CIS 359 CIS359 CIS/359 ENTIRE COURSE HELP – STRAYER UNIVERSITY

Description

CIS 359 CIS359 CIS/359 ENTIRE COURSE HELP – STRAYER UNIVERSITY

CIS 359 Final Exam All 2 Set

CIS 359 Final Exam Set 1

CIS 359 Final Exam Set 2

CIS 359 Midterm Exam All 3 Set

CIS 359 Midterm Exam Set 1

CIS 359 Midterm Exam Set 2

CIS 359 Midterm Exam Set 3

CIS 359 Week 1 Discussion

CIS 359 Week 10 Term Paper: Contingency Planning in Action

CIS 359 Week 2 Assignment 1 Continuity Planning Overview

CIS 359 Week 3 Case Study 1: Stuxnet and U.S. Incident Response

CIS 359 Week 4 Assignment 2: Incident Response (IR) Revamp

CIS 359 Week 6 Assignment 3 Incident Response (IR) Strategic Decisions

CIS 359 Week 7 Case Study 2: Disaster Recovery (DR) Lessons Learned: September 11th

CIS 359 Week 8 Assignment 4: Disaster Recovery (DR) Team

CIS 359 CIS359 CIS/359 ENTIRE COURSE HELP – STRAYER UNIVERSITY

CIS 359 Final Exam All 2 Set

CIS 359 Final Exam Set 1

CIS 359 Final Exam Set 2

CIS 359 CIS359 CIS/359 ENTIRE COURSE HELP – STRAYER UNIVERSITY

CIS 359 Final Exam Set 1

CIS 359 CIS359 CIS/359 ENTIRE COURSE HELP – STRAYER UNIVERSITY

CIS 359 Final Exam Set 2

CIS 359 CIS359 CIS/359 ENTIRE COURSE HELP – STRAYER UNIVERSITY

CIS 359 Midterm Exam All 3 Set

CIS 359 Midterm Exam Set 2

CIS 359 Midterm Exam Set 1

CIS 359 Midterm Exam Set 3

CIS 359 CIS359 CIS/359 ENTIRE COURSE HELP – STRAYER UNIVERSITY

CIS 359 Midterm Exam Set 1

Question 1

A CSIRT model that is effective for large organizations and for organizations with major computing resources at distant locations is the ____.

Question 2

The first group to communicate the CSIRT’s vision and operational plan is the managerial team or individual serving as the ____.

Question 3

Those services performed in response to a request or a defined event such as a help desk alert are called ____.

Question 4

One way to build and maintain staff skills is to develop incident-handling ____ and have the team members discuss how they would handle them.

Question 5

Giving the IR team the responsibility for ____ is generally not recommended.

Question 6

When an organization completely outsources its IR work, typically to an on-site contractor, it is called a(n) ____ model.

Question 7

The focus during a(n) ____ is on learning what worked, what didn’t, and where communications and response procedures may have failed.

Question 8

Those services undertaken to prepare the organization or the CSIRT constituents to protect and secure systems in anticipation of problems, attacks, or other events are called ____.

Question 9

____ are closely monitored network decoys serving that can distract adversaries from more valuable machines on a network; can provide early warning about new attack and exploitation trends; and can allow in-depth examination of adversaries during and after exploitation.

Question 10

Using a process known as ____, network-based IDPSs look for attack patterns by comparing measured activity to known signatures in their knowledge base to determine whether or not an attack has occurred or may be under way.

Question 11

In an attack known as ____, valid protocol packets exploit poorly configured DNS servers to inject false information to corrupt the servers’ answers to routine DNS queries from other systems on that network.

Question 12

The use of IDPS sensors and analysis systems can be quite complex. One very common approach is to use an open source software program called ____ running on an open source UNIX or Linux system that can be managed and queried from a desktop computer using a client interface.

Question 13

The ____ approach for detecting intrusions is based on the frequency with which certain network activities take place.

Question 14

A(n) ____ , a type of IDPS that is similar to the NIDPS, reviews the log files generated by servers, network devices, and even other IDPSs.

Question 15

The ____ is a federal law that creates a general prohibition on the realtime monitoring of traffic data relating to communications.

Question 16

A(n) ____ is often included in legal documents to ensure that a vendor is not liable for actions taken by a client.

Question 17

A ____ is an agency that provides physical facilities in the event of a disaster for a fee.

Question 18

A potential disadvantage of a ____ site-resumption strategy is that more than one organization might need the facility simultaneously.

Question 19

An organization aggregates all local backups to a central repository and then backs up that repository to an online vendor, with a ____ backup strategy.

Question 20

A(n) ____ is an extension of an organization’s intranet into cloud computing.

Question 21

A ____ is a synonym for a virtualization application.

Question 22

____ uses a number of hard drives to store information across multiple drive units.

Question 23

A resumption location known as a ____ is a fully configured computer facility capable of establishing operations at a moment’s notice.

Question 24

Some recovery strategies seek to improve the ____ of a server or system in addition to, or instead of, performing backups of data.

Question 25

The ____ is used to collect information directly from the end users and business managers.

Question 26

The purpose of the ____ is to define the scope of the CP operations and establish managerial intent with regard to timetables for response to incidents, recovery from disasters, and  reestablishment of operations for continuity.

Question 27

To a large extent, incident response capabilities are part of a normal IT budget. The only area in which additional budgeting is absolutely required for incident response is the maintenance of  ____.

Question 28

An manual alternative to the normal way of accomplishing an IT task might be employed in the event that IT is unavailable. This is called a ____.

Question 29

What is a common approach used in the discipline of systems analysis and design to understand the ways systems operate and to chart process flows and interdependency studies?

Question 30

Which of the following collects and provides reports on failed login attempts, probes, scans, denial-of-service attacks, and detected malware?

Question 31

The last stage of a business impact analysis is prioritizing the resources associated with the ____, which brings a better understanding of what must be recovered first.

Question 32

The final component to the CPMT planning process is to deal with ____.

Question 33

The ____ job functions and organizational roles focus on protecting the organization’s information systems and stored information from attacks.

Question 34

A(n) ____ is a detailed examination of the events that occurred, from first detection of an incident to final recovery.

Question 35

Incident analysis resources include network diagrams and lists of ____, such as database servers.

Question 36

The U.S. National Institute of Standards and Technology recommends a set of tools for the CSIRT including incident reporting mechanisms with which users can report suspected incidents. At least one of these mechanisms should permit people to report incidents ____.

Question 37

A(n) ____ is a CSIRT team member, other than the team leader, who is currently performing the responsibilities of the team leader in scanning the organization’s information infrastructure for signs of an incident.

Question 38

____ is the process of systematically examining information assets for evidentiary material that can provide insight into how an incident transpired.

Question 39

A favorite pastime of information security professionals is ____, which is a simulation of attack and defense activities using realistic networks and information systems.

Question 40

Should an incident begin to escalate, the CSIRT team leader continues to add resources and skill sets as necessary to attempt to contain and terminate the incident. The resulting team is called the ____ for this particular incident.

Question 41

General users require training on the technical details of how to do their jobs securely, including good security practices, ____ management, specialized access controls, and violation reporting.

Question 42

The ____ illustrates the most critical characteristics of information and has been the industry standard for computer security since the development of the mainframe.

Question 43

____ assigns a risk rating or score to each information asset. Although this number does not mean anything in absolute terms, it is useful in gauging the relative risk to each vulnerable information asset and facilitates the development of comparative ratings later in the risk control process.

Question 44

A ____ deals with the preparation for and recovery from a disaster, whether natural or man-made.

Question 45

A(n) ____ is any clearly identified attack on the organization’s information assets that would threaten the assets’ confidentiality, integrity, or availability.

Question 46

A ____ is a document that describes how, in the event of a disaster, critical business functions continue at an alternate location while the organization recovers its ability to function at the primary site.

Question 47

A(n) ____ is an object, person, or other entity that is a potential risk of loss to an asset.

Question 48

A(n) ____ is used to anticipate, react to, and recover from events that threaten the security of information and information assets in an organization; it is also used to restore the organization to normal modes of business operations;

Question 49

Information assets have ____ when they are not exposed (while being stored, processed, or transmitted) to corruption, damage, destruction, or other disruption of their authentic states.

Question 50

____ hack systems to conduct terrorist activities through network or Internet pathways.

CIS 359 CIS359 CIS/359 ENTIRE COURSE HELP – STRAYER UNIVERSITY

CIS 359 Midterm Exam Set 2

1.      One of the primary responsibilities of the IRP team is to ensure that the ____ is prepared to respond to each incident it may face.

2.      A(n) ____ is a detailed examination of the events that occurred, from first detection of an incident to final recovery.

3.      ____ is the process of systematically examining information assets for evidentiary material that can provide insight into how an incident transpired.

4.      The Southeast Collegiate Cyber Defense Competition is unique in that it focuses on the operational aspect of managing and protecting an existing network infrastructure. Unlike “capture-the-flag ” exercises, this competition is exclusively a real-world ____ competition.

5.      Should an incident begin to escalate, the CSIRT team leader continues to add resources and skill sets as necessary to attempt to contain and terminate the incident. The resulting team is called the ____ for this particular incident.

6.      A(n) ____ is a CSIRT team member, other than the team leader, who is currently performing the responsibilities of the team leader in scanning the organization’s information infrastructure for signs of an incident.

7.      The training delivery method with the lowest cost to the organization is ____.

8.      The U.S. National Institute of Standards and Technology recommends a set of tools for the CSIRT including incident reporting mechanisms with which users can report suspected incidents. At least one of these mechanisms should permit people to report incidents ____.

9.      A(n) ____ is an object, person, or other entity that is a potential risk of loss to an asset.

10.  A(n) ____ is used to anticipate, react to, and recover from events that threaten the security of information and information assets in an organization; it is also used to restore the organization to normal modes of business operations;

11.  A ____ is a document that describes how, in the event of a disaster, critical business functions continue at an alternate location while the organization recovers its ability to function at the primary site.

12.  ____ hack systems to conduct terrorist activities through network or Internet pathways.

13.  ____ is the risk control approach that attempts to reduce the impact caused by the exploitation of vulnerability through planning and preparation.

14.  ____ ensures that only those with the rights and privileges to access information are able to do so.

15.  ____ is a risk control approach that attempts to shift the risk to other assets, other processes, or other organizations.

16.  A ____ attack seeks to deny legitimate users access to services by either tying up a server’s available resources or causing it to shut down.

17.  Information assets have ____ when authorized users – persons or computer systems – are able to access them in the specified format without interference or obstruction.

18.  The purpose of the ____ is to define the scope of the CP operations and establish managerial intent with regard to timetables for response to incidents, recovery from disasters, and  reestablishment of operations for continuity.

19.  The ____ job functions and organizational roles focus on protecting the organization’s information systems and stored information from attacks.

20.  The ____ is the point in time by which systems and data must be recovered after an outage as determined by the business unit.

21.  Within an organization, a(n) ____ is a group of individuals who are united by shared interests or values and who have a common goal of making the organization function to meet its objectives.

22.  The ____ is used to collect information directly from the end users and business managers.

23.  The final component to the CPMT planning process is to deal with ____.

24.  The last stage of a business impact analysis is prioritizing the resources associated with the ____, which brings a better understanding of what must be recovered first.

25.  The ____ is an investigation and assessment of the impact that various events or incidents can have on the organization.

26.  The ____ job functions and organizational roles focus on costs of system creation and operation, ease of use for system users, timeliness of system creation, and transaction response time.

27.  A(n) ____ is an extension of an organization’s intranet into cloud computing.

28.  A ____ is a contractual document guaranteeing certain minimal levels of service provided by a vendor.

29.  A ____ is an agency that provides physical facilities in the event of a disaster for a fee.

30.  A(n) ____ is often included in legal documents to ensure that a vendor is not liable for actions taken by a client.

31.  An organization aggregates all local backups to a central repository and then backs up that repository to an online vendor, with a ____ backup strategy.

32.  A ____ is commonly a single device or server that attaches to a network and uses TCP/IP-based protocols and communications methods to provide an online storage environment.

33.  A potential disadvantage of a ____ site-resumption strategy is that more than one organization might need the facility simultaneously.

34.  Some recovery strategies seek to improve the ____ of a server or system in addition to, or instead of, performing backups of data.

35.  RAID 0 creates one logical volume across several available hard disk drives and stores the data using ____, in which data segments are written in turn to each disk drive in the array.

36.  The determination of what systems fall under the CSIRT ’s responsibility is called its ____.

37.  Those services performed in response to a request or a defined event such as a help desk alert are called ____.

38.  In the absence of the assigned team manager, the ____ should assume authority for overseeing and evaluating a provided service.

39.  When an organization completely outsources its IR work, typically to an on-site contractor, it is called a(n) ____ model.

40.  The champion for the CSIRT may be the same person as the champion for the entire IR function—typically, the ____.

41.  A CSIRT model that is effective for large organizations and for organizations with major computing resources at distant locations is the ____.

42.  The announcement of an operational CSIRT should minimally include ____.

43.  A key step in the ____ approach to incident response is to discover the identify of the intruder while documenting his or her activity.

44.  Using a process known as ____, network-based IDPSs look for attack patterns by comparing measured activity to known signatures in their knowledge base to determine whether or not an attack has occurred or may be under way.

45.  The ____ is a federal law that creates a general prohibition on the realtime monitoring of traffic data relating to communications.

46.  The ____ approach for detecting intrusions is based on the frequency with which certain network activities take place.

47.  A(n) ____ , a type of IDPS that is similar to the NIDPS, reviews the log files generated by servers, network devices, and even other IDPSs.

48.  ____ are closely monitored network decoys serving that can distract adversaries from more valuable machines on a network; can provide early warning about new attack and exploitation trends; and can allow in-depth examination of adversaries during and after exploitation.

49.  In an attack known as ____, valid protocol packets exploit poorly configured DNS servers to inject false information to corrupt the servers’ answers to routine DNS queries from other systems on that network.

A(n) ____ is the set of rules and configuration guidelines governing the implementation and operation of IDPSs within the organization.

CIS 359 CIS359 CIS/359 ENTIRE COURSE HELP – STRAYER UNIVERSITY

CIS 359 Midterm Exam Set 3

•           Question 1

When using virtualization, it is commonplace to use the term ____ to refer to a virtualized environment operating in or on a host platform.

•           Question 2

A(n) ____ backup only archives the files that have been modified since the last backup.

•           Question 3

A(n) ____ is an extension of an organization’s intranet into cloud computing.

•           Question 4

RAID 0 creates one logical volume across several available hard disk drives and stores the data using ____, in which data segments are written in turn to each disk drive in the array.

•           Question 5

A ____ is commonly a single device or server that attaches to a network and uses TCP/IP-based protocols and communications methods to provide an online storage environment.

•           Question 6

A ____ is an agency that provides physical facilities in the event of a disaster for a fee.

•           Question 7

A(n) ____ is often included in legal documents to ensure that a vendor is not liable for actions taken by a client.

•           Question 8

A resumption location known as a ____ is a fully configured computer facility capable of establishing operations at a moment’s notice.

•           Question 9

A ____ is a contractual document guaranteeing certain minimal levels of service provided by a vendor.

•           Question 10

The responsibility for creating an organization’s IR plan often falls to the ____.

•           Question 11

____ is the process of systematically examining information assets for evidentiary material that can provide insight into how an incident transpired.

•           Question 12

Incident analysis resources include network diagrams and lists of ____, such as database servers.

•           Question 13

One of the primary responsibilities of the IRP team is to ensure that the ____ is prepared to respond to each incident it may face.

•           Question 14

A(n) ____ is a detailed examination of the events that occurred, from first detection of an incident to final recovery.

•           Question 15

The Southeast Collegiate Cyber Defense Competition is unique in that it focuses on the operational aspect of managing and protecting an existing network infrastructure. Unlike “capture-the-flag ” exercises, this competition is exclusively a real-world ____ competition.

•           Question 16

The U.S. National Institute of Standards and Technology recommends a set of tools for the CSIRT including incident reporting mechanisms with which users can report suspected incidents. At least one of these mechanisms should permit people to report incidents ____.

•           Question 17

The training delivery method with the lowest cost to the organization is ____.

•           Question 18

A(n) ____ is the set of rules and configuration guidelines governing the implementation and operation of IDPSs within the organization.

•           Question 19

A(n) ____ is any system resource that is placed onto a functional system but has no normal use for that system. If it attracts attention, it is from unauthorized access and will trigger a notification or response.

•           Question 20

The use of IDPS sensors and analysis systems can be quite complex. One very common approach is to use an open source software program called ____ running on an open source UNIX or Linux system that can be managed and queried from a desktop computer using a client interface.

•           Question 21

A(n) ____ , a type of IDPS that is similar to the NIDPS, reviews the log files generated by servers, network devices, and even other IDPSs.

•           Question 22

New systems can respond to an incident threat autonomously, based on preconfigured options that go beyond simple defensive actions usually associated with IDPS and IPS systems. These systems, referred to as ____, use a combination of resources to detect an intrusion and then to trace the intrusion back to its source.

•           Question 23

The ____ is a federal law that creates a general prohibition on the realtime monitoring of traffic data relating to communications.

•           Question 24

In an attack known as ____, valid protocol packets exploit poorly configured DNS servers to inject false information to corrupt the servers’ answers to routine DNS queries from other systems on that network.

•           Question 25

The purpose of the ____ is to define the scope of the CP operations and establish managerial intent with regard to timetables for response to incidents, recovery from disasters, and  reestablishment of operations for continuity.

•           Question 26

The first major business impact analysis task is to analyze and prioritize the organization’s business processes based on their relationships to the organization’s ____.

•           Question 27

The ____ is an investigation and assessment of the impact that various events or incidents can have on the organization.

•           Question 28

One modeling technique drawn from systems analysis and design that can provide an excellent way to illustrate how a business functions is a(n) ____.:

•           Question 29

The ____ is used to collect information directly from the end users and business managers.

•           Question 30

The ____ job functions and organizational roles focus on costs of system creation and operation, ease of use for system users, timeliness of system creation, and transaction response time.

•           Question 31

Which of the following collects and provides reports on failed login attempts, probes, scans, denial-of-service attacks, and detected malware?

•           Question 32

Within an organization, a(n) ____ is a group of individuals who are united by shared interests or values and who have a common goal of making the organization function to meet its objectives.

•           Question 33

The elements required to begin the ____ process are a planning methodology; a policy environment to enable the planning process; an understanding of the causes and effects of core precursor activities, and access to financial and other resources.

•           Question 34

____ is a risk control approach that attempts to shift the risk to other assets, other processes, or other organizations.

•           Question 35

A ____ deals with the preparation for and recovery from a disaster, whether natural or man-made.

•           Question 36

The term ____ refers to a broad category of electronic and human activities in which an unauthorized individual gains access to the information an organization is trying to protect.

•           Question 37

____ of risk is the choice to do nothing to protect an information asset and to accept the outcome of its potential exploitation.

•           Question 38

A(n) ____ is an investigation and assessment of the impact that various attacks can have on the organization.

•           Question 39

A ____ attack seeks to deny legitimate users access to services by either tying up a server’s available resources or causing it to shut down.

•           Question 40

Information assets have ____ when authorized users – persons or computer systems – are able to access them in the specified format without interference or obstruction.

•           Question 41

The ____ illustrates the most critical characteristics of information and has been the industry standard for computer security since the development of the mainframe.

•           Question 42

____ is the process of examining, documenting, and assessing the security posture of an organization’s information technology and the risks it faces.

•           Question 43

A CSIRT model that is effective for large organizations and for organizations with major computing resources at distant locations is the ____.

•           Question 44

The CSIRT should be available for contact by anyone who discovers or suspects that an incident involving the organization has occurred. Some organizations prefer that employees contact a ____, which then makes the determination as to whether to contact the CSIRT or not.

•           Question 45

Those services undertaken to prepare the organization or the CSIRT constituents to protect and secure systems in anticipation of problems, attacks, or other events are called ____.

•           Question 46

The ____ flow of information needed from the CSIRT to organizational and IT/InfoSec management is a critical communication requirement.

•           Question 47

The champion for the CSIRT may be the same person as the champion for the entire IR function—typically, the ____.

•           Question 48

A key step in the ____ approach to incident response is to discover the identify of the intruder while documenting his or her activity.

•           Question 49

In the absence of the assigned team manager, the ____ should assume authority for overseeing and evaluating a provided service.

•           Question 50

Giving the IR team the responsibility for ____ is generally not recommended.

CIS 359 CIS359 CIS/359 ENTIRE COURSE HELP – STRAYER UNIVERSITY

CIS 359 Week 1 Discussion

From the e-Activity, explain in your own words what you believe CP attempts to provide for an organization, and describe what you believe is the most important CP consideration for an organization. Provide a rationale for your answer.

Consider an organization in a specific industry (e.g., healthcare, financial, etc.), and discuss the potential shortcomings and repercussions if an organization in this sector neglected to participate in contingency planning efforts. Provide two real-world examples (successes and / or failures) to justify your answer.

CIS 359 CIS359 CIS/359 ENTIRE COURSE HELP – STRAYER UNIVERSITY

CIS 359 Week 10 Term Paper: Contingency Planning in Action

Term Paper: Contingency Planning in Action

Due Week 10 and worth 200 points

Create a hypothetical organization with details including geographic location(s), number of employees in each location, primary business functions, operational and technology details, potential threats to the business and its technology, and anything else that you believe is relevant to the business.

Assume this organization is lacking in its contingency planning efforts and requires assistance in ensuring these efforts are appropriately addressed to increase its overall security and preparedness posture.

Write a ten to fifteen (10-15) page paper in which you:

1. Provide an overview of the organization and indicate why contingency planning efforts are needed and how these efforts could benefit the business.
2. Develop a full contingency plan for the organization. Include all subordinate functions / sub plans, including BIA, IRP, DRP, and BCP efforts.
3. Determine the policies and procedures that would be needed for all contingency planning efforts. Detail the role of the policy / procedure, and explain how each would help achieve the goals of these efforts.
4. Detail the processes to utilize in order to fully implement the contingency plan and its components, and explain the efforts to consider in maintaining the plans.
5. Create a hypothetical incident scenario where the contingency planning efforts would need to be utilized and detail:
   1. how the plan is sufficiently equipped to handle the incident.
   2. a timeline for the incident response and recovery efforts.
6. Identify any ethical concerns that are specific to this organization and its incident response personnel (especially the CP Team Leader), and explain how to plan for these concerns.
7. Use at least five (5) quality resources in this assignment.Note: Wikipedia and similar Websites do not qualify as quality resources.

Your assignment must follow these formatting requirements:

• Be typed, double spaced, using Times New Roman font (size 12), with one-inch margins on all sides; citations and references must follow APA or school-specific format. Check with your professor for any additional instructions.
• Include a cover page containing the title of the assignment, the student’s name, the professor’s name, the course title, and the date. The cover page and the reference page are not included in the required assignment page length.

The specific course learning outcomes associated with this assignment are:

• Explain risk management in the context of information security.
• Develop a disaster recovery plan for an organization.
• Summarize the various types of disasters, response and recovery methods.
• Compare and contrast the methods of disaster recovery and business continuity.
• Explain and develop a business continuity plan to address unforeseen incidents.
• Describe crisis management guidelines and procedures.
• Describe detection and decision-making capabilities in incident response.
• Develop techniques for different disaster scenarios.
• Evaluate the ethical concerns inherent in disaster recovery scenarios.
• Use technology and information resources to research issues in disaster recovery.
• Write clearly and concisely about disaster recovery topics using proper writing mechanics and technical style conventions.

CIS 359 CIS359 CIS/359 ENTIRE COURSE HELP – STRAYER UNIVERSITY

CIS 359 Week 2 Assignment 1 Continuity Planning Overview

CIS 359 CIS359 CIS/359 ENTIRE COURSE HELP – STRAYER UNIVERSITY

CIS 359 Week 3 Case Study 1: Stuxnet and U.S. Incident Response

Case Study 1: Stuxnet and U.S. Incident Response

Due Week 3 and worth 100 points

Read the article titled “When Stuxnet Hit the Homeland: Government Response to the Rescue,” from ABC News, located athttp://abcnews.go.com/blogs/headlines/2012/06/when-stuxnet-hit-the-homeland-government-response-to-the-rescue/ and consider this threat in terms of incident response and recovery procedures.

Write a three to four (3-4) page paper in which you:

1. Explain the role of US-CERT in protecting the nation’s industrial systems and analyze its efforts in relation to preparedness and incident and recovery management.
2. Discuss the efforts of ICS-CERT specifically to the Stuxnet threat and examine its incident response efforts to mitigate this risk against U.S. industrial systems.
3. With the sophistication of the primary sites of industrial system implementations, determine whether or not alternate sites (e.g., hot site) are feasible for organizations that utilize ICS technologies. Provide a rationale.
4. Explain the high-level planning needed for an industrial systems organization that utilizes ICS technologies to prepare for attacks from cyber threats such as Stuxnet.
5. Use at least four (4) quality resources in this assignment.Note: Wikipedia and similar Websites do not qualify as quality resources.

Your assignment must follow these formatting requirements:

• Be typed, double spaced, using Times New Roman font (size 12), with one-inch margins on all sides; citations and references must follow APA or school-specific format. Check with your professor for any additional instructions.
• Include a cover page containing the title of the assignment, the student’s name, the professor’s name, the course title, and the date. The cover page and the reference page are not included in the required assignment page length.

The specific course learning outcomes associated with this assignment are:

• Summarize the various types of disasters, response and recovery methods.
• Describe detection and decision-making capabilities in incident response.
• Use technology and information resources to research issues in disaster recovery.
• Write clearly and concisely about disaster recovery topics using proper writing mechanics and technical style conventions.

CIS 359 CIS359 CIS/359 ENTIRE COURSE HELP – STRAYER UNIVERSITY

CIS 359 Week 4 Assignment 2: Incident Response (IR) Revamp

Assignment 2: Incident Response (IR) Revamp

Due Week 4 and worth 75 points

Imagine you have just taken over the manager position for your organization’s incident response team, after coming from another division in the company. Your first realization is that proper procedures, best practices, and sound technologies are not being utilized. You decide to revamp the team’s efforts.

Write a two to three (2-3) page paper in which you:

1. Explicate the main efforts that would be included in the incident response efforts, including but not limited to personnel and team structure, tools and utilities, and proper procedures.
2. Discuss in detail the role that an IDS / IPS would play in the IR efforts, and explain how these systems can assist in the event notification, determination, and escalation processes.
3. Explain how the NIST SP800-61, Rev. 1 could assist the personnel in classifying incidents so each is identified appropriately and the proper incident-handling procedures are taken.
4. Explain how the use of log management systems (e.g., Splunk) could be a legitimate and useful component of the IR efforts, and describe the potential issues that could arise if not utilized.
5. Use at least three (3) quality resources in this assignment.Note: Wikipedia and similar Websites do not qualify as quality resources.

Your assignment must follow these formatting requirements:

• Be typed, double spaced, using Times New Roman font (size 12), with one-inch margins on all sides; citations and references must follow APA or school-specific format. Check with your professor for any additional instructions.
• Include a cover page containing the title of the assignment, the student’s name, the professor’s name, the course title, and the date. The cover page and the reference page are not included in the required assignment page length.

The specific course learning outcomes associated with this assignment are:

• Summarize the various types of disasters, response and recovery methods.
• Describe detection and decision-making capabilities in incident response.
• Use technology and information resources to research issues in disaster recovery.
• Write clearly and concisely about disaster recovery topics using proper writing mechanics and technical style conventions.

CIS 359 CIS359 CIS/359 ENTIRE COURSE HELP – STRAYER UNIVERSITY

CIS 359 Week 6 Assignment 3 Incident Response (IR) Strategic Decisions

Assignment 3: Incident Response (IR) Strategic Decisions

Due Week 6 and worth 75 points

Suppose that you have been alerted of a potential incident involving a suspected worm spreading via buffer overflow techniques, compromising Microsoft IIS Web servers. As the IR Team leader, it is your responsibility to determine the next steps.

Write a two to three (2-3) page paper in which you:

1. Explain in detail the initial steps that would need to be made by you and the IR team in order to respond to this potential incident.
2. Construct a process-flow diagram that illustrates the process of determining the incident containment strategy that would be used in this scenario, and identify which containment strategy would be appropriate in this case, through the use of graphical tools in Visio, or an open source alternative such as Dia. Note: The graphically depicted solution is not included in the required page length.
3. Construct a process flow diagram to illustrate the process(es) for determining if / when notification of the incident should be relayed to upper management, and explain how those communications should be structured and relayed through the use of graphical tools in Visio, or an open source alternative such as Dia. Note: The graphically depicted solution is not included in the required page length.
4. Detail the incident recovery processes for the resolution of this incident.
5. Use at least three (3) quality resources in this assignment.Note: Wikipedia and similar Websites do not qualify as quality resources.

Your assignment must follow these formatting requirements:

• Be typed, double spaced, using Times New Roman font (size 12), with one-inch margins on all sides; citations and references must follow APA or school-specific format. Check with your professor for any additional instructions.
• Include a cover page containing the title of the assignment, the student’s name, the professor’s name, the course title, and the date. The cover page and the reference page are not included in the required assignment page length.

The specific course learning outcomes associated with this assignment are:

• Summarize the various types of disasters, response and recovery methods.
• Develop techniques for different disaster scenarios.
• Use technology and information resources to research issues in disaster recovery.
• Write clearly and concisely about disaster recovery topics using proper writing mechanics and technical style conventions.

CIS 359 CIS359 CIS/359 ENTIRE COURSE HELP – STRAYER UNIVERSITY

CIS 359 Week 7 Case Study 2: Disaster Recovery (DR) Lessons Learned: September 11th

Case Study 2: Disaster Recovery (DR) Lessons Learned: September 11th

Due Week 7 and worth 100 points

Read the article titled “9/11: Top lessons learned for disaster recovery,” from Computerworld.com, located athttp://www.computerworld.com/s/article/9219867/9_11_Top_lessons_learned_for_disaster_recovery, and consider the effects the attacks of September 11, 2001, have had on technology recovery efforts.

Write a two to four (2-4) page paper in which you:

1. Explain how the attacks affected risk management in organizations and have prompted an increased justification for recovery-based objectives, initiatives, and expenditures.
2. Analyze the use of social media and other current methods of communication for emergency notifications during an incident or disaster situation.
3. Determine whether or not organizations need to consider distanced geographic locations when preparing for backup operations / data centers, and determine the effects that recovery point objectives (RPO) and recovery time objectives (RTO) have on these decisions.
4. Evaluate the use of cloud services as tools for recovery operations within an organization, and explain how they could increase or decrease the effectiveness of recovery operations.
5. Determine whether or not cloud services are ideal recovery options for organizations regardless of their size. Provide a rationale to support the answer.
6. Use at least four (4) quality resources in this assignment.Note: Wikipedia and similar Websites do not qualify as quality resources.

Your assignment must follow these formatting requirements:

• Be typed, double spaced, using Times New Roman font (size 12), with one-inch margins on all sides; citations and references must follow APA or school-specific format. Check with your professor for any additional instructions.
• Include a cover page containing the title of the assignment, the student’s name, the professor’s name, the course title, and the date. The cover page and the reference page are not included in the required assignment page length.

The specific course learning outcomes associated with this assignment are:

• Explain risk management in the context of information security.
• Summarize the various types of disasters, response and recovery methods.
• Compare and contrast the methods of disaster recovery and business continuity.
• Explain and develop a business continuity plan to address unforeseen incidents.
• Develop techniques for different disaster scenarios.
• Use technology and information resources to research issues in disaster recovery.
• Write clearly and concisely about disaster recovery topics using proper writing mechanics and technical style conventions.

CIS 359 CIS359 CIS/359 ENTIRE COURSE HELP – STRAYER UNIVERSITY

CIS 359 Week 8 Assignment 4: Disaster Recovery (DR) Team

Assignment 4: Disaster Recovery (DR) Team

Due Week 8 and worth 75 points

Consider a scenario where the contingency planning management team (CPMT) of your organization has designated you as the disaster recovery team leader, and the preparation and planning of this component of the security program is now under your purview with a team of 11 employees including yourself.

Write a two to three (2-3) page paper in which you:

1. Detail the DR team roles, responsibilities, and sub teams that would be implemented, and construct an organizational chart for the team through the use of graphical tools in Visio, or an open source alternative such as Dia. Note: The graphically depicted solution is not included in the required page length.
2. Describe the proper procedures and policies that would be implemented specific to the DR team personnel as well as special equipment that would be required.
3. Draft an executive summary to the DR plan and explain the purpose of the plan and high-level specifics for upper management.
4. Use at least three (3) quality resources in this assignment.Note: Wikipedia and similar Websites do not qualify as quality resources.

Your assignment must follow these formatting requirements:

• Be typed, double spaced, using Times New Roman font (size 12), with one-inch margins on all sides; citations and references must follow APA or school-specific format. Check with your professor for any additional instructions.
• Include a cover page containing the title of the assignment, the student’s name, the professor’s name, the course title, and the date. The cover page and the reference page are not included in the required assignment page length.
• Include charts or diagrams created in Visio or Dia. The completed diagrams / charts must be imported into the Word document before the paper is submitted.

The specific course learning outcomes associated with this assignment are:

• Develop a disaster recovery plan for an organization.
• Compare and contrast the methods of disaster recovery and business continuity.
• Develop techniques for different disaster scenarios.
• Use technology and information resources to research issues in disaster recovery.
• Write clearly and concisely about disaster recovery topics using proper writing mechanics and technical style conventions.