Reference no: EM133383253

Question 1. What member of an organization should decide where the information security function belongs within the organizational structure? Why?

Question 2. List and describe the options for placing the information security function within the organization. Discuss the advantages and disadvantages of each option.

Question 3. For each major information security job title covered in the chapter, list and describe the key qualifications and requirements for the position.

Question 4. What factors influence an organization's decisions to hire information security professionals?

Question 5. Prioritize the list of general attributes that organizations seek when hiring information security professionals. In other words, list the most important attributes first. Use the list you developed to answer the previous review question.

Question 6. What are critical considerations when dismissing an employee? Do they change according to whether the departure is friendly or hostile, or according to which position the employee is leaving?

Question 7. How do security considerations for temporary or contract employees differ from those for regular full-time employees?

Question 8. What career paths do most experienced professionals take when moving into information security? Are other pathways available? If so, describe them.

Question 9. Why is it important to use specific and clearly defined job descriptions for hiring information security professionals?

Question 10. What functions does the CISO perform?

Question 11. What functions does the security manager perform?

Question 12. What functions does the security analyst perform?

Question 13. What rationale should an aspiring information security professional use in acquiring professional credentials?

Question 14. List and describe the credentials of the information security certifications mentioned in this chapter.

Question 15. Who should pay for the expenses of certification? Why?

Question 16. List and describe the standard personnel practices that are part of the information security function. What happens to these practices when they are integrated with information security concepts?

Question 17. Why shouldn't an organization give a job candidate a tour of secure areas during an interview?

Question 18. List and describe the typical relationships that organizations have with temporary employees, contract employees, and consultants. What special security precautions must an organization consider for such workers, and why are they significant?

Question 19. What is separation of duties? How can it be used to improve an organization's information security practices?

Question 20. What is job rotation, and what benefits does it offer an organization?