COSC 4361 Chapter 9 Security Management Practices

1. Using a practice called baselining, you are able to develop policy based on the typical practices of the industry in which you are working.

• True
• False

2. A company striving for best security practices' makes every effort to establish security program elements that meet every minimum standard in their industry.

• True
• False

3. One question you should ask when choosing among recommended practices is "Can your organization afford to implement the recommended practice?"

• True
• False

4. Performance measurements are seldom required in today's regulated InfoSec environment.

• True
• False

5. Attaining certification in security management is a long and difficult process, but once attained, an organization remains certified for the life of the organization.

• True
• False

6. One of the critical tasks in the measurement process is to assess and quantify what will be measured and how it is measured.

• True
• False

7. The biggest barrier to baselining in InfoSec is the fact that many organizations do not share warnings with other organizations.

• True
• False - benchmarking

8. A comprehensive assessment of a system's technical and nontechnical protection strategies, as specified by a particular set of requirements is known as accreditation.

• True
• False - certification

9. Standardization is an an attempt to improve information security practices by comparing an organization's efforts against those of a similar organization or an industry-developed standard to produce results it would like to duplicate.

• True
• False - benchmarking

10. The authorization by an oversight authority of an IT system to process, store, or transmit information is known as certification.

• True
• False - accredation