foreign [Music]
okay so the second session for this evening is on security policies and standards this is part two
and our first question involves SQL injections your network administrator wants to mitigate the
potential risk of SQL injection attacks as much as possible which of the following is the best
route they could take all right take a moment look at your choices and make your selections
okay
so we have lots of choices for answer C
that is enable input validation and that is the correct answer here um applying host server OS
updates uh changing login passwords these are not effective to mitigate SQL injection attacks
are neither is enabling https input validation is in fact the way to mitigate the risk or potential
risk of SQL injections attacks as much as possible okay all right let's move on to the next question
okay all of the following are true about an mou except for what
should the following statements
is not true about memorandum of understanding
okay we have several responses in the chat let's see what you're thinking
Okay so
yes we have choices or B
okay
all right so again
these statements all of these statements about mou are true except for one of them
which one is not true
so questions that involve
what something is not are often a little more difficult
um only from the perspective that we are so used to studying what something is okay so
and the way this is worded makes it I think maybe a little more difficult all of the following
is true or are true about an mou except for what except one of these Okay so
memorandum of understanding is typically a less formal agreement
okay so not legally binding do you think that is a true statement or not a true statement
you see another vote for B it's not involved The Exchange okay all right so
not legally binding if that's true then that's not the answer we're looking for okay
um now even though it's a less formal agreement it's still an agreement between two parties
so that statement's true what about does not involve the exchange of money is that true
it's a less formal agreement
okay
so typically with the exchange of money we're looking at something contractual and signed by the
appropriate parties okay so does not involve the exchange of money that is a true statement about
mousse that leaves us with the correct answer summarizes the work or responsibilities assigned
okay all right now looking back at the chat a lot of you chose answer Choice B
and we have sort of a question not sort of we do have a question that is asking for the exception
okay so it's kind of you know a nut situation but then you have that same situation and one
of the answers does not involve the exchange of money okay so again you really need to be
careful when it comes to questions like this make sure you read the question twice and make sure
you understand what you are being asked for and that's just good General test taking tip no matter
which certification exam you may be sitting for okay Let's uh let's move on to the next question
okay
an organizations corporate audit and security employees
need to investigate and discover any discrepancies in employee activity
which policy should they enforce so that they are able to complete this task with enough time
okay let's take a moment and look at the answer choices and make your selections
Okay so we've had a couple responses
for Choice C access policies
okay so we're looking for discrepancies in employee activity
okay
anybody else want to weigh in before we go over the correct answer
okay so for this question the policy that should be enforced is mandatory vacation policy
and this policy is sometimes used as a security control okay so what the intent is
is to sort of keep an individual from having exclusive use of a system and by periodically
enforcing that the individual takes the vacation they then relegate control of the system to
someone else okay so it's a kind of detective control and that is the correct answer okay
so credential management is not the correct answer these protections these policies for production
of credentials can sometimes involve you know besides credential management the strategies
can be eliminating vulnerabilities or securing employee devices teaching employees to recognize
credential phishing attacks um administrator credential policy is also not correct
um this refers to admin accounts or root accounts right and the Mandate that
um for example credentials are different from one system to another especially passwords so
that if one account is compromised uh several others are not and then access policy defines
the level of access for users so the correct answer here is mandatory vacation policy
okay let's go to the next question
okay Ryan one of your co-workers has empty food wrappers soda cans and even stacks
of sensitive customer data on his desk what security policy is Ryan violating
okay so there's a couple of answers that stand out is pretty obviously wrong
uh and then there's something in the question I think that leads you to the correct answer
okay so we have several responses in the chat let's see what you're thinking
okay d c d e c okay one two three four five so out of these five
choices we had two votes for C which is the correct answer clean desk policy okay
so empty food wrappers soda cans and of course the the real giveaway here stacks of sensitive
customer data on his desk okay so yeah this is a violation of the clean desk policy
in fact it is the description is an antithesis of what a clean desk would be all right
next question some of this dirty practices
okay the I.T Department of Karen's organization decides to test their
employees by sending out a phishing email with a malicious link that tracks whoever clicks on it
the results show that 87 of the 100 employees clicked on the fake URL 87 percent
what could have prevented that many people from falling for this attack
this is another one of those questions I think that you really like to see
because and I think that everybody agrees with me it's pretty obvious
and yeah yeah so this is this is a situation of user security awareness um
this is just one of those things that has to be done certainly for people in the business that
is what all of you are intent upon doing um some things that we see all the time
are or become obvious because we have so much exposure to them but somebody whose job
is completely out of this field it basically is using the computer systems as a tool may not be as
aware and therefore it is up to you know the I.T Department to make sure that employees get proper
and not just inundated with training but the proper user awareness training so yeah okay
let's move on to the next question
okay
which of the following is not a necessary procedure when off-boarding thank you
so here again you're being asked which one of these is not necessary
okay we have about five responses in the chat and let's see what people are thinking
okay it looks like everybody's voting for answer Choice C
e activate personal emails and that is the correct Choice
um disabling user accounts and privileges is absolutely necessary um doing the best
that you can to make sure that whoever's being off boarded is not in possession of information assets
um and then wiping employee-owned devices of corporate data and applications these are all
common sense it seems good and good things to do certainly deactivating personal emails or contact
information yeah that's the correct answer for this question okay let's move on to the next
which term describes a gamified training event where Learners must discover Point
baits point-based tokens within a live Network or scripted Q and A game environment gee
okay I think this one's pretty obvious too it might even say that it's what
we're doing right now okay so yeah the correct answer here is capture the flag
um and that's exactly uh what you're looking at here with these questions they are Point
based and this is the preaching the Cyber range CTF fun stuff okay let's move on to the next one
okay which security principle states that a user should be allocated the minimum necessary
rights privileges or information to perform his or her role and no more
okay lots of responses in the chat
and for Choice answer Choice B least privilege and that is correct this does
not involve a code of conduct or separation of duties or standard operating procedures
this is the principle of least privilege
okay so um segregation of duties could look like a correct answer basically it ensures
that employees don't have access to systems that will lead to conflicts of interest fraud or abuse
okay so the correct answer again least privilege all right let's go on to the next question
a company's employee just got a new social media account they have a lot of friends
that work in the same field of business what is the biggest security risk in this situation
okay take a moment look at your answer choices and make your selections
okay so an employee gets a new social media account
and they have a lot of friends that work in the same type of business
so that's pretty much the big clue here
so when it comes to security
what's the weakest link in the chain
what do you think
the end user sure the human element right
and
even if it is not malicious
okay um what do we like to do what do we like to talk about with our friends
uh and especially if they do what we do
yeah over sharing talk about work what we do maybe something interesting that happened
okay all right so the answer choices the employee's email address will be added into
a database for random subscriptions no not not really a concern uh answer Choice C others can
see the employee's IP address while they're at work using the social media account okay
um that's really not going to be representative of a big security risk an attacker can post on
the employee's I guess account acting as them I mean that can be a problem
but it really boils down to sort of human nature here the employee could engage on
the site too much and expose the company's intellectual property um I mentioned earlier that
the intent does not have to be malicious and I can speak from experience to this point thinking back
to my early days as a software engineer and I was working on a particularly interesting project for
a company called flexible manufacturing systems and we were engaged with building an autonomous
guided vehicles and you know this this was the coolest thing I think I'd ever seen in my life
um this was in the late you know mid to late 80s and um this vehicle was just
off the chain it was not Guided by paint stripes on the floor or wires buried in the floor was
free-ranging and it was just like I said the slickest piece of technology I'd ever seen and
you know so myself and some of the other software Engineers we'd go out after work and you know have
some something to eat and you know I mean it just it just would come out I mean we talk about other
things but the first things that usually came from Miles were the events of the day or you know how
part of the project that we were working on was turning out or maybe some of the challenges um
that we were coming across and you know this was all done in in the spirit of you know camaraderie
and you know possibly even getting someone else's opinion on you know what was going on
um but when I think back to this sitting in in the restaurant having these conversations
sometimes they get quite animated and fact of the matter is you don't know who's sitting around you
and you know maybe you know in the excitement of of having these great discussions with your
colleagues you know even though they work on other parts of the project you could have been exposing
um proprietary information and so there's no malicious intent but you know that was human
nature to have these kinds of discussions so anyhow let's move on to the next question
okay which of the following is the information security standard for organizations that process
credit or bank card payments okay so hopefully everybody knows this one
okay lots of responses very quick
and all per Choice D so D is correct
so PCI DSS payment card industry data security standard okay set of security standards formed
in 2004 by Visa Mastercard Discover Financial Services JCB International and American Express
um the standard is administered by the payment card industry security standards Council
and it's use mandated by the different card brands so this is the correct answer
um IEEE Institute of electrical and electronic Engineers um that's a Professional Organization
not the correct answer statement on standards for attestation engagements is a set of Standards
governing service organizations security practices Choice B and that is not correct
and then Phipps is federal information processing standards uh refers to a series of computer
security standards developed by the federal government United States federal government in
line with federal information security management Act and approved by the Secretary of Commerce
so PCI DSS payment card industry data security standard correct answer okay
a company that is located in Paris France is complying with the gdpr when dealing with what
okay take a second look at your choices and make your selections
okay so we have some choices in the chat let's see looks like we have votes for b c and B okay so
vulnerability assessments personal data protection financial services and separating workloads for
performance and load balancing okay this is an example of a more knowledge based question uh
the um key to this is understanding what gdpr is and that is the general data protection regulation
this gdpr introduces rules for organizations that offer goods and services to people in the
European Union so this is very much involved with personal data protection okay all right so the
again if you if you know that much of it then you would go right to personal data protection
understanding that workloads separating workloads for performance and load balancing balancing load
balancing and vulnerability assessments are you know more technical answers not involved with this
uh Financial Services personal data protection would be the remaining two but again understanding
a little bit about gdpr would lead you right to the solution of personal data protection okay
okay HIPAA the date of privacy framework protects Health Care data for which of the following
it looks like they're all for answer D all options are correct so protecting personal
health care data for storage reading and data in transit and yes all options are correct
okay so that one's I think fairly easy as well all right let's move on to the next question
as the corporate ciso a new industry security compliance certification you're pursuing requires
that you implement a new corporate security policy regarding smartphone usage for business purposes
before writing the policy what is a good first step
all right take a second look at the choices and make your selection
okay
all right so we've got some responses in the chat see what you're thinking a b a a
okay so it looks like the bulk of the choices in
the chat are voting for get the legal Department's opinion first
okay so we can look at answer Choice C which states issue compliance smartphones to all
employees and that's definitely putting the cart before the horse so to speak
pass the rough draft to the policy out to the employees no that's obviously wrong
the question States before writing the policy so C and D clearly wrong A and B are the two
that you have to decide between and for the Chief Information Security Officer
you're going to be discussed with management and get their write-off
because you need to have something to show the legal department before you can get their opinion
and yes always important to ensure upper management is on board and aware of policies
prior to Creation well said so correct answer is Choice B okay all right very good okay
now the next question
next question
yes which of the following is based on s t i x and t a x i i standards
okay take a look at this and make your selection
okay so as before with at least one other question the one involving gdpr
you need to know um what these two clever acronyms stand for
so Stix structured threat information expression sticks if you will
t-a-x-i-i or maybe we will just say taxi trusted automated exchange of intelligence information
so what are they involved with
okay so we have a couple of responses
okay so we have three responses in the chat let's see what's on your mind A A and C okay two votes
for a a vote for C all right so the correct answer here is automated indicator sharing okay
and so basically um the structured threat information or Stakes defines
the what if you will of a Potential Threat and taxi defines how the information is transmitted
and so the point here is to you know make these things easily available
and so this is done because the um outputs are machine readable automated
and can easily be integrated into systems now when you look at this question and these responses
one of these and I'm talking now about answer Choice D vulnerability databases
um hopefully you've seen this enough that an organization
will come to mind fairly quickly when you see that what organization am I talking about
okay so concerning vulnerability databases um I'm talking about the miter Corporation
so you've got that yes cve right common vulnerabilities and exposures and that's miter
so knowing that you can eliminate Choice d uh pretty quickly that leaves threat maps and filer
code repositories so file and code repositories websites that contain a list of common exploits or
threats against product okay and they typically publish the compose code or compiled files
so again not involved with stakes and taxi and threat maps are what you can see just go by
going in and doing a search for you know real-time attack Maps or something of that nature all right
let's see yeah CBD right so automated indicator sharing is the correct answer let's move on
okay this looks like last question for this section
which of the following statements below is true regarding gdpr okay we're going to revisit this
for a second take a moment read your answer choices carefully and then make your selections
okay we've got several responses in the chat
there's two boats for a e let's see
and a couple more votes for a all right I have a lot of people voting for a it seems okay wow
General data protection regulation is a European Union
deal okay so a is incorrect it applies to EU personnel
okay
so a is not correct
and B is not correct
Choice C gdpr applies to EU data subjects but does not apply to
American companies that collect or process the personal data of people in EU countries
this answer is stated is also not correct but if we took out the word not
and we say gdpr applies to EU data subjects and applies to American companies that collect
or process the personal data of people in EU countries that would be a correct statement
but for this question the correct answer gdpr applies to European
Union data subjects that does not apply to American data subjects okay all right
Okay so that perhaps up this section on security policies and standards part two