Deck 5: Developing the Security Program

Question 1

Organizations with complex IT infrastructures are likely to require more information security support than those with less complex infrastructures.

Answer 1

True

Question 2

Training is most effective when it is designed for a specific category of users.

Answer 2

True

Question 3

Large organizations spend a larger portion of their IT budget on security than small organizations.

Answer 3

False

Question 4

The planning function needed to implement the information security program often takes a project management approach to planning.

Question 5

The professional agencies such as SANS,ISC2,ISSA and CSI offer industry training conferences and programs that are ideal for the average employee.

Question 6

According to Charles Cresson Wood,"Reporting directly to top management is not advisable for the Information Security Department Manager [or CISO] because it impedes objectivity and the ability to perceive what's truly in the best interest of the organization as a whole,rather than what's in the best interest of a particular department."

Question 7

A security administrator does not require technical knowledge.

Question 8

Training for management should be conducted in large groups.

Question 9

The information security budgets of very large organizations grow faster than their IT budgets.

Question 10

In small organizations,security training and awareness is most commonly conducted on a one-on-one basis.

Question 11

Providing training to general users on policies ensures that those policies will be read and understood.

Question 12

The size of the information security budget usually corresponds to the size of the organization.

Question 13

Legal assessment for the implementation of the information security program is almost always done by the information security or IT departments.

Question 14

In general,security programs are overstaffed for the tasks that they have been assigned.

Question 15

According to Briney and Prince,"Security spending per user and per machine declines exponentially as organizations grow."

Question 16

Small organizations spend more per user on security than medium- and large-sized organizations.

Question 17

Threats from insiders are more likely in a small organization than in a large one.

Question 18

A security technician is usually an entry-level position.

Question 19

The security education,training,and awareness (SETA)program is designed to reduce the incidence of external security attacks.

Question 20

An organization's size does not affect the structure of the organization's information security program.

Question 21

The scope of the security training program should focus on information security personnel responsible for the protection of organizational information assets.

Question 22

On-the-job training can result in substandard work performance while the trainee gets up to speed.

Question 23

The term information security program describes the structure and organization of the effort to contain the risks to the information assets of an organization._________________________

Question 24

Several keys to a good poster series include 1)standardizing the content and keeping posters updated,2)making them complex,and thus visually interesting,3)making the message clear and 4)reminding users of penalties for non-compliance.

Question 25

One of the most commonly implemented but least effective security methods is the security awareness program.

Question 26

Distance learning/Web seminars can be low- or no-cost.

Question 27

Computer-based training (CBT)allows users to learn from each other.

Question 28

The organization's size and available resources also indirectly affect the size and structure of the information security program._________________________

Question 29

In smaller organizations,the security administrator frequently turns to commercial off-the-shelf software to lower the costs of assessing and implementing security._________________________

Question 30

When developing an awareness program,be sure to: Focus on people both as part of the problem and as part of the solution.

Question 31

In the self-study method of training,trainees learn the specifics of their jobs through performing their jobs.

Question 32

The average amount spent on security per user in a(n)very large organization is less than that in any other type of organization._________________________

Question 33

Very large organizations tend to have the largest budget per user of all organizational sizes discussed._________________________

Question 34

A(n)small-sized organization typically spends about 5 percent of the total IT budget on information security._________________________

Question 35

Effective training and awareness programs make employees accountable for their actions.

Question 36

A(n)medium-sized organization typically spends about 20 percent of the total IT budget on information security.________________________

Question 37

In large organizations,it is recommended to separate information security functions into four areas,including: non-technology business functions,IT functions,information security customer service functions and information security compliance enforcement functions._________________________

Question 38

An organization's size is the variable that has the greatest influence on the structure of the organization's information security program._________________________

Question 39

A(n)large-sized organization typically spends about $300 per user on information security._________________________

Question 40

Training for managers would be more detailed than that for security staff.

Question 41

In the on-the-job method of training,a trainer works with each trainee on an individual basis._________________________

Question 42

A security trinket program is one of the most expensive security awareness programs._________________________

Question 43

Security education involves providing members of the organization with detailed information and hands-on instruction to enable them to perform their duties securely._________________________

Question 44

To their advantage,some observers feel that small organizations avoid some threats precisely because of their small size._________________________

Question 45

The purpose of the CAEIAE program is to enhance security by building in-depth knowledge,by developing security-related skills and knowledge,by improving awareness of the need to protect system resources._________________________

Question 46

The typical security staff in a small organization consists of ____.

A) one person
B) one to two people
C) one to three people
D) two to five people

Question 47

In informing and preparing employees for their role in information security,security awareness provides the "what",training provides the "how" and education provides the "why"._________________________

Question 48

Managers often resist organized training of any kind._________________________

Question 49

____ is the term used to describe the structure and organization of the effort that strives to contain the risks to the information assets of the organization.

A) Risk management
B) Security education, training and awareness program
C) Information security program
D) None of these

Question 50

The distance learning method of training is in use when a single trainer works with multiple trainees in a formal setting._________________________

Question 51

Security spending per user and per machine ____ as organizations grow,leaving most handcuffed when it comes to implementing effective security procedures.

A) declines algebraically
B) increases logarithmically
C) declines exponentially
D) increases arithmetically

Question 52

An organization's information security Web site should be placed on the Internet._________________________

Question 53

Security managers are accountable for the day-to-day operation of the information security program._________________________

Question 54

The Computer Security Act of 1987 requires federal agencies to provide mandatory periodic training in computer security encryption and accepted computer practices to all employees involved with the management,use,or operation of their computer systems._________________________

Question 55

Individuals who perform routine monitoring activities are called security technicians._________________________

Question 56

A convenient time to conduct training for general users is during employee orientation._________________________

Question 57

Security training and awareness activities can be undermined if information security personnel do not set a good example._________________________

Question 58

Which of the following variables is the most influential in determining how to structure an information security program?

A) Security capital budget
B) Organizational size
C) Security personnel budget
D) Organizational culture

Question 59

Small organizations spend an average of ____ of their IT budget on security.

A) 5%
B) 11%
C) 20%
D) 24%

Question 60

Security awareness and security training are designed to modify any employee behavior that endangers the security of the organization's information._________________________

Question 61

A medium-sized organization has ____.

A) a larger security staff than a small organization
B) a larger security budget (as percent of IT budget) than a small organization
C) a smaller security budget (as percent of IT budget) than a large organization
D) larger security needs than a small organization

Question 62

Which of the following functions needed to implement the information security program identifies the sources of risk and may offer advice on controls that can reduce the risk?

A) Risk management
B) Legal assessment
C) Incident response
D) Risk assessment

Question 63

____ are accountable for the day-to-day operation of the information security program.

A) Security administrators
B) Security managers
C) Security technicians
D) Security analysts

Question 64

Large organizations spend an average of ____ of the IT budget on security.

A) 5%
B) 10%
C) 11%
D) 20%

Question 65

Which of the following would be responsible for configuring firewalls and IDSs,implementing security software,and diagnosing and troubleshooting problems?

A) A security technician
B) A security analyst
C) A security consultant
D) The security manager

Question 66

Which of the following functions needed to implement the information security program implements and oversees the use of controls to reduce risk?

A) Risk assessment
B) Incident response
C) Risk management
D) Network security administration

Question 67

Large organizations tend to spend ____ on security as smaller organizations.

A) substantially less
B) twice as much
C) substantially more
D) about the same

Question 68

On average,the security budget of a medium-sized organization is ____ of the total IT budget.

A) 5%
B) 11%
C) 20%
D) 34%

Question 69

Which of the following functions needed to implement the information security program evaluates patches used to close software vulnerabilities and acceptance testing of new systems to assure compliance with policy and effectiveness?

A) Systems testing
B) Risk assessment
C) Incident response
D) Planning

Question 70

Researching,creating,maintaining,and promoting information security plans is part of the ____ function needed to implement the information security program.

A) systems testing
B) policy
C) planning
D) systems security administration

Question 71

Very large organizations spend an average of ____ of the IT budget on security.

A) 5%
B) 6%
C) 7%
D) 11%

Question 72

In large organizations the information security department is often headed by the CISO who reports directly to the ____.

A) VP of Insurance and Risk Management
B) VP of Marketing
C) top computing executive or Chief Information Officer
D) Chief Operations Officer

Question 73

Security managers commonly report to the ____.

A) CIO
B) CISO
C) CEO
D) security analyst

Question 74

Which of the following functions needed to implement the information security program evaluates risk present in IT initiatives and/or systems?

A) Risk management
B) Risk assessment
C) Systems testing
D) Vulnerability assessment

Question 75

The ____ may also be called the Manager of Security.

A) CEO
B) CIO
C) CISO
D) Security Watchstander

Question 76

The security analyst is a specialized ____.

A) security administrator
B) security technician
C) security manager
D) CISO

Question 77

The responsibilities of the ____ are a combination of the responsibilities of a security technician and a security manager.

A) CEO
B) CISO
C) security analyst
D) security administrator

Question 78

The ____ is primarily responsible for the assessment,management,and implementation of the program that secures the organization's information.

A) CEO
B) CIO
C) CISO
D) COO

Question 79

____ organizations have information security budgets that grow faster than their IT budgets.

A) Small
B) Medium-sized
C) Large
D) Very large

Question 80

In ____ organizations,the average amount spent on security per user is less than in any other type of organization.

A) small
B) medium-sized
C) large
D) very large