Iris called the company’s security hotline. The hotline is an anonymous way to report suspicious activity or abuse of company policy, although Iris chose to identify herself. The next morning, she was called to a meeting with an investigator from corporate security, which led to more meetings with others from corporate security and then with the director of human resources and Gladys Williams, the CIO of SLS. Do you think this matter needs to be communicated elsewhere inside the company? Who should be informed and how? How about outside the company?

Iris called the company’s security hotline. The hotline is an anonymous way to report suspicious activity or abuse of company policy, although Iris chose to identify herself. The next morning, she was called to a meeting with an investigator from corporate security, which led to more meetings with others from corporate security and then with the director of human resources and Gladys Williams, the CIO of SLS. Do you think this matter needs to be communicated elsewhere inside the company? Who should be informed and how? How about outside the company?

Management Of Information Security

6th Edition

ISBN:9781337405713

Author:WHITMAN, Michael.

Publisher:WHITMAN, Michael.

Chapter2: Compliance: Law And Ethics

Section: Chapter Questions

Problem 1DQ

See similar textbooks

Similar questions

Iris called the company’s security hotline. The hotline is an anonymous way to report suspicious activity or abuse of company policy, although Iris chose to identify herself. The next morning, she was called to a meeting with an investigator from corporate security, which led to more meetings with others from corporate security and then with the director of human resources and Gladys Williams, the CIO of SLS. Should Iris have approached Henry directly, or was the hotline the most effective way to take action? Why do you think so?
You were been given the position of Chief Information Officer at your organization. In your role as Chief Information Security Officer, the first thing you'll need to do is provide recommendations for how your company can protect its data from being lost on purpose or by mistake. Kindly suggest any precautions that might be taken to protect the information of your firm.
To learn more about your institution's security rules, look them up on the intranet or website. Is there a corporate security policy somewhere? Where have you come across security rules that are tailored to address a particular problem? What agency or department is in charge of issuing or coordinating all of these policies, or are they dispersed across the organization? Use the framework provided in this chapter to determine whether or not the policies you found in the preceding exercise are complete. What are the omissions in these areas?
Based on your reading of the chapter and what you now know about the issues, list at least three other things Charley could recommend to Iris.
Fred Chin, CEO of sequential label and supply, leaned back in his leather chair and propped his feet up on the long mahogany table in the conference room where the SLS Board of Directors had just adjourned their quarterly meeting.“What do you think about our computer security problem?” he asked Gladys Williams, the company’s chief information officer, or CIO. He was referring to last month’s outbreak of a malicious worm on the company’s computer network. Gladys replied, “I think we have a real problem, and we need to put together a real solution, not just a quick patch like the last time.” Eighteen months ago, the network had been infected by an employee’s personal USB drive. To prevent this from happening again, all users in the company were banned from using USB drives. Fred wasn’t convinced. “Can’t we just add another thousand dollars to the next training budget?” Gladys shook her head. “You’ve known for some time now that this business runs on technology. That’s why you hired me as…
Where do you think an organization's information security begins and ends, in your opinion? To put it another way, when does a company's security policy and measures go into effect, and when do they stop? Do you think any of these restrictions will be lifted in the future? Explain how and why this is the case if this is the case. What would be the reason if that was not the case?
In this discussion post, you will analyze difficult and often complex ethical decisions you may encounter as a security professional. To start, please watch Alex Stamos’s An Open Letter The White Hat's Dilemma video. After watching the video, respond to the following prompt in your post: How would you respond to the questions Alex asks the crowd? Why?
It's possible that you have some thoughts about the most recent high-profile security incident, which may have included access control or authentication and made news. To be more specific, how did it influence the day-to-day operations of the company? How much cash did the business sink down the drain?
The CISO approaches the interns who seem to be breaking various security standards, who express their displeasure. According to the organization, they don't encrypt their workstations, download unlicensed music, connect personal devices to corporate computers, spend too much time on social media, and download pornographic content on workplace systems. The CISO recommends that you create a security document (Rules of Behavior) that has at least 15 rules limiting what employees may and may not do when connected to the corporate network.
Where in a business do you think the responsibility for information security starts and ends? The organization's control decides when security policies and measures go into effect and when they go out of effect, respectively. Do you believe any of these limits should be further widened or widened? If that's the case, how did you go about it? If that's not the case, what's going on?
Answer the given question with a proper explanation and step-by-step solution. In this week's lecture, we are looking at the SANS CISO Mind Map and how we focused on Security Operations. Pick one of the items (for example - - Data Loss Prevention (DLP), VPN, Security Gateway, etc.) and research the topic and provide a two-paragraph minimum with references on the topic. Pick something you are interested in or do not know but would like to learn more about the topic. Sell me, make me excited.
You have been assigned to be a computer security trainer for your firm’s 2,000 employees and contract workers. What are the key topics you would cover in your initial one-hour basic training program for non-IT personnel? What sort of additional security-related training might be appropriate once people have the basics covered ?