Reference no: EM132548993

Part A: Brief Essay Questions 1-4

Question 1. a. Why is phishing, and social engineering generally, difficult to address or prevent with technological controls?

b. An internet site starts distributing a program that gets a popular word processor to send a copy of whatever files it produces to be emailed to a specific email address. Is this a vulnerability, an exploit, or a security incident?

c. Briefly explain the Cyber-Risk function below:
Risk = F { Threats , Vulnerability, Asset Value}

d. What is a hash function, and what can it be used for?

Question 2. a. A Banking systems analysts is reported to siphoning a customer's account. Briefly discuss if this is a vulnerability, an exploit or a security incident?
b. Based on the Asset Value, briefly discuss the statement: "Computer security should be periodically reassessed". You may be guided by the urgency and criticality of the information assets.
c. Briefly discuss the extent to which insiders or "frenemies" may pose security challenges to the organization.
d. What is a cryptographic key, and what is it used for?

Question 3. a. What is an open port? Why is it important to limit the number of open ports a system has to only those that are absolutely essential?
b. Discuss some pertinent Internet and Network attacks, and provide measures to mitigate those attacks.
c. As a security functionary, you've been called upon to advice the local Small Business Owners association on zero-day vulnerabilities, pirated software and patch management. Clearly discuss the key points that you would raise, enumerate and dilate upon with them.

Question 4. a. What are computer viruses and worms, and how do they attack computers?

b. For each of the following assets, examine and assign a low, moderate or high impact level for the loss of confidentiality, integrity and availability respectively. Justify your answers.
i. An organization managing public information on its web server.
ii. A law enforcement organization managing extremely sensitive investigative information.
iii. A financial organization managing routine administrative information (not privacy-related information).
c. Consider the first step of the common attack methodology; which is to gather publicly available information on possible targets. Briefly discuss how an attacker or a social engineer could utilize tailgating, Phishing, SMiShing and Vishing in executing this step.

Part B: Essay Questions

Question 5. a. Covid-19 has re-introduced the need for telecommuting amongst public sector employees in Ghana. Examine why it is important to consistently enforce security policy and "not go easy on these telecommuting network users"?

b. A renowned cyber-security consultant, Charles Cresson Wood has said that Information Security is basically people and management issues, rather than a technology issue. In summary, Cyber-security is a "business concern, and not a technical problem". The above statement underscores the business value of security; carefully evaluate the statement with its implications.

Question 6. a. A new organization is yet to be fully launched into operation, you have been asked to access their systems and resources and compile a detailed and comprehensive IT Risk Assessment Report for them. Discuss how you would accomplish this task and present a report that can guide them in making strategic decisions on mitigating against the potential risks. Please name your company and discuss what they do?

b. Briefly discuss the four (4) key protection mechanisms of deterrence, prevention, detection and response.

Question 7. a. Kontonkyi Rural Bank (KRB) is a mid-range bank with over 30 branches connected to a centralized computing system. A couple of the branches are connected via leased lines and others use Multiprotocol Label Switching (MPLS). Each branch has a variety of client computers and ATMs connected to a server. The server stores the branch's daily transaction data and transmits it several times during the day to the centralized system. Tellers at each branch use a four-digit numeric password, and each Teller's computer is transaction-coded to accept only its authorized transactions. As the System Administrator perform a risk assessment.

b. Three (3) major concerns of system developers and users are disaster (as a disruption of normal business functions), security and human errors. Of these three, which do you think is most difficult to deal with? Why?