INTRODUCTION – Security Frameworks and Controls

TEST YOUR KNOWLEDGE: MORE ABOUT FRAMEWORKS AND CONTROLS

1. How do security frameworks enable security professionals to help mitigate risk?

2. Competitor organizations are the biggest threat to a company’s security.

3. Fill in the blank: Security controls are safeguards designed to reduce _____ security risks.

4. A security analyst works on a project designed to reduce the risk of vishing. They developed a plan to protect their organization from attackers who could exploit biometrics. Which type of security control does this scenario describe?

TEST YOUR KNOWLEDGE: THE CIA TRIAD

1. What is the CIA triad?

2. Which element of the CIA triad specifies that only authorized users can access specific information?

3. A security analyst discovers that certain data is inaccessible to authorized users, which is preventing these employees from doing their jobs efficiently. The analyst works to fix the application involved in order to allow for timely and reliable access. Which element of the CIA triad does this scenario describe?

4. Fill in the blank: According to the CIA triad, _____ refers to ensuring that an organization’s data is verifiably correct, authentic, and reliable.

5. Fill in the blank: The CIA triad is a model that helps inform how organizations consider _____ when setting up systems and security policies.

TEST YOUR KNOWLEDGE: NIST FRAMEWORKS

1. What is the National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF)?

2. Fill in the blank: The five core functions that make up the CSF are: identify, protect, detect, _____, and recover.

3. Fill in the blank: The CSF _____ function relates to monitoring systems and devices in an organization’s internal network to help security teams manage potential cybersecurity risks and their effects.

4. What does a security analyst’s work involve during the CSF recover function?

TEST YOUR KNOWLEDGE: OWASP PRINCIPLES AND SECURITY AUDITS

1. A security analyst disables certain software features to reduce the potential vulnerabilities that an attacker could exploit at their organization. Which OWASP security principle does this scenario describe?

2. Fill in the blank: A security _____ is a review of an organization’s security controls, policies, and procedures against a set of expectations.

3. A security professional closely examines their organization’s network, then evaluates potential risks to the network. Their goal is to ensure internal safeguards and processes are effective. What security concept does this scenario describe?

4. A security professional is asked to communicate the results of an internal security audit to stakeholders. What should be included in that communication? Select three answers.

PORTFOLIO ACTIVITY: CONDUCT A SECURITY AUDIT

1. You reviewed the scope, goals, and risk assessment report.

2. You considered risks to Botium Toys’ customers, employees, and/or assets, based on controls and compliance best practices that are or are not currently implemented.

3. You reviewed the control categories document.

4. You selected “yes” or “no” for each control listed.

5. You selected “yes” or “no” for each compliance best practice.

MODULE 2 CHALLENGE

1. What is the purpose of a security framework?

2. Which of the following characteristics are examples of biometrics? Select all that apply.

3. Which of the following statements accurately describe the CSF? Select all that apply.

4. A security team establishes controls, including permission settings that will be used to create multiple security points that a threat actor must get through to breach their organization. Which OWASP principle does this scenario describe?

5. What are some of the primary objectives of an internal security audit? Select all that apply.

6 Fill in the blank: In an internal security audit, _____ involves identifying potential threats, risks, and vulnerabilities in order to decide what security measures should be implemented.

7. A security analyst performs an internal security audit. They determine that the organization needs to install surveillance cameras at various store locations. What are they working to establish?

8. What information is typically communicated to stakeholders after completion of an internal security audit? Select three answers.

9. How do organizations use security frameworks to develop an effective security posture?

10. Fill in the blank: A security professional uses _____ to convert data from a readable format to an encoded format.

11. You work as a security analyst for a community organization that has large amounts of private data. Which core principle of the CIA triad do you use to ensure private information is kept safe?

12. A security team considers how to avoid unnecessarily complicated solutions when implementing security controls. Which OWASP principle does this scenario describe?

13. Fill in the blank: The planning elements of an internal security audit include establishing scope and _____, then conducting a risk assessment.

14. What information is typically communicated to stakeholders after completion of an internal security audit? Select three answers.

15. What does a security professional use to create guidelines and plans that educate employees about how they can help protect the organization?

16. Fill in the blank: An employee using multi-factor authentication to verify their identity is an example of the _____ process.

17. What are some of the primary objectives of an internal security audit? Select all that apply.

18. You work as a security analyst at a bank and need to ensure that customers can access their account information. Which core principle of the CIA triad are you using to confirm their data is accessible to them?

19. Which of the following statements accurately describe the CSF? Select all that apply.

20. A security team has just finished addressing a recent security incident. They now conduct tests to ensure that all of their repairs were successful. Which OWASP principle does this scenario describe?

21. A security analyst performs an internal security audit. They focus on the human component of cybersecurity, such as the policies and procedures that define how their company manages data. What are they working to establish?

22. What information is typically communicated to stakeholders after completion of an internal security audit? Select three answers.

23. Fill in the blank: A security professional uses _____ to verify that an employee has permission to access a resource.

24. Fill in the blank: In an internal security audit, _____ refers to identifying people, assets, policies, procedures, and technologies that might impact an organization’s security posture.