Unit 9 Lab Recommend IT Security Policies to Help Mitigate Risk
IS3350

1. Which IT assets did you prioritize as critical to administrative or student computing? I prioritize the file servers and the teachers’ notebook as critical to administrative and student computing. 2. List your top five (5) risk exposures for which you believe this school should have specific risk mitigation strategies. - No firewall - Unauthorized access to school computers - Open connections on the WLAN. - The principals traveling notebook can carry a virus - wireless access security 3. Given the potential risks that you identified, what IT security policies would you recommend be created by the school to help mitigate each of the identified risk exposures you listed in #above? I would say create an AUP and a policy that implements the encryption of the file servers. First and foremost a comprehensive security policy that takes into consideration the variables and factors at the school. This includes students, teachers, physical access, layout of the school and property, security measures as defined by FERPA, HIPAA, etc. A password policy needs to be in place that stresses complexity, minimum length (recommendations) and recycling or expiring passwords. This could be accomplished with a minimum length of 8 characters, one being a capital letter, one being a number, and one being a special character. Physical security should be setup in a way that there are locked, secured doors to all entrances of the school (roof, side, non-viewed storage or work areas, etc.)

4. True or False. FERPA compliance law is about protecting the primary data of students including personal information, grades, and transcripts. The law itself defines a privacy requirement but it does not specifically address security controls and security countermeasures. True 5.