Reference no: EM133985027

QUESTION 1

A globally interconnected commercial world has emerged from the technological advances which created the Internet. Discuss briefly whether this creation increased or decreased the need for organizations to maintain secure operations of their systems.

Discuss the concept of an organisation's competitive advantage against competitors and how it has evolved over the years with the ongoing development of the IT industry.

Explain why networking components need more examination from an information security perspective than from a systems development perspective. Why must this practice be periodically reviewed?

Discuss the significance of the C.I.A. triangle and its latest development.

Explain what the definition of privacy is in information security, how this definition of privacy is different from the everyday definition, and why this difference is significant.

Characterize authentication, authorization, and accountability in the context of information security processes.

QUESTION 2

Identify the four risk control strategies in security management and explain each of them.

Discuss the differences between benchmarking and baselining, and the differences between due diligence and due care.

With the aid of examples, distinguish between the two risk control strategies, namely, risk transference and risk mitigation.

Discuss the concept of risk appetite. Why does it vary from organization to organization?

QUESTION 3

Discuss the differences between an information security policy and a security standard. Explain why they are both critical to the success of an information security program.

In comparison with information security standards, is security policy considered static or dynamic? Which factors might determine this status?

List and describe the three challenges in shaping policy.

Discuss the three types of information security policy proposed by NIST SP 800-14.

Of the risk control measures used to deal with information security risks, which one is viewed as the least expensive? What is the primary cost of this type of control?

QUESTION 4

Identify the major steps in Contingency Planning and explain why the Business Continuity plan is important in the Contingency Planning.

With the aid of a diagram, discuss the contingency planning hierarchy.

Differentiate between rapid-onset disaster and slow-onset disaster.

Why should continuity plans be tested and rehearsed?

QUESTION 5

What is Intellectual Property? Does it offer the same protection in every country over the world? What laws currently protect Intellectual Property in the UK and Europe?

Briefly discuss the concept of un-trusted network, firewall, and trusted network.

What is the DMZ? Discuss whether this is a good name for the function that this type of subnet performs.

Differentiate between due care and due diligence. Explain why they are both important for an organization to make sure it exercises them in their business operations.

QUESTION 6

What are the risks and benefits of outsourcing an information security program?

Identify and briefly discuss three UK laws relevant to the practice of information security.

Discuss the financial considerations required to implement an information security project.

What are the main benefits for an organization that assure from undertaking information security project management?