Title: Final Exam
Course: KVCC BUS118 > Section: Assessments

BUS118 Final Exam

Question 1 – CIA Triad

a.      One of the biggest concepts in this book is that of the CIA triad and this flavors all aspects of Information Security in the remainder of the chapters. To illustrate how this triad relates to the topics that have been discussed during class the following questions should be answered.

i.     Define each parts of the Triad in your own personal terms. What do they mean and how do they fit together as a relationship to one another.

ii.     For these questions please describe how the triad fits into the following areas and provide an example for each.

1.      How does the triad relate to Privacy

2.      How does the triad relate to Consumer Financial Information

3.      How does the triad relate to Children and their education records

4.      How does the triad relate to Health Information

5.      How does the triad relate to Corporations

6.      How does the triad relate to the Federal Government

7.      How does the triad relate to State Governments

8.      How does the triad relate to Intellectual Property

9.      How does the triad relate to your personal life

10.  How has the triad related to your professional life

iii.     Summarize the CIA Triad and how it relates to the field of information security and the laws that we discussed in class.

iv.     What is your overall assessment on the CIA Triad?

1.      Do you think it is effective? Why/Why not?

2.      If you were asked to add another leg to the system what would it be and why?

v.     Above you provided some examples of how the triad fits into various aspects of your life, what I want you to do is think on this further. How is the knowledge of the CIA triad going to affect your life from now on? How are you going to relate this information and use it?

Question 2 - Case Study

b.      This question is based on a case study from the textbook.

Question 3 – Acceptable use policy

c.      When it comes to legal concerns within a business one of the biggest concerns to be had is that of developing policies. As we discussed in class most of the time the development of these policies is done as a method to protect the organization from liability when it comes to the actions of employees. As an assignment we have written a privacy policy which is usually required by law in many cases. Another policy though not legally required is highly recommended is that of an acceptable use policy. This establishes the entire framework as to what is considered acceptable and unacceptable when it comes to the technology use within an organization. Your task is develop a policy based on the following scenario:

i.     You are an employee for a large sales and marketing firm. Recently there have been some misuses of computer technologies and the Internet. Your manager has tasked you with developing an acceptable use policy. Some items that you should address include the following:

1.      Employees all have some form of company provided computer system including desktops, laptops, and tablets.

2.      Because of the travelling nature of the sales team each are given company provided cell phones. They are encouraged to use these only for company work and not as a personal device however this is not formally documented. Also at the office there is a provided phone system for employee use. One of the primary problems is employees making personal phone calls during work hours.

3.      Because of the style of business social networking is necessary however this is getting to be a problem with much time being wasted on nonprofessional use on sites such as Facebook.

4.      The company provides email services however there have been some complaints about harassment or misuse of these systems.

ii.     Write a policy that fixes these above issues and provides for potential future problems.

iii.     How will you train your staff on this policy?

iv.     What methods will you as the owner or manager take to model the policy for the workers?

v.     How will you monitor compliance?

vi.     What will be the penalties for violations and how will you enforce these?

Question 4 – American Governmental Structure

d.      This course is a combination of a security and law course. To truly understand the law in regards to protecting the information within our businesses you have to understand the structure of our countries legal system and how it works overall. The following questions are on this topic:

i.     The first consideration when it comes to the legal systems is dealing with the three branches of government. We have already discussed the three federal branches and their checks and balances so we will not repeat that here:

1.      Out of the three federal branches which do you believe has the most impact on you as a potential business owner? Why?

2.      I would like you to do some research and examine federal laws that relate to a business and its information security. List the applicable law and summarize it for the following areas with an emphasis on relating it to a business:

a.      Privacy

b.      Consumer Financial information

c.      Children and Education Records

d.      Health Information

e.      Corporate Information

f.       Intellectual Property

3.      Not just as a business owner but as a citizen why is it important that you know the powers of each branch and how they try to extend these powers?

ii.     Once the federal government is examined the next step is that of the state:

1.      State governments often have additional powers and are modeled after their federal counterparts. These usually have more direct control over you and your business because there are more closely related. What areas should you consider when it comes to the state government and how it impacts your business?

2.      I would like you to go through the process like you did above for the federal government and research applicable laws for the state of Maine in the same areas.

3.      After this examination would you agree that the State government has more control over your business? Why/Why not.

iii.     One of the areas we did not explore in the text is that of the local or municipal government. They will not have all of the laws as in the federal or state however there will have a large amount of control over your business. I want you to pick a business type and search for the applicable laws in a local town or city that would impact you such as zoning and permits.

iv.     Outside of the various branches of government one of the biggest impacts on a business is that of governmental agencies. These agencies have the power of all three branches in the fact that they can make rules (laws), enforce rules, and interpret these rules. The employees of these agencies are not voted for and have most courts defer to their expertise. I want you to select a business it could be the same as above and research an agency that has oversight over that business. Summarize this research and describe how this agency would affect the operation of the business in question.

Question 5 – Application of course content

e.      Throughout this course we have discussed many topics in relation to the law and how it applies to information security. The biggest goal in this class is to have you understand the law in these areas so that if you are managing an IT department you can maintain your legal obligations and responsibilities. In this question I would like you to examine all that you have learned so far and then apply that to your professional and personal life. What topics do you think are the most important? What areas have you/your workplace been strong in? What areas have you been deficient in? How can you increase both your strengths and weaknesses? Please go into additional detail on any other important areas that you have learned in this class.

Attached Files: | - KVCC BUS118_LegalAspectsBusInfoSys_Final Exam(1).pdf