After reading the case presented in the module, write a short response to the following discussion questions and ethical decision making scenario. Discussion Questions Before the discussion at the start of this chapter, how do Fred, Gladys, and Charlie each perceive the scope and scale of the new information security effort? Did Fred’s perception change after that? How should Fred measure success when he evaluates Gladys’ performance for this project? How should he evaluate Charlie’s performance? Which of the threats discussed in this chapter should receive Charlie’s attention early in his planning process?

Place the capital letter of the control goal that best matches the situation described. Provide a one- or two-sentence explanation of how the situation relates to the control goal you selected. If you select more than one control goal for a situation, provide an explanation for each that you select. Hint: Some letters may be used more than once. Conversely, some letters may not apply at all. Control Goals Ensure effectiveness of operations Ensure efficient employment of resources Ensure security of resources Ensure input validity Ensure input completeness Ensure input accuracy Ensure update completeness Ensure update accuracy Situations An accounts payable clerk at C&C Company enters vendor invoices into the computer. When the invoices for a particular day were entered, the computer noted that vendor invoice 12345 appeared twice. The computer rejected the second entry (i.e., the duplicate, the invoice with the same number). In entering the invoices mentioned in situation 1, the…

The results might be a widening of the scope or the inclusion of additional features. Provide precise examples to highlight the differences between the two ideas. What, in your opinion, is the root of these two problems? What would happen if these two unfavorable things happened at the same time, making this endeavor a disaster?

A thorough breakdown of the wait-and-see strategy is provided. What are the main disadvantages of this kind of interaction? Create a formula to determine the amount of time spent connected using this case study.

It is necessary to submit a proposal for a security awareness program. All relevant elements must be present for an artifact to be considered complete and polished. It should demonstrate the incorporation of the input used to create it. The proposal will comprise an executive summary, a communication plan, an introduction to the idea, policies and procedures, suggested fixes for security flaws, and methods for continuously keeping an eye out for hostile behavior.

Let's conjure up a scenario in which the CIA's holy trinity of secrecy, trust, and attentiveness are all able to function together successfully.

The five risk-control strategies are listed and briefly described below.

A security policy is a document that provides employees with clear instructions about acceptable use of company confidential information, explains how the company secures data resources and what it expects of the people who work with this information. Most importantly, the policy is designed with enough flexibility to be amended when necessary. You are working in organization X, and you are supposed to develop an issue-specific security policy, you can pick one issue from Table.1 [1] (In the photos) Your Task is: To develop the different sections of your policy and adequate procedure(s), you can refer to SANS Policy Templates [2]. References: [1] Developing an Information Security Policy: A Case Study Approach, Fayez Hussain Alqahtani. 4th Information Systems International Conference 2017, ISICO 2017, 6-8 November 2017, Bali, Indonesia. [2] https://www.sans.org/information-security-policy/

Because the "holy trinity" of the CIA, which consists of secrecy, trust, and alertness, does not seem to be operational very often, let's create up a scenario in which it is.

In this section, you will prepare a risk mitigation plan using SimpleRisk. Before using SimpleRisk, you will create a paper-based plan. You will need to create three security controls in your risk mitigation plan: one control that reduces the asset value, one that reduces the vulnerability severity, and one that reduces the threat impact. Your security controls should also include examples of both strategic and tactical controls. You can refer to the following table for a clearer picture of the requirements. Security Control Reduces Level (strategic/tactical)   Asset value       Vulnerability severity       Threat Impact     Define three security controls designed to mitigate the risk associated with a recent leak of sensitive information that was stored in cleartext files.   Once you have identified your security controls, use SimpleRisk to create a Risk Mitigation plan. You do not need to perform a management review in this section.