Exercise chapter 8 PDF

Preview

Summary

exercise in class...

Description

Exercise chapter 8:

1. Define Infosec framework and blueprint A security framework is a compilation of state-mandated and international cybersecurity policies and processes to protect critical infrastructure. It includes precise instructions for companies to handle the personal information stored in systems to ensure their decreased vulnerability to security-related risks. A security blueprint is planning document that is basis for design, selection, and implementation of all security policies, education and training programs, and technological controls 2. What are the documents in the ISO/IEC27000 series? 

The documents in the ISO/IEC27000 series is a series of best practices to help organisations improve their information security. The series explains how to implement best-practice information security practices.

3. Briefly explain access control 



Access controls regulate the admission of users into trusted areas of the organization which both the logical access to the information systems, or the physical access to the organization’s facilities. Access control is maintained by means of a collection of policies, programs to carry out those policies, and technologies that enforce policies.

Access control is built on several key principles: 





Least privilege: The principle by which members of the organization can access the minimum amount of information for the minimum amount of time necessary to perform their required duties Need to know: Limits a user’s access to the specific information required to perform the currently assigned task, and not merely to the category of data required for a general work function Separation of duties: A control requiring that significant tasks be split up in such a way that more than one individual is responsible for their completion

4. Identify at least two approaches used to categorize access control methodologies, list the types of controls found in each  

Directive—Employs administrative controls such as policy and training designed to proscribe certain user behaviour in the organization Deterrent—Discourages or deters an incipient incident...