Exam 5: Developing the Security Program

According to Briney and Prince,"Security spending per user and per machine declines exponentially as organizations grow."

Which of the following functions needed to implement the information security program evaluates patches used to close software vulnerabilities and acceptance testing of new systems to assure compliance with policy and effectiveness?

In small organizations,security training and awareness is most commonly conducted on a one-on-one basis.

A convenient time to conduct training for general users is during employee orientation._________________________

A security trinket program is one of the most expensive security awareness programs._________________________

Security managers are accountable for the day-to-day operation of the information security program._________________________

A security administrator does not require technical knowledge.

Small organizations spend more per user on security than medium- and large-sized organizations.

Legal assessment for the implementation of the information security program is almost always done by the information security or IT departments.

The professional agencies such as SANS,ISC2,ISSA and CSI offer industry training conferences and programs that are ideal for the average employee.

____ is the term used to describe the structure and organization of the effort that strives to contain the risks to the information assets of the organization.

Advanced technical training can be selected or developed based on job category,job function,or ____.

The three methods for selecting or developing advanced technical training are by job category,by job function,and by ____________________.

Very large organizations tend to have the largest budget per user of all organizational sizes discussed._________________________

In large organizations the information security department is often headed by the CISO who reports directly to the ____.

Security awareness and security training are designed to modify any employee behavior that endangers the security of the organization's information._________________________

Which of the following functions needed to implement the information security program implements and oversees the use of controls to reduce risk?

Training can be customized for users by ____.

The scope of the security training program should focus on information security personnel responsible for the protection of organizational information assets.

A ____ program keeps information security at the forefront of users' minds on a daily basis.