1. Discuss the task of understanding potential threats which is part of the analysis phase of the SecSDLC. What are some ways to truly understand the enemy? How can you be sure you've covered all the bases?
2. Find an example of a disaster recovery plan. Write a report on the elements included in the plan. Is there anything missing that you think should have been included?
3. Find an example of an enterprise information security policy. What are four important aspects of this policy? Determine how the policy might be used.
4. Research three recent information security breaches. Do the main targets seem to be larger or smaller companies? Is there a particular industry that seems predominately targeted? Do you think breaches at smaller companies are just as likely to occur but not as likely to make the news? Explain your reasoning