Chapter 10 Implementing Information Security

Chapter 10 Implementing Information Security TRUEFALSE 1. The project plan as a whole must describe how to acquire and implement the needed security controls and create a setting in which those controls achieve the desired outcomes. (A) True (B) False Answer : (A) 2. In general, the design phase is accomplished by changing the configuration and operation of the organization's information systems to make them more secure. (A) True (B) False Answer : (B) 3. Planning for the implementation phase of a security project requires the creation of a detailed project plan. (A) True (B) False Answer : (A) 4. Each organization has to determine its own project management methodology for IT and information security projects. (A) True (B) False Answer : (A) 5. The first step in the work breakdown structure (WBS) approach encompasses activities, but not deliverables. (A) True (B) False Answer : (B) 6. The work breakdown structure (WBS) can only be prepared with a complex, specialized desktop PC application. (A) True (B) False Answer : (B) 7. Planners need to estimate the effort required to complete each task, subtask, or action step in the project plan. (A) True (B) False Answer : (A) 8. Each for-profit organization determines its capital budget and the rules for managing capital spending and expenses the same way. (A) True (B) False Answer : (B) 9. The budgets of public organizations are usually the product of legislation or public meetings. (A) True (B) False Answer : (A) 10. The need for qualified, trained, and available personnel constrains the project plan. (A) True (B) False Answer : (A) 11. The size of the organization and the normal conduct of business may preclude a large training program on new security procedures or technologies. (A) True (B) False Answer : (A) 12. All organizations should designate a champion from the general management community of interest to supervise the implementation of an information security project plan. (A) True (B) False Answer : (B) 13. When an estimate is flawed, as when the number of effort-hours required is underestimated, the plan should be corrected and downstream tasks updated to reflect the change. (A) True (B) False Answer : (A) 14. The primary drawback to the direct changeover approach is that if the new system fails or needs modification, users may be without services while the system's bugs are worked out. (A) True (B) False Answer : (A) 15. The networks layer of the bull's eye is the outermost ring of the bull's eye. (A) True (B) False Answer : (B) 16. The bull's-eye model can be used to evaluate the sequence of steps taken to integrate parts of the information security blueprint into a project plan. (A) True (B) False Answer : (A) 17. The effective use of a DMZ is one of the primary methods of securing an organization's networks. (A) True (B) False Answer : (A) 18. Every organization needs to develop an information security department or program of its own. (A) True (B) False Answer : (B) 19. "Unfreezing" in the Lewin change model involves thawing hard-and-fast habits and established procedures. (A) True (B) False Answer : (A) 20. Weak management support, with overly delegated responsibility and no champion, sentences a project to almost-certain failure. (A) True (B) False Answer : (A) 21. Performance management is the process of identifying and controlling the resources applied to a project as well as measuring progress and adjusting the process as progress is made toward the goal. _________________________ (A) True (B) False Answer : (B) 22. Planning for the implementation phase requires the creation of a detailed request for proposal, which is often assigned either to a project manager or the project champion. _________________________ (A) True (B) False Answer : (B) 23. In project planning, the tasks or action steps that come before the specific task at hand are commonly referred to as prerequisites. _________________________ (A) True (B) False Answer : (B) 24. A task or subtask becomes a(n) action step when it can be completed by one individual or skill set and when it includes a single deliverable. _________________________ (A) True (B) False Answer : (A) 25. In the early stages of planning, the project planner should attempt to specify completion dates only for major employees within the project. _________________________ (A) True (B) False Answer : (B) 26. The RFP determines the impact that a specific technology or approach can have on the organization's information assets and what it may cost. _________________________ (A) True (B) False Answer : (B) 27. The optimal time frame for training is usually one to three weeks before the new policies and technologies come online. _________________________ (A) True (B) False Answer : (A) 28. Most information security projects require a trained project developer. _________________________ (A) True (B) False Answer : (B) 29. Once a project is underway, it is managed using a process known as gap analysis, which ensures that progress is measured periodically. _________________________ (A) True (B) False Answer : (A) 30. Corrective action decisions are usually expressed in terms of trade-offs. _________________________ (A) True (B) False Answer : (A) 31. A direct changeover is also known as going "fast turnkey." _________________________ (A) True (B) False Answer : (B) 32. The primary drawback to the direct changeover approach is that if the new system fails or needs modification, users may be without services while the system's bugs are worked out. _________________________ (A) True (B) False Answer : (A) 33. The parallel operations strategy works well when an isolated group can serve as a test area, which prevents any problems with the new system dramatically interfering with the performance of the organization as a whole. _________________________ (A) True (B) False Answer : (B) 34. A proven method for prioritizing a program of complex change is the bull's-eye method. _________________________ (A) True (B) False Answer : (A) 35. An ideal organization fosters resilience to change. _________________________ (A) True (B) False Answer : (A) MULTICHOICE 36. Effective planning for information security involves: (A) collecting information about an organization's objectives. (B) collecting information about an organization's information security environment. (C) collecting information about an organization's technical architecture. (D) All of the above Answer : (D) 37. Tasks or action steps that come after the task at hand are called __________. (A) predecessors (B) successors (C) children (D) parents Answer : (B) 38. A(n) __________ is a simple project management planning tool. (A) RFP (B) WBS (C) ISO 17799 (D) SDLC Answer : (B) 39. If the task is to write firewall specifications for the preparation of a(n) __________, the planner would note that the deliverable is a specification document suitable for distribution to vendors. (A) WBS (B) CBA (C) SDLC (D) RFP Answer : (D) 40. The date for sending the final RFP to vendors is considered a(n) __________, because it signals that all RFP preparation work is complete. (A) intermediate step (B) resource (C) milestone (D) deliverable Answer : (C) 41. A(n) __________ is used to justify that the project will be reviewed and verified prior to the development of the project plan. (A) RFP (B) WBS (C) SDLC (D) CBA Answer : (D) 42. Many public organizations must spend all budgeted funds within the fiscal year-otherwise, the subsequent year's budget is __________. (A) increased by the unspent amount (B) not affected unless the deficit is repeated (C) automatically audited for questionable expenditures (D) reduced by the unspent amount Answer : (D) 43. In the __________ process, measured results are compared against expected results. (A) negative feedback loop (B) wrap-up (C) direct changeover (D) turnover Answer : (A) 44. The goal of the __________ is to resolve any pending project-related issues, critique the overall effort of the project, and draw conclusions about how to improve the project management process for the future. (A) direct changeover (B) wrap-up (C) phased implementation (D) pilot implementation Answer : (B) 45. Some cases of __________ are simple, such as requiring employees to begin using a new password on an announced date. (A) phased implementation (B) direct changeover (C) pilot implementation (D) wrap-up Answer : (B) 46. A __________ is usually the best approach to security project implementation. (A) direct changeover (B) phased implementation (C) pilot implementation (D) parallel operation Answer : (B) 47. In a __________ implementation, the entire security system is put in place in a single office, department, or division before expanding to the rest of the organization. (A) loop (B) direct (C) parallel (D) pilot Answer : (D) 48. The __________ methodology has been used by many organizations and requires that issues be addressed from the general to the specific, and that the focus be on systematic solutions instead of individual problems. (A) parallel (B) direct changeover (C) bull's-eye (D) wrap-up Answer : (C) 49. The __________ level of the bull's-eye model establishes the ground rules for the use of all systems and describes what is appropriate and what is inappropriate; it enables all other information security components to function correctly. (A) Policies (B) Networks (C) Systems (D) Applications Answer : (A) 50. The __________ layer of the bull's-eye model includes computers used as servers, desktop computers, and systems used for process control and manufacturing. (A) Policies (B) Networks (C) Systems (D) Applications Answer : (C) 51. The __________ layer of the bull's-eye model receives attention last. (A) Policies (B) Networks (C) Systems (D) Applications Answer : (D) 52. Technology __________ guides how frequently technical systems are updated, and how technical updates are approved and funded. (A) wrap-up (B) governance (C) turnover (D) changeover Answer : (B) 53. By managing the __________, the organization can reduce unintended consequences by having a process to resolve the potential conflict and disruption that uncoordinated change can introduce. (A) conversion process (B) wrap-up (C) process of change (D) governance Answer : (C) 54. The Lewin change model includes __________. (A) unfreezing (B) moving (C) refreezing (D) All of the above Answer : (D) 55. Project managers can reduce resistance to change by involving employees in the project plan. In the systems development parts of a project, this is referred to as __________. (A) DMZ (B) SDLC (C) WBS (D) JAD Answer : (D) SHORTANSWER 56. During the implementation phase, the organization translates its blueprint for information security into a project ____________________.Answer : plan 57. Management should coordinate the organization's information security vision and objectives with the communities of ____________________ involved in the execution of the plan.Answer : interest 58. A(n) _____________________ is a completed document or program module that can either serve as the beginning point for a later task or become an element in the finished project.Answer : deliverable 59. ____________________ is a phenomenon in which the project manager spends more time documenting project tasks, collecting performance measurements, recording project task information, and updating project completion forecasts than accomplishing meaningful project work.Answer : Projectitis 60. A(n) ____________________ is a specific point in the project plan when a task that has a noticeable impact on the plan's progress is complete.Answer : milestone 61. The tasks or action steps that come before the specific task at hand are called ____________________.Answer : predecessors 62. Tasks or action steps that come after the task at hand are called ____________________.Answer : successors 63. The project planner should describe the skills or personnel needed for a task, often referred to as a(n) ____________________.Answer : resource 64. Regardless of an organization's information security needs, the amount of effort that can be expended depends on the available funds; therefore, a ____________________ is typically prepared in the analysis phase of the SecSDLC and must be reviewed and verified prior to the development of the project plan.Answer : CBA Answer : cost-benefit analysis Answer : cost benefit analysis Answer : cost-benefit analysis (CBA) Answer : cost benefit analysis (CBA) Answer : CBA (cost-benefit analysis) Answer : CBA (cost benefit analysis) 65. Project ____________________ is a description of a project's features, capabilities, functions, and quality level, and is used as the basis of a project plan.Answer : scope 66. Once a project is underway, it is managed to completion using a process known as a negative ____________________ loop.Answer : feedback 67. A direct ____________________ involves stopping the old system and starting the new one without any overlap.Answer : changeover 68. A(n) ____________________ implementation is the most common conversion strategy and involves a measured rollout of the planned system with a part of the system being brought out and disseminated across an organization before the next piece is implemented.Answer : phased 69. The ____________________ operations strategy involves running the new system concurrently with the old system.Answer : parallel 70. At the center of the bull's-eye model are the ____________________ used by the organization to accomplish its work.Answer : applications 71. Technology _____________________ is a complex process that organizations use to manage the impact and costs of technology implementation, innovation, and obsolescence.Answer : governance 72. Medium- and large-sized organizations deal with the impact of technical change on the organization's operation through a(n) ____________________ control process.Answer : change 73. One of the oldest models of change is the Lewin change model, which consists of three stages: unfreezing, ____________________, and refreezing.Answer : moving 74. The level of resistance to ____________________ impacts the ease with which an organization is able to implement procedural and managerial changes.Answer : change 75. In systems development, JAD (____________________ development) means getting key representatives of user groups to serve as members of the development process.Answer : joint application ESSAY 76. What are the major steps in executing the project plan? Graders Info : The major steps in executing the project plan are: Planning the project Supervising tasks and action steps Wrapping up 77. What minimum attributes for project tasks does the WBS document? Graders Info : Work to be accomplished (activities and deliverables)Individuals (or skill set) assigned to perform the task Start and end dates for the task (when known) Amount of effort required for completion in hours or work days Estimated capital expenses for the task Estimated noncapital expenses for the task Identification of dependencies between and among tasks 78. What can the organization do by managing the process of change? Graders Info : By managing the process of change, the organization can do the following:- Improve communication about change across the organization - Enhance coordination between groups within the organization as change is scheduled and completed - Reduce unintended consequences by having a process to resolve the conflict and disruption that change can introduce - Improve quality of service as potential failures are eliminated and groups work together - Assure management that all groups are complying with the organization's policies regarding technology governance, procurement, accounting, and information security