Security+ Lesson1

Your company is developing an application in which a private US-based hospital will allow patients to access their medical records online. Regardless of what other data the application handles, what kind of compliance do you already know you need to research?

• FISMA

• FERPA

• PCI DSS

• HIPAA

Answer explanation

You need to research Health Insurance Portability and Accountability Act (HIPAA) compliance as it is a federal law designed to protect the health insurance coverage of workers who change or lose their jobs. The important part from an IT perspective is how it protects the privacy of patient records. HIPAA defines protected health information (PHI) and regulates how it can be used or disclosed. It also defines security standards for the storage and access of PHI.

The US government agency plans to migrate some of its internally hosted data to a cloud-based service. You need to make sure the proposed vendor can meet the same security requirements as the current solution. What are you currently practicing?

Each correct answer represents a complete solution. Choose all that apply.

• GDPR compliance

• FISMA compliance

• Due diligence

• Due care

• EGLBA compliance

Answer explanation

You are practicing due diligence and complying with FISMA before migrating some of the internally hosted data to a cloud-based service. Due diligence involves taking a regulated activity or anything else that could lead you into a legal liability. You must investigate the situation you’re entering, understand the risks and obligations it brings, then take reasonable care in your following actions whereas Federal Information Security Management Act (FISMA) is a law applying to all federal agencies. It requires every agency to develop, document, and implement an information security and protection program.

Joe is tuning her organization's firewall rules to prevent IP spoofing. What type of control is Joe implementing?

• Technical

• Operational

• Managerial

• Physical

Answer explanation

Technical controls enforce confidentiality, integrity, and availability in the digital space. Technical controls include firewall rules, access control lists, intrusion prevention systems, and encryption. In modern data systems, technical controls do a great amount of work and require the most exacting knowledge. However, they’re still only effective in conjunction with human activities used to implement and enforce them.

Which of the following controls primarily protect data availability?

• Hashing

• Patch management

• Digital signatures

• Version control

Answer explanation

It’s costly when your organization’s data and other resources aren’t available to those who need it, when they need it. Apart from any other harm done by a security incident, the more it disrupts your business operations, the more harm it will do. Many attacks are designed to damage solely by targeting availability. Availability is typically described in the percentage of the time a system or resource is expected to be operating and responsive. There are many security controls used to enhance availability during routine operations and during or after attacks or system errors.

> Redundancy

> Fault tolerance

> Patch management

Which one of the following statements is not true about compensating controls under PCI DSS?

• Use and regularly update antivirus software or programs.

• Do not use vendor-supplied defaults for system passwords and other security parameters.

• Allow physical access to cardholder data.

• Encrypt transmission of cardholder data across open public networks.

Answer explanation

For a typical example of regulatory compliance, PCI DSS defines twelve mandated controls needed to meet them.

> Install and maintain a firewall configuration to protect cardholder data.

> Do not use vendor-supplied defaults for system passwords and other security parameters.

> Protect stored cardholder data.

> Encrypt transmission of cardholder data across open, public networks.

> Use and regularly update antivirus software or programs.

> Develop and maintain secure systems and applications.

> Restrict access to cardholder data by business need to know.

> Assign a unique ID to each person with computer access.

> Restrict physical access to cardholder data.

> Track and monitor all access to network resources and cardholder data.

> Regularly test security systems and processes.

> Maintain a policy that addresses information security for all personnel.

A new privacy law demands more robust protection for your customer database. First, you researched database security products to find which would reliably meet your needs. Now that you’ve selected and installed one, you’re currently training administrators to perform integrity checks, update the software, and review logs for suspicious activities. What are you practicing?

• Availability

• Negligence

• Regulatory compliance

• Due care

Answer explanation

Due care is less about the research you put in ahead of time and more about the ongoing actions you perform for whatever assets you’re responsible for. For example, maintaining the safety standards of your property over time or making reasonable business decisions for a company you manage for others are examples of due care. If something goes wrong anyway, due care allows you to establish that you worked in good faith to protect the company and its assets from harm.

A third-party team is going to formally examine your organization’s overall security practices to make sure they meet regulatory compliance goals. Your organization may be fined if it fails. What would this verification process be called?

• Evaluation

• Certification

• Audit

• Assessment

Answer explanation

The audit is a systematic evaluation of effectiveness against a set of established criteria, such as to verify regulatory compliance or cost-effectiveness. Audits are intended to provide independent proof of performance to parties such as upper management, investors, external partners, and regulatory bodies. They tend to be formal and follow strictly designed criteria, and there can be severe consequences for production systems failing an audit. Depending on the audience of an audit, it might be performed by an independent internal team, or by an external contractor.

Someone stole thousands of customer records from your organization's database. What aspect of security was primarily attacked?

• Availability

• Integrity

• Confidentiality

• Portability

Answer explanation

The disclosure of sensitive information to unauthorized individuals is a violation of the principle of confidentiality. Confidentiality ensures that information is viewable only by authorized users or systems, and is either inaccessible or unreadable to unauthorized users. Confidentiality is most crucial for obviously sensitive information, but even information that isn’t secret in itself might be valuable to attackers who wish to compromise your organization.

Your internal network is protected from Internet attacks by a Cisco firewall. To improve security, your supervisor suggests installing a Fortinet firewall between the Cisco firewall and the trusted LAN, then using the space between as a perimeter network. Which security principles does this promote?

Each correct answer represents a complete solution. Choose all that apply.

• Defense-in-depth

• Availability

• Vendor diversity

• Security by obscurity

• Security by design

Answer explanation

Your supervisor is promoting defense-in-depth and vendor diversity strategies. Defense-in-depth typically defines multiple layers on which the organization's internal network needs to be secured. Those layers define where you need to look when you set up security systems or troubleshoot security issues. Defense-in-depth doesn’t just describe parts of your organization: a single layer can be made more secure by applying multiple complementary controls. Even if they’re all physical security, having locked doors, cameras, and patrolling guards is more robust protection for a secure facility than any one of the above. Even with the same type of control, vendor diversity can add security. Having two network firewalls made by two different vendors means if an attacker learns about a vulnerability in one, it might not be applicable to the other.

Which of the following is a US government agency charged with developing and supporting standards used by other government organizations?

• W3C

• NIST

• ISOC

• OWASP

Answer explanation

National Institute of Standards and Technology (NIST) is a US government agency charged with developing and supporting standards used by other government organizations, while it primarily promotes standards for use by the US government, they frequently are used by others with similar technology needs. In recent years, computer security standards have become a major part of its mission. NIST shares most of its findings with the broader security community and regularly publishes information about known software vulnerabilities and security best practices.