Chapter 4 Answers to Review Questions

CHAPTER SOLUTIONS > Chapter 4 Answers to Review Questions

Pearson Institute of Higher Education CS IT212 1. How can a security framework assist in the design and implementation of a security infrastructure? What is information security governance? Who in the organization should plan for it? Designing a working plan for securing the organization’s information assets begins by creating or validati ...[Show More]

Pearson Institute of Higher Education
CS IT212
1. How can a security framework assist in the design and implementation of a security

infrastructure? What is information security governance? Who in the organization should plan for

it?

Designing a working plan for securing the organization’s information assets begins by creating or

validating an existing security blueprint for the implementation of needed security controls. A

framework is the outline from which a more detailed blueprint evolves. The blueprint is the basis

for the design, selection, and implementation of all subsequent security policies, education and

training programs, and technologies. The blueprint provides scalable, upgradeable, and

comprehensive security for the coming years. The blueprint is used to plan the tasks to be

accomplished and the order in which to proceed.

Information security governance is the application of corporate governance principles to an

organization’s information security. This process is authorized by policy from senior management

and usually carried out by senior IT and information security executives, such as the CIO and

CISO.

2. Where can a security administrator find information on established security frameworks?

A security administrator can look to the following sources among the many established security

frameworks available:

 Information Technology—Code of Practice for Information Security Management, ISO

17799/BS 7799

 The NIST Security Models, including SP 800-12, -14, -18, -26, and -30

3. What is the ISO 27000 series of standards? Which individual standards make up the series?

One of the most widely referenced security models is the Information Technology—Code of

Practice for Information Security Management, which was originally published as British

Standard BS7799. In 2000, this Code of Practice was adopted as ISO/IEC 17799, an international

standard framework for information security by the International Organization for Standardization

(ISO) and the International Electrotechnical Commission (IEC). The document was revised in

2005 to become ISO 17799:2005, and it was then renamed as ISO 27002 in 2007 to align it with

ISO 27001. Other standards in the series include:

27000 Series Overview and Terminology

27003 Information Security Management Systems Implementation Guidelines

27004 Information Security Measurements and Metrics

27005 ISMS Risk Management

27006 Requirements for Bodies Providing Audit and Certification of an ISMS

4. What are the inherent problems with ISO 17799, and why hasn’t the United States adopted it?

What are the recommended alternatives?

The problems include:

 The global information security community has not defined any justification for a code of

practice identified in ISO/IEC 17799.

 ISO/IEC 17799 lacks “the necessary measurement precision of a technical standard.”

 There is no reason to believe that ISO/IEC 17799 is more useful than any other available

approach.

 ISO/IEC 17799 is not as complete as other available frameworks.

 ISO/IEC 17799 is perceived to have been hurriedly prepared, given the tremendous impact its

adoption could have on industry information security controls.

The recommended alternative is to use the many documents available from the Computer Security

Resource Center of the National Institute for Standards and Technology (NIST). These documents

are publicly available at no charge and have been for some time, so they have been broadly

reviewed by government and industry professionals.