Principles of Information Security, 4 th Edition Chapter 2 Review Questions 1. Why is information security a management problem? What can management do that technology cannot? Both general management and IT management are responsible for implementing information security to protect the ability of the organization to function. Decision-makers in organizations must set policy and operate their organization in a manner that complies with the complex, shifting political legislation on the use of technology. Management is responsible for informed policy choices and the enforcement of decisions that affect applications and the IT infrastructures that support them. Management can also implement an effective information security program to protect the integrity and value of the organization’s data. 2. Why is data the most important asset an organization possesses? What other assets in the organization require protection? Data is important in the organization because without it an organization will lose its record of transactions and/or its ability to deliver value to its customers. Since any business, educational institution, or government agency that functions within the modern social context of connected and responsive service relies on information systems to support these services, protecting data in motion and data at rest are both critical. Other assets that require protection include the ability of the organization to function, the safe operation of applications, and technology assets. 3. Which management groups are responsible for implementing information security to protect the organizations’ ability to function? Both general management and IT management are responsible for implementing information security that protects the organization’s ability to function. Although many business and government managers shy away from addressing information security because they perceive it to be a technically complex task, in fact, implementing information security has more to do with management than with technology. Just as managing payroll has more to do with management than with mathematical wage computations, managing information security has more to do with policy and its enforcement than with the technology of its implementation. 4. Has the implementation of networking technology created more or less risk for business that use information technology? Why? Networking is usually considered to have created more risk for businesses that use information technology. This is due to the fact that potential attackers have more and readier access to these information systems when they have been networked, especially if they are interconnected to the Internet. 5. What is information extortion? Describe how such an attack can cause losses, using an example not found in the text. When an attacker is able to control access to an asset, it can be held hostage to the attacker’s
This is the end of the preview. Sign up to
access the rest of the document.