S3110 Risk Management in Information Technology Security Quiz Quiz Questions 1. Define an SLA and state why it is required in a risk adverse organization. A SLA is a service level agreement, which is a contract between the ISP and the company. A SLA gives the company an idea of how much time they will be without services, should something happen with the ISP. A SLA is important to a company in making recovery plans, knowing what critical systems need to be available for a continuance of business and formulation of disaster recovery.
2. Using the user domain, define risks associated with users and explain what can be done to mitigate them. The user domain has several risks involved, as people are involved and there is no way employees can be monitored without the use of CCTV, Social engineering a person trying to obtain information through malicious means. The greatest tool in mitigating risk in the user domain is training and reminders for users to be aware of their surroundings. No acceptable users policy, AUP, or lack of training employees on the correct usage of the network. User accounts left active, if the employee is terminated, and another employee has the log on credentials. Mitigation would to be disabling all user accounts upon termination.
3. Using the workstation domain, define risks associated within that domain and explain what can be done to reduce risks in that domain. The use of USBs or disk, the files could contain viruses and infect other files or applications on the network. No acceptable users policy, AUP, or lack of training employees on the correct usage of the network. There is a susceptible to malicious software, and you can mitigate it by downloading the proper antivirus software.
4. List four compliance laws or regulations or mandates, and explain them. a. Federal Information Security Management Act (FISMA) 2002 its purpose is to