There are five (5) questions. Each response is worth 20 points. Each response is limited to 300 words. Points may be deducted for exceeding the word limit.
The following criteria will be used for grading: relevance and correctness, completeness, clarity and logical flow, spelling, grammar, and proper citations/Reference List.
1. Life Style Surveillance
Digitization, technology and applications permit us to monitor our physical activity and health statistics.
Employers are increasingly interested in influencing or controlling the non-work activities of their employees. Describe the potential benefits to be gained from employers' collecting/using employee lifestyle data.
For example, do employees exercise regularly? Do they smoke? Document one example of an employer collecting or accessing information about employee non-duty activities. Identify and explain legal and ethical challenges to the practice of monitoring employee off- duty lifestyle activities.
2. Ransomware Preparation
There have been a number of ransomware incidents this year. You are the CISO for a small U.S. company that collects and stores personal information including financial data.
What are the key activities you need to do to prepare for the possibility of a ransomware attack? Be sure to note why each of these activities is important.
3. Bring Your Own Device (BYOD) and Acceptable Use
Most organization rely on an Acceptable Use Policy (AUP) to limit the personal use of company resources. But, BYOD means the devices being used for work belong to employees.
Discuss how an organization can/should manage the personal use of personal devices. What are most important restrictions the organization can impose? Why are these limits important? How can they be established and enforced?
4. Computer Fraud and Abuse Act (CFAA)
This key cybersecurity law makes it a federal crime to intentionally access a computer without authorization or to exceed authorized access and get information from a protected computer. Explain the issue(s) presented by the CFAA term, "authorization," using recent example(s).
5. The Privacy Act and Data Brokers
The Privacy Act controls the federal government protection of certain data in its systems of records. Explain how or if that Act applies to data the government accesses from commercial databrokers.