Exam 4: Information Security Policy

Practices are built on sound policy and carry the weight of policy._________________________

In the bull's-eye model,issues are addressed by moving from the general to the specific,always starting with policy.That is,the focus is on $\text {\underline{ specific } }$ solutions instead of individual problems._________________________

List and briefly describe the major components of the ISSP.

To be effective,policy must be uniformly applied to all employees,including executives.

Practices are created from ____.

Policies must note the existence of penalties for unacceptable behavior and define an appeals process.

A policy acknowledgment screen that does not require any unusual action on the part of the user to move past it is a ____.

Some policies incorporate a(n)sunset clause indicating a specific date the policy will expire._________________________

One of the goals of an issue-specific security policy is to indemnify the organization against liability for an employee's inappropriate or illegal use of the system.

List the significant guidelines used in the formulation of effective information security policy.

The computers used in an organization are part of the ____________________ layer of the bull's-eye model.

In an organization,a(n)____________________ security policy provides detailed,targeted guidance to instruct all the members in the use of technology-based systems.

The analysis phase of the SecSDLC in policy development should produce a new or recent risk assessment or IT audit documenting the current information security needs of the organization._________________________

Configuration rules are configuration codes that guide the execution of a system when information is passing through it._________________________

During the ____ phase of the SecSDLC,the information security policy is monitored,maintained,and modified as needed.

Policy servers code organization-specific policies in a special machine-readable language that then can be accessed by operating systems,access control packages,and network management systems._________________________

A quality information security program begins and ends with ____________________ .

A typical EULA screen may require the user to ____.

A(n)capability table specifies which subjects and objects that users or groups can access._________________________

During the ____ phase of the SecSDLC,the team must create a plan to distribute,and verify the distribution of,the policies.