Chapter 8, Problem 3RQ

Program Plan Intro

System vulnerability:

• When huge data amounts are been kept in electronic form, it becomes susceptible to many threats.
• The information systems in many locations are been interconnected through communication networks.
• The unauthorized access can occur at many access points in network and is not limited to single location.
• The data flowing over networks could be accessed; valuable information could be stolen while transmission or data could be altered without authorization.
• The denial-of-service attacks are launched by intruders to disrupt website operations.
• Internets are vulnerable than internal networks as it is open to everyone.

Explanation of Solution

Application Controls:

• Application controls denote specific controls that are exclusive to each application.
• It includes both manual as well as automated procedures.
• It ensures that authorized data is been processed by application.
• The types include:
  • o Input controls:
    • It checks data for correctness as well as completeness while they go in system...

Explanation of Solution

Risk assessment function:

• A risk assessment would determine risk level to firm if an explicit activity is not controlled properly.
• The information assets value, vulnerability point, likely problem frequency and damage potential can be determined by business managers.
• Controls could be added or adjusted to focus on greater risk areas.
• Security risk analysis would involve determination of what is needed to be protected and the manner to protect.
• It denotes an examining process for risks of firm and ranking for those risks by severity level.
• The cost effective decisions are been involved in process...

Explanation of Solution

Security policy, Acceptable use policy and Identity management:

• A security policy denotes ranking of information risks, identification of acceptable goals of security as well as identification of mechanism to achieve goals.
  • o It drives policies that determine acceptable information resource usage of firm.
  • o It determines access details of company’s information assets.
• An acceptable use policy denotes acceptable uses of resources of firm and equipment for computing.
  • o It includes desktop, laptop, wireless devices, Internet and telephones.
  • o It clarifies privacy, responsibility of user as well as personal usage for company equipment policies...

Explanation of Solution

Information systems auditing promotes control and security:

• Information system auditing determines effectiveness of information system security as well as control.
• An MIS audit would identify all control...