SECURITY POLICY & STANDARTS

The seven domains of a typical IT infrastructure include the User Domain, Workstation Domain, LAN Domain, LAN-to-WAN Domain, WAN Domain, Remote Access Domain, and System/Application Domain. As you’ve learned, each domain has business, technical, and security policy challenges that affect organizations.

Answer the following question(s):

  1. What is an advantage of organizing IT security policies by domain?
  2. Do you think one domain is more challenging than the others as far as applying security policies? Explain your answer.

Importance of Security Policies

Learning Objectives and Outcomes

Explain the importance of information security policies and the role they play in ensuring sound and secure business information.
Assignment Requirements

Answer the following question(s):

1.Think about how you would feel if there were no rules regarding how your credit card information was stored on merchants’ websites. Consider whether you would purchase items online. Would the Internet be as big as it is today if we had no laws or information security policies regarding data that makes up an e-commerce transaction? Provide rationale for your answer.

2.Imagine that you work for an organization that has no Internet use policy. Employees use the Internet in whatever way they want using company-owned personal computers. Could this cause a problem for the organization? Why or why not?

Child Pornography is found on a corporate computer

1.If Child Pornography is found on a corporate computer, what should an employee avoid doing?
2.What should a corporate computer, e-mail and Internet user policy contain?
3.Do you think that chain of custody places an undue burden on investigators of crime scenes? Why or why not?
4.Why should the qualifications of potential witnesses be evaluated? What happens when attorneys fail to do so?
5.Are deleted files ever really gone? Why or why not?

Laws Influencing Information Security and Privacy in the Financial Sector

 

Select one American financial institution that frames your research. Describe the organization, its business(es), its scope, and any additional descriptive information that will inform your reader about your subject matter.
Describe and define at least one the laws focused on compliance within the financial sector that came up during our course. Research the law itself, any legal cases that were based on that law, and the critique of the law that you found through your research. Of course, if your selected financial institution was involved in such litigation, or has published their critique, include that information too.
In addition to compliance laws that directly target financial institutions, countless other laws apply to them. Use the U.S. Patent and Trademark Office’s website to discover whether your selected institution has been awarded intellectual property rights for their trademarks, patents, or IP. Describe whether and how it protects its trade secrets. Describe for your reader some of the most prominent criminal or tort risks that your entity faces; or perhaps has been involved in.
In addition to risks in the realms of criminal or tort law, every organization faces the potential risk of enduring a cyber-attack or other incident that must be followed by a forensics investigation. Keeping the focus on your organization and the financial sector, research and discuss an incident or case in which such an institution was compelled to go through the forensic investigation process. There are no sectors exempt from those incidents or cases, regrettably, so be diligent and you will find one to discuss.
Conclude the Portfolio with your overall assessment of whether the legal system—from compliance mandates, to IT, criminal, and tort laws, to forensic investigations—benefits, hurts, or otherwise affects the organization. Assume the role of information security and privacy risk consultant in this section.

 

Regulating the Internet

 

 

 

 

 

Describe methods governments have tried to regulate the Internet, and the difficulties they have experienced. Include in your discussion antitrust, taxation, and regulation of user-generated content. What are arguments for and against net neutrality? See my Twitter feed for recent decisions related to regulations.

Getting an attacker’s agent installed

 

 

 

 

 

If an attacker can retrieve the API and libraries, then use these to write an agent, and then get the attacker’s agent installed, how should Digital Discuss protect itself from such an attack? Should the business analytics system provide a method of authentication of valid agents in order to protect against a malicious one? Is the agent a worthy attack surface?