New England College Cryptography Attack & Business Continuity Plan Questions Question-1 : Cryptography is used to protect confidential data in many areas.

New England College Cryptography Attack & Business Continuity Plan Questions Question-1 : Cryptography is used to protect confidential data in many areas. Chose one type of cryptography attack and briefly explain how it works (examples include: ciphertext-only attack, known-plain-test attack, chosen-plaintext, chosen-ciphertext attack, timing attack, rubber hose attack, adaptive attack).

Question-2 : Select one type of cryptography or encryption and explain it in detail. Include the benefits as well as the limitations of this type of encryption. Your summary should be 2-3 paragraphs(200 words) in length and uploaded as a TEXT DOCUMENT. Click the link above to submit your work. There is an EXAMPLE attached to show you the format requirements.

Reference :

1. https://www.youtube.com/watch?v=-yFZGF8FHSg&feature=youtu.be

2. Attached Video

Question-3: Describe each of the elements of a Business Continuity Plan (BCP). An initial post must be between

250-300 words

Reference : Attached PPT Fundamentals of Information
Systems Security
Lesson 4
The Drivers of the
Information Security Business
© 2018 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Learning Objective(s)
▪ Explain information systems security and
its effect on people and businesses.
Fundamentals of Information Systems Security
© 2018 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Page 2
Key Concepts
▪ Risk management and approaches
▪ Business impact analysis (BIA), business
continuity plan (BCP), and disaster recovery plan
(DRP)
▪ Impact of risks, threats, and vulnerabilities on the
IT infrastructure
▪ Adhering to compliance laws and governance
▪ Managing and mitigating risk
Fundamentals of Information Systems Security
© 2018 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Page 3
Business Drivers
Elements in an organization that
support business objectives
People
Fundamentals of Information Systems Security
Information
© 2018 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Conditions
Page 4
Defining Risk Management
▪ Process of identifying, assessing,
prioritizing, and addressing risks
▪ Ensures you have planned for risks that
may affect your organization
Fundamentals of Information Systems Security
© 2018 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Page 5
Risks, Threats, and Vulnerabilities
Fundamentals of Information Systems Security
© 2018 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Page 6
Defining Risk Management
Risk
methodology
A description of how you will manage risk
Risk
register
A list of identified risks
Fundamentals of Information Systems Security
© 2018 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Page 7
Implementing a BIA, a BCP, and a
DRP
Protecting an organization’s IT resources and
ensuring that events do not interrupt normal
business functions
Business impact
analysis (BIA)
Fundamentals of Information Systems Security
Business
continuity plan
(BCP)
Disaster recovery
plan (DRP)
© 2018 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Page 8
Business Impact Analysis (BIA)
▪ An analysis of an organization’s functions
and activities that classifies them as critical
or noncritical
▪ Identifies the impact to the business if one
or more IT functions fails
▪ Identifies the priority of different critical
systems
Fundamentals of Information Systems Security
© 2018 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Page 9
BIA Recovery Goals and
Requirements
Recovery point objective (RPO)
Recovery time objective (RTO)
Business recovery requirements
Technical recovery requirements
Fundamentals of Information Systems Security
© 2018 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Page 10
Business Continuity Plan (BCP)
▪ A written plan for a structured response to any
events that result in an interruption to critical
business activities or functions
▪ Order of priorities:
1. Safety and well-being of people
2. Continuity of critical business functions and
operations
3. Continuity of IT infrastructure components
within the seven domains of an IT
infrastructure
Fundamentals of Information Systems Security
© 2018 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Page 11
Elements of a Complete BCP
▪ Policy statement defining the policy, standards,
procedures, and guidelines for deployment
▪ Project team members with defined roles, responsibilities,
and accountabilities
▪ Emergency response procedures and protection of life,
safety, and infrastructure
▪ Situation and damage assessment
▪ Resource salvage and recovery
▪ Alternate facilities or triage for short-term or long-term
emergency mode of operations and business recovery
Fundamentals of Information Systems Security
© 2018 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Page 12
Disaster Recovery Plan (DRP)
▪ Disaster
• Is an event that affects multiple business
processes for an extended period
• Causes substantial resource damage you must
address before you can resolve business process
interruption
▪ DRP
• Includes specific steps and procedures to recover
from a disaster
• Is part of a BCP
• Extends and supports the BCP
Fundamentals of Information Systems Security
© 2018 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Page 13
Disaster Recovery Plan (DRP)
Threat analysis
Impact scenarios
Recovery
requirement
documentation
Disaster recovery
Fundamentals of Information Systems Security
© 2018 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Page 14
Disaster Recovery Plan (DRP)
Hot site
• Has environmental utilities, hardware,
software, and data like original data
center
Warm site
• Has environmental utilities and basic
computer hardware
Cold site
• Has basic environmental utilities but
no infrastructure components
Mobile site
Fundamentals of Information Systems Security
• Trailer with necessary environmental
utilities, can operate as warm or cold
site
© 2018 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Page 15
Assessing Risks, Threats, and
Vulnerabilities
Risk Management Guide for Information Technology
Systems (NIST SP800-30)
CCTA Risk Analysis and Management Method
(CRAMM)
Operationally Critical Threat, Asset, and Vulnerability
Evaluation (OCTAVE)
ISO/IEC 27005 “Information Security Risk
Management”
Fundamentals of Information Systems Security
© 2018 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Page 16
Closing the Information Security Gap
Security gap
Difference between
the security controls
in place and controls
you need to address
vulnerabilities
Fundamentals of Information Systems Security
Gap analysis
Comparison of the
security controls in
place and the controls
you need to address
all identified threats
© 2018 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Page 17
Steps for Conducting a Gap Analysis
▪ Identify applicable elements of security policy
and other standards
▪ Assemble policy, standard, procedure, and
guideline documents
▪ Review and assess implementation of
policies, standards, procedures, and
guidelines
▪ Collect hardware and software inventory
information
Fundamentals of Information Systems Security
© 2018 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Page 18
Steps for Conducting a Gap Analysis
(cont.)
▪ Interview users to assess knowledge of and
compliance with policies
▪ Compare current security environment with
policies
▪ Prioritize identified gaps for resolution
▪ Document and implement remedies to
conform to policies
Fundamentals of Information Systems Security
© 2018 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Page 19
Adhering to Compliance Laws
Sarbanes-Oxley Act (SOX)
Health Insurance Portability and Accountability Act
(HIPAA)
Gramm-Leach-Bliley Act (GLBA)
Payment Card Industry Data Security Standard
(PCI DSS)
Federal Information Security Modernization Act
(FISMA)
Government Information Security Reform Act
(Security Reform Act) of 2000
Fundamentals of Information Systems Security
© 2018 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Page 20
Keeping Private Data Confidential
Ensuring
availability and
integrity is
important
You cannot undo
a confidentiality
violation
Fundamentals of Information Systems Security
© 2018 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Page 21
The Three Tenets of Information
Security
Fundamentals of Information Systems Security
© 2018 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Page 22
Keeping Private Data Confidential
Authentication controls
Authorization controls
Passwords and PINs
Authentication server rules
and permissions
Smart cards/ tokens
Access control lists
Biometric devices
Intrusion detection/
prevention
Digital certificates
Physical access control
Challenge-response
handshakes
Connection/access policy
filters
Kerberos authentication
Network traffic filters
One-time passwords
Fundamentals of Information Systems Security
© 2018 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Page 23
Mobile Workers and Use of
Personally Owned Devices
Mobility
• Allows remote workers and employees to be
connected to the IT infrastructure in almost real
time
Bring Your Own Device (BYOD)
• Employees using their personally owned
devices for business and personal use
Fundamentals of Information Systems Security
© 2018 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Page 24
BYOD Concerns/Policy Definition
Data ownership
Antivirus management
Support ownership
Privacy
User acceptance
Legal concerns
Fundamentals of Information Systems Security
© 2018 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Page 25
Endpoint and Device Security
Full device encryption
Remote wiping
Global positioning system (GPS)
Asset tracking
Device access control
Removable storage
Fundamentals of Information Systems Security
© 2018 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Page 26
Summary
▪ Risk management and approaches
▪ Business impact analysis (BIA), business
continuity plan (BCP), and disaster
recovery plan (DRP)
▪ Impact of risks, threats, and
vulnerabilities on the IT infrastructure
▪ Adhering to compliance laws and
governance
▪ Managing and mitigating risk
Fundamentals of Information Systems Security
© 2018 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Page 27

Purchase answer to see full
attachment