Describe the main differences between Computer Security and Information Security

Solution.pdf

Part ONE 

Discuss the following questions base on the case study provided. 

Discuss and answer the following 2 questions. 

1. Describe the main differences between Computer Security and Information Security. Define and 

describe key elements in Information Security. 

2. Describe and define the key characteristics of information security management in an organization. 

In discussing this topic, consider the following points that may help you frame your answer: 

a. What information assets need to be protected in the organization described in the Case Scenario? 

b. Why do these information assets need to be protected? What are the implications if these information 

assets are not protected? 

c. How can these information assets, (in the organization described in the Case Scenario) be protected? 

Discuss in relation to CIA triangle and how that relates to the use of information technology in managing 

and providing access to the organisation's information user. 

d. Identify personnel that are responsible for the protection of these information assets. 

e. Identify key (specialised) areas of security within the organization described in the Case Scenario. 

Deliverables 

The report should be integrated as required into the single Case Study, Security Plan assignment (report 

on the fictional organization scenario). This topic’s work should form the basis of a preface and 

introduction to the security plan assignment. 

• Must include, References and corresponding in-text citations using APA referencing style. 

• Include appropriate citations throughout the paper and a list of references at the end. Referencing should be in APA style. 

• Your paper should include a minimum of 14 references. 

• Only 4 of the references can be news articles, textbooks, websites such as CNET or government websites etc. otherwise all other references MUST be academic/scholarly. 

• Scholarly references can be found via Google Scholar, published no earlier than 2011. 

• Wikipedia and references from essay or assignment websites are NOT valid references. ZERO marks will be awarded (to the entire topic discussion) for use of such references. 

1 

Table 1: Description and responsibility 

Role Brief Description of Each Role Each student must prepare a report related to their business 

unit (eg CIO, CSO etc). The report should be integrated into a single Security Plan (which will include a report from all roles, the CEO, Director Sales & Product, CIO, CSO, Director Back Office and Legal Officer’s report). Chief Executive Officer CEO) 

This position is of great responsibility. The CEO is responsible for the company and the people within the company. Their job is to ensure that everybody within the company contributes equally to the weekly discussion, ensures that the discussions stays on track and in the event of disagreements in discussion have the final say in decision making. They are also responsible for vetting through any written work before submission for grading. 

Using the template provided on page 6 of this document: The CEO of the group must prepare a report related to the security threats that affects your business unit (e.g., the company’s reputation etc -- see description of your department and role). First, carefully read the case study scenario. The case study have many security vulnerabilities that need to be addresses. The CEO must assess the case study, and prepare a detailed report (not a list of items, you must provide a detailed discussion). Based on the vulnerabilities in the case study, i) consider what type of technical attacks, physical attacks, human related attacks and processes and procedure attacks; ii) consider what information assets need to be protected in your business unit, and iii) what sort of technical and non-technical countermeasures you would recommend in protecting the information assets. As a CEO, prepare a report (not bullet points), covering the following in relation to your business unit: Technical risks 1. Identify and describe at least two information security threats of a technical nature 2. Discuss how each of the two technical threats will affect your business unit 3. For each threat, provide one real-world example of a recent security attack/breach and the impact caused in the real-world security attack. 4. Provide reference and in-text citation for the above 5. Describe and recommend countermeasures to mitigate the two identified threats 

Do the same (above steps 1 to 5) for - Technical risks - Physical risks - Human resource risks - Processes, procedure and policy risks 

Director-Back Office 

The Director - back office is responsible for all the administrative functions/departments within the company (e.g. HR, accounting, finance). Their job, during the discussion sessions, is to advise the CEO and the rest of the team on anything concerning those departments. 

Using the template provided on page 6 of this document: The Director-Back Office of the group must prepare a report related to the security threats that affects your business unit (e.g., HR functions etc -- see description of your department and role). First, carefully read the case study scenario. The case study has many security vulnerabilities that need to be addressed. The Director- Back Office must assess the case study, and prepare a detailed report (not a list of items, you must provide a detailed discussion). Based on the vulnerabilities in the case study, i) consider what type of technical attacks, physical attacks, human related attacks and processes and procedure attacks; ii) consider what information assets need to be protected in your business unit, and iii) what sort of technical and non-technical countermeasures you would recommend in protecting the information assets. As a Director- Back Office, prepare a report (not bullet points), covering the following in relation to your business unit: Technical risks 1. Identify and describe at least two information security threats of a technical nature 2. Discuss how each of the two technical threats will affect your business unit 3. For each threat, provide one real-world example of a recent security attack/breach and the impact caused in the real-world security attack. 4. Provide reference and in-text citation for the above 5. Describe and recommend countermeasures to mitigate the two identified threats 

2 

Do the same (above steps 1 to 5) for - Technical risks - Physical risks - Human resource risks - Processes, procedure and policy risks 

Chief Information Officer (CIO) 

The CIO is responsible for the overall IT infrastructure of the company. However, since many functions of IT security overlap with the general security of the company, the CIO is expected to work closely with the CSO to resolve any potential issues. The CIO is to advise the CEO and the rest of the team on all IT related matters during the discussion sessions. 

Using the template provided on page 6 of this document: The Chief Information Officer (CIO) of the group must prepare a report related to the security threats that affects your business unit (e.g., the network topology, etc -- see description of your department and role). First, carefully read the case study scenario. The case study has many security vulnerabilities that need to be addressed. The CIO must assess the case study, and prepare a detailed report (not a list of items, you must provide a detailed discussion). Based on the vulnerabilities in the case study, i) consider what type of technical attacks, physical attacks, human related attacks and processes and procedure attacks; ii) consider what information assets need to be protected in your business unit, and iii) what sort of technical and non-technical countermeasures you would recommend in protecting the information assets. As a CIO, prepare a report (not bullet points), covering the following in relation to your business unit: Technical risks 1. Identify and describe at least two information security threats of a technical nature 2. Discuss how each of the two technical threats will affect your business unit 3. For each threat, provide one real-world example of a recent security attack/breach and the impact caused in the real-world security attack. 4. Provide reference and in-text citation for the above 5. Describe and recommend countermeasures to mitigate the two identified threats 

Using the template provided on page 6 of this document: The Chief Information Officer (CIO) of the group must prepare a report related to the security threats that affects your business unit (e.g., the network topology, etc -- see description of your department and role). First, carefully read the case study scenario. The case study has many security vulnerabilities that need to be addressed. The CIO must assess the case study, and prepare a detailed report (not a list of items, you must provide a detailed discussion). Based on the vulnerabilities in the case study, i) consider what type of technical attacks, physical attacks, human related attacks and processes and procedure attacks; ii) consider what information assets need to be protected in your business unit, and iii) what sort of technical and non-technical countermeasures you would recommend in protecting the information assets. As a CIO, prepare a report (not bullet points), covering the following in relation to your business unit: Technical risks 1. Identify and describe at least two information security threats of a technical nature 2. Discuss how each of the two technical threats will affect your business unit 3. For each threat, provide one real-world example of a recent security attack/breach and the impact caused in the real-world security attack. 4. Provide reference and in-text citation for the above 5. Describe and recommend countermeasures to mitigate the two identified threats 

Do the same (above steps 1 to 5) for - Technical risks - Physical risks - Human resource risks - Processes, procedure and policy risks 

Chief Security Officer (CSO) 

The CSO is responsible for the overall security of the company except for anything related to IT. However, since many functions of general security overlap with IT security, the CSO is expected to work closely with the CIO to resolve any potential issues. The CSO is to advise the CEO and the rest of the team on all security related matters during the discussion sessions. 

Using the template provided on page 6 of this document: The Chief Security Officer (CSO) of the group must prepare a report related to the security threats that affects your business unit (e.g., IT Security functions, etc -- see description of your department and role). First, carefully read the case study scenario. The case study has many security vulnerabilities that need to be addressed. The CSO must assess the case study, and prepare a detailed report (not a list of items, you must provide a detailed discussion). Based on the vulnerabilities in the case study, i) consider what type of technical attacks, physical attacks, human related attacks and processes and procedure attacks; ii) consider what information assets need to be protected in your business unit, and iii) what sort of technical and non-technical countermeasures you would recommend in protecting the information assets. As a CSO, prepare a report (not bullet points), covering the following in relation to your business unit: Technical risks 1. Identify and describe at least two information security threats of a technical nature 2. Discuss how each of the two technical threats will affect your business unit 3. For each threat, provide one real-world example of a recent security attack/breach and the impact caused in the real-world security attack. 4. Provide reference and in-text citation for the above 5. Describe and recommend countermeasures to mitigate the two identified threats 

Using the template provided on page 6 of this document: The Chief Security Officer (CSO) of the group must prepare a report related to the security threats that affects your business unit (e.g., IT Security functions, etc -- see description of your department and role). First, carefully read the case study scenario. The case study has many security vulnerabilities that need to be addressed. The CSO must assess the case study, and prepare a detailed report (not a list of items, you must provide a detailed discussion). Based on the vulnerabilities in the case study, i) consider what type of technical attacks, physical attacks, human related attacks and processes and procedure attacks; ii) consider what information assets need to be protected in your business unit, and iii) what sort of technical and non-technical countermeasures you would recommend in protecting the information assets. As a CSO, prepare a report (not bullet points), covering the following in relation to your business unit: Technical risks 1. Identify and describe at least two information security threats of a technical nature 2. Discuss how each of the two technical threats will affect your business unit 3. For each threat, provide one real-world example of a recent security attack/breach and the impact caused in the real-world security attack. 4. Provide reference and in-text citation for the above 5. Describe and recommend countermeasures to mitigate the two identified threats 

Do the same (above steps 1 to 5) for - Technical risks 

3 

- Physical risks - Human resource risks - Processes, procedure and policy risks 

Director, Sales & Product 

The director - sales and product is responsible for all departments concerning the sales and marketing of the product of the company, including research and product development. They are responsible for advising the CEO and the rest of the management team on all matters pertaining to those areas during the discussion session. 

Using the template provided on page 6 of this document: The Director, Sales & Product of the group must prepare a report related to the security threats that affects your business unit (e.g., sales related processes and functions etc -- see description of your department and role). First, carefully read the case study scenario. The case study has many security vulnerabilities that need to be addressed. The Director, Sales & Product must assess the case study, and prepare a detailed report (not a list of items, you must provide a detailed discussion). Based on the vulnerabilities in the case study, i) consider what type of technical attacks, physical attacks, human related attacks and processes and procedure attacks; ii) consider what information assets need to be protected in your business unit, and iii) what sort of technical and non-technical countermeasures you would recommend in protecting the information assets. As a Director, Sales & Product, prepare a report (not bullet points), covering the following in relation to your business unit: Technical risks 1. Identify and describe at least two information security threats of a technical nature 2. Discuss how each of the two technical threats will affect your business unit 3. For each threat, provide one real-world example of a recent security attack/breach and the impact caused in the real-world security attack. 4. Provide reference and in-text citation for the above 5. Describe and recommend countermeasures to mitigate the two identified threats 

Using the template provided on page 6 of this document: The Director, Sales & Product of the group must prepare a report related to the security threats that affects your business unit (e.g., sales related processes and functions etc -- see description of your department and role). First, carefully read the case study scenario. The case study has many security vulnerabilities that need to be addressed. The Director, Sales & Product must assess the case study, and prepare a detailed report (not a list of items, you must provide a detailed discussion). Based on the vulnerabilities in the case study, i) consider what type of technical attacks, physical attacks, human related attacks and processes and procedure attacks; ii) consider what information assets need to be protected in your business unit, and iii) what sort of technical and non-technical countermeasures you would recommend in protecting the information assets. As a Director, Sales & Product, prepare a report (not bullet points), covering the following in relation to your business unit: Technical risks 1. Identify and describe at least two information security threats of a technical nature 2. Discuss how each of the two technical threats will affect your business unit 3. For each threat, provide one real-world example of a recent security attack/breach and the impact caused in the real-world security attack. 4. Provide reference and in-text citation for the above 5. Describe and recommend countermeasures to mitigate the two identified threats 

Do the same (above steps 1 to 5) for - Technical risks - Physical risks - Human resource risks - Processes, procedure and policy risks 

Legal Officer The legal officer is responsible for advising the 

CEO and the rest of the team on the legal and ethical ramification of any decision or action taken, or to be taken by the company. The legal officer is also responsible for taking the minutes of any meeting held. 

Using the template provided on page 11 of this document: The Legal Officer of the group must prepare a report related to the security threats that affects your business unit (e.g., legal issues such as lack of compliance etc -- see description of your department and role). First, carefully read the case study scenario. The case study has many security vulnerabilities that need to be addressed. The Legal Officer must assess the case study, and prepare a detailed report (not a list of items, you must provide a detailed discussion). Based on the vulnerabilities in the case study, i) consider what type of technical attacks, physical attacks, human related attacks and processes and procedure attacks; ii) consider what information assets need to be protected in your business unit, and iii) what sort of technical and non-technical countermeasures you would recommend in protecting the information assets. As a Legal Officer, prepare a report (not bullet points), covering the following in relation to your business unit: Technical risks 1. Identify and describe at least two information security threats of a technical nature 2. Discuss how each of the two technical threats will affect your business unit 3. For each threat, provide one real-world example of a recent security attack/breach and the impact caused in the real-world security attack. 4. Provide reference and in-text citation for the above 5. Describe and recommend countermeasures to mitigate the two identified threats 

Do the same (above steps 1 to 5) for - Technical risks 

4 

5 

- Physical risks - Human resource risks - Processes, procedure and policy risks 

Use the following template, to report your assessment of the technical, physical, human resources and Processes, procedure and policy risks you have identified in your department, in the scenario provided in the fictitious company. 

Report Template 

Your Role: 

(e.g., CIO) 

Security Issue: 

(e.g., Technical Risks) 

Identify and briefly describe the security issue: (In this section, you will Identify and briefly describe at least two information security threats of a technical nature). Read the case scenario provided, can you identify any vulnerabilities within your department – e.g., the network, compliance, policies or lack of policies? 1. Describe Technical Issue 1 

2. Describe Technical Issue 2 Discuss how each of the two technical threats (identified above) will affect your business unit: 1. How will Technical Issue 1 affect your business unit? 

2. How will Technical Issue 2 affect your business unit? For each threat, provide one real-world example of a recent security attack/breach and the impact caused in the real-world security attack: 1. Technical Issue 1 - provide one real-world example of security breach and impact 

2. Technical Issue 2 - provide one real-world example of security breach and impact 

Provide reference and in-text citation for the real-world examples identified here. Describe and recommend countermeasures to mitigate the two identified threats: 1. Technical Issue 1 – recommend a countermeasure and describe how it would mitigate the issue 

2. Technical Issue 2 – recommend a countermeasure and describe how it would mitigate the issue 

6 

Part TWO 

For several of your resources that you have identified in Part One as being at Risk: 

1. Create an inventory of resources for your [fictitious] organization. 

2. Classify and categorize your assets. 

3. Assign relative values to assets. 

4. Rank your assets. 

5. Perform a vulnerability assessment. 

6. Produce a Threat-Vulnerability assessment worksheet. 

7. Imagine limited resources; decide where to assign resources to protect your assets. 

Imagine that your [fictitious] organization has limited resources. 

Go through a selection of your risk assessments and decide which is the best of the following approaches: 

• Defense 

• Transferal 

• Mitigation 

• *Acceptance 

• Termination *If you choose avoidance, how would you do this?