If you’re planning on taking the Security+ exam, you should have a basic understanding of security policies involving a third party and the importance of a non-disclosure agreement (NDA).
For example, can you answer this question that we recently added to the online test banks?
Q. The BizzFad company decides to partner with Costington’s to bid on a contract. Management in both companies realize that they need to share proprietary data. However, they want to ensure that distribution of this data is limited within each of the companies. Which of the following will BEST meet this need?
A. MOU
B. BPA
C. NDA
D. ISA
More, do you know why the correct answer is correct and the incorrect answers are incorrect? The answer and explanation is available at the end of this post.
Third Party Issues
There are multiple instances where an organization works with another organization as a third party and it can bring up a variety of security issues. A third party is an entity that isn’t directly involved in activities between two primary parties.
As an example, imagine that an organization called Get Certified Get Ahead hosts a web site (http://getcertifiedgetahead.com/) and collects customer data. The GetCertifiedGetAhead.com web site and each customer make up the primary two parties. Now, imagine that Get Certified Get Ahead hires an application developer to modify the web site application, and the developer can potentially access user data. In this situation, the application developer is the third party and represents a potential risk when granted access to the web site and data.
On-boarding business partners refers to granting them access to a system by giving them an account. One of the key considerations when on-boarding a business partner is to ensure you follow the principle of least privilege. Grant them access to what they need for their job, but no more. Off-boarding is the process of removing their access. Once a partnership has ended, you need to revoke the business partner’s access.
NDA Concerns
In many situations, it’s appropriate to use a non-disclosure agreement (NDA) to ensure that third parties understand their responsibilities. This can be a completely separate agreement, but is more commonly embedded as a clause in a contract with the third party. Some concerns or issues to include in the contract or NDA are:
- Privacy considerations. A contract stresses the importance of maintaining privacy of any data, and especially PII. The goal is to ensure that the third party understands the importance of protecting the data.
- Data ownership. The first party owns the data and a contract might stress this. In other words, the third party is not authorized to keep, use, or distribute the data and should destroy it upon completion of the contract period.
- Data backups. If activity by the third party has the potential to destroy or corrupt data, a contract might stress the need for the third party to maintain up-to-date backups.
- Unauthorized data sharing. Because the third party does not own the data, it is not authorized to share it with any other entities.
- Security policy and procedures. During the period of the contract, the third party is responsible for following appropriate security policies and procedures. This might include items such as encrypting all data in transit or reporting potential incidents as soon as they are discovered.
- Reviews. Depending on the scope of the partnership, an NDA might include review clauses. The goal of a review is to verify the third party is complying with the agreement and meeting performance standards.
Remember this
When working with third parties or as a third party, it’s important to protect data. Most non-disclosure agreements prohibit sharing data unless you are the data owner.
The 601 Version of the Study Guide
The CompTIA Security+: Get Certified Get Ahead: SY0-601 Study GuideEach of the eleven chapters presents topics in an easy to understand manner and includes real-world examples of security principles in action.
You’ll understand the important and relevant security topics for the Security+ exam, without being overloaded with unnecessary details. Additionally, each chapter includes a comprehensive review section to help you focus on what’s important.
Over 300 realistic practice test questions with in-depth explanations will help you test your comprehension and readiness for the exam. The book includes:
- A 75 question pre-test
- A 75 question post-test
- Practice test questions at the end of every chapter.
Each practice test question includes a detailed explanation to help you understand the content and the reasoning behind the question. You’ll be ready to take and pass the exam the first time you take it.
If you plan to pursue any of the advanced security certifications, this guide will also help you lay a solid foundation of security knowledge. Learn this material, and you’ll be a step ahead for other exams. This SY0-601 study guide is for any IT or security professional interested in advancing in their field, and a must-read for anyone striving to master the basics of IT security.
Q. The BizzFad company decides to partner with Costington’s to bid on a contract. Management in both companies realize that they need to share proprietary data. However, they want to ensure that distribution of this data is limited within each of the companies. Which of the following will BEST meet this need?
A. MOU
B. BPA
C. NDA
D. ISA
C is correct. A non-disclosure agreement (NDA) would meet this need. It can be written to ensure that proprietary data is not shared with other departments or divisions in the other company. This question is a great example of how you can often answer a Security+ question just by knowing what the acronym means.
A is incorrect. A memorandum of understanding (MOU) expresses an understanding between two or more parties indicating their intention to work together toward a common goal. However, it is less formal than an NDA and it doesn’t have strict guidelines in place to protect sensitive data.
B is incorrect. A business partners agreement (BPA) details the relationship between business partners including their obligations toward the partnership. It is not an agreement between different organizations, but instead an agreement between partners in a single organization.
D is incorrect. An interconnection security agreement (ISA) specifies the technical and security requirements for planning, establishing, maintaining, and disconnecting a secure connection between two or more entities.
See Chapter 11 of the CompTIA Security+: Get Certified Get Ahead: SY0-401 Study Guide for more information on operational security. Also Appendix A is an acronym list of all of the relevant acronyms covered on the Security+ exam.
