SEC 402 Final Exam

Strayer SEC 402 Cyber Security, Final Exam, Cybersecurity: The essential body of knowledge
Exclusive and Original document Available only on Course Answer


Download Now
(sent via email)



Discussion 1

Propose three ways to ensure that cooperation occurs across security functions when developing a strategic plan. Select what you believe is the most effective way to promote collaboration and explain why. The frrst thing that comes to mind when I think of cooperation across security functions are the three (3) main security control types, i.e., administrative, technical and physical. Obviously, there are more but, these particular control types essentially have the common goal and mission of protecting a company and its assets. Not only that they interact in such a way to achieve the goals in which they were created to protect which is confidentially, integrity and availability. With this understanding when developing a strategic plan, each plan must be tailored in such a way to include each of the controls and more if need be. I believe three (3) ways to best accomplish this is to: 1. Information Security- Identify common denominators that are addressed in the other two (2) when considering strategic plans. {COOP, DRP, IRP)-Inside/Outside Cyber Threats a. Administrative = training, awareness, policies, procedures b. Technical = training, awareness, policies, procedures c. Physical = training, awareness, policies, procedures, exercise scenarios 2. Technical Security- Identify common denominators that are addressed in the other two (2). Identify common denominators that are addressed in the other two {2) when considering strategic plans. (COOP, DRP, IRP)-Inside/Outside Cyber Threats a. Administrative = training, awareness, policies, procedures b. Technical = training, awareness, policies, procedures c. Physical = training, awareness, policies, procedures, exercise scenarios 3. Physical Security -Identify common denominators that are addressed in the other two (2). -Identify common denominators that are addressed in the other two (2) when considering strategic plans. (COOP, DRP, IRP, Active Shooter) a. Administrative = training, awareness, policies, procedures b. Technical= training, awareness, policies, procedures c. Physical = training, awareness, policies, procedures, exercise scenarios I believe the most effective way to promote collaboration among all programs are going to be by way of communication and constant auditing; with leadership buy-in and management tracking (Quarterly and Annually) will certainly sustain a successful program for each of these platforms. Explain what may happen if working cultures are overlooked when developing a strategy. Recommend one way to prevent working cultures from being overlooked. When working cultures are overlooked or not included in the process or taken into consideration it is much like the concept; “Well, it doesn’t work so it’s obviously broken” this is not necessarily the case. Which is the very reason why standardization and uniformity needs to be taken into account. Take for example, the military; for a number of years they had for each installation their own network they were responsible for i.e., (patching, security (logical/technical/physical, boundary protection etc.) It was costly, chaotic and not standardized … and when individuals moved from one (1) installation to another, what worked efficiently for one (1) base may not have been implemented or worked for another because the platforms was different. Not to mention the personnel were only educated or trained to understand that platform. Since that debacle the military got smarter and opted for more of a unified/standardized platform along with protocols for policies and procedures. When you allow organizations/installations to go rouge then uniformity and standardization doesn’t work. By having management buy-in and putting in place protocols that everyone is to follow then the need to work harder not smart concept is preventable … and not overlooked.

Discussion 2

“Installing Security with System and Application Development” Please respond to the following: • Provide three examples that demonstrate how security can be instilled within the Systems Development Life Cycle (SDLC). Provide two examples on what users may experience with software products if they are released with minimal security planning. Specification Phase – In this phase you need to understand the functional security requirements and the security requirements that the application needs to possess. Design Phase – During the design phase you will identify any security defects that are created and need to be fixed. Testing Phase – In the testing phase you can assure that the security controls implemented are working as designed. Users could experience issues while accessing the new application if the security controls are not implemented and tested properly. They may also experience a very bed user experience if the security controls impact their ability to do their work either through slow performance or having to login multiple times to the same product. • Suggest three ways that application security can be monitored and evaluated for effectiveness. Choose what you believe to be the most effective way and discuss why. Patching Application -You need to make sure that your applications are being kept up to date with vendor supplied updates and patches. Operating System Patches – You need to make sure that the server OS is being patched on a regular basis to prevent any exploits. Auditing – Security should perform regular audits of the systems and provide the application owners with the audit reports for remediation.