Question

As part of the Security Monitoring guidelines presented in the FFIEC's Information Technology Examination Handbook for Information Security, an examiner would look for certain steps that should have been taken by the organization. Essentially, the examiner is looking to gain assurance that the organization has an adequate risk mitigation strategy in place with respect to keeping information secure. Which of the following steps in an organization's security monitoring process would provide the examiner with the assurance:

1. Respond to intrusions and other security events and weaknesses to mitigate risk to the organization and its customers, and to restore system.
2. Monitor network and host activity to identify policy violations and anomalous behavior.
3. Monitor host and network conditions to identify authorized access and other conditions that decrease the risk of intrusion or other security events.
4. Analyze results of monitoring to identify, classify, escalate, report, and guide responses to security events.

a. 1, 2, 3, & 4
b. 2 & 3
c. 1, 2, & 4
d. 1, 3, & 4

Answer 1

The steps in an organization's security monitoring process that provide assurance to the examiner are: responding to security events, monitoring network and host activity, monitoring host and network conditions, and analyzing results of monitoring. The correct answer is d.

Step-by-step explanation:

The correct answer is d. 1, 3, & 4. These steps in an organization's security monitoring process would provide the examiner with assurance that the organization has an adequate risk mitigation strategy in place:

1. Respond to intrusions and other security events and weaknesses to mitigate risk to the organization and its customers, and to restore system.
2. Monitor host and network conditions to identify authorized access and other conditions that decrease the risk of intrusion or other security events.
3. Analyze results of monitoring to identify, classify, escalate, report, and guide responses to security events.

These steps demonstrate a comprehensive approach to security monitoring, addressing the identification, response, and analysis of security events and weaknesses.