Lesson 1: Comparing Security Roles and Security Controls

Which security related phrase relates to the integrity of data?

• Availability

• Modification

• Confidentiality

• Risk

Answer explanation

Any modification is authorized and is stored and transferred as intended when referring to the integrity of data. Integrity is part of the CIA triad.

Availability means that any information is accessible to those authorized to view or modify it. Availability is part of the CIA triad.

Confidentiality means that certain information should only be known to certain people. Confidentiality is part of the CIA triad.

Risk is the likelihood and impact (or consequence) of a threat actor exploiting a vulnerability.

An engineer looks to implement security measures by following the five functions in the National Institute of Standards and Technology (NIST) Cybersecurity Framework. When documenting the “detect” function, what does the engineer focus on?

• Evaluate risks and threats

• Install, operate, and decommission assets

• Ongoing proactive monitoring

• Restoration of systems and data

Answer explanation

Detect refers to performing ongoing proactive monitoring to ensure that controls are effective and capable of protecting against new types of threats.

Identify covers developing security policies and capabilities, and evaluating risks, threats, and vulnerabilities and recommend security controls to mitigate them.

Protect and procure covers the processes to install, operate, and decommission IT hardware and software assets with security as an embedded requirement of every stage of an operations life cycle.

Recovery deals with the implementation of cybersecurity resilience to restore systems and data if other controls are unable to prevent attacks.

How might the goals of basic network management not align with the goals of security?

• Management focuses on confidentiality and availability.

• Management focuses on confidentiality over availability.

• Management focuses on integrity and confidentiality.

• Management focuses on availability over confidentiality.

Answer explanation

Security is increasingly thought of as a dedicated function. The goals of a network manager are not always well-aligned with the goals of security; network management focuses on availability over confidentiality.

System security may be a dedicated business unit with its own management structure. As a result, network management might only concern itself with availability.

The goals of a basic network management are not always well-aligned with the goals of security; network management would not focus on confidentiality, but rather availability.

Network management would encompass the responsibility for systems up-time and availability. Security administrators would focus on integrity and confidentiality.

Any external responsibility for an organization’s security lies mainly with which individuals?

• The senior executives

• Tech staff

• Managers

• Public relations

Answer explanation

External responsibility for security (due care or liability) lies mainly with owners or senior executives. It is important to note that all employees share some measure of responsibility.

Technical and specialist staff have the direct responsibility for implementing, maintaining, and monitoring the policy. Security might be made a core competency of systems and network administrators, or there may be dedicated security administrators.

Managers at an organization may have responsibility for a specific domain or unit, such as building control, ICT, or accounting.

Non-technical staff have the responsibility of complying with policy and with any relevant legislation. Public relations is responsible for media communications.

The National Institute of Standards and Technology (NIST) provides a framework that classifies security-related functions. Which description aligns with the "respond" function?

• Evaluate risks, threats, and vulnerabilities.

• Perform ongoing, proactive monitoring.

• Implement resilience to restore systems

• Identify, analyze, and eradicate threats.

Answer explanation

The identify function is to develop security policies and capabilities. This function is used to evaluate risks, threats, and vulnerabilities and recommend security controls to mitigate them.

The detect function is to perform ongoing, proactive monitoring to ensure that controls are effective and capable of protecting against new types of threats.

The recover function is to implement cybersecurity resilience to restore systems and data if other controls are unable to prevent attacks.

The respond function is to identify, analyze, contain, and eradicate threats to systems and data security.

A company has an annual contract with an outside firm to perform a security audit on their network. The purpose of the annual audit is to determine if the company is in compliance with their internal directives and policies for security control. Select the broad class of security control that accurately demonstrates the purpose of the audit.

• Managerial

• Technical

• Physical

• Compensating

Answer explanation

Managerial is the control that gives oversight of the information system including selection of other security controls. An example of this type of control is regular scans and audits.

Technical control is implemented as a system (hardware, software, or firmware). For example, firewalls, antivirus software, and OS access control models are technical controls. Technical controls may also be described as logical controls.

Physical controls deter access to premises and hardware. Examples include alarms, gateways, and locks.

A compensating control serves as a substitute for a principal control, as recommended by a security standard, and affords the same (or better) level of protection but uses a different methodology or technology.

The _____ requires federal agencies to develop security policies for computer systems that process confidential information.

• Sarbanes-Oxley Act (SOX)

• Computer Security Act

• Federal information Security Management Act (FISMA

• Gramm-Leach-Bliley Act (GLBA)

Answer explanation

The Computer Security Act (1987) specifically requires federal agencies to develop security policies for computer systems that process confidential information.

The Sarbanes-Oxley Act (2002) mandates the implementation of risk assessments, internal controls and audit procedures. This act is not for any specific entity.

The Federal Information Security Management Act (2002) governs the security of data processed by federal government agencies. This act requires agencies to implement an information security program.

The Gramm-Leach-Bliley Act (1999) is a United States federal law that requires financial institutions to explain how they share and protect their customers' private information.

After a poorly handled security breach, a company updates its security policy to include an improved incident response plan. Which of the following security controls does this update address?

• Compensating

• Deterrent

• Corrective

• Detective

Answer explanation

An incident response plan is corrective. It responds to and fixes an incident. It may also prevent its recurrence.

Compensating is a security control that serves as a substitute for a principal control, as recommended by a security standard.

A deterrent is the control that may not physically or logically prevent access, but psychologically discourages an attacker from attempting an intrusion.

A detective is the control that may not prevent or deter access but will identify and record any attempted or successful intrusion.

The IT department head returns from an industry conference feeling inspired by a presentation on the topic of cybersecurity frameworks. A meeting is scheduled with IT staff to brainstorm ideas for deploying security controls by category and function throughout the organization. Which of the following ideas are consistent with industry definitions? (Select all that apply.)

• Deploy a technical control to enforce network access policies.

• Deploy an operational control to monitor compliance with external regulations.

• Schedule quarterly security awareness workshops as a preventive control to prevent social engineering attacks.

• Deploy agents to file servers to perform continuous backups to cloud storage as a corrective control to mitigate the impact of malware

Which of the following has a cyber security framework (CSF) that focuses exclusively on IT security, rather than IT service provisioning?

• National Institute of Standards and Technology (NIST)

• International Organization for Standardization (ISO)

• Control Objectives for Information and Related Technologies (COBIT)

• Sherwood Applied Business Security Architecture (SABSA)

Answer explanation

The National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF) is a relatively new addition to the IT governance space, and is distinct from other frameworks by focusing exclusively on IT security, rather than IT service provision more generally.

ISO develops standards and frameworks governing the use of computers, networks, and telecommunications, including ones for information security (27000 series). It is a commercial product.

COBIT is an IT governance framework with security as a core component. COBIT is published by ISACA and is also a commercial product, available through APMG International.

SABSA is a methodology for providing information assurance aligned to business needs and driven by risk analysis.