•What are some of the security considerations in this conversion? 

•What are some of the ethical and legal ramifications of keeping files with a person's name attached? 

•What might be a better way of extracting (and storing) this information to ensure maximum security and control? 

•Are there major differences between the two techniques? 

•Are all messages critical or would encryption/authentication be applied only to certain transmittals? If so, which ones? 

•Will these processes slow down operations? 

•What other safeguards should be considered? (Provide 3 suggestions)

Case 3

Bishop Enterprises

Bishop Enterprises, located in Seattle, Washington, is a medium-sized business specializing in building concrete structures (storage building, bridges, utility buildings, and various defense-related installations). 

Peter Bishop, president of the company, states that security of its computer systems is critical due to the competitiveness of the commercial concrete industry and the need to protect defense-related information. BE's computer system, as is typical of many, grew on an ad hoc basis as the company grew. Security was not an issue in the early days when there were only a few key employees and the day-to-day, hands-on-management style assured constant vigilance. Mr. Bishop now feels that a solid security package should be added to ensure the ongoing protection of the computer operation. 

Mr. Bishop has assigned the task of evaluating several security packages to the director of computer operations, James Clarke. The four objectives that Mr. Clarke has defined for the package selected are: 

1Accountability 

2.Auditability 

3.Integrity 

4.Usability 

What factors should be included in an official policy statement sent out with the request for proposal to the vendors? Write a clear and concise statement so that the vendor is able to respond correctly. 

Question B1

Policymakers need to take into account a number of considerations, among them the rationale for a policy, available resources, the policy direction, budgetary and legal requirements, and expected policy outcomes. With these considerations, discuss and illustrate the life cycle of information security policy.

Question B2

With example, discuss step by step ways to identify whether your business information or system may have been attacked.  

[10 Marks]

Question B3 

Consider the Question 2 above. Assuming that the attacks was successfully identified, discuss an effective way of mitigating and minimising damage from the attacks. Also suggest what one can do to prosecute the offender of the attacks.   

Read less