You work in the IT department of a medium-sized company. Confidential information has got into the wrong hands several times. This has hurt the image of the company. You have been asked to propose…

Question

Options

• AFormulate a policy regarding mobile media (PDAs, laptops, smartphones, USB sticks)
• BAppoint security personnel
• CEncrypt the hard drives of laptops and USB sticks
• DSet up an access control policy

• A
  69% (18)
• B
  19% (5)
• C
  8% (2)
• D
  4% (1)

Explanation

Policy comes before implementation. When addressing a systemic security problem, you must first establish a formal policy (A) because it defines the rules, scope, and acceptable use standards that all other measures will be built upon - without a governing policy, any technical or personnel controls lack authority and consistency.

• B (Appoint security personnel) is premature: security staff enforce a policy, but if no policy exists yet, they have nothing to enforce.
• C (Encrypt hard drives) is a technical control - a valid measure, but one that should be mandated by the policy, not implemented before it.
• D (Set up access control) is also a technical/procedural control that flows from the policy, not a starting point.

Memory tip: Think of security measures as a house - the policy is the blueprint. You draw the blueprint before you hire contractors (B), install locks (D), or add a security system (C). If someone asks "what's the first step?" the answer is almost always the governing policy or framework.

No community discussion yet for this question.