CIS 462 Midterm Exam

Strayer CIS 462 Security Strategy and Policy, Midterm Exam, Security Policies and Implementation Issues
Exclusive and Original document Available only on Course Answer

Download Now
(sent via email)

Discussion 1

Describe the main elements of an acceptable use policy. Determine the factors that organizations need to consider when developing their acceptable use policy. An acceptable use policy defines what the intended use of an organizations computers and networks. They should also define what is considered acceptable use and the penalties for violations of policies. It should also include password management, and software licenses. It should also cover the misuse of resources and the overuse of resources. It should include the proper etiquette to be used when interacting with others like through e-mail or and organizations bulletin board. Determine the special considerations that need to be taken into account when developing the acceptable use policy for different types of users (i.e., employees, system administrators, security personnel, contractors, guests, and auditors). No matter what position is held in an organization each employee has their own unique credentials to identify that they are who they say they are. Employees with administrative rights should be made to sign a privilege-level access agreement (P AA) that hold them accountable to keep their information safe. End should know the basics of information security and what risk there is and be kept informed of the latest threats. Auditors need access to logs, security reports and configuration information. They may also need to capture evidence and would need permission to do so. Contractors are usually temporary and still need to be made aware of and adhere to policies. They should only be granted access to what they need, when there contract is up all access that they had to the organizations computer systems should be taken away.Security personnel need to have access to a wide variety of information like how security controls are working, access to logs and information about configurations. Guests also need to be made aware of and adhere to policies, and only have access to what a guest would need. The least privilege principle can be followed to make sure people are only granted privileges to accomplished their tasks and no more.

Discussion 2

Imagine that your supeiVisor has asked you to draft a brief statement about best practices for user domain policies that will be presented to the executive board. Create five best practices for user domain policies. Select the best practices that you would emphasize the most during this presentation to the executive board and explain why. It is important to adopt best practices for several reasons. By managing and reducing risk exposure, an organization can experience a more competitive advantage over other organizations in the same industry. This advantage can strengthen the organization’s brand, its portfolio to attracting new investors and increasing the organization’s stock value. These are five examples of industry-adopted Security and Privacy Controls from the National Institute of Standard and Technology (NIST), SP800-53 Rev 4ยท These best practices can be further enhanced: least privilege, patch management, virus protection, unique identity and layered defense. Least Privilege: The organization employs the principle of least privilege, allowing only authorized accesses for users (or processes acting on behaH of users) which are necessary to accomplish assigned tasks in accordance with organizational missions and business functions. Patch Management: The organization employs mechanisms to maintain an up-to-date, complete, accurate, and readily available baseline configuration of the information system that addresses managing security patches. A patch management process shall be implemented to track, evaluate, and install security patches for applicable assets. Patches that cannot be immediately patched a mitigation plan will be established and monitored to ensure completion. Virus Protection: The organization employs malicious code protection mechanisms at information system entcy and exit points to detect and eradicate malicious code. Conducts updates malicious code protection mechanisms as new releases become available. Configures malicious code protection systems to run scans on attachments and alert on when malicious code is detected in the network. Addresses false positive alerts and establishes countermeasures to improve alerting results. Unique Identity: The organization’s systems uniquely identify and authenticate users. The systems implement multifactor authentication for network access to privileged accounts. The systems implements multi-factor authentication for remote access to privileged and non-privileged accounts such that one of the factors is provided by a device separate from the system gaining access and the device meets organization established requirements. Layered Defense: The organization employs a strategic approach of layering it’s defenses with several security controls to safeguard data, network and systems. I would emphasize instituting a “layered defense” best practice since this control involves employing a combination of several best practice security controls that would operate in concert. In the event one mechanism fails, the additional layers of security will protect the organization and may provide additional time for response and potentially slow or stop any further breach.