Third-Party Agreements

Posted by in Security+ | 0 comments

If you’re planning on taking the Security+ exam, you should have a basic understanding of security policies involving a third party and the importance of a non-disclosure agreement (NDA).

For example, can you answer this question that we recently added to the online test banks?

Q. The BizzFad company decides to partner with Costington’s to bid on a contract. Management in both companies realize that they need to share proprietary data. However, they want to ensure that distribution of this data is limited within each of the companies. Which of the following will BEST meet this need?

A. MOU

B. BPA

C. NDA

D. ISA

More, do you know why the correct answer is correct and the incorrect answers are incorrect?  The answer and explanation is available at the end of this post.

Get Certified Get Ahead

Third Party Issues

There are multiple instances where an organization works with another organization as a third party and it can bring up a variety of security issues. A third party is an entity that isn’t directly involved in activities between two primary parties.

As an example, imagine that an organization called Get Certified Get Ahead hosts a web site (http://getcertifiedgetahead.com/) and collects customer data. The GetCertifiedGetAhead.com web site and each customer make up the primary two parties. Now, imagine that Get Certified Get Ahead hires an application developer to modify the web site application, and the developer can potentially access user data. In this situation, the application developer is the third party and represents a potential risk when granted access to the web site and data.

Full Security+ (SY0-401) Course

Full Security+ Course Now Available

Helping you Pass the First Time

Online access includes all of the content from the

CompTIA Security+: Get Certified Get Ahead: SY0-401 Study Guide

  • Introduction
  • About the exam (including types of questions and strategies for performance-based questions)
  • 100 question pre-assessment exam
  • Mastering Security Basics (full content from Chapter 1 of the study guide including the exam topic review and 20 practice test questions)
  • Exploring Control Types and Methods (full content from Chapter 2 of the study guide including the exam topic review and 20 practice test questions)
  • Understanding Basic Network Security (full content from Chapter 3 of the study guide including the exam topic review and 20 practice test questions)
  • Securing Your Network (full content from Chapter 4 of the study guide including the exam topic review and 20 practice test questions)
  • Securing Hosts and Data (full content from Chapter 5 of the study guide including the exam topic review and 20 practice test questions)
  • Understanding Malware and Social Engineering (full content from Chapter 6 of the study guide including the exam topic review and 20 practice test questions)
  • Identifying Advanced Attacks (full content from Chapter 7 of the study guide including the exam topic review and 20 practice test questions)
  • Managing Risk (full content from Chapter 8 of the study guide including the exam topic review and 20 practice test questions)
  • Preparing for Business Continuity (full content from Chapter 9 of the study guide including the exam topic review and 20 practice test questions)
  • Understanding Cryptography (full content from Chapter 10 of the study guide including the exam topic review and 20 practice test questions)
  • Exploring Operational Security (full content from Chapter 11 of the study guide including the exam topic review and 20 practice test questions)
  • 100 question post-assessment exam
  • Security+ Acronyms

Get the Full Security+ Course Here

 Full Security+ Course Now Available


Test your readiness with these quality materials

Random 100-question tests

Random practice tests from the all of the practice test questions in the CompTIA Security+: Get Certified Get Ahead: SY0-401 Study Guide. All questions include explanations so you'll know why the correct answers are correct, and why the incorrect answers are incorrect.

34 Simulated Performance-based Questions

Eight sets of performance-based questions with multiple questions in each set. These questions help you understand and prepare for performance based questions.

22 Realistic Performance-based Questions

Two new sets of performance-based questions with a total of 22 questions. These new questions use a new testing engine that includes realistic drag and drop, matching, sorting, and fill in the blank questions.

Flashcard Set

  • 273 Security+ Flashcards to reinforce key testable concepts
  • 280 Security+ acronyms flashcards to help you master the required acronyms
  • 204 Security+ Remember This slides

Audio - SY0-401 Security+ Remember This Audio Files

Learn by Listening. Over one hour and 15 minutes of audio (MP3 downloads.)

Audio - SY0-401 Security+ Question and Answer Audio Files

Learn by Listening. Over three hours hour and 15 minutes of audio (MP3 downloads.)

Bonus #1

Audio from the end of chapter reviews from each of the chapters in the CompTIA Security+: Get Certified Get Ahead: SY0-401 Study Guide. Over one hour and 15 minutes of additional audio.

Bonus #2

Subnetting mini-tutorial that will help you answer two key question types:
  • Identify how many hosts a subnet supports
  • Identify valid IP addresses within a subnet

Bonus #3 

Access the study materials for a total of 60 days because sometimes life happens.

Get the Full Security+ Course Here

On-boarding business partners refers to granting them access to a system by giving them an account. One of the key considerations when on-boarding a business partner is to ensure you follow the principle of least privilege. Grant them access to what they need for their job, but no more. Off-boarding is the process of removing their access. Once a partnership has ended, you need to revoke the business partner’s access.

NDA

NDA Concerns

In many situations, it’s appropriate to use a non-disclosure agreement (NDA) to ensure that third parties understand their responsibilities. This can be a completely separate agreement, but is more commonly embedded as a clause in a contract with the third party. Some concerns or issues to include in the contract or NDA are:

  • Privacy considerations. A contract stresses the importance of maintaining privacy of any data, and especially PII. The goal is to ensure that the third party understands the importance of protecting the data.
  • Data ownership. The first party owns the data and a contract might stress this. In other words, the third party is not authorized to keep, use, or distribute the data and should destroy it upon completion of the contract period.
  • Data backups. If activity by the third party has the potential to destroy or corrupt data, a contract might stress the need for the third party to maintain up-to-date backups.
  • Unauthorized data sharing. Because the third party does not own the data, it is not authorized to share it with any other entities.
  • Security policy and procedures. During the period of the contract, the third party is responsible for following appropriate security policies and procedures. This might include items such as encrypting all data in transit or reporting potential incidents as soon as they are discovered.
  • Reviews. Depending on the scope of the partnership, an NDA might include review clauses. The goal of a review is to verify the third party is complying with the agreement and meeting performance standards.

Remember this

When working with third parties or as a third party, it’s important to protect data. Most non-disclosure agreements prohibit sharing data unless you are the data owner.

CompTIA Security+ Study Guide

The 401 Version of the Study Guide

SY0-401 Study GuideThe CompTIA Security+: Get Certified Get Ahead: SY0-401 Study Guide is an update to the top-selling SY0-201 and SY0-301 study guides, which have helped thousands of readers pass the exam the first time they took it.

CompTIA Authorized Quality Content (CAQC)After a comprehensive review by ProCert Labs, the SY0-401 version has been certified as CompTIA Approved Quality Content (CAQC) and covers every aspect of the SY0-401 exam.

It includes the same elements readers raved about in the previous two versions.

Each of the eleven chapters presents topics in an easy to understand manner and includes real-world examples of security principles in action.

You’ll understand the important and relevant security topics for the Security+ exam, without being overloaded with unnecessary details. Additionally, each chapter includes a comprehensive review section to help you focus on what’s important.


Click for Free Preview


Over 400 realistic practice test questions with in-depth explanations will help you test your comprehension and readiness for the exam. The book includes:

  • A 100 question pre-test
  • A 100 question post-test
  • Practice test questions at the end of every chapter.

Each practice test question includes a detailed explanation to help you understand the content and the reasoning behind the question. You’ll be ready to take and pass the exam the first time you take it.

If you plan to pursue any of the advanced security certifications, this guide will also help you lay a solid foundation of security knowledge. Learn this material, and you’ll be a step ahead for other exams. This SY0-401 study guide is for any IT or security professional interested in advancing in their field, and a must read for anyone striving to master the basics of IT security.

Kindle edition also available.

Are you looking for SYO-501 Study Guide?

The 501 Version of the Study Guide is Now Available. Click Here.


 

Q. The BizzFad company decides to partner with Costington’s to bid on a contract. Management in both companies realize that they need to share proprietary data. However, they want to ensure that distribution of this data is limited within each of the companies. Which of the following will BEST meet this need?

A. MOU

B. BPA

C. NDA

D. ISA

C is correct. A non-disclosure agreement (NDA) would meet this need. It can be written to ensure that proprietary data is not shared with other departments or divisions in the other company. This question is a great example of how you can often answer a Security+ question just by knowing what the acronym means.

A is incorrect. A memorandum of understanding (MOU) expresses an understanding between two or more parties indicating their intention to work together toward a common goal. However, it is less formal than an NDA and it doesn’t have strict guidelines in place to protect sensitive data.

B is incorrect. A business partners agreement (BPA) details the relationship between business partners including their obligations toward the partnership. It is not an agreement between different organizations, but instead an agreement between partners in a single organization.

D is incorrect. An interconnection security agreement (ISA) specifies the technical and security requirements for planning, establishing, maintaining, and disconnecting a secure connection between two or more entities.

See Chapter 11 of the CompTIA Security+: Get Certified Get Ahead: SY0-401 Study Guide for more information on operational security. Also Appendix A is an acronym list of all of the relevant acronyms covered on the Security+ exam.

 

Leave a Comment

CompTIA Security+: Get Certified Get Ahead: SY0-401 Study Guide

Subscribe To Our Newsletter

Join our mailing list and get a free excerpt of the CompTIA Security+: Get Certified Get Ahead: SY0-401 Study Guide.  This excerpt includes the introduction and Chapter 1. 

You have Successfully Subscribed!

Get Certified Get Ahead is a participant in the Amazon Services LLC Associates Program,
an affiliate advertising program designed to provide a means for sites to earn advertising fees by advertising and linking to amazon.com.

Copyright © 2015 Get Certified Get Ahead. All Rights Reserved.