Cybersecurity: Module 3

The process of defining and specifying the long-term direction (strategy) to be taken by an organization, and the allocation and acquisition of resources needed to pursue this effort.

Sometimes used synonymously with objectives; the desired end of a planning cycle.

The documented product of strategic planning; a plan for the organization’s intended strategic efforts over the next several years.

Sometimes used synonymously with goals; the intermediate states obtained to achieve progress toward a goal or goals.

The documented product of tactical planning; a plan for the organization’s intended tactical efforts over the next few years.

The documented product of operational planning; a plan for the organization’s intended operational efforts on a day-to-day basis for the next several months.

The actions taken by management to specify the intermediate goals and objectives of the organization in order to obtain specified strategic goals, followed by estimates and schedules for the allocation of resources necessary to achieve those goals and objectives.

The actions taken by management to specify the short-term goals and objectives of the organization in order to obtain specified tactical goals, followed by estimates and schedules for the allocation of resources necessary to achieve those goals and objectives.

“The set of responsibilities and practices exercised by the board and executive management with the goal of providing strategic direction, ensuring that objectives are achieved, ascertaining that risks are managed appropriately and verifying that the enterprise’s resources are used responsibly.”

Executive management’s responsibility to provide strategic direction, ensure the accomplishment of objectives, oversee that risks are appropriately managed, and validate responsible resource use.

The application of the principles of corporate governance to the information security function.

A detailed statement of what must be done to comply with policy, sometimes viewed as the rules governing policy compliance. If the policy states that employees must “use strong passwords, frequently changed,” the standard might specify that the password “must be at least 8 characters, with at least one number, one letter, and one special character.”

A standard that has been widely adopted or accepted by a public group rather than a formal standards organization.

A standard that has been formally evaluated, approved, and ratified by a formal standards organization.

Nonmandatory recommendations the employee may use as a reference in complying with a policy.

Step-by-step instructions designed to assist employees in following policies, standards, and guidelines.

Examples of actions that illustrate compliance with policies.

Written instructions provided by management that inform employees and others in the workplace about proper behavior regarding the use of information and information assets.

The high-level information security policy that sets the strategic direction, scope, and tone for all of an organization’s security efforts.

An organizational policy that provides detailed, targeted guidance to instruct all members of the organization in the use of a resource, such as one of its processes or technologies.

Organizational policies that often function as standards or procedures to be used when configuring or maintaining systems.

A systems-specific security policy that expresses management’s intent for the acquisition, implementation, configuration, and management of a particular technology, written from a business perspective.

A type of systems-specific security policy that expresses technical details for the acquisition, implementation, configuration, and management of a particular technology, written from a technical perspective. Typically the policy includes details on configuration rules, systems policies, and access control.

Specifications of authorization that govern the rights and privileges of users to a particular information asset.

A lattice-based access control with rows of attributes associated with a particular subject (such as a user).

An integration of access control lists (focusing on assets) and capability tables (focusing on users) that results in a matrix with organizational assets listed in the column headings and users listed in the row headings; contains ACLs in columns for a particular device or asset and capability tables in rows for a particular user.

The instructions a system administrator codes into a server, networking device, or security device to specify how it operates.

An employee responsible for the creation, revision, distribution, and storage of a policy in an organization.

A component of policy or law that defines an expected end date for its applicability.

A managerial program designed to improve the security of information assets by providing targeted knowledge, skills, and guidance for an organization’s employees.

In information security, a framework or security model customized to an organization, including implementation details.

In information security, a specification of a model to be followed during the design, selection, and initial and ongoing implementation of all subsequent security controls, including information security policies, security education and training programs, and technological controls.

A well-recognized information security framework, usually promoted by a government agency, standards organization, or industry group.