Course Work I: Consider the following scenario: As a Chief Information Security Officer, you have to train two additional Information Security Officers to support you in the company. You have a problem in that the training budget for the year has been allocated, and that the reason for the two additional officers is that you already have a heavy work load. In order to address some of their training needs you have decided to set them some reading from key texts in the subject area. The company has a well stocked library so you need to decide which text the new officers should read. Your task: Select TWO of the following topic areas and the relevant chapters from TWO text books. Some suggested texts are detailed below; however there are many more texts in LRC and on the eBooks facility on FindIt. The trainees need to improve their knowledge in the following topic areas: • Security Policy for Computer Users • Role of Information Security Officer • How Risk is identified in a Security System • Technical Security Controls for a Network • Investigating an Incident Compare and contrast your selected chapters, justifying your decision why the trainee officers should read one rather than the other textbook. You should then address any areas that the books leave out with further appropriate references. Also, give suggestions with references for additional reading that addresses any missing issues relating to the chosen topics. These texts are available in the LRC • Andrew Blyth, Gerald Kovacich, Information Assurance, 2nd Edition, Springer, 2006 • Charles P. Pfleeger, Security in Computing, International Edition, Prentice-Hall, 2007 • Rita C. Summers, Secure Computing: Threats and Safeguards, McGraw-Hill, 1997 • Dhillion. G., (2007) Principles of information Systems Security: Texts and Cases Willey. You also have access to the e-books at the following URL: http://www.netlibrary.com Course Work II: Consider the following scenario: A multinational banking organization has decided to set up a small credit card and on-line banking service. The new company known as Lime Financial Services offers the usual credit card facilities with the ability to monitor credit card accounts via the internet. It also offers an attractive Green credit card. The company has two main sites: The Lime Financial Services’ head office is based in Canary Wharf in London. A backup of key data is held at this site but the main data servers are based outside London in Bracknell. The parent company has invested heavily in the best technology required to run Lime securely. The bank is using hardware supplied by Dell, Cisco and a number of other leading firms. 17th October 2008 Midday on 17th October, John Peach, an alert system administrator in the server farm in Bracknell notes particularly high network traffic on one server and carefully starts to investigate. He discovers that the software in the bank’s internet firewall, which has recently been upgraded, appears to be interacting incorrectly with some of the routers allowing internet traffic to what should be a protected port. The system administrator checks the server and finds additional files, one of which appears to contain credit card numbers. At this point Mr Peach suspects the system may have been compromised. 19th October 2008 The head office receives a threat through an anonymous email account. The email threatens to announce that the Lime Financial Services systems have been compromised and publish the compromised credit card numbers on the internet. The blackmailer demands & amp;amp;#163;1M in return for keeping quiet. The blackmailer attaches 500 credit card numbers to the email as proof of intent. 20th October 2008 The head office decides to negotiate with the blackmailer to gain time; the blackmailer places the initial 500 credit card numbers on a bulletin board site to force the bank to move faster. The bank prepares to announce to the press that the system has been compromised. Question 1 For each of the incidents on the 17th, 19th and 20th October write a short paragraph (around 500-600 words) describing your opinion of the potential problem and the appropriate actions the company should have taken. Your suggestions should be supported by appropriate documents. Question 2 Write a short essay (around 2000 words) discussing the key steps the company should take to prepare for future incidents.