1. You must be aware of what the risks, threats, and vulnerabilities are to your infrastructure so that you know where the most attention is needed

2. Setting up security measures through various means. Forcing users to update password every X number of days. Educating users. Firewalls Anti-malware

3. Common things such as user activity can be a huge risk, so it’s best to consider all options as potential threats with some being higher and lower than others.

4. Disable auto-run, deny USB storage devices for users, and restrict installation rights from within Active Directory

5. Security baselines are security settings which establish duties, but nothing else.

6. What are your plans/goals? What will the budget cost be?

7. Evaluating risk interactions and common causes because if you don’t know what the risk is, you can’t possibly mitigate it.

8. All short-term mitigation tasks need to be implemented immediately. Long-term mitigation tasks should be implemented immediately following all critical tasks. On- going is exactly that, the tasks involved here are part of day-to-day operations and need to be handled.

9. User Domain

10. System-Application

11. WorkStation

12. Because it allows users to access the private network

13. Because you do not know how it will react to the already implemented software. Just because there is a security does not mean you install it to the live servers. You basically need to know how well it plays with the rest of the system

14. Yes. You want a reference point.

15. Very crucial because compliance laws can be strict and carry heavy penalties if not followed. You do not want the company to incur fines because of laws that can be