TRUE/FALSE QUESTIONS:

1. Because the responsibility for IT security is shared across the organization, there is a risk of inconsistent implementation of security and a loss of central monitoring and control.

2. A major disadvantage of the baseline risk assessment approach is the significant cost in time, resources, and expertise needed to perform the analysis.

3. A threat may be either natural or human made and may be accidental or deliberate.

4. To ensure that a suitable level of security is maintained, management must follow up the implementation with an evaluation of the effectiveness of the security controls.

5. Detection and recovery controls provide a means to restore lost computing resources.

6. Physical access or environmental controls are only relevant to areas housing the relevant equipment.

7. Once in place controls cannot be adjusted, regardless of the results of risk assessment of systems in the organization.

8. It is likely that the organization will not have the resources to implement all the recommended controls.

9. The selection of recommended controls is not guided by legal requirements.

10. The implementation phase comprises not only the direct implementation of the controls, but also the associated training and general security awareness programs for the organization.

11. Appropriate security awareness training for all personnel in an organization, along with specific training relating to particular systems and controls, is an essential component in implementing controls.

12. Security architecture, and which controls you elect to put in place, should be risk-based and driven by business needs, expressed in policy.

13. For the cost effect, Commercial organizations and federal agencies tend to have a simple security architecture, whether explicit or not.

14. The ISO/IEC 27000 series is much more commonly applied in government than in commercial organizations.

15. Management should set a simple policy direction in line with business plans and demonstrate support for, and commitment to, IT security through the issue and maintenance of an IT security policy across the organization.

16. Access to information, information processing facilities, and business processes should be controlled on the basis of employees requirements.

17. Access control rules should take account of policies for information dissemination and authorization.

18. NIST Special Publication 800-53 Recommended Security Controls for Commercial Information Systems.

19. The primary characteristic of the SABSA model is that everything must be derived from an analysis of the users requirements for security.

20. COBIT includes best practices, measures, and processes organizations can implement to standardize (and theoretically improve) IT management.

21. Threats are attacks carried out.

22. Computer security is protection of the integrity, availability, and confidentiality of information system resources.

23. Data integrity assures that information and programs are changed only in a specified and authorized manner.

24. Availability assures that systems works promptly and service is not denied to authorized users.

25. The A in the CIA triad stands for authenticity.

26. Computer security is essentially a battle of wits between a perpetrator who tries to find holes and the administrator who tries to close them.

27. Many security administrators view strong security as an impediment to efficient and user-friendly operation of an information system.

28. Hardware is the most vulnerable to attack and the least susceptible to automated controls.

29. Contingency planning is a functional area that primarily requires computer security technical measures.

30. X.800 architecture was developed as an international standard and focuses on security in the context of networks and communications.

31. Assurance is the process of examining a computer product or system with respect to certain criteria.

32. One of the most influential computer security models is the Bell-LaPadula model.

33. The BLP model effectively breaks down when (untrusted) low classified executable data are allowed to be executed by a high clearance (trusted) subject.

34. The Biba models deals with confidentiality and is concerned with unauthorized disclosure of information.

35. Multilevel security is of interest when there is a requirement to maintain a resource in which multiple levels of data sensitivity are defined.

36. The addition of multilevel security to a database system does not increase the complexity of the access control function.

37. The Common Criteria for Information Technology and Security Evaluation are ISO standards for specifying security requirements and defining evaluation criteria.

38. Organizational security objectives identify what IT security outcomes should be achieved.

39. The assignment of responsibilities relating to the management of IT security and the organizational infrastructure is not addressed in a corporate security policy.

40. It is critical that an organizations IT security policy have full approval or buy-in by senior management.