Help me

Learning Objectives

1. Demonstrate knowledge of security concepts.
2. Know how to mitigate security risk through the use of controls.
3. Evaluate the scenario.
4. Apply the knowledge in a scenario.

Instruction

XYZ Network Solutions provides network services and value-add communications to customers in several countries in Europe and North America.

The corporate headquarters is in Miami Florida with offices in Chicago, London, UK and Frankfurt, Germany. The company has a sales division with eight employees led by Andre Wisser, human resources with three employees led by Jane Aubin, Technical and Communications with 45 employees led by Peter ODay. Finance is led by Andrea Worth but most of the Payroll and Finance functions have been outsourced to a SaaS Cloud Provider.

1- Project Title *

2- Andrea Worth, Manager, Finance has just asked you to monitor the activity of an employee in her department. As a security professional what must you consider before doing this monitoring?

3- An employee that does a lot of travelling has been approving their own expenses. What control should be in place to address the risk associated with such a practice?

4- As a network service provider, XYZ Network Solutions provides high speed network services to many clients such as government, banks, and internet-based businesses. What is the primary security consideration for XYZ Network Solutions? Confidentiality? Availability? Integrity? How can the clients of XYZ Network Solutions assure themselves of acceptable levels of service?

5- What is the risk of using a technical control such as a firewall without also having managerial and operational controls?

6- What is the primary purpose of information classification?

7- Describe the characteristics of a good policy.

8- What steps should be taken in regard to patch management?

9- What class of fire is based on the burning of common combustibles such as wood and paper?

10- Why should a security awareness program address the risk of social engineering?

11- What is meant by the term non-repudiation?