John Moura

Chapter 1 – Introduction to the Management of Information Security

Review Questions

1. A globally interconnected commercial world has emerged from the technical advances that created the Internet. Has its creation increased or decreased the need for organizations to maintain secure operation of their systems? Why?

Answer: As Internet use continues to rise, the amount of “malicious entities” is also rising. As “malicious entities” grow and become more numerous, the probability that an organization could receive a threat increases.

2. Which trend in IT has eliminated the “we have technology people to handle technology problems” approach as method for securing systems?

Answer: NSTISSC Security Model

3. List and describe an organization’s three communities of interest that engage in efforts to solve InfoSec problems. Give two or three examples of who might be in each community.

4. What is the definition of security? How is a secure state usually achieved?

Answer: “the quality or state of being secure—to be free from danger.” Taking measures, by procedure and policy, to minimize attacks, risks, and threats from any entity causing them.

5. List and describe the specialized areas of security.

Answer: Physical security – protects physical assets of an organization (i.e. people, buildings) Operations security – addresses the continuity of business operations without interruption Communications security – protection of communications media, technology, content, and the ability for employees to successfully use these tools Network security – protection of organization’s data, networking devices, connections, and contents, and the ability for employees to accomplish communication functions

What is the definition of information security? What essential protections must be in place to protect