IT 238 Essay Questions

This part of the exam consists of four essay questions worth 10-20 points each. These questions require longer answers than the short answer questions, and there's no single correct answer for the questions. For that reason, your explanation is more important than a specific answer.

Spell check and proofread your answers carefully. One free typo per question, after that each typo will result in a deduction of one point, up to five points per question. There are additional specific grading policies described with each question.

Everything you need to answer these questions can be found in the textbook or other reading and videos assigned during the course. You may search the internet for relevant information, but be aware as always that the internet is an unreliable source of information and terminology varies, so this is a risky approach.

All work on the exam must be your own. You are not allowed to use any quotations from any source in your answers. Any students found to be working together or sharing answers will each receive a zero on the entire final exam. Plagiarism from any source will also result in a zero.

You must upload your answers to all questions in a single PDF document.

Question 1. The United States has taken the position that the acceptability of cyber espionage depends upon the motivation of the espionage and what is done with the stolen information. This is most obvious in the United States position towards China's espionage activities.

What does the United States believe is an appropriate motivation for espionage, and what is inappropriate? Your answer must include an example of a cyberattack we read about this quarter that had appropriate motivation and one with inappropriate motivation.

Grading for question 1. This question is worth 10 points. Your answer must be at least 100 words in length. If it is between 50 and 99 words, you will receive a maximum of 5 points. If it is less than 50 words, you will receive 0 points. The answer to this question requires that you describe two attacks. If you fail to do so, you will lose 2 points for each one.

Question 2. You are in charge of IT for an electric utility. The CEO of the company suggests disconnecting the company's computer network from the internet so that you don't have to worry about all of that "cybersecurity stuff".

Respond to the CEO by saying why the suggestion of creating an "air gap" is not sufficient to protect your network against cyberattacks. In your response, describe one cyberattack that we learned about this quarter where the target was not connected to the internet.

Grading for question 2. This question is worth 10 points. Your answer must be at least 100 words in length. If it is between 50 and 99 words, you will receive a maximum of 5 points. If it is less than 50 words, you will receive 0 points. 5 points will be deducted if you do not describe a cyberattack as required in the instructions.

Question 3. Explain whether you believe the following statement to be true, and why or why not?
Countries are unlikely to attack the United States in cyberspace because they fear that the United States will retaliate with cyberattacks against them.

You must justify your answer by referring to topics covered in the class, you can't just base your answers on general beliefs like "other countries fear (or do not fear) the US".

Grading for question 3. This question is worth 10 points. Your answer must be at least 100 words in length. If it is between 50 and 99 words, you will receive a maximum of 5 points. If it is less than 50 words, you will receive 0 points.

Question 4. You have been hired by President-elect Trump as a cybersecurity advisor. Write an essay proposing what you believe is the most important action/policy/law he should pursue to improve cybersecurity in the United States.

Your essay must include the following:

• A description of the proposal.

• What effect would implementing the proposal have - how would it improve cybersecurity?

• Which of the three elements of deterrence is the proposal most closely related to?

• Identify at least one cyberattack we have read about this quarter where the proposal would make the attack less likely to occur, and explain why.

Please do not inject political commentary in your answer, what you write should be the same regardless of who actually won the election.

Grading for question 4. This question is worth 20 points. Your answer to Question 4 should be 250-400 words in length. If your answer is between 200 and 250 words, the maximum score is 15 points. If your answer is between 150 and 250 words, the maximum score is 10 points. If your answer is less than 150 words in length, no credit will be given.

Each of the bullet points above are given equal weight in the grading of this question