Part 1: True or False Questions .

1. T F There is only one way to calculate economic value to justify investments in security measures. Answer: _____

2. T F A business continuity plan explains how an organization will maintain operational capabilities during an incident, while an incident response describes how the organization will handle the security incident itself. Answer: ____

3. T F Viruses infect hardware and executable files. Answer: _____

4. T F A fence register protects an operating system from a user, but does not protect the user from other users. Answer: _____

5. T F In conducting a risk analysis, it is often not possible to directly estimate the probability of an event. Answer: _____

6. T F A security policy that by default provides no access rights is an example of least privilege. Answer: _____

7. T F A security policy, no matter how well written, may need revision from time to time. Answer: _____

8. T F With unlimited resources and security controls, it is possible to reduce risk to zero. Answer: _____

9. T F A database management system with perfect user access controls would have no integrity vulnerability. Answer: _____

10. T F Since physical security is often managed under separate responsibility from information security, risk analysis for information security does not need to address physical security. Answer: _____

Part 2: Short Answers. Please answer briefly and completely, and cite all sources of information.

1. What is the principle of adequate protection? Do you agree with the principle? What difficulties are associated with implementing it?

2. What is the difference between a threat and a vulnerability? Define each, and then give at least one example of a threat and of a vulnerability.

3. Describe the fundamental principles in both the Bell-LaPadula and Biba security models. For each, explain what sort of security the model is intended to provide, the two key properties of the model, and then explain in your own words why each of the properties makes sense from a security standpoint.

4. Describe the similarities and differences between a virus, a Trojan horse, and a worm. Give examples of controls that could be implemented to mitigate the threat of each of these types of malicious code.

5. What is the difference between inference and aggregation? Give an example of each, and describe at least one way to mitigate each type of vulnerability.

6. Cite a risk in computing for which it is impossible or infeasible to develop a classical probability of occurrence. Why?

Part 3: Short Essay. Please restrict your answer to three (3) pages (double spaced) or less.

Global Corporation, Inc. (GCI) is a fictional multi-national company providing outsourced financial services to a variety of clients across many industries, including commercial and government entities. GCI specializes in billing and invoicing services, in which GCI receives relevant data from its clients and processes the data to produce the invoices, monthly statements, and other billing items that are sent to the customers of GCI's clients. GCI employees serve the company's customers both on-site at customer locations and while working in GCI facilities. GCI employees routinely store data related to multiple clients on their company-issued laptops.

GCI's Chief Information Officer, having read of the numerous data breaches reported among commercial and government organizations, has become concerned about the risk to GCI's customers and potentially the company's reputation if GCI were to experience a similar breach. She has tasked you, the Director of Information Security, to create a new corporate policy regarding the protection of client and company confidential data stored on employee computers, particularly including laptops. Respond to each of the following, taking into account material we have studied in this course regarding threats and vulnerabilities, as well as Pfleeger's discussion of the characteristics of effective security policies in chapter 8 of the text. Cite these and other pertinent sources used in your answer. Be specific and briefly but fully explain and give reasons for your answers.

a. Summarize the primary vulnerabilities and potential threats that exist for GCI related to the practice of storing sensitive data on laptops. In your opinion, which of the risks GCI faces are most significant to the company?

b. What measures would you propose to senior management to try to prevent a breach of data held by GCI? Your response should include recommendations for mitigating vulnerabilities identified in part (a).

Write a succinct policy statement specifying employee and company responsibilities for protecting client and corporate data, such as the data stored on employee laptops. Be sure to address requirements for protecting the data from theft, and for rendering the data unusable should it be compromised.