CHAPTER SUMMARY

The chief information security officer (CISO) “owns” the information protection program for the organization. He or she must monitor the adoption and effectiveness of the security policies. The CISO must ensure that noncompliance is escalated to senior leadership for enforcement. Still, it’s everyone’s responsibility to enforce security policies. This is accomplished by the collective action of leaders. Enforcement starts with executive support. This support goes beyond granting permission to implement security policies. Executive support also means personal commitment by the managers to use their position and skills to influence the direction of their teams. Once executives put their own credibility behind policies, they are less likely to allow violations to occur.

The organization also enforces policies through committees. These committees act as a gateway to check that security policies are being followed. This may mean monitoring employee use of the computer. When behavior does not conform to policies, it is the role of front-line managers and supervisors to act.

This chapter examined the relationship among organizational layers (governance and management), laws, regulations, and policies. It defined what is law and what is policy. It examined different methods of enforcing policies. It also examined the strengths and weaknesses of automated and manual controls. Finally, the chapter examined the legal implication of enforcing security policies.

KEY CONCEPTS AND TERMS

Architecture review committee

Data leakage

External connection committee

Gateway committees

General counsel

Honeypot

Law

Pervasive control

Project committee

Regulations

Security compliance committee

Subject matter expert (SME)

Vendor governance committee

CHAPTER 14 ASSESSMENT

  1. Which of the following is not an organizational gateway committee?
    1. Architecture review committee
    2. Internal connection committee
    3. Vendor governance committee
    4. Security compliance committee
  2. _____________ often focuses on enterprise risk management across multiple lines of business to resolve strategic business issues.
  3. The security compliance committee has one role, which is to identify when violations of policies occur.
    1. True
    2. False
  4. Which of the following is not an access control?
    1. Authentication
    2. Authorization
    3. Decryption
    4. Logging
  5. In which of the following areas might a company monitor its employees’ actions?
    1. Internet
    2. Email
    3. Computers
    4. A and B
    5. A, B, and C
  6. _____________ establish how the organization achieves regulatory requirements.
  7. Laws define the specific internal IT processes needed to be compliant.
    1. True
    2. False
  8. What is not required in modern-day CISO positions?
    1. Must rely on the organization to enforce policy
    2. Needs to have strong law enforcement background
    3. Needs to build relationships and consensus
    4. Must influence behavior and change culture to enforce policy
  9. What is an example of a manual control?
    1. Background checks
    2. Authentication
    3. Access rights reviews
    4. A and C
    5. A, B, and C
  10. A breach of a single customer record cannot be considered a pervasive control weakness.
    1. True—you must lose a significant amount of data for it to be considered a pervasive control weakness.
    2. False—any breach can be a pervasive control weakness, depending on the control that failed.
  11. Connecting a personal device to the company network can create legal implications.
    1. True
    2. False
  12. Line management does which of the following to make policies operational?
    1. Acts as go-to people for addressing questions
    2. Applies policies consistently
    3. Gathers metrics on the policies’ effectiveness
    4. A and C
    5. A, B, and C
  13. In which process would you place quality assurance controls?
    1. Governance processes
    2. Management processes
    3. Both governance and management processes
    4. Neither governance nor management processes
  14. Which of the following is not reviewed when monitoring a user’s email and Internet activity?
    1. Data leakage
    2. Viruses and malware
    3. Unauthorized access to sites
    4. Network performance
  15. When testing for security in an application code, the quality assurance process tests _____________ the code is in production and quality control tests _____________ the code is in production.
  16. The operational risk function is responsible for ensuring that the business operates within risk _____________ and risk _____________.
..................Content has been hidden....................

You can't read the all page of ebook, please click here login for view all page.
Reset
3.145.47.230