Marketing Information Management Stimulation Chapter 12

Information Security Management SIMULATION TITLE: Information Security Management SIMULATION DESCRIPTION: As the new head of IS security for GearOn Gyms, you must develop strategies to protect the company's information systems and data. GearOn Gyms: IS Security Chief After a successful spin-off from its parent company, GearUp, the former division of GearOn Gyms has become an independent company under its new CEO, Eliot White. You have just been brought in as the new head of IS security and it is your responsibility to protect the information systems of the company. Eliot is especially concerned that gym members' data be protected after a recent security breach at GearUp that damaged the company's reputation. You tell Eliot that you plan to develop a company-wide security policy. Learning from the Past You begin your first day of responsibilities by examining the recent IS security breach at GearUp to get ideas for safeguards you will take. At GearUp, criminals accessed the company's improperly-secured wireless system and stole customers' credit card information as well as employee social security numbers. What kind of computer crime did GearUp face? YOU CHOSE OPTION2 sniffing You identified "sniffing" as the security loss that GearUp faced. This was the correct answer. Sniffing occurs when computer communications are intercepted and data is disclosed to unauthorized people. Learning from the Past You also look into another recent data security problem GearUp faced when many customers were denied service from its web site after IT ran a software update at peak usage time. How can you characterize the cause of this problem? YOU CHOSE OPTION1 human error You characterized the cause of this recent data security problem as human error. This was the right answer. IT personnel made a mistake by running a software update at peak usage time, causing the web site to crash resulting in a temporary denial of service. Improving GearOn's Security What is your first step in implementing GearOn's improved security? YOU CHOSE OPTION3 Develop a company-wide security policy. You decided that the first critical senior management security function that you need to address in improving GearOn’s security would be to establish a company-wide security policy. This was the best choice. This step should be implemented first, before additional steps are taken. Technical Safeguards for the Database What technical safeguards will you use to allow GearOn employees to securely access the database that stores members' credit card data? YOU CHOSE OPTION2 Smart card and pin You decided to require a smart card and pin for GearOn employees to securely access the database that stores members' credit card information. This was the best choice, as it fulfills Eliot's clear directive to protect members' data. Installing Firewalls You consider installing a firewall or multiple firewalls as technical safeguards for secure access to the database. How many firewalls will you install? YOU CHOSE OPTION3 A perimeter firewall and an internal firewall You decided to install a perimeter firewall and an internal firewall to protect GearOn. This was the best choice. Multiple firewalls are necessary to protect an organization. Preventing Loss of the Encryption Key You learn that in a previous security breach at GearUp, a disgruntled employee destroyed the encryption key that had been used to protect data. How will you prevent a similar data safeguard problem at GearOn? YOU CHOSE OPTION1 Implement a key escrow procedure. You answered that in order to protect the encryption key, you would implement a key escrow procedure. This was the best choice, because a key escrow procedure is when a trusted party has a copy of the encryption key. If GearOn’s copy of the key were destroyed, a key escrow procedure would allow it to be easily re-implemented. Human Security Safeguards What is the most effective way to begin setting up human security safeguards? YOU CHOSE OPTION2 Document the security sensitivity for each position You answered that the effective way to begin setting up human security safeguards was to document the security sensitivity for each position. This was the best choice. Effective human safeguards begin with definitions of job tasks and responsibilities. Employee Passwords Several employees come to you complaining that the passwords they must use are too long, too complex, and must be changed too often. What do you tell them? YOU CHOSE OPTION1 These measures are necessary for security to be strong. You answered that these measures are necessary for security to be strong. This was the best choice. For passwords to be effective security measures, they must be long, complex, and changed often. Frequent password changes reduce not only the risk of password loss but also limit the extent of damage if an existing password is compromised. Employees will have to accept this as a part of their job.