lements, including the systems and hardware that use, store, and transmit the information.
Question 11. What Are The Critical Characteristics Of Information?
Question 12. What Is Nstissc Security Model?
This refers to “The National Security Telecommunications and Information Systems Security Committee” document. This document presents a comprehensive model for information security. The model consists of three dimensions.
Question 13. What Are The Components Of An Information System?
An Information System (IS) is much more than computer hardware; it is the entire set of software, hardware, data, people, and procedures necessary to use information as a resource in the organization.
Question 14. What Is Meant By Balancing Security And Access?
- Balancing Security and Access
- It is impossible to obtain perfect security – it is not an absolute; it is a process
- Security should be considered a balance between protection and availability
- To achieve balance, the level of security must allow reasonable acces, yet protect against threats.
Question 15. What Are The Approaches Used For Implementing Information Security?
- Bottom Up Approach
- Top-down Approach.
Question 16. What Is Sdlc?
- The Systems Development Life Cycle
- Information security must be managed in a manner similar to any other major system implemented in the organization
- Using a methodology
- ensures a rigorous process
- avoids missing steps.
Question 17. Explain Different Phases Of Sdlc ?
Investigation, Analysis, Logical Design, Physical Design, Implementation,Maintenance and Change.
Question 18. What Is Security Sdlc?
- Security Systems Development Life Cycle
- The same phases used in the traditional SDLC adapted to support the specialized implementation of a security project
- Basic process is identification of threats and controls to counter them
- The SecSDLC is a coherent program rather than a series of random, seemingly unconnected actions.
Question 19. How Information Security Is Viewed As A Social Science?
Social science examines the behavior of individuals interacting with systems Security begins and ends with the people that interact with the system End users may be the weakest link in the security chain Security administrators can greatly reduce the levels of risk caused by end users, and create more acceptable and supportable security profiles.
Question 20. What Are The Information Security Roles To Be Played By Various Professionals In A Typical Organization?
- Senior Management – Chief Information Officer, Chief Information Security Officer
- Security Project Team
- The champion
- The team leader
- Security policy developers
- Risk assessment specialists
- Security professionals
- Systems administrators
- End users.
Question 21. What Are The Three Types Of Data Ownwership And Their Responsibilities?
Data Owner – responsible for the security and use of a particular set of information Data Custodian – responsible for the storage, maintenance, and protection of the information Data Users – the end systems users who work with the information to perform their daily jobs supporting the mission of the organization.
Question 22. What Is The Difference Between A Threat Agent And A Threat?
A threat is a category of objects,persons,or other entities that pose a potential danger to an asset. Threats are always present. A threat agent is a specific instance or component of a threat. (For example All hackers in the world are a collective threat Kevin Mitnick,who was convicted for hacking into phone systems was a threat agent.)
Question 23. What Is The Difference Between Vulnerability And Exposure?
The exposure of an information system is a single instance when the system is open to damage. Weakness or faults in a system expose information or protection mechanism that expose information to attack or damage or known as vulnerabilities.
Question 24. What Is Attack?
An attack is an intentional or unintentional attempt to cause damage or otherwise compromise the information. If some one casually reads sensitive information not intended for his or her use ,this co