...Week 1, Chapter 1 03/23/2013 1. What is the defining difference between computer sinformation ecurity and security? Information security protects the data, computer security protects the hardware and network security protects the interconnectivity of the computers (Indika, 2011). I do believe that there is a clear distinction between each area but if you not in an IT state of mind like myself when working in a nursing environment as a result then, no, these areas will most likely mean the same thing as in the computer that is protected. Yes, I do believe that each area requires a slight difference in knowledge. Starting with the least: Computer security is having password protection, not leaving passwords visible, and just securing any external devices. Information security is learning how to encrypt and decrypt information, and making backup copies. Reference Indika (2011). “Difference between Network Security and Information Security” Retrieved on 03/23/2014 from http://www.differencebetween.com/difference-between-network-security-and-vs- information-security/ 2. Why can we argue that information security is really an application of social science? In my opinion, information security is an application of social science because most of the information security breaches are not technical in nature but social. A variety of technical scams from a year or so ago like phishing and the Nigerian scam are purely social in nature. 3. A globally...
Words: 425 - Pages: 2
...Joan Didion: What is Home? In Joan Didion’s essay “On Going Home” she writes about leading a double life. She feels like one person when she’s with her husband and daughter in Los Angeles, and a completely different person when back “home” surrounded by her childhood family in the Central Valley of California. During this particular trip, she begins to reflect on her life in Los Angeles. Didion contemplates the fact that she often feels uneasy around her husband, just like he feels uneasy being around her family. At a crossroad, she must decide not only who she is, and the life she wants, but also the kind of life she wants for her daughter. Her life in Los Angeles has cleansed her from her youth—one that was dusty and full of useless trinkets. She ponders the time her husband wrote the word “D-U-S-T” on those useless trinkets and she remembers her feelings of sadness and indignation. She says, “We live in dusty houses…filled with mementos quite without value to him” (139-40). The dust-covered trinkets signify what is important to her, or what needs to be addressed in her marriage. Yet, these objects just lay there waiting for someone to see them—for someone to dust them off and care for them—not unlike how Didion wishes her husband would see her and nurture her in their marriage. Didion wonders which of her two homes is normal or if they are both flawed. When she and her husband are with her family, he becomes apprehensive about her behavior, “…because once there I fall...
Words: 1042 - Pages: 5
...Unit 2 Assignment 1 Window of Vulnerability A window of vulnerability (WoV) is the time that a system or server lacks the proper protection. This window should be as small as possible to prevent any unauthorized access. If a window is ignored it can become a weak spot in a security system and can cripple a system or network. Defining how big the window is and long it will last rely on 4 factors; Discovery-time, exploit-time, disclosure-time, and patch-time. Discovery-time is when the vulnerability is found and recognized. This is the first step in correcting the vulnerability the proper manner. A vulnerability cannot be fixed if you do not know what it is. Exploit-time is when hacker tools, viruses, data, or sequence of commands can bypass the security system. Disclosure-time is when the vulnerability is freely available to the public or has undergone analysis by experts. This is when most of the hacker tools will be attacking the system. Finally, patch-time is when a vendor or originator releases a fix, workaround, or patch for the system. All these factors should be done in as little time as possible to minimize damage and the threat of attacks on the security system. Unit 2 Assignment 2 1. a. Unauthorized access to LAN b. LAN server operating system software vulnerabilities c. Unauthorized access to systems, application, and data d. Rogue user on WLANs e. LAN servers have different hardware, Operating systems,...
Words: 315 - Pages: 2
...Grace xxxxxx IFSM 370 Section 6380 Risk Analysis: Metric Machine Parts and Supplies Corp. This white paper examines the risks and security issues faced by MMPS Company’s strained network and the impact of those risks on the business’s data and functions. This paper would also seek to identify the business problems and evaluate technology solutions that can used to combat those risks. The challenge of mitigating security risks arising from compromised network is brought to focus in this analysis as we evaluate how to effectively build merge new technology solutions to the existing infrastructure for operational improvement. It is not of no surprise that although most businesses long for growth, they do not adequately consider scalability of their technology solutions as part of their ongoing business strategy which ultimately proves to be a costly endeavor when the need arises. The Business Problem Metric Machine Parts and Supplies Corporation (MMPS) is a growing company with over 75, 000 customers across the world cataloging over 100, 000 parts that are typically made available online to its customers. The telecommunications network aspect of the business is outsourced to an outside management company responsible for managing the upkeep of its network. Due to frequent crashes and disruptions, the MMPS is seeking other alternatives to handle the growing problems. The business telecommunication network is incapable of handling the simultaneous orders from its customers...
Words: 2106 - Pages: 9
...1. | Consideration of computer ethics is recognized to have begun with the work of which of the following? a. Joseph Weizenbaum b. Donn B. Parker c. Norbert Wiener d. Walter Maner | | 2. | Which of the following U.S. laws, regulations, and guidelines does not have a requirement for organizations to provide ethics training? a. Federal sentencing guidelines for organizations b. Health Insurance Portability and Accountability Act c. Sarbanes-Oxley Act d. New York Stock Exchange governance structure | | 3. | According to Peter S. Tippett, which of the following common ethics fallacies is demonstrated by the belief that if a computer application allows an action to occur, the action is allowable because if it was not, the application would have prevented it? a. The computer game fallacy b. The shatterproof fallacy c. The hacker's fallacy d. The law-abiding citizen fallacy | | 4. | According to Stephen Levy, which of the following is one of the six beliefs he described within the hacker ethic? a. There must be a way for an individual to correct information in his or her records. b. Thou shalt not interfere with other people's computer work. c. Preserve the value of their systems, applications, and information. d. Computers can change your life for the better. | | 5. | According to Fritz H. Grupe, Timothy Garcia-Jay, and William Kuechler, which of the following represents the concept behind the "no free lunch" rule ethical basis for IT...
Words: 1149 - Pages: 5
...Individual Assignment: Defining Financial Terms • Resource: Financial Management: Principles and Applications • Define the following terms and identify their roles in finance: Finance- A branch of economics concerned with resource allocation as well as resource management, acquisition and investment. Basically, finance deals with matters related to money and the markets. Efficient market- When the information that investors need to make investment decisions is widely available, thoroughly analyzed, and regularly used, the result is an efficient market. This is the case with securities traded on the major US stock markets. That means the price of a security is a clear indication of its value at the time it is traded. Primary market- The primary market is the market for new securities issues. In the primary market the security is purchased directly from the issuer. Secondary market- A secondary market is where investors purchase securities or assets from other investors, rather than from issuing companies. The national exchanges - such as the New York Stock Exchange and the NASDAQ are secondary markets. Risk- Risk is defined as the variability of returns from an investment, the greater the variability (in dividend fluctuation or security price, for example), the greater the risk. Security- Security is collateral offered by a debtor to a lender to secure a loan. For instance, the security behind a mortgage loan is the real estate...
Words: 476 - Pages: 2
...Risk Management – Kentucky Farm Bureau Insurance Christopher Peer CMGT/582 – Security and Ethics John Harvey Overview Kentucky Farm Bureau Insurance is challenged to align security with business requirements. Business operational and financial integrity alongside compliance mandate that adequate and appropriate policy, operational and technical controls are in place to protect the organization and its information assets. To validate that its security and risk management program is effectively managed to business requirements, KFB relies on an effective risk assessment program to evaluate information security, set priorities, identify weaknesses and shortcomings in current processes, and define changes to improve the overall effectiveness of the security program. KFB frequently compares their information security program to others in the same industry sector to provide appropriate guidance on strengths and deficiencies in the program so they can maintain an appropriate level of information security for their business. The Assessment Approach The Kentucky Farm Bureau risk assessment program is based on industry best practices in the areas of information security and risk management. These practices are first introduced to key management and security personnel to develop proper methods for improving the information security program. The assessment starts with the data gathering phase to collect data that will be used to adapt the assessment data model to the KFB environment...
Words: 2717 - Pages: 11
...risk to the security of the Btech Lab and ways to limit the risk of occurrence. One threat that is identified is the unauthorized users that utilize the Lab, the current security access used is a finger print system (Biometrics system) but students bring their friend and open for them which the increases the risk of theft and damage of equipment. Phase 3: The Vulnerability...
Words: 937 - Pages: 4
...While the crime triangle allows for the rating of risk, it does not take consequence into consideration as ISO31000 does. Where the organisation is able to understand how they will be adversely affected by negative risks, there will be a higher level of co-operation to assign resources. Where the consequence is only portrayed in a technical manner and not in line with the organisations strategy and business objective, there will more reluctance to support risk treatment. Organisations must utilise an Enterprise Risk Model that allows for scalability and organisational wide understanding and co-operation. Such a model should be developed enterprise wide and further more adapted for the identification of different types of risks, such as security risks. ISO31000 better suits such a requirement in comparison to the crime triangle that specifics risks as crime. It is imperative to understand that risks are not always perceived as crimes and utilise a model that allows for this. Risks are often guided by uncertainty and it is imperative for organisation to utilise as much information relating to the risk as possible as too much uncertainty pollutes the risk and its consequence. Organisations must use a model that provides some form of certainty and utilises historical data where as many factors can be historically quantified as possible. Such a model allows for a standardised approach to risk management and prioritisation across the organisation which in turn allows for treatment...
Words: 3417 - Pages: 14
...major organizational challenges of forming a sound information security program, and ascertain the fundamental manner in which regulations and compliancy may factor into the challenges in question. * From the e-Activity, compare and contrast quantitative, qualitative, and hybrid risk assessment methodologies overall. Give one (1) example of when you would use each of the methods over the others. Justify your response. In my opinion, from a management perspective, in order for an organization to implement a sound information security program after analyzing the company in its entirety, the attention must focused on the key components that influences the operations of systems and the behavior of the employees. The requirements needed to produce a solid security program would need to address “Security Controls, Confidentiality Integrity Availability (CIA), Defense in Depth, Single Points of Failure, Fail Open Fail Closed Fail Soft, and Privacy” (Gregory, 2010). With these systems implemented correctly, the results would provide a more secure and efficient security management system within the organization. In regards to challenges, organizations whether small or large businesses face compliance challenges with regulations concerning IT security. Keeping up with regulations presents many challenges to organizations because of the ever evolving IT vulnerabilities and threats that continue to challenge corporate security policies and defense. “Due to the increase in regulatory oversight...
Words: 586 - Pages: 3
...programs. RICHARD RAYSMAN JOHN ROGERS PARTNER HOLLAND & KNIGHT LLP CHIEF TECHNOLOGIST BOOZ ALLEN HAMILTON INC. Richard’s practice concentrates on computer law, outsourcing, complex technology transactions and intellectual property. He has significant experience in structuring technology transactions and has represented clients in billions of dollars of outsourcing transactions in addition to litigating reported cases. Richard is a guest contributor to The Wall Street Journal on technology issues, and Chambers has selected him as a leading technology attorney. Prior to practicing law, Richard was a systems engineer for IBM Corporation. © 2015 Thomson Reuters. All rights reserved. John has extensive information security experience in a variety of industries including financial services, retail, healthcare, higher education, insurance, non-profit and technology services. He focuses on improving client cybersecurity programs, assessing these programs against industry standards, designing secure solutions and performing cost/benefit analyses. Practical Law The Journal | Transactions & Business | June 2015 37 D espite major efforts to prevent cyber attacks, no common standard of care exists yet for organizations to assess their cybersecurity programs. While global cybersecurity spending is expected to exceed $50 billion in coming years, the proliferation of high-profile data breaches continues and remains a growing concern...
Words: 4438 - Pages: 18
...Dr. Michael Workman Information Security Management RISK ASSESMENT Information systems have long been at some risk from malicious actions or inadvertent user errors and from natural and man-made disasters. In recent years, systems have become more susceptible to these threats because computers have become more interconnected and, thus, more interdependent and accessible to a larger number of individuals. In addition, the number of individuals with computer skills is increasing, and intrusion, or “hacking,” techniques are becoming more widely known via the Internet and other media. Arisk assessment is not about creating huge amounts of paperwork , but rather about identifying sensible measures to control the risks in your workplace. You are probably already taking steps to protect your employees, but your risk assessment will help you decide whether you have covered all you need to. Think about how accidents and ill health could happen and concentrate on real risks – those that are most likely and which will cause the most harm. For some risks, other regulations require particular control measures. Your assessment can help you identify where you need to look at certain risks and these particular control measures in more detail. These control measures do not have to be assessed separately but can be considered as part of, or an extension of, your overall risk assessment. Although all elements of the risk management cycle are important, risk assessments...
Words: 3691 - Pages: 15
...Executive Summary 2 Company Overview 2 Two Security Vulnerabilities 3 Recommended Solutions 3 Summary 4 Citation: 5 Executive Summary The purpose of the report is to assist Aircraft Solutions (AS) in identifying the most significant Information Technology (IT) security vulnerabilities. AS products and services are at the forefront of the industry and the protection of such is very important as they are an industry leader. The vulnerabilities that will be discussed are those of the Aircraft Communications Addressing and Reporting System and defining security policy regarding the timeliness of firewall configuration and updates. Company Overview Aircraft Solutions (AS) is a recognized leader in the design and fabrication of component products and services for companies in the electronics, commercial, defense, and aerospace industry. Located in Southern California, AS has a dedicated, trained workforce and maintains a large capacity plant and extensive equipment to meet customer requirements. Much of the equipment is automated to increase production while reducing costs. The company's workforce has a large skill base: design engineers, programmers, machinists, and assembly personnel to work its highly-automated production systems. The mission of AS is to provide customer success through machined products and related services, and to meet cost, quality, and schedule requirements. Aircraft Solution uses Business Process Management (BPM) to handle end to end...
Words: 699 - Pages: 3
...Risk Management Kathy Austin University of Phoenix AJS/562 August 05, 2014 Richard Nuckles Risk Management “Risk assessment analysis is a rational and orderly approach as well as a comprehensive solution to problem identification and probability determination. While it is not an exact science, it is, nevertheless, the art of defining probability in a fairly precise manner” (Broder, 2013 (p. 1). Risk management is a systematic, analytical process considering the likelihood of risky events, actions to reduce the risks, and to mitigate the consequences of the event. Although risk cannot always be described or eliminated management can enhance the protection from known or potential threat. The three elements involved in determining potential risk are assessment of threat, vulnerabilities, and criticality. The following will address the three potential risks for management in justice and security organizations. Planning for the risk, cost, benefits, and the role of nature in management’s risk assessment (Decker, 2001). Planning for Risk and Identifying Resources When planning for risk the first step for management is to determine the risk and decide what is an acceptable amount of loss. The basic tasks of risk management are to identify the assets needing protection, kinds of risk, probability of a risk occurrence, and dollar value affecting the organization. When identifying the assets people, money, manufactured products, and industrial processes, are just a few items...
Words: 559 - Pages: 3
...STUDENT NUMBER: 066275 CLOUD COMPUTING SECURITY TERM PAPER TWO Living with Increasing Attacks on Cloud Computing Platforms Cloud Computing is an on demand, flexible and cost friendly delivery platform that has provided IT consumers and organizations services such as networks, storage, servers and applications over the Internet. Its importance is increasing as a large number of industrial and technological communities are rapidly adopting it. The benefits such as low cost and convenience of cloud computing services have significantly changed our day to days activities, however, there are numerous security issues facing cloud computing making it difficult to maintain data security and privacy, support data and service availability and demonstrate compliance. These issue also make cloud vulnerable to exploitation by attackers. The three cloud services models used today are Software as a Service (SaaS), Platform as a Service (PaaS) and Infrastructure as a Service (IaaS).Iaas provides the most dynamic functionality since it is based as the underlying layer in cloud. It widens the resilience for users to design a practical environment that includes virtual machines running with different operating systems. This may pose as a vulnerability since an attacker could lease these virtual machines, analyze their configurations, find their vulnerabilities, and attack other customers’ virtual machines within the same cloud. Brute force and Distributed denial of service (DDoS) attacks could...
Words: 1310 - Pages: 6