CHAPTER 2: Developing Your Security Policy

What does the following statement refers to?

"A set of guidelines and rules that outlines the measures and procedures that an organization should follow to protect its assets, including data, people, and property, from various threats such as theft, damage, or unauthorized access."

• Counter Measures

• Security Policy

• Policy Vulnerabilities

• Standardize Software

What does it mean by IDENTIFY YOUR RISKS? Choose all that apply.

• What are your risks from inappropriate use?

• Identify the level of security for your organization.

• Identify information that should be restricted.

• Keep staff informed about security policy.

What you should not overprotect your network?

• Staff will getting bored with the rules.

• Network with haphazard compliance is almost as

  bad as no policy at all.

• Too much security can be as bad as too little.

• It will exposed to a threat.

What are the steps to a successful Security Policy?

Choose all that apply.

• Learn from others.

• Include staff in policy development.

• Train your employees.

• Uninstall the tool that you need.

Answer explanation

What are the STEPS to a

successful Security Policy?

1) IDENTIFY YOUR RISK

2) LEARN FROM OTHERS

3) MAKE SURE THE POLICY

CONFORMS TO THE LEGAL REQUIREMENTS

4) LEVEL OF SECURITY = LEVEL OF RISK

5) INCLUDE STAFF IN SECURITY DEVELOPMENT

6) TRAIN YOUR EMPLOYEES

7) GET IT IN WRITING

8) SET CLEAR PENALTIES &

ENFORCE THEM

9) UPDATE YOU STAFF

10) INSTALL THE TOOLS YOU

NEED

Why you should update your staff regarding the security policy? Choose all that apply.

• Database are created and destroyed.

• New security threats pop-up.

• A security policy is a static document because the

  network itself is never evolving.

• People come and go.

Answer explanation

Why should you update your staff?

- A security policy is a dynamic document because the network itself is always evolving.

- People come and go.

- Databases are created and destroyed.

- New security threats pop up.

Which of the following are the examples of tools for enforcing security policies?

• Microsoft Security Compliance

  Toolkit

• Data Loss Prevention (DLP)

• McAfee ePolicy Orchestrator

• Identity and Access

  Management (IAM)

• Firewall

Identify the tips on how to respond to cyber attack.

• Secure Human Resource (HR) system.

• Launch Backup

• Notifies Authority

• Identify vulnerabilities.

"It is a weakness or flaw in software, hardware, or organizational processes, which when exposed to a threat, can result in a security breach."

The above statement refers to....

• Security Threat

• Malware

• Vulnerabilities

• Ransomware

Which of the following best describes Non-Physical Vulnerabilities?

• Involve security policy.

• Involve hardware and data.

• Involve software and data.

• Involve staff and administrator.

Answer explanation

Non-physical Network

Vulnerabilities:

* Involve SOFTWARE and DATA.

* E.g.: Operating system (OS)

might be vulnerable to network attacks if it’s not updated with the latest security patches.

"Involve the physical protection of an asset such as locking a server in a rack closet or securing an entry point with a turnstile."

The above statement refers to...

• Access Control

• Network Protection Measure

• Security Policy

• Physical Network Vulnerabilities