on 76. Define Issue-specific Security Policy (issp) ?
addresses specific areas of technology
requires frequent updates
contains an issue statement on the organization’s position on an issue.
Question 77. What Are Acl Policies?
ACLs allow configuration to restrict access from anyone and anywhere
- Who can use the system
- What authorized users can access
- When authorized users can access the system
- Where authorized users can access the system from
- How authorized users can access the system.
Question 78. What Is Information Security Blueprint?
The Security Blue Print is the basis for Design,Selection and Implementation of Security Policies,education and training programs,and technology controls.
Question 79. Define Iso 17799/bs 7799 Standards And Their Drawbacks ?
One of the most widely referenced and often discussed security models is the Information Technology – Code of Practice for Information Security Management, which was originally published as British Standard BS 7799
This Code of Practice was adopted as an international standard by the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC) as ISO/IEC 17799 in 2000 as a framework for information security.
Question 80. Mention The Drawbacks Of Iso 17799/bs 7799 ?
Several countries have not adopted 17799 claiming there are fundamental problems:
The global information security community has not defined any justification for a code of practice as identified in the ISO/IEC 17799
17799 lacks “the necessary measurement precision of a technical standard”
There is no reason to believe that 17799 is more useful than any other approach currently available
17799 is not as complete as other frameworks available
17799 is perceived to have been hurriedly prepared given the tremendous impact its adoption could have on industry information security controls.
Question 81. What Are The Objectives Of Iso 17799?
Organizational Security Policy is needed to provide management direction and support
Operational Security Policy
Organizational Security Infrastructure
Asset Classification and Control
Physical and Environmental Security
Communications and Operations Management
System Access Control
System Development and Maintenance
Business Continuity Planning
Question 82. What Is The Alternate Security Models Available Other Than Iso 17799/bs 7799?
Another approach available is described in the many documents available from the Computer Security Resource Center of the National Institute for Standards and Technology (csrc.nist.gov) – Including:
NIST SP 800-12 – The Computer Security Handbook
NIST SP 800-14 – Generally Accepted Principles and Practices for Securing IT Systems
NIST SP 800-18 – The Guide for Developing Security Plans for IT Systems.
Question 83. Lis The Management Controls Of Nist Sp 800-26?
Review of Security Controls
Life Cycle Maintenance
Authorization of Processing Certification and Accreditation
System Security Plan.
Question 84. Mention The Operational Controls Of Nist Sp 800-26 ?
- Personnel Security
- Physical Security
- Production, Input/Output Controls
- Contingency Planning
- Hardware and Systems Software
- Data Integrity
- Security Awareness, Training, and Education
- Incident Response Capability.
Question 85. What Are The Technical Controls Of Nist 800-26?
Identification and Authentication
Logical Access Controls
Question 86. What Is Sphere Of Protection?
The “sphere of protection” overlays each of the levels of the “sphere of use” with a layer of security, protecting that layer from direct or indirect use through the next layer.
The people must become a layer of security, a human firewall that protects the information from unauthorized access and use Information security is therefore designed and implemented in three layers policies people (education, training, and awareness programs) technology.
Question 87. What Is Defense In Depth?
One of the foundations of security architectures is the requirement to implement security in layers
Defense in depth requires that the organization establish sufficient securit