Quiz 6
1. Define an SLA and state why it is required in a risk adverse Organization?
A service level agreement (SLA) is a document that identifies an expected level of performance. It identifies the minimum uptime or the maximum downtime. Organizations use SLAs as contracts between a service provider and a customer. An SLA can identify monetary penalties if the terms are not met. If your organization has SLAs with other organizations, these should be included in the risk management review. You should pay special attention to monetary penalties. For example, an SLA could specify a maximum downtime of four hours. After four hours, hourly penalties will start to accrue. You can relate this to the maximum acceptable outage (MAO).
2. Using the user domain, define risks associated with users and explain what can be done to mitigate them? the primary risks associated with the user domain are related to social engineering. Users can be conned and tricked. A social engineer tries to trick a user into giving up information or performing an unsafe action. You combat these risks by raising user awareness. Implement acceptable use policies (AUPs) to ensure users know what they should and should not be doing. Use logon banners to remind users of the AUP. Send out occasional e-mails with security tidbits to keep security in their minds. Use posters in employee areas.
3. Using the workstation domain, define risks associated within that domain and explain what can be done to reduce risks in that domain?
Some of the primary risks associated with workstations are related to malware. Users can bring malware from home on Universal Serial Bus (USB) flash disks. They can accidentally download malware from Web sites. They can also install malware from malicious e-mails. The primary protection is to ensure that you install antivirus (AV) software. Additionally, you need to update AV signatures regularly. You can’t depend on the users to keep their signatures up to date. Instead, you must take control of the process. Many AV vendors provide tools to automatically install and update AV software on workstations. You must also be sure to keep operating systems up to date. When security patches become available, they should be evaluated and deployed when needed. Many of these security patches remove vulnerabilities. Without the patch, the systems remain vulnerable.
4. List four compliance laws, regulations, or mandates, and explain them?
Health Insurance Portability and Accountability Act (HIPAA)
HIPAA applies to any organization that handles health information. The obvious organizations that handle health information are hospitals and doctor’s offices. However, HIPAA reaches much farther than the medical industry. Health information includes any data that relates to the health of individuals. This includes the past, present, and future health of individuals. It includes their condition, physical health, or mental health. It also includes any past, present, or future payments for health care. If any organization creates or receives health information, it must comply with HIPAA. This includes employers. It includes health plan sponsors, health care providers, public health authorities, and more.
Sarbanes-Oxley Act (SOX)
The SOX Act applies to any business that is required to be registered with the Securities and Exchange Commission. This is any publicly traded company. In other words, if someone can buy stocks for your company, then SOX applies. SOX establish a set of standards. Even if they don’t apply directly to private businesses, private businesses can use these same standards. If organizations face legal issues later, they can point to their actions as good faith efforts to avoid the problems. Federal Information Security Management Act (FISMA)
FISMA applies to all U.S. federal agencies. The goal is to ensure that federal agencies take steps to protect their data. If you work in a federal agency, FISMA applies.
The NIST is tasked by FISMA to develop standards, guidelines, and best practices to support FISMA. Special publications created by NIST for FISMA are available publically.
Family Educational Rights and Privacy Act (FERPA)
FERPA applies to all education institutions and agencies that receive funding under any program administered by the U.S. Department of Education (ED).
The obvious examples are any public schools from grades K through 12. However, many other entities can receive funding from ED. This includes any school or agency offering preschool programs. It includes any institution of higher education. It can also include community colleges or any other education institution.
Children’s Internet Protection Act (CIPA)
CIPA applies to any school or library that receives funding from the U.S. E-Rate program. The Federal Communications Commission (FCC) sponsors the E-Rate program. It provides discounts for Internet access. Schools and libraries are not required to use the E-Rate program. However, if they choose to take advantage of the discounts, they are governed by CIPA. The annual E-Rate application requires schools and libraries to certify they are complying with CIPA.
Payment Card Industry Data Security Standard (PCI DSS)
PCI DSS is not a law. Instead, it is a standard that was jointly created by several credit card companies. Any organization that accepts credit card payments over the Internet needs to comply with PCI DSS..
5. Define risk with formula. Explain what each variable means?
One of the methods you can use to determine if countermeasures overlap is to map the countermeasure to threat/vulnerability pairs. Chapter 1 covered matching threats with
Vulnerabilities to help determine a risk. You may remember the following formula:
Risk = Threat × Vulnerability
Risk = Threat × Vulnerability isn’t a mathematical formula. In other words, you don’t assign numerical values to threats and vulnerabilities to determine a numerical value for risk. Instead, it shows that risks occur when vulnerability is a weakness, and by itself it does not present a risk.
Similarly, threats by themselves do not present a risk. A risk occurs when a threat exploits vulnerability. Countermeasures either reduce or eliminate the impact of the threat or the vulnerability, or threats and vulnerabilities are combined.