Chapter 6: Engineering - Computer Security

D. Authorization Authorization determines the permissions that a user or process has in an access control scheme. In this case, Janet is determining those permissions, so she is performing an authorization function.

A. Laws Organizational compliance efforts include compliance with an organization's own policies, audits, culture, and standards. Legal compliance falls under the realm of regulatory compliance, not organizational compliance.

B. Access to a high level of expertise In this scenario, Mark is most likely to achieve access to a high level of expertise because security vendors focus exclusively on providing advanced security services. Mark's costs are likely to increase rather than decrease with outsourcing, and this decision will inhibit developing internal knowledge and talent.

A. Service level agreement (SLA) SLAs are formal contracts that detail the specific services a vendor will provide. Notification of security breaches is a common requirement found in SLAs.

C. Memorandum of understanding (MOU) An MOU, also called a letter of intent, is an agreement between two or more parties that expresses areas of common interest that result in shared actions. MOUs are generally less enforceable than a formal agreement.

C. Assume that information should be free Users should not assume that information is free and respect intellectual property rights. Assuming that information should be free is one of the common fallacies about ethics.

C. Enforcing the integrity of computer-based information RFC 1087 outlines six categories of unethical activity. IAB considers unethical and unacceptable any activity that purposely (1) seeks to gain unauthorized access to the resources of the Internet, (2) disrupts the intended use of the Internet, (3) wastes resources (people, capacity, computer) through such actions, (4) destroys the integrity of computer-based information, (5) compromises the privacy of users, or (6) involves negligence in the conduct of Internet-wide experiments.

B. An organization should share its information. The OECD guidelines state that an organization should NOT share its information. Other principles in those guidelines state that organizations should collect only what they need, keep information up-to-date, properly destroy information, and use information only for the purpose for which it was collected.

D. Separation of duties The principles of separation of duties breaks a task into subtasks that different users must carry out. This means that a single user cannot carry out a critical task without the help or approval of another user.

D. Punish users who violate policy : Security awareness programs should teach, inform, and motivate users. Although users who intentionally violate policies may be punished for their actions, this is a disciplinary issue that should be handled outside of the awareness program.

A. Baseline Baselines provide basic configurations for specific types of computers or devices. Baselines are the benchmarks that help make sure a minimum level of security exists across multiple systems and across different products.

D. Phishing Phishing attacks use email messages and/or webpages that resemble the work of a reputable organization. They attempt to deceive users into revealing sensitive information, such as passwords.

D. Threat The three characteristics normally used to make classification decisions are value, sensitivity, and criticality.

A. Configuration control Configuration control is the management of the baseline settings for a system device. The baseline settings are designed to meet security requirements.

B. Request, impact assessment, approval, build/test, implement, monitor The sequence of events during the change control process is request, impact assessment, approval, build/test, implement, and monitor.

A. Project initiation and planning The project initiation and planning phase includes developing project budgets, system design, maintenance, and the project timeline.

A. Formatting Formatting a disk does not remove the data stored on it and is not a reliable data destruction technique. Physically destroying the media, overwriting the data multiple times, and degaussing with a magnetic field are all acceptable means for data destruction.

B. Authorizing official (AO) The authorizing official (AO) is a senior manager who reviews the certification report and makes the decision to approve a system for implementation. The AO officially acknowledges and accepts the risk that the system may pose to agency mission, assets, or individuals.

B. SQL injection In an SQL injection attack, the attacker executes malicious SQL statements against a database that provide unauthorized access to data or allow other unauthorized database activities.

D. Waterfall The waterfall model is a sequential process for developing software. The essence of the waterfall model is that no phase begins until the previous phase is complete.

A. True

B. False The interconnection service agreement (ISA) serves as an agreement that documents the technical requirements of interconnected assets, and is often an extension of a MOU. A BPA creates preapproved accounts with qualified suppliers to fulfill recurring orders for products or services.

B. False A compliance liaison makes sure all personnel are aware of and comply with an organization's policies. Remediation involves fixing something that is broken or defective.

A. True

B. False Job rotation minimizes risk by rotating employees among various systems or duties. Mandatory vacations give you the opportunity to detect fraud. When users are on vacation, you should suspend their access to your environment.

A. True

A. True

A. True

A. True

B. False Procedures reduce mistakes in a crisis, ensure you don't miss important steps, provide for places within the process to conduct assurance checks, and are mandatory requirements.

B. False The term "system owner" refers to the person or group that manages the infrastructure. The data owner is the person who owns the data or of someone the owner assigns.

A. True

A. True

B. False It's important that all configuration changes occur only within a controlled process. Uncontrolled configuration changes often result in conflicts and even new security vulnerabilities.

B. False A hardware configuration chart should include copies of all software configurations so that you can examine changes and updates planned for one device in terms of their impact on other devices.

A. True

B. False Change creates risk for a business. It might circumvent established security features and it could result in outage or system failure. It might require extensive retraining for employees to learn how to use the new systems.

A. True

A. True

B. False Accreditation is the formal agreement by an authorizing official to accept the risk of implementing a system. Certification is the process of reviewing a system throughout its life cycle to ensure that it meets its specified security requirements.