2.1 Introduction to Security Within the Organization

The GRC framework is the asking of which two questions?

• What regulations do we need to comply with?

• What assets are most important?

• What controls do we need to implement?

• What is adequate protection?

The G in GRC stands for

• Government

• Governance

• Green

• Gallagher

The R in GRC stands for

• Random

• Rating Framework

• Risk Management

• Recursive

The C in GRC stands for

• Compliance

• Complete

• Calculated

• Champion

How do we define the 'importance' of an asset?

• Cost of the asset after depreciation

• How much customer data is lost if security is breached

• How many people would be disrupted if the asset was unavailable?

• How important is this asset to the company's profits?

Which one of these is incorrect?

• The board of investors represents the interests of shareholders in a company

• The CEO is the highest role and does not report to anyone

• The CFO means Chief Financial Officer and reports to the CEO

• Some organizations only have a CISO. In this case, the CISO serves both CISO and CIO roles

SOC stands for

• Safety Operations Command

• Security Officer in Charge

• Safety Officer in Charge

• Security Operations Center

Redundancy eliminates the risk from

• Miscommunication

• Services

  Backflow

• Single Point of Failure

• Shallow Security

Defence in Depth

• A cybersecurity approach that uses multiple layers of security

• To run military drills very deep under water

• To store PII in a hidden location in the system

• A newly created cybersecurity field that defends the critical underwater infrastructure between countries

Control diversity means to

• Have multiple methods of protection for a given asset

• To switch up paradigms of cybersecurity defence between systems

• To monitor the types of attackers attempting to enter the system

• To monitor and control the type of people we have on the SOC team