Part 1: Core Concepts (2 Marks)
- Information Security Governance: The system by which an enterprise directs and controls its information security operations, ensuring security activities align with business objectives, comply with regulations, and manage risk appropriately.
- The CIA Triad:
- Confidentiality: Preserving authorized restrictions on information access and disclosure (enforced via AES-256 encryption, access control lists).
- Integrity: Guarding against improper information modification or destruction (enforced via SHA-256 cryptographic hashing, digital signatures).
- Availability: Ensuring timely and reliable access to and use of information (enforced via redundancy, clustering, DDoS mitigation).
- Security Policy Hierarchy:
- Policy: High-level, executive-mandated statements of management intent (mandatory, technology-agnostic).
- Standard: Specific, mandatory hardware/software requirements and configurations (e.g., minimum 14-character passwords).
- Baseline: Uniform minimum security levels established across an enterprise.
- Guideline: Discretionary, non-mandatory best-practice recommendations.
- Procedure: Step-by-step sequential operational instructions to perform tasks.
- Zero Trust Architecture (ZTA): A modern cybersecurity paradigm founded on the core principle of “Never Trust, Always Verify,” requiring continuous verification of identity, device health, and context for every request regardless of network location.
Part 2: Structural Frameworks (10 Marks)
1. Hierarchical Taxonomy of Security Documentation
- [ ENTERPRISE SECURITY POLICY ]
- Executive Vision, Mandatory, General
- [ STANDARDS ] [ BASELINES ]
- Mandatory Specifications Minimum Acceptable Thresholds
- (e.g., TLS 1.3 Encryption) (e.g., CIS Benchmarks)
- [ PROCEDURES ] [ GUIDELINES ]
- Mandatory Step-by-Step Advisory Recommendations
- SOPs (e.g., User Offboarding) (e.g., Remote Work Hygiene)
2. The Zero Trust Security Architecture Pillars
- | POLICY ENGINE & ADMINISTRATOR |
- | Continuous Context Evaluation: Identity + Device + Location + Risk|
- Policy Decision Point | Dynamic Session Grant / Revoke
- | POLICY ENFORCEMENT POINT (PEP) |
- [ IDENTITIES ] [ WORKLOADS ] [ DATA ]
- MFA, Biometrics, Microsegmentation, Classification, DLP,
- Least Privilege Container Security End-to-End Encryption
Part 3: Distinction Tables
| Basis of Comparison | Security Policy | Security Procedure |
|---|---|---|
| Organizational Level | Executive management / Board level | Operational IT / Security analyst level |
| Mandatory Nature | Strictly mandatory corporate rule | Strictly mandatory operational steps |
| Content Specificity | Broad, overarching, technology-agnostic | Granular, step-by-step, platform-specific |
| Frequency of Revision | Infrequent (reviewed annually or upon major structural shifts) | Frequent (updated whenever software or tooling changes) |
| Example Expression | “All corporate sensitive data must be encrypted at rest.” | “Execute cryptsetup luksFormat /dev/sdb1 using 256-bit AES.” |
| Primary Audience | All enterprise employees and contractors | Technical administrators and operational teams |
Part 4: Worked Problems & Exam Traps
Problem Archetype: Designing a Defense-in-Depth Information Security Strategy
Question: Design an end-to-end layered Defense-in-Depth architecture for a Nepalese commercial bank transitioning to internet and mobile banking services. Identify defensive controls across all architectural tiers. Solution:
- Tiered Defensive Layers:
- Perimeter / Edge: Cloud-based DDoS scrubbing (Cloudflare/Akamai), Next-Generation Firewalls (NGFW), Web Application Firewalls (WAF) inspecting OWASP Top 10 vulnerabilities.
- Network Core: Internal network micro-segmentation, DMZ isolation, 802.1X Network Access Control (NAC), Intrusion Prevention Systems (IPS).
- Host / Endpoint: Endpoint Detection and Response (EDR), Host-based Firewalls, OS hardening (CIS benchmarks), automated patch management.
- Application Layer: Secure Software Development Lifecycle (SSDLC), static and dynamic code analysis (SAST/DAST), strict input validation, API gateways with rate limiting.
- Data Layer: AES-256 database encryption at rest (TDE), TLS 1.3 in transit, tokenization for credit cards, Data Loss Prevention (DLP).
- Human / Governance: Multi-Factor Authentication (MFA), Phishing simulations, mandatory annual security awareness training.
TU Exam Trap: In governance questions, students often assign total legal responsibility for a security breach to the CISO or IT Director. Legally and corporately, ultimate fiduciary accountability for information asset protection rests with the Board of Directors and Chief Executive Officer (CEO)! The CISO is responsible for operational program execution, while the Board bears ultimate legal responsibility to shareholders and regulators.