Part A Please number each question.
1A. Explain the significance of information systems security policies and the challenges and issues associated with ineffective or nonexistent policies in an organization.
B. Propose three methods that organizations can use to increase the acceptance of policies within their organization. Explain the potential challenges to implementing these methods.
C. Examine the classifications of security controls (physical, administrative, and technical) and the types of security controls (preventive, detective, and corrective). Explain how these different types of controls are used to enforce security policies within an organization.
D. Explain the classifications and the type of security controls that are most challenging to implement. Include suggestions for overcoming these challenges.
2A.(https://www.fcc.gov/consumers/guides/childrens-internet-protection-act)
From the e-Activity, describe the purpose of CIPA and whom it applies to. Determine why it is important for people attending schools and libraries affected by CIPA to know which schools and libraries must comply with CIPA versus those that do not.
B. From the e-Activity, determine some of the legal and technical challenges and issues with the implementation of CIPA.
C. Select one of the seven domains of IT responsibility and describe what is encompassed within that domain from a security perspective. Include an explanation of the common security controls implemented within the domain that you selected.
D. Describe the business challenges associated with the domain you selected. Determine the security controls and policies needed to overcome these challenges.
3A. Describe the basic elements of human nature and how they affect information security policy development and impact information security policy implementation issues.
B. Propose at least three ways that organizations can overcome these policy development and implementation issues.
C. Determine the part of an IT security program that you believe is the most challenging for organizations to implement. Justify your reasoning.
D. Analyze the business considerations, information assurance, and information systems security considerations that impact the area that you identified as being most challenging to implement. Provide at least two recommendations for IT management to implement to align the information assurance and security considerations with the business goals.
4A. Select two principles for policy and standards development (accountability, awareness, ethics, multidisciplinary, proportionality, integration, defense-in-depth, timeliness, reassessment, democracy, internal control, adversary, least privilege, continuity, simplicity, and policy-centered security). Examine how these principles would be the same and different for a health care organization and a financial organization.
B. Determine which type of organization would have the most difficulty implementing the principles you selected. Support your answer.
C. (https://resources.sei.cmu.edu/library/asset-view.cfm?assetID=8419)
From the e-Activity, provide a brief explanation of the Operationally, Critical Threat, Asset, and Vulnerability Evaluation (OCTAVE) methods. Explain how they are beneficial for organizations developing their IT risk management approaches.
D. From the e-Activity, explain how the size of the organization impacts the OCTAVE method utilized. B. Determine the factors that large organizations, as opposed to small organizations, are most concerned with.
Part B Case Study
An Acceptable Use Policy (AUP) is a very important policy within organizations to define acceptable employee behavior when accessing company resources. Additionally, there are also legal implications within AUPs. Use an existing AUP that you are familiar with, such as from a current or previous workplace, or search on the Internet for an example AUP to complete this case study.
Write a three to five (3) page paper in which you:
Describe the purpose of an Acceptable Use Policy you have selected and explain how the AUP helps provide confidentiality, integrity, and availability within the organization.
Critique the AUP you selected and provide recommendations for improving the AUP.
Explain methods that organizations can implement to help ensure compliance with the AUP, mitigate their risk exposure, and minimize liability. Describe how your selected AUP accomplishes these goals.
Describe methods for increasing the awareness of the AUP, and other policies, within the organization.