cy
Organizational Security Infrastructure
Asset Classification and Control
Physical and Environmental Security
Communications and Operations Management
System Access Control
System Development and Maintenance
Business Continuity Planning
Question 82. What Is The Alternate Security Models Available Other Than Iso 17799/bs 7799?
Another approach available is described in the many documents available from the Computer Security Resource Center of the National Institute for Standards and Technology (csrc.nist.gov) – Including:
NIST SP 800-12 – The Computer Security Handbook
NIST SP 800-14 – Generally Accepted Principles and Practices for Securing IT Systems
NIST SP 800-18 – The Guide for Developing Security Plans for IT Systems.
Question 83. Lis The Management Controls Of Nist Sp 800-26?
Review of Security Controls
Life Cycle Maintenance
Authorization of Processing Certification and Accreditation
System Security Plan.
Question 84. Mention The Operational Controls Of Nist Sp 800-26 ?
- Personnel Security
- Physical Security
- Production, Input/Output Controls
- Contingency Planning
- Hardware and Systems Software
- Data Integrity
- Security Awareness, Training, and Education
- Incident Response Capability.
Question 85. What Are The Technical Controls Of Nist 800-26?
Identification and Authentication
Logical Access Controls
Question 86. What Is Sphere Of Protection?
The “sphere of protection” overlays each of the levels of the “sphere of use” with a layer of security, protecting that layer from direct or indirect use through the next layer.
The people must become a layer of security, a human firewall that protects the information from unauthorized access and use Information security is therefore designed and implemented in three layers policies people (education, training, and awareness programs) technology.
Question 87. What Is Defense In Depth?
One of the foundations of security architectures is the requirement to implement security in layers
Defense in depth requires that the organization establish sufficient security controls and safeguards, so that an intruder faces multiple layers of controls.
Question 88. What Is Security Perimeter?
The point at which an organization’s security protection ends, and the outside world begins is referred to as the security perimeter.
Question 89. What Are The Key Technological Components Used For Security Implementation?
A firewall is a device that selectively discriminates against information flowing into or out of the organization
The DMZ (demilitarized zone) is a no-man’s land, between the inside and outside networks, where some organizations place Web servers
In an effort to detect unauthorized activity within the inner network, or on individual machines, an organization may wish to implement Intrusion Detection Systems or IDS.
Question 90. What Is Systems-specific Policy (syssp)?
SysSPs are frequently codified as standards and procedures used when configuring or maintaining systems..
Systems-specific policies fall into two groups:
Access control lists (ACLs) consist of the access control lists, matrices, and capability tables governing the rights and privileges of a particular user to a particular system.
Question 91. What Is The Importance Of Blueprint?
The blueprint should specify the tasks to be accomplished and the order in which they are to be realized. It should serve as a scaleable,upgradable,and comprehensive paln for the information security needs for coming years.
Question 92. What Are The Approaches Of Issp?
- Create a number of independent ISSP documents
- Create a single comprehensive ISSP document
- Create a modular ISSP document.
Question 93. What Are Firewalls?
A firewall is any device that prevents a specific type of information from moving between the untrusted network outside and the trusted network inside The firewall may be:
- a separate computer system
- a service running on an existing router or server
- a separate network containing a number of supporting devices.
Question 94. Explain Different Generations Of Firewalls ?
- First Generation – packet filtering fir