Answer all questions
Chapter 11
1- Why is it good practice to put an Incident Response Plan in place for small software systems as well as large software systems? Give examples to support your position.
2- What are the essential outcomes of the Final Security Review? Why is this process necessary as the last step before release if security has been a consideration throughout the development process?
3- Why is periodic system review beneï¬cial to security? Justify your position.
4- What are the essential outcomes of secure system retirement? Justify your position.
5- How does the evolution of attack tools affect existing systems? What steps should an organization take to remain vigilant of these new methods for compromising systems?
Chapter 12
1- Why is it important to train personnel in security if it is not part of their job routine? Give examples to justify your position.
2- Why do insiders pose such a signiï¬cant threat to an organization? Find examples to justify your position.
3- What are the top three outcomes an organization should have for security training in an organization? Justify your ranking.
4- What are the main problems with preventing social engineering in an organization? Give examples to support your answer.
5- What is the risk of allowing Web 2.0 technologies to run on the computers of all employees in an organization? Give examples to justify your position.
