Title: Exam 2
Course: KVCC BUS214 > Section: Assessments

Module 4

This module is on the development of policies and procedures within an organization. This is one of the most important concepts in this entire course with your security infrastructure beginning with these policies and the training that arises from them. Answer the following questions on this topic:

a.      This module begins with the discussion that in order for a policy to be effective it must meet the following criteria with it needing to be:

1.      Planned

2.      Maintained

3.      Used

Describe each and provide a scenario that illustrates how each fit within an organization.

a.         Why are policies important to an organization? Defend your answer.

b.         When developing policies there are other important documents that we should be aware of, Testout lists the following:

1. Regulations

2. Procedures

3. Baselines

4. Guidelines

Provide a definition and illustrate the definition by providing an example scenario for each.

d.         In class, we talked about the various dues that apply to legal and regulatory compliance. Explain how you could accomplish due care, due diligence, and due process within your business. How would you ensure that you were meeting these standards?

e.         As per our discussion on the different pieces of security polices we discussed the following types:

1.      Acceptable use

2.      Change and Configuration Management

3.      Code Of Ethics

4.      Password

5.      Privacy

What I would like to do is have you think about each of the above policies and try to summarize what you would like to say within each. I want you to boil this down to three statements for each area. If I had to say take the three most important points or sentences from each of the above policies what would those be?

e.      One of the things we discussed as per this chapter was the need to develop a Manageable Network Plan. One of the big tenants of this is to find a way to document your network and its components.

1.      What would you document in your network and why?

2.      Where would you place this documentation and who would have access to it? Why?

3.      Once you have the documentation in place what would you do to manage it and ensure it is updated?

g.      One of the things we have also discussed in terms of this section is the idea of risk. I want you to take your current or past workplace and examine the present risks. I want you to list off five of the main risks that you would state exist in that business. Describe your approach to the risk (such as risk mitigation) and ultimately how you would address it.

h.      One of the considerations when thinking on risks and areas that could compromise an organization is how to maintain continuity during trying or troublesome times. Any downtime when it comes to a business usually results in the loss of money or potentially the organization itself. With this understanding I want you to try to think about this business and list the three methods you would recommend they implement to maintain continuity. Describe each and how they would benefit this purpose.

Module 5

This module is on Physical Security. Answer the following questions based on this topic

1.      The discussion began as to the three factors to consider when it comes to Physical Security these are prevention, detection, and recovery. Define each and describe how you could integrate each within your current or past workplace. How would this implementation benefit the organization?

2.      We discussed various physical controls that you might deal with within an organization, they include:

a.      Perimeter Barriers

b.      Doors and Locks

c.      Access Logs

d.      Access Controls

e.      Visitor Controls

3.      I want to think about a workplace you have had experience in and analyze them in the above areas. What did they do well? What areas would you improve and why? How would these improvements make the business better?

4.      One of the major concerns with physical security is restricting local access to the computer systems. We talked about a few methods to control this within a business. What methods would you use to restrict this access?

5.      Would you allow your employees to sign out equipment such as laptops and bring them home?

a.      If not why and how would you, justify this to the employees?

b.      If yes what would you do to ensure that they contents are protected and how would you have them sign them out?

6.      One of the big concerns when it comes to physical security is the fact that we are moving towards more mobile devices and use them often in the modern workplace. Answer the following questions:

a.      If you owned your own business to what extent would you support mobile devices? Why?

b.      Will you provide these devices or require them to bring their own?

c.      Either way how will you manage these mobile devices?

d.      How will you ensure that the data that is used on these is secure?

7.      In the previous question it was asked if you would provide the devices or have the employees use their own. The following questions deal with the bring your own device concept:

a.      How would you introduce the BYOD concept to your employees? What would you do to show them the benefits for using their own devices to access work related content? Another way to state this is how will you get them on board?

b.      How would you address the idea of control in this BYOD environment? How would you persuade the users to let you have some level of control over their personally owned devices?

c.      What are ways you could instill a safety attitude in your employees to keep them safe while using these devices in their personal and professional lives?

d.      To what extent will you support the devices that the employees are using? Why?

8.      When it comes to mobile devices one of the primary concerns is how to manage these devices and this often leads us to investigate software called mobile device management. In class we discussed a few of these programs such as JAMF and Intune. I would like you to investigate a MDM software and write a summary about it. Something’s to discuss are:

a.      Its features

b.      What separates it from others

c.      User reviews

d.      Any other areas you deem important

9.      What is your opinion on using mobile devices in the workplace?

a.      What concerns do you have?

b.      What benefits do you see?

c.      Do you currently use mobile devices in your work?

i.     If yes how do they enhance your work?

ii.     If no how could you possibly integrate them?

d.      Where do you think these mobile devices will go in terms of the future? Why?

Attached Files: | - KVCC BUS214_InfoSystemsSecurity_Asessment 2.pdf