Assignment Code: MSEI-026/TMA/2023

Course Code: MSEI-026

Assignment Name: BCP, DR Planning and Audit

Year: 2023

Verification Status: Verified by Professor

There are two questions in this assignment. Answer all the questions. You may use illustrations and diagrams to enhance your explanations.

Question 1: Conventional security measures such as firewalls and SSL provide defense to some attacks but you should thoroughly validate your input and use parameterized stored procedures as a minimum defense. Suggest the various actions that must be taken to provide basic information security for the digital information, computers, and networks. (10 Marks)

Ans) For digital information, computers, and networks, basic information security means using a layered approach that combines different measures to make a defence in depth. Various actions that must be taken to provide basic information security for the digital information, computers, and networks are:

1. Access Control: Limit access to sensitive data and functionality to authorised users only. Use strong passwords and multi-factor authentication to guard against illegal access.

2. Network Security: Protect your network from malicious software and illegal access by putting in place various security measures, such as firewalls, intrusion detection systems, and more.

3. Data Encryption: Protecting sensitive data while it is in transit and while it is stored requires the use of powerful encryption methods. This covers the utilisation of SSL/TLS for web connections as well as the encryption of data that is stored.

4. Regular Updates: Maintaining your software and operating systems' up-to-date status with the latest security patches and upgrades is the best way to prevent exploits of known vulnerabilities.

5. Secure Coding: To avoid security flaws from being introduced into your software, you should write secure code that complies with all of the relevant coding standards and recommendations.

6. Security Testing: Regular security testing, including vulnerability scanning, penetration testing, and code reviews, should be carried out in order to locate and fix any security flaws that may have been discovered.

7. Incident Response: Prepare for potential security breaches with a well-thought-out incident response strategy so that you can act swiftly and reduce the damage they do.

8. User Training: Users should be instructed on best practises for safe computing, including how to identify and avoid being a victim of phishing scams and other forms of social engineering assaults.

Question 2: Risk analysis is an integral part of the planning of a project, not an add-on at the end. One of the prime reasons for doing risk analyses are to identify risks and risk management strategies so the decision-makers can decide how the risks can be managed which could well involve a revision of the project plan. Do you agree? Explain in detail. (10 Marks)

Ans) I couldn't agree more that, risk assessment is an essential component of project planning and that it need to be carried out from the outset of the undertaking rather than as an afterthought at the conclusion of the work.

This is due to a number of factors, including the following:

Identify Risks

The primary goal of conducting a risk analysis is to identify potential hazards that may have an effect on the project. It is possible for project managers to identify and evaluate potential risks prior to their occurrence if they conduct risk analysis at the beginning of the project. This enables project managers to develop risk management strategies that can reduce the impact of the risks or even eliminate them entirely.

Develop Risk Management Strategies

Project managers are able to devise risk management solutions once the hazards have been recognised, with the goal of reducing or eliminating the risks as much as possible. This requires determining the likelihood of each risk occurring as well as the potential consequences of its occurrence, as well as devising plans of action to deal with the risks should they materialise.

Decision Making

The results of a risk analysis supply decision-makers with knowledge that can be utilised in the process of making informed decisions regarding how to manage the risks that are involved with the project. The project managers can use this information to assist them decide whether to continue with the project as planned or whether to alter the project plan in order to meet the risks that have been identified.

Resource Allocation

The identification of prospective hazards that may call for additional resources or attention is one of the many ways that risk analysis can assist project managers in more effectively allocating such resources.

Cost Management

If risks are recognised and mitigation strategies are developed early on in a project, it may be possible to avoid more expensive delays or rework later on in the project.