Questions and Answers > New York UniversityCSCI-SHU MISCMidterm 2 Spring


New York UniversityCSCI-SHU MISCMidterm 2 Spring ...[Show More]

Preview 1 out of 8 pages
Purchase this document to unlock the blurred part and the rest of the document

Unlock Now

Reviews( 0 )

Unlock this Document

Purchase the document to unlock it.

Free

Login

7
1

Category: Questions and Answers
Number of pages: 8
Language: English
Last updated: 1 year ago
Downloads: 1
Views: 7

Can't Find what you want?

PLACE CUSTOM WRITING ORDER

Related documents


6 Pages

Questiontt
21 marks) On slide 35 of Lecture 7, some examples of possible security performance measurements were offered. Please read the first 2 pages (pp. 48-49) of the attached paper titled "Metrics for Information Security Vulnerabilities". The paper offers some criteria for defining a good metric. Are there any metrics from slide 35, Lecture 7, which in your opinion do not meet the criteria of Repeatability and Easiness? If so, why? (Slide 35 of Lecture 7) Table 7-4 Examples of possible security performance measurements •Percentage of the organization's information systems budget devoted to InfoSec •Percentage of high vulnerabilities mitigated within organizationally defined time periods after discovery •Percentage space of remote access points used to gain unauthorized access •Percentage of information systems personnel who have received security training •Average frequency of audit records review and analysis for inappropriate activity •Percentage of new systems that have completed C&A prior to their implementation •Percentage of approved and implemented configuration changes identified in the latest automated baseline configuration •Percentage of information systems that have conducted annual contingency plan testing •Percentage of users with access to shared accounts •Percentage of incidents reported within required time frame per applicable incident category •Percentage of system components that undergo maintenance in accordance with formal maintenance schedules •Percentage of media that passes sanitization procedures testing •Percentage of physical security incidents allowing unauthorized entry into facilities containing information assets •Percentage of employees who are authorized access to information systems only after they sign an acknowledgement that they have read and understood the appropriate policies •Percentage of individuals screened before being granted access to organizational information and information systems •Percentage of vulnerabilities remediated within organizationally specified time frames •Percentage of system and service acquisition contracts that include security requirements and/or specifications •Percentage of mobile computers and devices that perform all cryptographic operations using organizationally specified cryptographic modules operating in approved modes of operations •Percentage of operating system vulnerabilities for which patches have been applied or that have been otherwise mitigated.