IAS1 - LAP3

What is the primary purpose of the investigation phase in the SecSDLC?

• To implement security measures immediately.

• To conduct a post-implementation review.

• To develop training programs for staff.

• To gather and analyze requirements for security needs.

How does the logical design phase contribute to information security?

• It eliminates the need for data encryption in the system.

• It prioritizes performance over security measures in the architecture.

• It focuses solely on user interface design without considering security.

• It establishes a framework for data management and integrates security measures into the system architecture.

What key policies are examined during the logical design phase?

• Data visualization techniques

• Data integrity, security policies, access control, normalization standards, backup and recovery procedures.

• Network architecture standards

• User interface design principles

What is continuity planning in the context of SecSDLC?

• Continuity planning is about creating new security processes from scratch.

• Continuity planning ensures the resilience of security processes during disruptions in the SecSDLC.

• Continuity planning eliminates the need for security measures in SecSDLC.

• Continuity planning focuses solely on financial aspects of SecSDLC.

Why is incident response planning important in security projects?

• It helps in creating more security incidents.

• It is primarily focused on employee training.

• Incident response planning is important because it enables organizations to effectively manage and mitigate the impact of security incidents.

• It is only necessary for compliance purposes.

What are the typical directives from upper management during the investigation phase?

• Ignore feedback from stakeholders

• Focus solely on budget constraints

• Limit communication to only key personnel

• Gather data, ensure compliance, maintain communication, allocate resources, establish timelines.

How does the SecSDLC differ from the traditional SDLC?

• SecSDLC incorporates security at every phase, while traditional SDLC treats security as a separate or later phase.

• Traditional SDLC includes security in the initial planning phase.

• SecSDLC eliminates the need for security measures entirely.

• SecSDLC is only applicable to software development, not to other projects.

What outcomes are expected from the investigation phase?

• Expected outcomes include a defined problem statement, requirements documentation, and a list of potential solutions.

• A list of team members involved

• A timeline for project completion

• A summary of the final report

What factors are considered in the budget for a security project?

• Office supplies

• Travel costs

• Marketing expenses

• Personnel costs, equipment expenses, training costs, maintenance fees, compliance requirements, contingency funds.

What steps should be taken in the event of a catastrophic loss?

• Start a fire to attract attention

• Ignore the situation and wait for help

• Ensure safety, assess damage, notify emergency services, contact insurance, begin recovery efforts.

• Leave the area without informing anyone