- Security awareness is required by which of the following?
- Law
- Customers
- Shareholders
- All of the above
- A(n) _______ looks at risk and issues an independent opinion.
- A privileged-level access agreement (PAA) prevents an administrator from abusing elevated rights.
- True
- False
- Which of the following does an acceptable use policy relate to?
- Server-to-server communication
- Users accessing the Internet
- Encryption when transmitting files
- A and B
- A(n) _______ has inside information on how an organization operates.
- Social engineering occurs when a hacker posts his or her victories on a social website.
- True
- False
- In large organizations, all administrators typically have the same level of authority.
- True
- False
- A CISO must _______ risks if the business unit is not responsive.
- What is the difference between least access privileges and best fit access privileges?
- Least access privileges customize access to an individual.
- Best fit privileges customize access to a group based on risk.
- There is no difference.
- A and B
- System accounts are also referred to as _______ accounts.
- An interactive service account typically does not have a password.
- True
- False