CST339 - Ch 09

Which of the following are common hiring issues according to security employment practices?

• Detailed job descriptions that include information that describes access privileges grant to the (successful) applicant

• Avoiding secure and restricted sites during interview sessions that includes a tour

• Background check conducted after extending an offer to a candidate

• Not requiring any periodic security awareness training

Termination issues: Which of the following does not need to be performed?

• Employee return all removable media

• Keycard access be revoked

• Business cards returned

• Personal effects be removed from the premise

Which factors influence on the treatment of a departure as friendly or hostile?

• Nature of new company they joining

• Nature job of last job/role in the current company

• Relationship with the HR/Management

• Random

Why do we need a two-man rule?

• To prevent accidental/intentional leaks of information

• To ensure more jobs for the citizens

• Double up staff count for a department/task

From a security standpoint , access to information

for these individuals should be limited to what is

necessary to perform their duties

• HR Officers

• Temporary Workers

• Top Management

• CEO

Costs

and benefits and performance of InfoSec are

impossible to measure!

• True

• False

What are the THREE common types of InfoSec performance management measurements?

• Those that determine the effectiveness of the execution of InfoSec policy

• Those that determine the effectiveness of the design of InfoSec policy

• Those that determine the effectiveness of the delivery of InfoSec services

• Those that assess the impact of an incident

It is sufficient to collect InfoSec measurements once.

• True

• False

Which of the following CANNOT be done via Benchmarking ?

• Determine how controls from another similar organization should be implemented in own organization

• Look at paths taken by similar organizations in deriving own security blueprint

• Generate security blueprint by drawing from established security models and frameworks

• Offload the security risks to a third-party

What is standards of due diligence?

• Adherence to the minimal level of security to establish a future legal defence

• Adherence to implemented standards that meet the required level of protection

• Being diligents in all aspects of setting up a standard