Dyson College of Arts and Sciences

8. Data Recovery Capability (validated manually): The processes and tools used to properly backup critical information with a proven methodology for timely recovery of the critical information. 9. Security Skills Assessment and Training to Fill Gaps: The process and tools to make sure an organization understands the technical skill gaps with their workforce including an integrated plan to fill the gaps through policy, training and awareness. 10. Secure Configurations for Network Devices such as Firewalls, Routers and Switches: The processes and tools used to track, control, prevent, and/or correct security weaknesses in the configurations in network device such as firewalls, routers and witches based on formal configuration management and change controls processes. 11. Limitation and Control of Network Ports, Protocols, and Services: The processes and tools used to track/control/prevent/correct use of ports, protocols, and services on networked devices. 12. Controlled Use of Administrative Privileges: The processes and tools used to track, control, prevent, correct use, assignment, and configuration of administrative privileges on computers, networks, and applications. 13. Boundary Defense: The processes and tools used to detect, prevent, and/or correct the flow of information transferring networks of different trust levels with a focus on security-damaging data. 14. Maintenance, Monitoring and Analysis of Audit Logs: The processes and tools used to detect, prevent, and/or correct use of systems and information based on audit logs of events that are considered significant or could impact the security of an organization; this control focuses on systems rather than networks. 15. Controlled Access Based on Need to Know: The processes and tools used to track, control, prevent, and/or correct secure access to information according to the formal determination of which person, computers, and applications have a need and right to access information based on an approved classification. 16. Account Monitoring & Control: The processes and tools used to track, control, prevent, and/or correct use of system and application accounts. 17. Data Loss Prevention: The processes and tools used to track, control, prevent, and/or correct data transmission and storage, based on the data's content and associated classification. 18. Incident Response Capability (validates manually): The process and tools to make sure an organization has a properly tested plan with appropriate trained resources, for dealing with any adverse events or threats of adverse events. 19. Secure N/W Engineering (validated manually): The process and tools used to build, update and validate a network infrastructure that properly withstand attacks from advanced threats. 20. Penetration Tests, Red Team Exercises (validated manually): The process and tools used to simulate attacks against a network to validate the overall security of an organization. 73

• Cover