@funkychicken Big congrats in passing the exam.
Sounds like lot of ambiguous questions on the exam 🙂 Thanks for the advice, re - best answer
Thanks for your explanation for the question below. However, these keywords "minimum security requirements' could be interpreted different way by some. Some may think the minimum requirement /effort could be just encrypt all mail rather than go through the extensive process in classifying emails appropriately and then label them, and then apply appropriate polices. And we know email and data classification is challenging and takes time and efforts. Not disagreeing with the answer but just my 2 cents...
"Question 1.
Johny needs to provide a set of minimum security requirements for email. What steps should he recommend for his organization to ensure that the email remains secure?
Lets break this down.
Johny needs to provide a set of MINIMUM security requirements for EMAIL. So the standards are going to be minimum and not necessarily for all email. Infact most times in an organisation especially when doing ISO27001 and PCI-DSS, all email does not require to be encrypted only the sensitive items need to be. We must also consider encryption as a technology that puts lots of processing power on CPU resources and also will slow down the system if being used for all email so in reality this really isn't a viable options because in an email scenario, receiving an email if it is not sensitive is more important than encrypting it.
What steps should he recommend for his organization to ensure that the email remains secure?
OK so he needs to take some steps, and he should recommend these steps for the org to make sure THE EMAIL remains secure.
So, the email relates to the type of email that is being encrypted. This does not relate to all email, it relates to the type of email which means that it has been broken down in to categories. So here you will have email that is non secure and is OK to be sent to users and then you have email that is sensitive and needs to be secured and send using something like PGP encryption.
Remember the CISSP training and the core skills of a CISSP representative. The Security Dept is there to facilitate the business to achieve the business goals. There are also many elements of the CISSP training which you need to consider for every answer to a question. Remember that most of the answers are correct but it is the best answer which you need to know in the situation. I know all these are confusing but you will need to consider every situation in every part of the CISSP and adopt the knowledge to answer the question.
So the answers:
A. All email should be encrypted - not necessarily. In most companies all email does not need to be encrypted but only the category of email that is required to be encrypted.
B. All email should be encrypted and labelled - same as above. In certain companies or government operations it should be but if this was a standard then Office 365 would adopt this or yahoo.com and everyone would have to use PGP and everything would need to be labelled which is impractical at the moment.
C. Sensitive email should be encrypted and labelled - Yes there is always a time where there are certain emails which need to be shared with a key. They also need to be labelled and considered inbound and outbound. So something that may not be considered sensitive inside but when released outside of the company this may be considered sensitive and therefore should be labelled as such.
D. Only highly sensitive email should be encrypted - This is incorrect because some email which is classified as non sensitive may be sensitive if the data was released outside.
I recently passed my CISSP I had to review all of the documentation for these areas. It became more and more obvious that its not just the specific question that is the concern but every element from the training, what the current state of the technology is that is mentioned in the question, wow the technology works, the CIA triad, the principles of a CISSP, the roles and objectives of a CISSP in a business and a variety of other aspects that could affect the answer to a question.
When I sat my exam there were many questions that were like this, and the thought process is not just the question at stake as all of the answers could be correct but its what is the best answer in this scenario given the situation. "
