Iris called the company’s security hotline. The hotline is an anonymous way to report suspicious activity or abuse of company policy, although Iris chose to identify herself. The next morning, she was called to a meeting with an investigator from corporate security, which led to more meetings with others from corporate security and then with the director of human resources and Gladys Williams, the CIO of SLS. Should Gladys call the legal authorities? Which agency should she call?

Iris called the company’s security hotline. The hotline is an anonymous way to report suspicious activity or abuse of company policy, although Iris chose to identify herself. The next morning, she was called to a meeting with an investigator from corporate security, which led to more meetings with others from corporate security and then with the director of human resources and Gladys Williams, the CIO of SLS. Should Gladys call the legal authorities? Which agency should she call?

Management Of Information Security

6th Edition

ISBN:9781337405713

Author:WHITMAN, Michael.

Publisher:WHITMAN, Michael.

Chapter10: Planning For Contingencies

Section: Chapter Questions

Problem 1EDM

See similar textbooks

Similar questions

Iris called the company’s security hotline. The hotline is an anonymous way to report suspicious activity or abuse of company policy, although Iris chose to identify herself. The next morning, she was called to a meeting with an investigator from corporate security, which led to more meetings with others from corporate security and then with the director of human resources and Gladys Williams, the CIO of SLS. Should Iris have approached Henry directly, or was the hotline the most effective way to take action? Why do you think so?
Fred Chin, CEO of sequential label and supply, leaned back in his leather chair and propped his feet up on the long mahogany table in the conference room where the SLS Board of Directors had just adjourned their quarterly meeting.“What do you think about our computer security problem?” he asked Gladys Williams, the company’s chief information officer, or CIO. He was referring to last month’s outbreak of a malicious worm on the company’s computer network. Gladys replied, “I think we have a real problem, and we need to put together a real solution, not just a quick patch like the last time.” Eighteen months ago, the network had been infected by an employee’s personal USB drive. To prevent this from happening again, all users in the company were banned from using USB drives. Fred wasn’t convinced. “Can’t we just add another thousand dollars to the next training budget?” Gladys shook her head. “You’ve known for some time now that this business runs on technology. That’s why you hired me as…
To learn more about your institution's security rules, look them up on the intranet or website. Is there a corporate security policy somewhere? Where have you come across security rules that are tailored to address a particular problem? What agency or department is in charge of issuing or coordinating all of these policies, or are they dispersed across the organization? Use the framework provided in this chapter to determine whether or not the policies you found in the preceding exercise are complete. What are the omissions in these areas?
Where do you think an organization's information security begins and ends, in your opinion? To put it another way, when does a company's security policy and measures go into effect, and when do they stop? Do you think any of these restrictions will be lifted in the future? Explain how and why this is the case if this is the case. What would be the reason if that was not the case?
Where in a business do you think the responsibility for information security starts and ends? The organization's control decides when security policies and measures go into effect and when they go out of effect, respectively. Do you believe any of these limits should be further widened or widened? If that's the case, how did you go about it? If that's not the case, what's going on?
Give specifics about a current security breach in the news concerning access control or authentication. Has it had a negative influence on the company's day-to-day operations? Is there any specific harm that the firm has suffered as a result of this?
1. You've just been hired as a Chief Information Security Officer for a small startup. They've written four applications and just got funding to go live. Before they do so, they realized they've never had a cybersecurity professional, so they've hired you. While there are hundreds of things to do, you are asked to come up with a list of your top TEN (10) items, in a bulleted list, to focus on in the first day or two. These can be questions to ask or actions to take, and aren't meant to be the full solution, but the initial things you'll do to get control of the situation. Provide a NUMBERED LIST of TEN (10) items that is your initial list of priority areas to focus on and potential actions to take. Do not use more than one line per item. Many aswers are correct, so credit is given for coming up with ten good and comprehensive focus areas based on what we've covered in class, in the labs, and in our readings.
What do you mean when you say "network security," and how do you describe it?In your argumentation, justify the adoption of the industry-standard data encryption technique.
What do you mean when you say "network security," and how do you describe it? In your argumentation, justify the usage of the industry-standard data encryption technique.
Assume you are an information security professional for a corporation. You have been asked to review responses and recovery from real security incidents. In addition, senior management wants a summary of the types of tests you have run on the organization's computer incident response team (CIRT) plan, the results, and lessons learned.Why would senior management want to know how a CIRT plan has been tested and the results?
You were been given the position of Chief Information Officer at your organization. In your role as Chief Information Security Officer, the first thing you'll need to do is provide recommendations for how your company can protect its data from being lost on purpose or by mistake. Kindly suggest any precautions that might be taken to protect the information of your firm.
What are the specific goals that we want to accomplish with this authentication procedure? Give an explanation of both the positives and negatives associated with each authentication technique that you've investigated.