David Martin just finished his inspection coordinator course. After obtaining his firstappointment, he plans to add his personal secretary to the inspection team for thepurpose of serving as session scribe and producing the required reports. He assumesthat her participation will free him for the coordination tasks and enable him to conductthe session successfully.1. Is it advisable to employ a secretary (a non-information technology professional) asa scribe in an inspection session? List your arguments pro and con.

The secretary is expected to perform the reporting task efficiently. However, it is expected that…

David Martin just finished his inspection coordinator course. After obtaining his first ppointment, he plans to add his personal secretary to the inspection team for the purpose of serving as session scribe and producing the required reports. He assumes hat her participation will free him for the coordination tasks and enable him to conduct he session successfully. Is it advisable to employ a secretary (a non-information technology professional) as a scribe in an inspection session? List your arguments pro and con.

David Martin just finished his inspection coordinator course. After obtaining his first ppointment, he plans to add his personal secretary to the inspection team for the purpose of serving as session scribe and producing the required reports. He assumes hat her participation will free him for the coordination tasks and enable him to conduct he session successfully. Is it advisable to employ a secretary (a non-information technology professional) as a scribe in an inspection session? List your arguments pro and con.

Management Of Information Security

6th Edition

ISBN:9781337405713

Author:WHITMAN, Michael.

Publisher:WHITMAN, Michael.

Chapter5: Developing The Security Program

Section: Chapter Questions

Problem 2E

See similar textbooks

Similar questions

Develop a list of compliance laws required for DoD contracts. Report should include a justification or discussion and determin these compliance laws are necessary for Tech R Us to fullfill the DoD contract. What happens with the awarded contract if Tech R Us does not comply to these laws?
the answer is not DRP Jason has just been hired as the Director of IT. He is reviewing existing policies and procedures to determine how well the company has defined the roles of its employees in order to keep the organization secure and operating efficiently under any scenario. He finds that the company does not have an existing plan for how their offices in a hurricane-prone area will continue to operate during a hurricane. Which of the following plans should he consider implementing to ensure that employees at this location and supporting locations will be well prepared to both handle and continue to operate through whatever situations may arise as a result of natural disasters? the answer is not DRP
Chain Link Consulting is an information technology consulting company that focuses on system security concerns. When the company's president asks you to assist her with the preparation of a presentation for a group of potential clients at a trade show meeting next month, you say "yes." First and foremost, she would like you to examine system security concerns in light of all six security levels. Afterwards, she wants you to come up with a list of methods that Chain Link might evaluate a client's security procedures in order to obtain an accurate evaluation of their level of exposure.It was her way of making the situation more intriguing by saying that it was fine to be imaginative in your ideas, but that you should avoid proposing anything that would be unlawful or immoral. Example: It might be OK to pretend as a job candidate with phony references to see whether they were being reviewed, but it would be inappropriate to steal a lock and access the computer room to check on things.Your…
When a large U.S. city realized that more than 70% of its IT personnel was eligible to retire within three years, they quickly implemented a strategy to begin bringing in fresh IT workers and matching them with seasoned veterans. Because their IT systems were nearly entirely created in-house over a 20-year period, organizational IT expertise was essential, and those needed talents were not available on the open market. Does this imply that another aspect of crisis management and contingency planning should be addressed? Shouldn't this problem have previously been addressed in some plan or document?
I need help with this problem for my Strategic Management class. Thank you You have received word of the Ryuk threat, a ransomeware attack. Assume $100 per infected device to recover data. Your assignment is to research the threat and write a 1 page executive briefing (use a memo format), using the following steps: Research and review information regarding a security threat and/or breach Analyze the threat Prepare an executive briefing (a one-page paper in Word, PDF, etc.) Summarize the key points of the issue Describe how/if it might impact St Eligius Recommend short term mitigation steps Recommend long term mitigation action
According to the 2022 Cost of a Data Breach Report, which statement summarizes the state of data breaches? a. On average, it takes 35 days to contain a data breach b. For the first time, the Middle East emerged as the geography with the highest cost of a data breach among those analyzed c. The average cost of a data breach is decreasing year over year d. The average cost of a data breach is $4.35 million (USD), an all time high for breach costs.
This week, your flooring sales and installation company client wants you to explain the different kinds of attack threats their business faces from hackers. Write a 1- to 2-page memo or create a 1- to 2-page table that summarizes attack threats from hackers to any business, noting which are applicable to your client's business; how the vulnerabilities in a system can be exposed; and countermeasures that can mitigate against threats from attack. Describe sniffing attacks, identify a protocol that is vulnerable to sniffing, and suggest appropriate countermeasures. Describe session hijacking, provide an example of a specific threat from session hijacking, and recommend appropriate countermeasures for the threat. Describe spoofing, provide an example of a specific threat from spoofing, and recommend appropriate countermeasures for the threat. Describe poisoning attacks, provide an example of a specific threat from a poisoning attack, and recommend appropriate countermeasures…
A major, yet often overlooked, aspect of incident response is learning from an attack and making improvements to prevent further occurrence. The SolarWinds attack highlighted many deficiencies in several aspects of the application of cybersecurity across the industry. Carry out your independent research on the SolarWinds hack (there are many well done resources available on this incident), in 500 words, provide your own list of “lessons learned” to include in the recommended changes to the organization’s cybersecurity structure. NB: be very specific and type all response here.
You are heading up a IT Security function. For your team's operational and developmental planning, what are the ten most important skills, technical (5) and non-technical (5), that your team members will need and why? Please be sure to discuss the areas from where some skills will fall in the context of Red Team, Blue Team, Purple Team or "soft skills".
Similar to reviewing security policies, a CASP+ might need to review business documents such as disclosure agreements or service agreements. You might be asked to review such a document by the company lawyer or a senior executive familiar with the conditions of the document, but not necessarily have the technical expertise to assess its feasibility. 1. Does your company have or make use of an NDA? If no, an NDA should be created. 2. Is the existing or proposed NDA a one-way or a two-way NDA? A one-way NDA protects only the information of the company. Two-way NDAs are designed to protect the confidential information of both the client and the company. 3. Does the NDA clearly define confidential information? 4. Are controls put in place to protect confidential information? 5. What are the obligations of the receiving party? What level of protection must they apply to the information they have received? 6. What time period applies to the NDA? Most NDAs don’t last forever and have a time…
Write a report which, if implemented, will address all the issues identified in the case study. Thereport must have the following structures:Q.2.1 Your report must be structured in the following approach.Q.2.1.1 Executive summary. (5)Q.2.1.2 Background (case study’s IT security issues only). (5)Q.2.1.3 Development of the proposed solution. (5)Q.2.1.4 The role of the IT risk manager in addressing physical and networkrisk.(5)Q.2.1.5 The best methods of combating the network-based attack. (5)Q.2.1.6 The impact of social engineering when combating network security. (5)Q.2.1.7 The most appropriate mechanism in implementing network accessauthentication and authorisation without compromising networksecurity.(5)Q.2.1.8 The implementation of the best strategy to fight against hacking,hijacking and maintain the online presence.(5)Q.2.1.9 The most appropriate location and strategy for the DMZ and firewallimplementation.(5)Q.2.1.10 Conclusion.
For this assignment you will provide security advice for a fictional stakeholder. Assume that you are a cybersecurity consultant that has been brought on board to provide industry best practices. This means that your advice should not rely on your personal opinion, nor on the personal opinion of others. Seek out sources for INDUSTRY best practices - which means using a security framework. Use NIST (800-53). Do NOT prescribe specific technologies or products. Keep it platform neutral. For example, IA-4 calls for Identifier Management, which is solved with the following advice. "Use a centrally managed user repository with individual user IDs based on employee ID, but use aliases for email and IM accounts. This way customers and co-workers can identify contact information for employees, but username remains semi-confidential " The scenario: We need to set up a secure virtual boardroom. Our security people have found the following OSA (open-source architecture) pattern for what we need,…