- Welcome to Lesson 23: Deep Dive Quiz.
Lesson 23 was about summarizing
effective security governance.
And in 23.1 we talked about governance structures
and in 23.2 we talked about governance documents.
So are you ready for a five question quiz?
Pen, paper, pencil, whatever you're using,
be sure you have it handy.
And really, put me on pause as often as you need to
so that you take the time to answer these questions.
All right, let's get started.
An action that a prudent person
would have exercised under the same
or similar conditions.
Is this stewardship?
Due diligence?
Fiduciary?
Or due care?
Said that this was a legal construct.
The actions that a prudent person
would have exercised under the same
or similar conditions.
Stewardship, due diligence, a fiduciary, or due care.
What do you like?
You can put me on pause if you wanna think about it.
Well, let's go through these.
A stewardship is really the care,
taking care of something that's been entrusted to you.
Due diligence is the act of doing an investigation.
We've talked about due diligence
at the beginning of a relationship,
during the lifetime of a relationship,
and definitely if whenever a contract has to be resigned.
A fiduciary is a legal responsibility, right?
For whatever you have been entrusted with.
But due care is really the legal standard
that a prudent person would have exercised
under the same or similar condition.
So I'm going with due care.
Do you like it?
Let's check.
And that is correct.
Match the organizational role and the description.
And we have four roles down the left-hand side,
a compliance officer, internal audit,
the chief information security officer,
or executive management.
On the right-hand side we have:
independently assesses the control environment;
identifies applicable statutory, regulatory,
and contractual requirements;
that the responsibilities include budgeting,
value delivery, and resource optimization;
or manages the information security program.
Let's start with that one 'cause that's the easy one, right?
Manages the information security program.
Is that compliance, internal audit,
a chief security officer, or executive management?
Yeah, for sure.
Chief information security officer.
if you wanna put me on pause, don't forget to do so.
All right, let's go.
What do we have next?
Independently assesses the control environment.
Well, who do we know has to be independent
in our organization?
Audit.
Audit will always be independent.
Even if they're internal audit,
they will still be independent.
They have to follow specific audit standards.
All right, well now we have two choices here.
Identifies applicable statutory, regulatory,
and contractual compliant requirements,
or responsible for budgeting, value delivery,
and resource optimization.
Well, I think they're already in the right place.
The compliance officer identifies applicable statutory,
regulatory, and contractual requirements.
An executive management, among other things,
is responsible for budgeting, value delivery,
and resource optimization.
So going through these,
a compliance officer identifies applicable statutory,
regulatory, and contractual requirements.
Internal audit independently assesses
the control environment.
The chief information security officer
manages the information security program.
And executive management is responsible,
among other things, for budgeting, value delivery,
and resource optimization.
You agree?
Let's try it.
And that's correct.
All right, question three.
In which type of governance document
would you most likely find a statement,
"password complexity must include uppercase,
lowercase, and at least one symbol"?
Is that gonna be in a standard,
a guideline, a procedure,
or a baseline?
Password complexity must include uppercase,
lowercase, and one symbol.
Standard, guideline, procedure, or baseline?
Well, that sounds a lot to me
like mandatory implementation details.
So I'm gonna choose, it's a standard.
A guideline helps me either implement a policy
or implement a standard,
but a guideline is not mandatory.
A guideline is really optional.
It's guidance, that's where the word guideline comes from.
A procedure would be step-by-step.
So if the document told me how to create
that password step-by-step,
I could think of it as a procedure.
And a baseline is when we combine
a number of different standards for a particular grouping.
And that grouping could be a platform,
it could be a location, it could be a type of device.
So, I really like standard.
How about you?
Let's check.
And that is correct.
All right, question four.
This agreement should clearly state handling standards,
explanation of monitoring, and limitation of privacy.
Is this the acceptable use policy agreement,
the nondisclosure agreement, a service level agreement,
or a remote access agreement?
Now, this is the one that I said
I wish didn't have the word policy in it, right?
But it's going to clearly state
the handling standards, how we handle information
at different classification levels,
the explanation of how we might be monitored,
and the limitation of our privacy.
Well, let's start at the bottom.
A remote access agreement, right,
is only going to be applicable to remote access
and it will go to anyone who's using remote access,
but it's very specific.
An SLA, a service level agreement,
is an agreement we have with our vendors
about a level of service.
So the expectation of service.
A nondisclosure agreement, that's an NDA,
also called a confidentiality agreement.
We use that to protect data.
The one that we like here,
acceptable use policy agreement, right?
Because the document is called the acceptable use policy
and the corresponding agreement would be
the acceptable use policy agreement.
Did you get that one?
All right, let's check.
And that's correct.
All right, you wanna read this one carefully.
The information security strategy
should be endorsed by the:
CEO,
CISO,
Board of Directors,
the Information Security Steering Committee, or equivalent?
The word endorsed here is important.
There's a difference between endorsed and authorized.
And you wanna be looking for these kind of keywords
in your questions in the exam.
So who should endorse it?
The CEO,
the CISO,
the Board of Directors,
or the Information Security Steering Committee?
Hmm, think about that for a moment.
Well ultimately, it's going to need to be approved
by the board of directors
and we definitely hope the CISO likes it.
But the endorsement should really come
from the Information Security Steering Committee.
Why? Because that's going to be business managers
from across the spectrum.
And once you get their endorsement,
now you've got their buy-in,
now it's gonna go up to the board of directors
or board of trustees or equivalent
and get authorized.
But it will come to the table with their endorsement
and their support.
So Information Security Steering Committee.
And again, the key here was the word endorsed
versus the word authorized.
You agree?
Let's check.
And we are correct.
Great job.
All right, we're gonna keep moving on lesson 24.
We're gonna explain the elements
of the risk management process.
See you there.