Your company decides to start the business of selling toys online and shipping globally as a strategic move. You are going to be designated as the program manager for the E-commerce program that is sponsored by the COO and tasks an in-house development team to develop the E-commerce system to support the new business. Which of the following is most critical to your success?
A. Competent team
B. Communicated Policy
C. Executable strategy
D. Documented program plan
As a security professional, we don’t implement security controls for no reason. We have specific control objectives to achieve by implementing security controls as risk treatments to enforce the CIA security objectives (confidentiality, integrity, and availability).
Control objectives direct the planning, implementation, and evaluation of security controls. They provide specific targets for auditors to evaluate the effectiveness of security controls. Besides, they can be classified so that risk practitioners can identify risks based on the taxonomy; for example, Compliance, Financial Reporting, Strategic, Operations, or Unknown.
We implement a security control as a risk treatment measure to achieve certain security objectives; therefore, It is common to classify security controls based on security objectives. The categorization of administrative, technical, and physical are the most well-known as it is mentioned in HIPAA.
For example, given two questions as follows:
The control objective of question No. 1 lies in mediating logical access to “information” though authentication on the computer device, e.g., fingerprint, while the control objective of question No. 2 is controlling physical access to “information systems” or “facilities.”
If we categorize security controls based on the target assets to be protected that are primary components of the security objective, we can conclude that the answer to the first question is technical, while the second is physical. That’s why technical controls are also known as logical controls compared with the physical controls.
So, is a biometric-based system a technical or physical control?
The following two posts are worth your thoughts:
Your company decides to start the business of selling toys online and shipping globally. An in-house development team is tasked to develop the E-commerce system to support the new business. As a security professional and a member of the project team, you want to ensure the use of secure information system development processes. Which of the following provides practices or guidelines that best meet your requirements?
A. Agile
B. ISO 15288
C. NIST SP 800-160 Volume 1
D. CMMI
Your company decides to start the business of selling toys online and shipping globally. A newly recruited developer, Jack, is hired because of a critical algorithm published in his graduate thesis. He joined the in-house development team and developed a software component for shopping cart analysis from scratch that copied the idea from his previous company, which claims to have the patent of the algorithm. As a security professional, which of the following is the most concern?
A. Trademark
B. Trade secret
C. Patent
D. Copyright
The HIPAA Security Rule defines certain safeguards as “the technology and the policy and procedures for its use that protect electronic protected health information and control access to it.” Which of the following best describes the category or type of the safeguard mentioned above?
A. Directive
B. Management
C. Technical
D. Logical
You are sitting for the CISSP exam. An agreement is displayed on the screen requiring that you, as an exam taker, cannot share any content of the exam with others. After reviewing it, you click “I agree” and proceed to start the exam. Which of the following best describes your behavior?
A. Accountability
B. Digital signature
C. Due care
D. Due diligence
According to the Health Insurance Portability and Accountability Act of 1996 (HIPAA), the safeguards are grouped into three categories: administrative, physical, and technical.
The Centers for Medicare & Medicaid Services (CMS) issues regulations, known as the Privacy Rule and Security Rule, to specify security controls applicable to those entities covered by HIPAA.
The Privacy Rule, primarily, addresses how PHI (Protected Health Information) can be used and disclosed, while the Security Rule, as a subset of the Privacy Rule, applies specifically to electronic PHI or ePHI.
The Security Rule defines administrative safeguards as, “administrative actions, and policies and procedures, to manage the selection, development, implementation, and maintenance of security measures to protect electronic protected health information and to manage the conduct of the covered entity’s workforce in relation to the protection of that information.”
The Security Rule defines technical safeguards as “the technology and the policy and procedures for its use that protect electronic protected health information and control access to it.”
The Security Rule defines physical safeguards as “physical measures, policies, and procedures to protect a covered entity’s electronic information systems and related buildings and equipment, from natural and environmental hazards, and unauthorized intrusion.”
以下針對聯合新聞網的報導表達我的看法. 該報導是2019-12-18 10:18聯合報 主筆室在聯合新聞網的文章, 標題是:【重磅快評】歐盟將核能納入綠色轉型是蔡英文的噩耗.
Your company decides to start the business of selling toys online and shipping globally. The software development is conducting threat modeling and identifies a misuse case that an attacker can manipulate the backend database by sending XML messages through HTTP POST. Which of the following vulnerability should be fixed first?
A. SQL Injection
B. XML External Entities (XEE)
C. Broken Authentication
D. Cross-Site Request Forgery (CSRF)
