Is3445 Essay

Dennis Thomas
IS4550
UNIT 9 LAB 9: ASSESS AND AUDIT AN EXISTING IT SECURITY POLICY FRAMEWORK DEFINITION
1. What is the purpose of having a policy framework definition as opposed to individual policies? It is a set of principles and long-term goals that form the basis of making rules and guidelines, and to give overall direction to planning and development of the organization. 2. When should you use a policy definition as means of risk mitigation and element of a layered security strategy? When implementing a new Policy

3. In you gap analysis of the IT security policy framework definitions provided, which policy definition was missing from all access to various IT systems, applications, and data throughout the scenario? Data Access Policy 4. Do you need policies for you telecommunication and Internet service providers? Yes

5. Which policy definitions from the list provided in lab#9-part B helps optimize performance of an organization’s internet connection? Asset Identification and Classification Policy

6. What is the purpose of a Vulnerability Assessment & Management Policy for an IT infrastructure? It identifies, quantifies, and prioritizes (or ranking) the vulnerabilities in a system

7. Which policy definition helps achieve availability goals for data recovery when data is lost or corrupted? Threat Assessment and Management Policy

8. Which policy definitions reference a Data Classification Standard and use of cryptography for confidentiality purposes?
Asset Management Policy

9. Which policy definition from the sample IT security policy framework definition mitigates risk in thee User Domain?
Security Awareness Training Policy

10. Which Policy definition from the sample IT security policy framework definition mitigates risk in the LAN-to-WAN Domain?
Vulnerability Assessment and Management Policy

11. How does