f the vulnerabilities that remain viable risks to the organization.
Vulnerabilities are specific avenues that threat agents can exploit to attack an information asset.
Examine how each of the threats that are possible or likely could be perpetrated and list the organization’s assets and their vulnerabilities.
The process works best when groups of people with diverse backgrounds within the organization work iteratively in a series of brainstorming sessions.
Question 70. What Is Risk Assessment?
We can determine the relative risk for each of the vulnerabilities through a process called risk assessment
Risk assessment assigns a risk rating or score to each specific information asset, useful in gauging the relative risk introduced by each vulnerable information asset and making comparative ratings later in the risk control process.
Question 71. Mention The Risk Identification Estimate Factors ?
Value of Information Assets
Percent of Risk Mitigated
Question 72. Give An Example Of Risk Determination ?
For the purpose of relative risk assessment:
risk = likelihood of vulnerability occurrence times value (or impact) –
percentage risk already controlled + an element of uncertainty
Information Asset A has an value score of 50 and has one vulnerability:
Vulnerability 1 has a likelihood of 1.0 with no current controls and you estimate that assumptions and data are 90 % accurate
Asset A: vulnerability rated as 55 = (50 * 1.0) – 0% + 10%.
Question 73. What Is A Policy?
A policy is a plan or course of action, as of a government, political party, or business, intended to influence and determine decisions, actions, and other matters.
Question 74. What Are The Three Types Of Security Policies?
Management defines three types of security policy:
- General or security program policy
- Issue-specific security policies
- Systems-specific security policies.
Question 75. What Is Security Program Policy?
A security program policy (SPP) is also known as:
- A general security policy
- IT security policy
- Information security policy.
Question 76. Define Issue-specific Security Policy (issp) ?
addresses specific areas of technology
requires frequent updates
contains an issue statement on the organization’s position on an issue.
Question 77. What Are Acl Policies?
ACLs allow configuration to restrict access from anyone and anywhere
- Who can use the system
- What authorized users can access
- When authorized users can access the system
- Where authorized users can access the system from
- How authorized users can access the system.
Question 78. What Is Information Security Blueprint?
The Security Blue Print is the basis for Design,Selection and Implementation of Security Policies,education and training programs,and technology controls.
Question 79. Define Iso 17799/bs 7799 Standards And Their Drawbacks ?
One of the most widely referenced and often discussed security models is the Information Technology – Code of Practice for Information Security Management, which was originally published as British Standard BS 7799
This Code of Practice was adopted as an international standard by the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC) as ISO/IEC 17799 in 2000 as a framework for information security.
Question 80. Mention The Drawbacks Of Iso 17799/bs 7799 ?
Several countries have not adopted 17799 claiming there are fundamental problems:
The global information security community has not defined any justification for a code of practice as identified in the ISO/IEC 17799
17799 lacks “the necessary measurement precision of a technical standard”
There is no reason to believe that 17799 is more useful than any other approach currently available
17799 is not as complete as other frameworks available
17799 is perceived to have been hurriedly prepared given the tremendous impact its adoption could have on industry information security controls.
Question 81. What Are The Objectives Of Iso 17799?
Organizational Security Policy is needed to provide management direction and support
Operational Security Poli