[Jul 06, 2024] Valid SSCP Test Answers & SSCP Exam PDF
Valid ISC Certification SSCP Dumps Ensure Your Passing
Why do you need to take the ISC SSCP Certification?
ISC SSCP, a certification from International Information Systems Security Certification Consortium, is one of the biggest leading international qualifications for security professionals. Most of the people thing It's hard to pass, but you can do it by practicality from SSCP Dumps. The ISC SSCP is recognized and supported by industry experts and governments worldwide. ISC SSCP demonstrates technical knowledge and skills in cyber security. The ISC SSCP credentials measure an individual professional level of competence to perform one or more of the following tasks: installation, operations, and troubleshooting of network systems designing network architecture providing network administration, intrusion detection/prevention system administration, security policy development, and implementation.
ISC SSCP allows you to demonstrate your expertise in key areas such as Infrastructure Protection Planning (threat analysis), Security Architecture & Engineering (system use lifecycle), Protection Mechanisms Design (access controls, physical security, cryptography), Operations Security (accountable anonymity, information security management systems), and Detection & Response (vulnerability assessments, forensics). ISC SSCP certification is highly respected in the industry and has fame. It is recognized and supported by major employers including HP, IBM, Symantec. ISC SSCP is also recognized by governments like the US Department of Defense (DoD) and Immigration New Zealand. Certification helps greatly to establish your credibility. After getting success with the aid of SSCP Dumps, you can also be eligible for project or job opportunities that require ISC SSCP certification qualification. This certification is accredited under ISO/IEC Standard 17024:2012 General Requirements for Bodies Operating Certification Systems.
The SSCP certification is an excellent way for IT professionals to demonstrate their expertise in the field of cybersecurity. System Security Certified Practitioner (SSCP) certification covers a wide range of topics and is recognized globally, making it an ideal choice for anyone looking to advance their career in this field. With the demand for cybersecurity professionals increasing, the SSCP certification is an excellent way to stand out from the crowd and demonstrate your ability to protect your organization’s critical assets.
NEW QUESTION # 497
Which of the following tape formats can be used to backup data systems in addition to its original intended audio uses?
- A. Digital Analog Tape (DAT).
- B. Digital Audio Tape (DAT).
- C. Digital Video Tape (DVT).
- D. Digital Voice Tape (DVT).
Answer: B
Explanation:
Digital Audio Tape (DAT) can be used to backup data systems in addition to its original intended audio uses.
NEW QUESTION # 498
Which of the following statements is most accurate regarding a digital signature?
- A. It is a method used to encrypt confidential data.
- B. It is the art of transferring handwritten signature to electronic media.
- C. It allows the recipient of data to prove the source and integrity of data.
- D. It can be used as a signature system and a cryptosystem.
Answer: C
Explanation:
Source: TIPTON, Hal, (ISC)2, Introduction to the CISSP Exam presentation.
NEW QUESTION # 499
Which of the following service is not provided by a public key infrastructure (PKI)?
- A. Reliability
- B. Access control
- C. Integrity
- D. Authentication
Answer: A
Explanation:
A Public Key Infrastructure (PKI) provides confidentiality, access control, integrity, authentication and non-repudiation.
It does not provide reliability services.
NEW QUESTION # 500
Which integrity model defines a constrained data item, an integrity verification procedure and a transformation procedure?
- A. The Bell-LaPadula integrity model
- B. The Take-Grant model
- C. The Clark Wilson integrity model
- D. The Biba integrity model
Answer: C
Explanation:
The Clark Wilson integrity model addresses the three following integrity goals: 1) data is protected from modification by unauthorized users; 2) data is protected from unauthorized modification by authorized users; and 3) data is internally and externally consistent. It also defines a Constrained Data Item (CDI), an Integrity Verification Procedure (IVP), a Transformation Procedure (TP) and an Unconstrained Data item. The Bell-LaPadula and Take- Grant models are not integrity models.
NEW QUESTION # 501
Which of the following is NOT a property of a one-way hash function?
- A. Given a digest value, it is computationally infeasible to find the corresponding message.
- B. It is computationally infeasible to construct two different messages with the same digest.
- C. It converts a message of a fixed length into a message digest of arbitrary length.
- D. It converts a message of arbitrary length into a message digest of a fixed length.
Answer: C
Explanation:
An algorithm that turns messages or text into a fixed string of digits, usually for security or data management purposes. The "one way" means that it's nearly impossible to derive the original text from the string.
A one-way hash function is used to create digital signatures, which in turn identify and authenticate the sender and message of a digitally distributed message.
A cryptographic hash function is a deterministic procedure that takes an arbitrary block of data and returns a fixed-size bit string, the (cryptographic) hash value, such that an accidental or intentional change to the data will change the hash value. The data to be encoded is often called the "message," and the hash value is sometimes called the message digest or simply digest.
The ideal cryptographic hash function has four main or significant properties:
it is easy (but not necessarily quick) to compute the hash value for any given message it is infeasible to generate a message that has a given hash it is infeasible to modify a message without changing the hash it is infeasible to find two different messages with the same hash
Cryptographic hash functions have many information security applications, notably in digital signatures, message authentication codes (MACs), and other forms of authentication. They can also be used as ordinary hash functions, to index data in hash tables, for fingerprinting, to detect duplicate data or uniquely identify files, and as checksums to detect accidental data corruption. Indeed, in information security contexts, cryptographic hash values are sometimes called (digital) fingerprints, checksums, or just hash values, even though all these terms stand for functions with rather different properties and purposes.
Source:
TIPTON, Hal, (ISC)2, Introduction to the CISSP Exam presentation. and http://en.wikipedia.org/wiki/Cryptographic_hash_function
NEW QUESTION # 502
The basic language of modems and dial-up remote access systems is:
- A. Asynchronous Interaction.
- B. Synchronous Interaction.
- C. Asynchronous Communication.
- D. Synchronous Communication.
Answer: C
Explanation:
Explanation/Reference:
Asynchronous Communication is the basic language of modems and dial-up remote access systems.
Source: KRUTZ, Ronald L & VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, 2001, John Wiley & Sons, Page 100.
NEW QUESTION # 503
What is called the formal acceptance of the adequacy of a system's overall security by the management?
- A. Certification
- B. Accreditation
- C. Evaluation
- D. Acceptance
Answer: B
Explanation:
Accreditation is the authorization by management to implement software or systems in a production environment. This authorization may be either provisional or full.
The following are incorrect answers:
Certification is incorrect. Certification is the process of evaluating the security stance of the
software or system against a selected set of standards or policies. Certification is the
technical evaluation of a product. This may precede accreditation but is not a required
precursor.
Acceptance is incorrect. This term is sometimes used as the recognition that a piece of
software or system has met a set of functional or service level criteria (the new payroll
system has passed its acceptance test). Certification is the better tem in this context.
Evaluation is incorrect. Evaluation is certainly a part of the certification process but it is not
the best answer to the question.
Reference(s) used for this question:
The Official Study Guide to the CBK from ISC2, pages 559-560
AIO3, pp. 314 - 317
AIOv4 Security Architecture and Design (pages 369 - 372)
AIOv5 Security Architecture and Design (pages 370 - 372)
NEW QUESTION # 504
Which conceptual approach to intrusion detection system is the most common?
- A. Knowledge-based intrusion detection
- B. Behavior-based intrusion detection
- C. Statistical anomaly-based intrusion detection
- D. Host-based intrusion detection
Answer: A
Explanation:
Section: Analysis and Monitoring
Explanation/Reference:
There are two conceptual approaches to intrusion detection. Knowledge-based intrusion detection uses a database of known vulnerabilities to look for current attempts to exploit them on a system and trigger an alarm if an attempt is found. The other approach, not as common, is called behaviour-based or statistical analysis- based. A host-based intrusion detection system is a common implementation of intrusion detection, not a conceptual approach.
Source: KRUTZ, Ronald L. & VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, John Wiley & Sons, 2001, Chapter 3: Telecommunications and Network Security (page
63).
Also: HARRIS, Shon, All-In-One CISSP Certification Exam Guide, McGraw-Hill/Osborne, 2002, chapter 4:
Access Control (pages 193-194).
NEW QUESTION # 505
Which type of attack involves hijacking a session between a host and a target by predicting the target's choice of an initial TCP sequence number?
- A. IP spoofing attack
- B. TCP sequence number attack
- C. Smurf attack
- D. SYN flood attack
Answer: B
Explanation:
A TCP sequence number attack exploits the communication session which was established between the target and the trusted host that initiated the session. It involves hijacking the session between the host and the target by predicting the target's choice of an initial TCP sequence number. An IP spoofing attack is used to convince a system that it is communication with a known entity that gives an intruder access. It involves modifying the source address of a packet for a trusted source's address. A SYN attack is when an attacker floods a system with connection requests but does not respond when the target system replies to those requests. A smurf attack occurs when an attacker sends a spoofed (IP spoofing) PING (ICMP ECHO) packet to the broadcast address of a large network (the bounce site). The modified packet containing the address of the target system, all devices on its local network respond with a ICMP REPLY to the target system, which is then saturated with those replies.
NEW QUESTION # 506
At which layer of ISO/OSI does the fiber optics work?
- A. Data link layer
- B. Transport layer
- C. Network layer
- D. Physical layer
Answer: D
Explanation:
Section: Network and Telecommunications
Explanation/Reference:
The Answer: Physical layer The Physical layer is responsible for the transmission of the data through the physical medium. This includes such things as cables. Fiber optics is a cabling mechanism which works at Physical layer of OSI model All of the other answers are incorrect.
The following reference(s) were/was used to create this question:
Shon Harris all in one - Chapter 7 (Cabling)
NEW QUESTION # 507
Which type of attack involves impersonating a user or a system?
- A. Spamming attack
- B. Smurfing attack
- C. Spoofing attack
- D. Sniffing attack
Answer: C
Explanation:
Section: Network and Telecommunications
Explanation/Reference:
A spoofing attack is when an attempt is made to gain access to a computer system by posing as an authorized user or system. Spamming refers to sending out or posting junk advertising and unsolicited mail. A smurf attack is a type of denial-of-service attack using PING and a spoofed address. Sniffing refers to observing packets passing on a network.
Source: KRUTZ, Ronald L. & VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, John Wiley & Sons, 2001, Chapter 3: Telecommunications and Network Security (page
77).
NEW QUESTION # 508
What works as an E-mail message transfer agent?
- A. SNMP
- B. S-RPC
- C. S/MIME
- D. SMTP
Answer: D
Explanation:
SMTP (Simple Mail Transfer Protocol) works as a message transfer agent. Source: HARRIS, Shon, All-In-One CISSP Certification Exam Guide, McGraw-Hill/Osborne, 2001, Page 821.
NEW QUESTION # 509
What does the simple integrity axiom mean in the Biba model?
- A. No read up
- B. No read down
- C. No write down
- D. No write up
Answer: B
Explanation:
Section: Access Control
Explanation/Reference:
The simple integrity axiom of the Biba access control model states that a subject at one level of integrity is not permitted to observe an object of a lower integrity (no read down).
Source: KRUTZ, Ronald L. & VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, John Wiley & Sons, 2001, Chapter 5: Security Architectures and Models (page 205).
NEW QUESTION # 510
Which of the following can best be defined as a cryptanalysis technique in which the analyst tries to determine the key from knowledge of some plaintext-ciphertext pairs?
- A. A chosen-plaintext attack
- B. A known-algorithm attack
- C. A chosen-ciphertext attack
- D. A known-plaintext attack
Answer: D
Explanation:
RFC2828 (Internet Security Glossary) defines a known-plaintext attack as a cryptanalysis technique in which the analyst tries to determine the key from knowledge of some plaintext-ciphertext pairs (although the analyst may also have other clues, such as the knowing the cryptographic algorithm). A chosen-ciphertext attack is defined as a cryptanalysis technique in which the analyst tries to determine the key from knowledge of plaintext that corresponds to ciphertext selected (i.e., dictated) by the analyst. A chosen-plaintext attack is a cryptanalysis technique in which the analyst tries to determine the key from knowledge of ciphertext that corresponds to plaintext selected (i.e., dictated) by the analyst. The other choice is a distracter.
The following are incorrect answers: A chosen-plaintext attacks The attacker has the plaintext and ciphertext, but can choose the plaintext that gets encrypted to see the corresponding ciphertext. This gives her more power and possibly a deeper understanding of the way the encryption process works so she can gather more information about the key being used. Once the key is discovered, other messages encrypted with that key can be decrypted.
A chosen-ciphertext attack In chosen-ciphertext attacks, the attacker can choose the ciphertext to be decrypted and has access to the resulting decrypted plaintext. Again, the goal is to figure out the key. This is a harder attack to carry out compared to the previously mentioned attacks, and the attacker may need to have control of the system that contains the cryptosystem.
A known-algorithm attack Knowing the algorithm does not give you much advantage without knowing the key. This is a bogus detractor. The algorithm should be public, which is the Kerckhoffs's Principle . The only secret should be the key.
Reference(s) used for this question:
Source: SHIREY, Robert W., RFC2828: Internet Security Glossary, may 2000. and Harris, Shon (2012-10-25). CISSP All-in-One Exam Guide, 6th Edition (p. 866). McGraw-Hill. Kindle Edition. and Kerckhoffs's Principle
NEW QUESTION # 511
What kind of Encryption technology does SSL utilize?
- A. Public Key
- B. Hybrid (both Symmetric and Asymmetric)
- C. Private key
- D. Secret or Symmetric key
Answer: B
Explanation:
SSL use public-key cryptography to secure session key, while the session key (secret key) is used to secure the whole session taking place between both parties communicating with each other.
The SSL protocol was originally developed by Netscape. Version 1.0 was never publicly released; version 2.0 was released in February 1995 but "contained a number of security flaws which ultimately led to the design of SSL version 3.0." SSL version 3.0, released in 1996, was a complete redesign of the protocol produced by Paul Kocher working with Netscape engineers Phil Karlton and Alan Freier.
All of the other answers are incorrect
NEW QUESTION # 512
What can best be described as an abstract machine which must mediate all access to subjects to objects?
- A. The reference monitor
- B. The security perimeter
- C. A security domain
- D. The security kernel
Answer: A
Explanation:
The reference monitor is an abstract machine which must mediate all access to subjects to objects, be protected from modification, be verifiable as correct, and is always invoked. The security kernel is the hardware, firmware and software elements of a trusted computing base that implement the reference monitor concept. The security perimeter includes the security kernel as well as other security-related system functions that are within the boundary of the trusted computing base. System elements that are outside of the security perimeter need not be trusted.
A security domain is a domain of trust that shares a single security policy and single management.
NEW QUESTION # 513
Which of the following statements pertaining to ethical hacking is incorrect?
- A. Ethical hacking should not involve writing to or modifying the target systems negatively.
- B. Ethical hackers never use tools that have the potential of affecting servers or services.
- C. Testing should be done remotely to simulate external threats.
- D. An organization should use ethical hackers who do not sell auditing, hardware, software, firewall, hosting, and/or networking services.
Answer: B
Explanation:
Section: Analysis and Monitoring
Explanation/Reference:
This means that many of the tools used for ethical hacking have the potential of exploiting vulnerabilities and causing disruption to IT system. It is up to the individuals performing the tests to be familiar with their use and to make sure that no such disruption can happen or at least shoudl be avoided.
The first step before sending even one single packet to the target would be to have a signed agreement with clear rules of engagement and a signed contract. The signed contract explains to the client the associated risks and the client must agree to them before you even send one packet to the target range. This way the client understand that some of the test could lead to interruption of service or even crash a server. The client signs that he is aware of such risks and willing to accept them.
The following are incorrect answers:
An organization should use ethical hackers who do not sell auditing, hardware, software, firewall, hosting, and/ or networking services. An ethical hacking firm's independence can be questioned if they sell security solutions at the same time as doing testing for the same client. There has to be independance between the judge (the tester) and the accuse (the client).
Testing should be done remotely to simulate external threats Testing simulating a cracker from the Internet is often time one of the first test being done, this is to validate perimeter security. By performing tests remotely, the ethical hacking firm emulates the hacker's approach more realistically.
Ethical hacking should not involve writing to or modifying the target systems negatively. Even though ethical hacking should not involve negligence in writing to or modifying the target systems or reducing its response time, comprehensive penetration testing has to be performed using the most complete tools available just like a real cracker would.
Reference(s) used for this question:
KRUTZ, Ronald L. & VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, John Wiley & Sons, 2001, Appendix F: The Case for Ethical Hacking (page 520).
NEW QUESTION # 514
Companies can now be sued for privacy violations just as easily as they can be sued for security compromises.
- A. False
- B. True
Answer: B
NEW QUESTION # 515
Kerberos depends upon what encryption method?
- A. El Gamal cryptography.
- B. Secret Key cryptography.
- C. Blowfish cryptography.
- D. Public Key cryptography.
Answer: B
Explanation:
Kerberos depends on Secret Keys or Symmetric Key cryptography.
Kerberos a third party authentication protocol. It was designed and developed in the mid 1980's by MIT. It is considered open source but is copyrighted and owned by MIT. It relies on the user's secret keys. The password is used to encrypt and decrypt the keys.
This question asked specifically about encryption methods. Encryption methods can be SYMMETRIC (or secret key) in which encryption and decryption keys are the same, or ASYMMETRIC (aka 'Public Key') in which encryption and decryption keys differ.
'Public Key' methods must be asymmetric, to the extent that the decryption key CANNOT be easily derived from the encryption key. Symmetric keys, however, usually encrypt more efficiently, so they lend themselves to encrypting large amounts of data. Asymmetric encryption is often limited to ONLY encrypting a symmetric key and other information that is needed in order to decrypt a data stream, and the remainder of the encrypted data uses the symmetric key method for performance reasons. This does not in any way diminish the security nor the ability to use a public key to encrypt the data, since the symmetric key method is likely to be even MORE secure than the asymmetric method.
For symmetric key ciphers, there are basically two types: BLOCK CIPHERS, in which a fixed length block is encrypted, and STREAM CIPHERS, in which the data is encrypted one 'data unit' (typically 1 byte) at a time, in the same order it was received in.
The following answers are incorrect:
Public Key cryptography. Is incorrect because Kerberos depends on Secret Keys or Symmetric Key cryptography and not Public Key or Asymmetric Key cryptography.
El Gamal cryptography. Is incorrect because El Gamal is an Asymmetric Key encryption algorithm. Blowfish cryptography. Is incorrect because Blowfish is a Symmetric Key encryption algorithm.
NEW QUESTION # 516
Which of the following statements pertaining to disaster recovery planning is incorrect?
- A. A disaster recovery plan should cover return from alternate facilities to primary facilities.
- B. Every organization must have a disaster recovery plan
- C. The major goal of disaster recovery planning is to provide an organized way to make decisions if a disruptive event occurs.
- D. A disaster recovery plan contains actions to be taken before, during and after a disruptive event.
Answer: B
Explanation:
It is possible that an organization may not need a disaster recovery plan. An organization may not have any critical processing areas or system and they would be able to withstand lengthy interruptions.
Remember that DRP is related to systems needed to support your most critical business functions.
The DRP plan covers actions to be taken when a disaster occur but DRP PLANNING which is the keywork in the question would also include steps that happen before you use the plan such as development of the plan, training, drills, logistics, and a lot more.
To be effective, the plan would certainly cover before, during, and after the disaster actions.
It may take you a couple years to develop a plan for a medium size company, there is a lot that has to happen before the plan would be actually used in a real disaster scenario. Plan for the worst and hope for the best.
All other statements are true.
NOTE FROM CLEMENT: Below is a great article on who legally needs a plan which is very much in line with this question. Does EVERY company needs a plan? The legal answer is NO. Some companies, industries, will be required according to laws or regulations to have a plan. A blank statement saying: All companies MUST have a plan would not be accurate. The article below is specific to the USA but similar laws will exist in many other countries.
Some companies such as utilities, power, etc... might also need plan if they have been defined as Critical Infrastructure by the government. The legal side of IT is always very
complex and varies in different countries. Always talk to your lawyer to ensure you follow
the law of the land :-)
Read the details below:
So Who, Legally, MUST Plan?
With the caveats above, let's cover a few of the common laws where there is a duty to have
a disaster recovery plan. I will try to include the basis for that requirement, where there is
an implied mandate to do so, and what the difference is between the two
Banks and Financial Institutions MUST Have a Plan
The Federal Financial Institutions Examination Council (Council) was established on March
10, 1979, pursuant to Title X of the Financial Institutions Regulatory and Interest Rate
Control Act of 1978 (FIRA), Public Law 95-630. In 1989, Title XI of the Financial Institutions
Reform, Recovery and Enforcement Act of 1989 (FIRREA) established the Examination
Council (the Council).
The Council is a formal interagency body empowered to prescribe uniform principles,
standards, and report forms for the federal examination of financial institutions by the Board
of Governors of the Federal Reserve System (FRB), the Federal Deposit Insurance
Corporation (FDIC), the National Credit Union Administration (NCUA), the Office of the
Comptroller of the Currency (OCC), and the Office of Thrift Supervision (OTS); and to
make recommendations to promote uniformity in the supervision of financial institutions. In
other words, every bank, savings and loan, credit union, and other financial institution is
governed by the principles adopted by the Council.
In March of 2003, the Council released its Business Continuity Planning handbook
designed to provide guidance and examination procedures for examiners in evaluating
financial institution and service provider risk-management processes.
Stockbrokers MUST Have a Plan
The National Association of Securities Dealers (NASD) has adopted rules that require all its
members to have business continuity plans. The NASD oversees the activities of more
than 5,100 brokerage firms, approximately 130,800 branch offices and more than 658,770
registered securities representatives.
As of June 14, 2004, the rules apply to all NASD member firms. The requirements, which
are specified in Rule 3510, begin with the following:
3510. Business Continuity Plans. (a) Each member must create and maintain a written
business continuity plan identifying procedures relating to an emergency or significant
business disruption. Such procedures must be reasonably designed to enable the member
to meet its existing obligations to customers. In addition, such procedures must address the
member's existing relationships with other broker-dealers and counter-parties. The
business continuity plan must be made available promptly upon request to NASD staff.
NOTE:
The rules apply to every company that deals in securities, such as brokers, dealers, and
their representatives, it does NOT apply to the listed companies themselves.
Electric Utilities WILL Need a Plan
The disaster recovery function relating to the electric utility grid is presently undergoing a
change. Prior to 2005, the Federal Energy Regulatory Commission (FERC) could only
coordinate volunteer efforts between utilities. This has changed with the adoption of Title
XII of the Energy Policy Act of 2005 (16 U.S.C. 824o). That new law authorizes the FERC
to create an Electric Reliability Organization (ERO).
The ERO will have the capability to adopt and enforce reliability standards for "all users,
owners, and operators of the bulk power system" in the United States. At this time, FERC
is in the process of finalizing the rules for the creation of the ERO. Once the ERO is
created, it will begin the process of establishing reliability standards.
It is very safe to assume that the ERO will adopt standards for service restoration and
disaster recovery, particularly after such widespread disasters as Hurricane Katrina.
Telecommunications Utilities SHOULD Have Plans, but MIGHT NOT
Telecommunications utilities are governed on the federal level by the Federal
Communications Commission (FCC) for interstate services and by state Public Utility
Commissions (PUCs) for services within the state.
The FCC has created the Network Reliability and Interoperability Council (NRIC). The role
of the NRIC is to develop recommendations for the FCC and the telecommunications
industry to "insure [sic] optimal reliability, security, interoperability and interconnectivity of,
and accessibility to, public communications networks and the internet." The NRIC members
are senior representatives of providers and users of telecommunications services and
products, including telecommunications carriers, the satellite, cable television, wireless and
computer industries, trade associations, labor and consumer representatives,
manufacturers, research organizations, and government-related organizations.
There is no explicit provision that we could find that says telecommunications carriers must
have a Disaster Recovery Plan. As I have stated frequently in this series of articles on
disaster recovery, however, telecommunications facilities are tempting targets for terrorism. I have not changed my mind in that regard and urge caution.
You might also want to consider what the liability of a telephone company is if it does have a disaster that causes loss to your organization. In three words: It's not much. The following is the statement used in most telephone company tariffs with regard to its liability:
The Telephone Company's liability, if any, for its gross negligence or willful misconduct is not limited by this tariff. With respect to any other claim or suit, by a customer or any others, for damages arising out of mistakes, omissions, interruptions, delays or errors, or defects in transmission occurring in the course of furnishing services hereunder, the Telephone Company's liability, if any, shall not exceed an amount equivalent to the proportionate charge to the customer for the period of service during which such mistake, omission, interruption, delay, error or defect in transmission or service occurs and continues. (Source, General Exchange Tariff for major carrier)
All Health Care Providers WILL Need a Disaster Recovery Plan HIPAA is an acronym for the Health Insurance Portability and Accountability Act of 1996, Public Law 104-191, which amended the Internal Revenue Service Code of 1986. Also known as the Kennedy-Kassebaum Act, the Act includes a section, Title II, entitled Administrative Simplification, requiring "Improved efficiency in healthcare delivery by standardizing electronic data interchange, and protection of confidentiality and security of health data through setting and enforcing standards."
The legislation called upon the Department of Health and Human Services (HHS) to publish new rules that will ensure security standards protecting the confidentiality and integrity of "individually identifiable health information," past, present, or future.
The final Security Rule was published by HHS on February 20, 2003 and provides for a uniform level of protection of all health information that is housed or transmitted electronically and that pertains to an individual.
The Security Rule requires covered entities to ensure the confidentiality, integrity, and availability of all electronic protected health information (ePHI) that the covered entity creates, receives, maintains, or transmits. It also requires entities to protect against any reasonably anticipated threats or hazards to the security or integrity of ePHI, protect against any reasonably anticipated uses or disclosures of such information that are not permitted or required by the Privacy Rule, and ensure compliance by their workforce.
Required safeguards include application of appropriate policies and procedures, safeguarding physical access to ePHI, and ensuring that technical security measures are in place to protect networks, computers and other electronic devices. Companies with More than 10 Employees
The United States Department of Labor has adopted numerous rules and regulations in regard to workplace safety as part of the Occupational Safety and Health Act. For example, 29 USC 654 specifically requires:
(a)
Each employer:
(1)
shall furnish to each of his employees employment and a place of employment which are free from recognized hazards that are causing or are likely to cause death or serious physical harm to his employees;
(2)
shall comply with occupational safety and health standards promulgated under this Act.
(b)
Each employee shall comply with occupational safety and health standards and all rules, regulations, and orders issued pursuant to this Act which are applicable to his own actions and conduct.
Other Considerations or Expensive Research questions for Lawyers (Sorry, Eddie!)
The Foreign Corrupt Practices Act of 1977 Internal Revenue Service (IRS) Law for Protecting Taxpayer Information Food and Drug Administration (FDA) Mandated Requirements Homeland Security and Terrorist Prevention Pandemic (Bird Flu) Prevention ISO 9000 Certification Requirements for Radio and TV Broadcasters Contract Obligations to Customers Document Protection and Retention Laws Personal Identity Theft...and MORE!
Suffice it to say you will need to check with your legal department for specific requirements in your business and industry!
I would like to thank my good friend, Eddie M. Pope, for his insightful contributions to this article, our upcoming book, and my ever-growing pool of lawyer jokes. If you want more information on the legal aspects of recovery planning, Eddie can be contacted at my company or via email at mailto:[email protected]. (Eddie cannot, of course, give you legal advice, but he can point you in the right direction.)
I hope this article helps you better understand the complex realities of the legal reasons why we plan and wish you the best of luck
See original article at: http://www.informit.com/articles/article.aspx?p=777896
See another interesting article on the subject at: http://www.informit.com/articles/article.aspx?p=677910&seqNum=1
References used for this question:
KRUTZ, Ronald L. & VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, John Wiley & Sons, 2001, Chapter 8: Business Continuity Planning and Disaster Recovery Planning (page 281).
NEW QUESTION # 517
Which of the following prevents, detects, and corrects errors so that the integrity, availability, and confidentiality of transactions over networks may be maintained?
- A. Communications security management and techniques
- B. Client security management and techniques
- C. Information security management and techniques
- D. Server security management and techniques
Answer: A
Explanation:
Communications security and techniques are the best area for addressing this objective.
"Information security management and techniques" is incorrect. While the overall information security program would include this objective, communications security is the more specific and better answer.
"Client security management and techniques" is incorrect. While client security plays a part in this overall objective, communications security is the more specific and better answer.
"Server security management and techniques" is incorrect. While server security plays a part in this overall objective, communications security is the more specific and better answer.
NEW QUESTION # 518
......
SSCP Dumps Real Exam Questions Test Engine Dumps Training: https://lead2pass.troytecdumps.com/SSCP-troytec-exam-dumps.html