Post 044 - CIS 608

Week Eight Assignments- Maps to Course Obj. 1

..

Read/Review

: Chapter 8, Management of Information Security, 3e.

: Powerpoint Slides, Chapter 8, located in Course Documents, Lecture Notes

: NIST Security docs

Learning Objectives - Week 8

• Define risk management and its role in the organization

• Use risk management techniques to identify and prioritize risk factors for information assets.

• Assess risk based on the likelihood of adverse events and the effects on information assets when events occur

• Document the results of risk identification

Assignment 8.1

This assignment is worth 50 points.

The Mesusa Corporation has three information assets to evaluate for risk management as listed below. Create a ranked list of risk associated with the four vulnerabilities. You can begin with the columns from the Ranked Vulnerability Risk worksheet (Asset, Impact, Vulnerability, Likelihood), determine the risk rating, then include percentage of current control and the uncertainty rate to come up with a final risk -rating estimate. Use the formula as described in this chapter.

From your results, determine in what order the three assets be evaluated for additional controls. Include your worksheet and interpretation of the results.

Switch L47 connects a network to the Internet. It has two vulnerabilities; (1) susceptibility to hardware failure, with the likelihood of 0.2, and (2) susceptibility to an SNMP buffer overflow attack, with a likelihood of 0.1. This switch has an impact rating of 90 and has no current controls in place. There is a 75% certainty of the assumptions and data.

Server WebSrv6 hosts a company Web site and performs e-commerce transactions. It has Web server software that is vulnerable to attack via invalid Unicode values. The likelihood of such and attack is estimated at 0.2. The server has been assigned an impact value of 100, and a control has been implemented that reduces the impact of vulnerability by 75%. There is an 80% certainty of the assumptions and data.

Operators use the MGMT45 control console to monitor operations in the server room. It has no passwords and is susceptible to unlogged misuse by the operators. Estimates show the likelihood of misuse is 0.1. There are no controls in place on this asset, which has an impact rating of 5. There is a 90% certainty of the assumptions and data.

..

Assignment 8.2 (post to the Week 8 Forum)

This assignment is worth 50 points; 25 points for your original posting, and 25 points for participation.

Using the data classification scheme presented in this chapter, identify and classify the categories of information contained in your personal computer or personal digital assistant. Based on the potential for misuse or embarrassment, what information is a) confidential, b) sensitive but unclassified, or c) suitable for public release?

In your response, comment on whether you agree with the ratings, and identify any possible instances for misuse or embarrassment that the author may have missed.

Minimum Posting Requirements: You must post at least five messages to get credit for participation. The first message is your original posting, due no later than Wed. At least two of the other messages must be responses to other student original postings. This is a pass/fail type of grade. If you meet the minimum requirements you get the points. If you do not meet the minimum requirements, you'll get no points for participation. Messages must be posted on more than one day. Don't wait until the last minute!

________________________________________

Group Assignment-Week 8

This assignment is worth 50 points.

As a group, determine a best response to the Case Exercises for RWW, Inc. at the end of the chapter. Use your group forum area for discussion, located under the Groups button to the left... Have one person in your group post the group consensus, labeled as "Week8 Post - Grade Me" to your group forum.

Assignment 8.3 (Post to your Blog)

This assignment is worth 20 points.

Time to start adding to that blog! If you are not sure what to include, you might want to re-read the assignment located at the top of the Week 1 Assignments.