Tutorial/Practical 3 (Week 4) – CP3302/CP5603
Remarks: • This tutorial/practical consists of some tutorial-type questions that are chosen from ‘Review Questions’ in Chapter 4 of the textbook, as well as some practical-type questions that are chosen from: Michael E. Whitman and Herbert J. Mattord, Hands-On Information Security Lab Manual, (third edition), Course Technology, Cengage Learning, USA, 2011. • This tutorial/practical may not be completed in the scheduled practical session for this subject. So you are strongly recommended to complete it in your own time (note that students are expected to work 10 hours per week on this subject, including 3 hours of contact time). • Due to security issues, you may not be allowed to practise all commands and programs of the practical-type questions with the university’s computers. So, interested students are encouraged to do this section on their own computers (if available). You will not be assessed for utilities/commands that cannot be practised on university computers.

1. (Review Question 1) What is risk management? Why is identification of risks, by listing assets and their vulnerabilities, so important to the risk management process? 2. (Review Question 3) Who is responsible for risk management in an organization? Which community of interest usually takes the lead in information security risk management? 3. (Review Question 4) In risk management strategies, why must periodic review be a part of the process? 4. (Review Question 5) Why do networking components need more examination from an information security perspective than from a systems development perspective? 5. (Review Question 6) What value does an automated asset inventory system have for the risk identification process? 6. (Review Question 8) Which is more important to the systems components classification scheme, that the list be comprehensive or mutually