The interns who appear to be violating numerous security rules are approached by the CISO and express their discontent. They don't encrypt their workstations, download illegal music, link their personal gadgets to company computers, spend too much time on social media, and download pornographic material on business systems, claims the corporation. The CISO advises you to develop a security document (Rules of Behavior) with at least 15 rules defining what employees are allowed and not allowed to do when connected to the company network.

The interns who appear to be violating numerous security rules are approached by the CISO and express their discontent. They don't encrypt their workstations, download illegal music, link their personal gadgets to company computers, spend too much time on social media, and download pornographic material on business systems, claims the corporation. The CISO advises you to develop a security document (Rules of Behavior) with at least 15 rules defining what employees are allowed and not allowed to do when connected to the company network.

Principles of Information Security (MindTap Course List)

6th Edition

ISBN:9781337102063

Author:Michael E. Whitman, Herbert J. Mattord

Publisher:Michael E. Whitman, Herbert J. Mattord

Chapter4: Planning For Security

Section: Chapter Questions

Problem 3E

See similar textbooks

Similar questions

The CISO approaches the interns who seem to be breaking various security standards, who express their displeasure. According to the organization, they don't encrypt their workstations, download unlicensed music, connect personal devices to corporate computers, spend too much time on social media, and download pornographic content on workplace systems. The CISO recommends that you create a security document (Rules of Behavior) that has at least 15 rules limiting what employees may and may not do when connected to the corporate network.
To learn more about your institution's security rules, look them up on the intranet or website. Is there a corporate security policy somewhere? Where have you come across security rules that are tailored to address a particular problem? What agency or department is in charge of issuing or coordinating all of these policies, or are they dispersed across the organization? Use the framework provided in this chapter to determine whether or not the policies you found in the preceding exercise are complete. What are the omissions in these areas?
A recent incident involving a security weakness in authentication or access control may make for a fascinating topic for a case study if it was written up. Is there going to be a change in the way that the company functions as a consequence of this? I was wondering if you would mind if I inquired about the loss history of the firm and, if so, what those losses consisted of.
Over the last three years, a security breach of personal information has resulted in certain instances of identity theft. What can you do to safeguard against identity theft? Give a concrete illustration of what you mean.
It could be beneficial to cite an instance of a recent breach of security involving access control or authentication as an example. Do you believe it has had an impact on the way the firm conducts its business? In particular, can you tell me whether there have been any losses for the company?
This week, your flooring sales and installation company client wants you to explain the different kinds of attack threats their business faces from hackers. Write a 1- to 2-page memo or create a 1- to 2-page table that summarizes attack threats from hackers to any business, noting which are applicable to your client's business; how the vulnerabilities in a system can be exposed; and countermeasures that can mitigate against threats from attack. Describe sniffing attacks, identify a protocol that is vulnerable to sniffing, and suggest appropriate countermeasures. Describe session hijacking, provide an example of a specific threat from session hijacking, and recommend appropriate countermeasures for the threat. Describe spoofing, provide an example of a specific threat from spoofing, and recommend appropriate countermeasures for the threat. Describe poisoning attacks, provide an example of a specific threat from a poisoning attack, and recommend appropriate countermeasures…
It can be beneficial to look at an example of a recent security breach that included access control or authentication. Do you believe that it has had an effect on the business practises of the company? Are you able to provide me with detailed information on whether or not the company has experienced any losses?
An example of a current security lapse involving access control or authentication might be instructive. Do you think it has changed the way the corporation does business? Are you able to provide me specific information on whether or not the business has suffered losses?
A recent incident involving a breach in access control or authentication might serve as a useful case study. Do you think it has altered the company's methods of doing business? Can you tell me whether or whether the firm has suffered any losses, and what those losses were?
1. What methods does a social engineering hacker use to gain information about a user’s login ID and password? How would this method differ if it targeted an administrator’s assistant versus a data-entry clerk? 2. Consider the information stored in your personal computer. Do you currently have information stored in your computer that is critical to your personal life? If that information became compromised or lost, what effect would it have on you? 3. There are a number of professional organizations for computer security. Search for two organizations and share the websites and descriptions of those organizations. Share that information here:4. Choose two of the US federal agencies listed in Chapter 3 that deal with computer/cybercrime. List at least three differences, in terms of reach or responsibility, between the two organizations.
Question 1 Which of the following correctly describes the difference between privacy and security? Privacy is about the individual's control over sensitive information pertaining to the individual; security is about the methods used to provide control over information. Privacy is about controlling access to personal information; security is about controlling access to company information. None of the listed choices are correct. Privacy and security refer to the sets of controls used to protect information. Question 2 Extended service agreements which run for 3 more years require that Sifers-Grayson provide software maintenance and patches for SCADA systems sold more than fifteen years ago. The engineering workstations used to provide this support take up 500 sq ft of space in the R&D lab and, due to their reliance on Windows XP, present security vulnerabilities which need to…