Deck 7: Security Management Practices

Question 1

NIST recommends the documentation of each performance measure in a customized format to ensure repeatability of measures development,tailoring,collection,and reporting activities.

Answer 1

False

Question 2

When an organization applies statistical and quantitative forms of mathematical analysis to the data points collected to measure the activities and outcomes of the InfoSec program,it is using InfoSec best practices.

Answer 2

False

Question 3

In the future,NIST is replacing traditional Certification and Accreditation with authorization strategies and security control assessment.

Answer 3

True

Question 4

One of the priorities in building an information security measures program is determining whether these measures will be macro-focus or micro-focus.

Question 5

A best practice is a "value or profile of a performance metric against which changes in the performance metric can be usefully compared."

Question 6

To generate a security blueprint,organizations usually draw from established security models and practices.

Question 7

Best security practices (BSPs)balance the need for information access with the need for adequate protection while simultaneously demonstrating social responsibility.

Question 8

"Good security now is better than perfect security never."

Question 9

The biggest barrier to benchmarking in information security is the fact that organizations do not talk to each other.

Question 10

Information security performance management is the process of designing,implementing,and managing the use of the collected data elements called measures to determine the effectiveness of the overall security program.

Question 11

Certification is defined as "the comprehensive evaluation of the technical and nontechnical security controls of an IT system to support the accreditation process that establishes the extent to which a particular design and implementation meets a set of specified security requirements.

Question 12

Once developed,information security performance measures must be implemented and integrated into ongoing information security management operations.For the most part,it is sufficient to collect these measures once.

Question 13

The platinum standard is a model level of performance that demonstrates industrial leadership,quality,and concern for the protection of information.

Question 14

One of the three goals of System Certification and Accreditation as defined by NIST is to: define essential maximum security controls for federal IT systems.

Question 15

Another way to create a blueprint is to look at the paths taken by organizations similar to the one whose plan you are developing,known as baselining.

Question 16

Accreditation is the authorization of an IT system to process,store,or transmit information.

Question 17

The first phase in the NIST performance measures methodology is to collect data and analyze results; collect,aggregate,and consolidate metric data collection and compare measurements with targets.

Question 18

Organizations strive to deliver the most value with a given level of investment-this is called the value proposition.

Question 19

Organizations that adopt minimum levels of security to establish a future legal defense may need to verify that they have done what any prudent organization would do in similar circumstances; this is known as a standard of due care.

Question 20

In information security,two categories of benchmarks are used: 1)standards of due care and due diligence and 2)baselining.

Question 21

One of the critical tasks in the measurement process is to assess and quantify what will be secured._________________________

Question 22

Because "organizations manage what they measure," it is important to ensure that individual metrics are reported in the same manner as the performance they measure._________________________

Question 23

Even with strong management support,an information security measures program must be able to demonstrate due care to the organization._________________________

Question 24

Implementing controls at an acceptable standard-and maintaining them-demonstrates that an organization has performed due diligence._________________________

Question 25

It is no longer sufficient to simply assert effective information security; an organization must demonstrate that it is taking effective measures in the spirit of due diligence._________________________

Question 26

By looking at the paths taken by organizations similar to the one whose plan you are developing,known as benchmarking,the organization can follow the recommended or existing practices of a similar organization or industry-developed standards._________________________

Question 27

Production level statistics depend greatly on the number of systems and the number of users of those systems._________________________

Question 28

A goal of 100 percent employee information security training in the training program would invalidate the continued collection of training measures._________________________

Question 29

Performance measurement is an ongoing,continuous improvement operation._________________________

Question 30

When choosing from among recommended practices,an organization should ask if it resembles the target organization of the recommended practice._________________________

Question 31

In some organizations,the terms metrics and best practices are interchangeable._________________________

Question 32

In information security,two categories of benchmarks are used: standards of due care and due diligence and recommended practices._________________________

Question 33

Security efforts that seek to provide a(n)acceptable level of performance in the protection of information are called recommended business practices or just best practices._________________________

Question 34

Another problem with benchmarking is that no two organizations are similar._________________________

Question 35

Strong upper level management support is critical to the success of an information security performance program._________________________

Question 36

One of the most popular of the many references that support the development of process improvement and performance measures is The Capability Maturity Model Integrated (CMMI)designed specifically to integrate an organization's process improvement activities across disciplines._________________________

Question 37

The federal government prohibits the distribution of best security practices with organizations other than federal agencies._________________________

Question 38

Measures are data points or computed trends that may indicate the effectiveness of security countermeasures or controls-technical and managerial-as implemented in the organization._________________________

Question 39

Industries that are regulated by governmental agencies are required to meet government guidelines in their security practices._________________________

Question 40

A(n)baseline is a "value or profile of a performance metric against which changes in the performance metric can be usefully compared." _________________________

Question 41

In selecting among recommended practices,an organization should seek to ensure that the target ____ is similar to their own.

A) threat environment
B) resource expenditures
C) organization structure
D) all of these

Question 42

Which of the following is a major activity in the information security measures development process,according to NIST?

A) Identification and definition of the current information security program
B) Development and selection of specific measures to gauge the implementation, effectiveness, efficiency and impact of the security controls
C) Both of these
D) Neither of these

Question 43

Information security ____ is the process of designing,implementing,and managing the use of the collected data elements called measures to determine the effectiveness of the overall security program.

A) performance management
B) baselining
C) best practices
D) standards of due care/diligence

Question 44

During Phase 1 of the NIST performance measures development process,the organization identifies relevant ____ and their interests in information security measurement.

A) stakeholders
B) users
C) goals and objectives
D) regulations

Question 45

The benefits of using information security performance measures include all but which of the following?

A) Increasing efficiency for InfoSec performance
B) Improving effectiveness of InfoSec activities
C) Demonstrating compliance with laws, rules and regulations
D) Providing quantifiable inputs for resource allocation decisions

Question 46

A ____ is a "value or profile of a performance metric against which changes in the performance metric can be usefully compared.".

A) benchmark
B) best practice
C) baseline
D) standard of due care

Question 47

Which of the following is NOT one of the three types of performance measures used by organizations?

A) Those that determine the effectiveness of the execution of information security policy
B) Those that determine the effectiveness and/or efficiency of the delivery of information security services
C) Those that assess the impact of budgetary shortfalls in information security on the organization or its mission
D) All of these are types of performance measures used by organizations

Question 48

Benchmarking can help to determine ____ controls should be considered,but it cannot determine ____ those controls should be implemented in your organization.

A) which; when
B) if; when
C) what; why
D) which; how

Question 49

Good security now is better ____.

A) than nothing
B) than a kick in the teeth
C) than perfect security never
D) delayed until better security can be developed

Question 50

In information security,two categories of benchmarks are used: standards of due care and due diligence and ____ practices.

A) security
B) recommended
C) measures
D) metrics

Question 51

The ____ standard is a model level of performance that demonstrates industrial leadership,quality,and concern for the protection of information.

A) Silver
B) Gold
C) Platinum
D) Diamond

Question 52

Security efforts that seek to provide a superior level of performance in the protection of information are called ____.

A) recommended business practices
B) best practices
C) best security practices
D) All of these are correct

Question 53

Problems with benchmarking include all but which of the following?

A) Organizations don't share information on successful attacks
B) Organizations being benchmarked are seldom identical
C) Recommended practices change and evolve, thus past performance is no indicator of future success
D) Baseline data provides little value to evaluating progress in improving security

Question 54

One of the most popular references for developing process improvement and performance measures is the ____ model from the Software Engineering Institute at Carnegie Mellon University.

A) Creative Measures & Management Implementation
B) California Metropolitan Management International
C) InfoSec Process and Performance Measures
D) none of these

Question 55

Which of the following is NOT a question a CISO should be prepared to answer,about a performance measures program,according to Kovacich?

A) Why should these statistics be collected?
B) How will these statistics be collected?
C) How much will the collection of statistics cost?
D) Who will collect these statistics?

Question 56

Which of the following is NOT a factor critical to the success of an information security performance program?

A) Strong upper level management support
B) Practical InfoSec budgets and resources for the program
C) Quantifiable performance measures
D) Results oriented measures analysis

Question 57

Creating a blueprint by looking at the paths taken by organizations similar to the one whose plan you are developing is known as ____.

A) benchmarking
B) best practices
C) baselining
D) standards of due care

Question 58

Organizations must consider all but which of the following during development and implementation of an information security measurement program?

A) Measures must yield quantifiable information (percentages, averages, and numbers)
B) Data that supports the measures needs to be readily obtainable
C) Only repeatable information security processes should be considered for measurement
D) Measures must be useful for tracking shortfalls in organizational resources

Question 59

Organizations that adopt minimum levels of security to establish a future legal defense may need to verify that they have done what any ____ organization would do in similar circumstances.

A) prudent
B) security
C) excellent
D) gold standard

Question 60

While the terms may be interchangeable in some organizations,typically the term ____ is used for more granular,detailed measurement,while the term ____ is used for aggregate,higher-level results.

A) details; summaries
B) objectives; outcomes
C) measures; metrics
D) metrics; measures

Question 61

Maintaining an acceptable level of secure controls over time indicates that an organization has met the standard of ____.

A) prudent man defense
B) due diligence
C) best practice
D) due care

Question 62

One of the critical tasks in the performance measurement process is to assess and ____ what will be measured.

A) regulate
B) quantify
C) report
D) analyze

Question 63

In security management,____ is the authorization of an IT system to process,store,or transmit information.

A) accreditation
B) certification
C) performance measurement
D) authorization

Question 64

In reporting InfoSec performance measures,the CISO must also consider ____.

A) to whom the results should be disseminated
B) how they should be delivered
C) Both of these
D) Neither of these

Question 65

In the NIST performance measures implementation process,the comparison of observed measurements with target values is known as a ____ analysis.

A) shortfall
B) gap
C) corrective
D) failure

Question 66

Performance ____ make it possible to define success in the security program.

A) measures
B) targets
C) programs
D) none of these

Question 67

Which of the following is the first phase in the NIST process for performance measures implementation?

A) Develop the business case
B) Obtain resources
C) Prepare for data collection
D) Obtain management support

Question 68

It is seldom advisable to broadcast complex and nuanced metrics-based reports to large groups,unless ____.

A) the group is well educated and capable of understanding such complex reports
B) the reports also contain addendums providing detailed analyses of the findings
C) the key points are well established and embedded in a more complete context such as a newsletter or press release
D) None of these

Question 69

Production-level statistics depend greatly on the number of ____.

A) performance measures developed
B) systems and users of those systems
C) threats and attacks
D) activities and goals implemented by the business unit

Question 70

In most cases,simply listing the measurements collected does not adequately convey their ____.

A) meaning
B) cost
C) value
D) importance

Question 71

Which of the following is the last phase in the NIST process for performance measures implementation?

A) Apply corrective actions
B) Obtain resources
C) Repeat the process
D) Obtain management support

Question 72

Designing the performance measures collection process requires thoughtful consideration of the ____ of the metric along with a thorough knowledge of how production services are delivered.

A) cost
B) location
C) intent
D) owner

Question 73

Organizations pursue accreditation or certification to ____.

A) gain a competitive advantage
B) provide assurance to their customers
C) provide confidence to their customers
D) All of these

Question 74

Once developed,information security performance measures must be implemented and integrated into ____ information security management operations.

A) cost-effective
B) ongoing
C) efficient
D) regulated

Question 75

Collecting project metrics may be even more challenging.Unless the organization is satisfied with a simple tally of who spent how many hours doing which tasks,it needs some mechanism to link the ____ of each project,in terms of loss control or risk reduction,to the resources consumed.

A) metric
B) outcome
C) budget
D) users

Question 76

NIST recommends the documentation of performance measures in a format to ensure ____ of measures development,tailoring,collection,and reporting activities.

A) effectiveness
B) efficiency
C) repeatability
D) accountability

Question 77

During Phase 2 of the NIST performance measures development process,the organization will identify and document the information security performance ____ that would guide security control implementation for the information security program of a specific information system.

A) stakeholders
B) users
C) goals and objectives
D) regulations

Question 78

In security management,____ is "the comprehensive evaluation of the technical and nontechnical security controls of an IT system to support the process that establishes the extent to which a particular design and implementation meets a set of specified security requirements.

A) accreditation
B) certification
C) performance measurement
D) authorization

Question 79

One of the priorities in building an information security measures program is determining whether these measures will be macro-focus or micro-focus.____ measures examine the performance of the overall security program.

A) Micro-focused
B) Macro-focused
C) Both of these
D) Neither of these

Question 80

One of the fundamental challenges in information security performance measurement is the definition of ____ security.

A) effective
B) modern
C) information
D) efficient