Suppose you discovers an element of the IT strategic plan stating that IT will reduce costs by implementing s specific new technology. However, you know that the technology has not been shown to reduce costs even though it does improve the quality of IT services. If you are the Chief Information Security Officer (CISO), are you ethically obligated to raise this issue with higher management? Or should you leave the subject alone?

Suppose you discovers an element of the IT strategic plan stating that IT will reduce costs by implementing s specific new technology. However, you know that the technology has not been shown to reduce costs even though it does improve the quality of IT services. If you are the Chief Information Security Officer (CISO), are you ethically obligated to raise this issue with higher management? Or should you leave the subject alone?

Management Of Information Security

6th Edition

ISBN:9781337405713

Author:WHITMAN, Michael.

Publisher:WHITMAN, Michael.

Chapter3: Governance And Strategic Planning For Security

Section: Chapter Questions

Problem 1EDM

See similar textbooks

Similar questions

You have been hired as an IT security analyst by a multinational company. You noticed the biggest challenge in their production line is usage and reliance on outdated information system. Required:-Develop a road map for acquisition of a new information system clearly indicating the key attributes to consider.
Your company has acquired Joggers PLC, a smaller company. The integration of the information systems can take up to 6 months, and until then Joggers PLC workers will continue following their policies. You have been tasked with ensuring that their IT practices will be safe and lead to a secure system. What advice would you give your manager regarding information security policies?
In light of the impending retirement of more than 70% of its IT personnel over the next three years, a major American city has swiftly created a strategy to recruit young IT specialists and combine them with seasoned veterans. Having staff with understanding in information technology was crucial since their IT systems were almost entirely constructed in-house over a 20-year period and such talents were unavailable on the open market. Is this a signal that we need to invest more resources into creating crisis management and backup plans? Perhaps someone at some point in the past attempted to write a paper or devise a strategy to solve this problem.
You are heading up a IT Security function. For your team's operational and developmental planning, what are the ten most important skills, technical (5) and non-technical (5), that your team members will need and why? Please be sure to discuss the areas from where some skills will fall in the context of Red Team, Blue Team, Purple Team or "soft skills".
You are the new information security consultant company for the XYZ Group, a medium-sized software development company. Before hiring you, the company had been plagued with security incidents that are listed below. Management has asked you to help assess the risk and conduct a cost/benefit analysis of proposed solutions. Incident #1: Two years ago, plans for a new product were leaked onto the Internet, and as a result a competitor was able to produce a rival version of the software and get it to market first. XYZ estimates that sales of that software, which were expected to be at $1 million annually, were reduced by 50% due to the information leakage. Next year, the company is planning to introduce a new software that will be a major upgrade to the previous model. It should regain the company's market share in that product line. The cost for averting a similar information leak for the new product is not yet known, but training the staff, which would cost about $50,000 per year, is…
The PCS working group has been a smashing success and the team members have already formed better inter-department communications. The customer Security Director from the Istanbogus Ministry of Defense has requested a threat briefing explaining the top risks to his new system. As the CISO you have your ideas but would like to get the opinion of the working group members. Describe at least three different categories (human and non-human) of threats from your Unit research. Explain how each category presents risk to information systems. Make a case for the top threat to the missile defense system for each category and give an example of how that threat might be realized in a real compromise of the system. Discuss some of the factors that play into the assessment of system threats.
Chain Link Consulting is an information technology consulting company that focuses on system security concerns. When the company's president asks you to assist her with the preparation of a presentation for a group of potential clients at a trade show meeting next month, you say "yes." First and foremost, she would like you to examine system security concerns in light of all six security levels. Afterwards, she wants you to come up with a list of methods that Chain Link might evaluate a client's security procedures in order to obtain an accurate evaluation of their level of exposure.It was her way of making the situation more intriguing by saying that it was fine to be imaginative in your ideas, but that you should avoid proposing anything that would be unlawful or immoral. Example: It might be OK to pretend as a job candidate with phony references to see whether they were being reviewed, but it would be inappropriate to steal a lock and access the computer room to check on things.Your…
Write a brief report explaining how you would apply the Risk Management Framework to your chosen network. Feel free to use the following template for your response: Introduction Briefly describe your chosen network or system. How big is it? What assets are in it? Who uses it? Who manages it? What sort of cyber risks might each individual component face? RMF Process You can use subheadings for each task - Categorize, Select, Implement, Assess, Authorize, Monitor. For each task, briefly describe how you would identify, implement, and evaluate security controls to mitigate risks associated with it.
Write a report which, if implemented, will address all the issues identified in the case study. Thereport must have the following structures:Q.2.1 Your report must be structured in the following approach.Q.2.1.1 Executive summary. (5)Q.2.1.2 Background (case study’s IT security issues only). (5)Q.2.1.3 Development of the proposed solution. (5)Q.2.1.4 The role of the IT risk manager in addressing physical and networkrisk.(5)Q.2.1.5 The best methods of combating the network-based attack. (5)Q.2.1.6 The impact of social engineering when combating network security. (5)Q.2.1.7 The most appropriate mechanism in implementing network accessauthentication and authorisation without compromising networksecurity.(5)Q.2.1.8 The implementation of the best strategy to fight against hacking,hijacking and maintain the online presence.(5)Q.2.1.9 The most appropriate location and strategy for the DMZ and firewallimplementation.(5)Q.2.1.10 Conclusion.
Knowing that more than 70% of its IT employees will be eligible for retirement over the next three years, a major city in the United States quickly developed a strategy to hire fresh IT specialists and combine them with seasoned veterans. Organizational IT experience was crucial, since their IT systems were almost entirely constructed in-house over a 20-year period, and such talents were unavailable on the open market. Is this a hint that more work needs to be done on crisis management and backup plans? Perhaps there was a previous paper or strategy that should have dealt with this problem.
A. What conditions must be met to ensure that risk acceptance has been used properly? B. Discuss the concept of an organisation’s competitive advantage against competitors and how it has evolved over the years with the ongoing development of the IT industry. C. Explain why networking components need more examination from an information security perspective than from a systems development perspective. Why must this practice be periodically reviewed? D. With the aid of a diagram, discuss the contingency planning hierarchy. E. What is the DMZ? Discuss whether this is a good name for the function that this type of subnet performs.
As an Information Systems expert, you have been asked to deliver a presentation relating to Espionage as an Information Security threat. Your presentation is aimed at users of Information Technology who are not IT professionals. Your brief is to explain to them what Espionage is, how it is carried out and what sort of IT professionals are likely to carry out Espionage. In particular, break down and clarify their roles in Espionage to clear all confusion relating especially to the different skill sets in the hacker community.