Reference no: EM133244621

Question 1. The compliance approach to ISM, as exemplified by organizations doing the minimum to obtain certification against ISO/IEC 27001, has been widely criticized.

a. Look for such criticism, e.g. on the Internet, and summarize in a paragraph or two some of the main critical arguments.

b. Can you think of possible alternatives to the ISO/IEC 27001 approach?

Question 2. Find and describe an example from the press (or elsewhere) of an organization that has suffered a major security breach

Discuss whether this breach means that the organization has not followed the requirements of ISO/IEC 27001; this will involve thinking about the nature of the breach and

(a) whether the attack could have been anticipated, and (b) whether appropriate controls were used to address the risk(s) related to the attack.

Question 3. identify an organizational scenario to provide context for the remainder of the answer to this question.

Choose one of the security policies;

Access Control, Backup, Information Transfer, Protection from Malware, Cryptographic Control, Communication Security, Privacy and Protection of PII, Physical and Environmental Security), and give two information security risks for this topic area that apply in the identified scenario.

Assessed these risks within the context of the identified scenario, following the three-stage the approach outlined in ISO/IEC 27005, and suggest possible treatments.

Question 4. Choose a personal computing device that you own, e.g. a smartphone, tablet, notebook, or desktop computer, to answer this question. Start your answer by briefly describing the device.

a) List three security controls that you employ to protect this device. In each case indicate which of the standardized control types from ISO/IEC 27002 these controls correspond to.

b) List three other controls that you could have employed but which you have chosen not to, again indicating which of the standardized control types from ISO/IEC 27002 these controls correspond to.

c) For each of the identified controls in your answers to a) and b), briefly discuss what risks these controls address, and, in the case of controls in b), indicate why you have chosen not to address these risks.

Question 5. Describe briefly, a recent security breach affecting a major company that involved a compromise of sensitive data, and explain why you believe it did (or did not) breach European data privacy requirements (e.g. those imposed by GDPR). Please choose a different example to that used to answer question 2.