Reference no: EM133955691
Assignment:
Everything needed to solve this question is here. Nothing outside what is posted is necessary.
Security Program Development
This exercise is designed to have you begin developing a security program. To accomplish this goal, you must think through the case scenario below. Remember that every organization is different, and the security program needs to be effective, applicable and achievable.
The Scenario:
ElectricVehicleMotors (EVM) creates and sells several specialized motor vehicles for personal and business use. EVM has invested significant funds into their Intellectual Property (IP) used within the battery management system called "ChargeIT" This system enables drivers to plan trips around charging stations and reliably calculates remaining power to make sure no one runs out of battery power before reaching one of their available charging stations.
Other features of the EVM fleet of vehicles include auto-pilot mode for highway driving and several on-board sensors to allow for lane departure alerts, emergency braking, and self-parking capabilities. Owners of EVM vehicles have the option of allowing the EVM corporation to continuously monitor on-board diagnostics, performance data, and location information for a small monthly charge.
Security features of this motor vehicle include biometric authentication via face, fingerprint, or voice recognition to unlock and operate the vehicle. EVM vehicles are considered the most exotic and technologically advanced vehicles on the road today.
While the general public considers this one of the most advanced motor vehicles in production to date, the majority of the population is concerned with the security of their private data, including location, travel habits, speed, and stored biometric data. Understanding the importance of security and privacy from the start, the EVM CEO and Board of Directors have invested considerable amounts of money to develop a comprehensive security and privacy program. Failure to protect their IP could result in competitors gaining market advantage as well as allowing malicious hackers the opportunity to find weaknesses within the system information control and processing units, which could result in serious accidents and driver harm.
Your role:
You are the Chief Information Security Officer (CISO) at EVM. It is your responsibility to protect the information and information systems, including IP, supporting design and development environments and the customer vehicle monitoring systems. Should any system be compromised, the CISO is responsible for incident response and disaster recovery utilizing high-availability systems.
After reviewing the scenario above, this assignment is designed to get you thinking about developing a security program that takes a holistic approach to security throughout the organization. Remember that it is important to demonstrate your thought process in explaining your responses to the questions below, and relate the answers to the scenario.
- List in the order of importance: risk assessments, policies, metrics, and security strategy.
- Discuss the relationship that risk assessments, policies, metrics, and the security strategy play in the development of the information security program.
[Hint: Compare and contrast the importance and dependencies on the 4 topic areas listed above.]