During the security review of a legacy business application, it was discovered that sensitive client data is not encrypted in storage, which does not comply with the organization’s information security policy. Which of the following would be the information security manager’s BEST course of action?
Answer(s): C
The BEST way to ensure that security settings on each platform are in compliance with information security policies and procedures is to:
Answer(s): B
Security baselines will provide the best assurance that each platform meets minimum criteria. Penetration testing will not be as effective and can only be performed periodically. Vendor default settings will not necessarily meet the criteria set by the security policies, while linking policies to an independent standard will not provide assurance that the platforms meet these levels of security.
A web-based business application is being migrated from test to production. Which of the following is the MOST important management signoff for this migration?
Answer(s): A
As owners of the system, user management signoff is the most important. If a system does not meet the needs of the business, then it has not met its primary objective. The needs of network, operations and database management are secondary to the needs of the business.
The BEST way to ensure that information security policies are followed is to:
The best way to ensure that information security policies are followed is to periodically review levels of compliance. Distributing printed copies, advertising an abuse hotline or linking policies to an international standard will not motivate individuals as much as the consequences of being found in noncompliance.Escalating penalties will first require a compliance review.
The MOST appropriate individual to determine the level of information security needed for a specific business application is the:
Answer(s): D
Data owners are the most knowledgeable of the security needs of the business application for which they are responsible. The system developer, security manager and system custodian will have specific knowledge on limited areas but will not have full knowledge of the business issues that affect the level of security required. The steering committee does not perform at that level of detail on the operation.
Post your Comments and Discuss ISACA CISM exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the CISM content, but please register or login to continue.