Exam 2: Planning and Policy

Which of the following gives the best estimate of the complete cost of a compromise?

Strong security can be an enabler, allowing a company to do things it could not do otherwise.

The FTC can ________.

What security function(s) usually is(are) not outsourced?

An example of "pressure" from the fraud triangle would include paying back embezzled money.

Conducting stings on employees ________.

Which of the following is a good rule for handling exceptions?

Border management ________.

Placing IT auditing in an existing auditing department would give independence from IT security.

________ means responding to risk by not taking a risky action.

Exceptions in policies and procedures should be forbidden.

________ audits are done by an organization on itself.

Having realistic goals for reducing vulnerabilities ________.

Once a company's resources are enumerated, the next step is to ________.

When someone requests to take an action that is potentially dangerous, what protection should be put into place?

Independence is best provided for IT security by placing it within the IT department.

The book recommends hard-headed thinking about security ROI analysis.

The FTC can act against companies that fail to take reasonable precautions to protect privacy information.

Policies should be written by ________.

Security professionals should minimize burdens on functional departments.