Can you include a section at the bottom which summarises some of the key activities from the exercise "Configuring Examples of Security Control Types". The lab uses windows folder access permissions to control user access based on active directory groups like "domain_users" and "domain_admins" - Controlling user folder access in thie way is a *preventative control*. Windows local security policy can be used to implement file and folder access logging which is a form of *detective control* file and folder auditing can also be used to log deletions. The exercise also uses local security policy to create a logon banner message which is used to remind users that access to the machine is subject to the AUP, this warning serves as a *directive control* encouraging compliance with the AUP. The exercise then demonstrates 2 *corrective controls*. The first is built into windows and automatically recovers from a crash using what is commonly known as the blue screen of death BSOD. The second is a script which uses powershell SigVerif to detect changes in an important file and return the file to its proper state when a change is detected.
Chapter Title Slide
Understand the multidisciplinary nature of Information Security
Understand the CISO role
List some of the management roles in Information Security
List some of the Technical and Non-Technical roles in Information Security
Chapter Summary Slide
There is no single person who can cover all responsibilities
There is no single department that can cover all responsibilities
Cyber Security risk is managed in different ways
By individuals with different skills
Who form part of different teams
Cyber Security is a team effort
Overall Responsibility lies with:
CIO
Chief Information Officer
Enable business growth through technology
CISO
Chief Information Security Officer
Ensures technology is secure
Historically the CISO has reported to the CIO
Some organisations allow direct reporting to the CEO or board
Executive Cyber Security Roles
Both set strategy and direction
Represent their domain (IT or security) at the board level
Are accountable for risk, compliance, and long…
