
Where is it stored for update purposes.
Question 64. What Are The Asset Information For Data?
Size of data structure
Data structure used – sequential, relational
Online or offline
Backup procedures employed.
Question 65. How Information Assets Are Classified?
Examples of these kinds of classifications are:
Informal organizations may have to organize themselves to create a useable data classification model
The other side of the data classification scheme is the personnel security clearance structure.
Question 66. Define Data Classification And Management?
A variety of classification schemes are used by corporate and military organizations
Information owners are responsible for classifying the information assets for which they are responsible
Information owners must review information classifications periodically
The military uses a five-level classification scheme but most organizations do not need the detailed level of classification used by the military or federal agencies.
Question 67. What Are Security Clearances?
The other side of the data classification scheme is the personnel security clearance structure
Each user of data in the organization is assigned a single level of authorization indicating the level of classification
Before an individual is allowed access to a specific set of data, he or she must meet the need-to-know requirement
This extra level of protection ensures that the confidentiality of information is properly maintained.
Question 68. Explain The Process Of Threat Identification?
Each of the threats identified so far has the potential to attack any of the assets protected
This will quickly become more complex and overwhelm the ability to plan
To make this part of the process manageable, each step in the threat identification and vulnerability identification process is managed separately, and then coordinated at the end of the process.
Question 69. What Is Vulnerability Identification?
We now face the challenge of reviewing each information asset for each threat it faces and creating a list of the vulnerabilities that remain viable risks to the organization.
Vulnerabilities are specific avenues that threat agents can exploit to attack an information asset.
Examine how each of the threats that are possible or likely could be perpetrated and list the organization’s assets and their vulnerabilities.
The process works best when groups of people with diverse backgrounds within the organization work iteratively in a series of brainstorming sessions.
Question 70. What Is Risk Assessment?
We can determine the relative risk for each of the vulnerabilities through a process called risk assessment
Risk assessment assigns a risk rating or score to each specific information asset, useful in gauging the relative risk introduced by each vulnerable information asset and making comparative ratings later in the risk control process.
Question 71. Mention The Risk Identification Estimate Factors ?
Value of Information Assets
Percent of Risk Mitigated
Question 72. Give An Example Of Risk Determination ?
For the purpose of relative risk assessment:
risk = likelihood of vulnerability occurrence times value (or impact) –
percentage risk already controlled + an element of uncertainty
Information Asset A has an value score of 50 and has one vulnerability:
Vulnerability 1 has a likelihood of 1.0 with no current controls and you estimate that assumptions and data are 90 % accurate
Asset A: vulnerability rated as 55 = (50 * 1.0) – 0% + 10%.
Question 73. What Is A Policy?
A policy is a plan or course of action, as of a government, political party, or business, intended to influence and determine decisions, actions, and other matters.
Question 74. What Are The Three Types Of Security Policies?
Management defines three types of security policy:
- General or security program policy
- Issue-specific security policies
- Systems-specific security policies.
Question 75. What Is Security Program Policy?
A security program policy (SPP) is also known as:
- A general security policy
- IT security policy
- Information security policy.
Questi