Scenario: A client company has asked you to help it develop an outline for an Enterprise IT Security Policy which addresses the following Enterprise Areas: 1.  Access Control 2.  Application Development 3.  Asset Management 4.  Business Operations 5.  Communications 6.  Compliance 7.  Corporate Governance 8.  Customers 9.  Incident Management 10.  IT Operations 11.  Outsourcing 12.  Physical/Environmental 13.  Policies & Procedures 14.  Privacy 15.  IT Security Program Implementation The client has specifically requested that you address applicable elements of the Framework Core and protective technologies aslisted in the National Institute of Standards and Technology Framework for Improving Critical Infrastructure Cybersecurity (see Table 2 in http://www.nist.gov/‌cyberframework/‌upload/‌cybersecurity-framework-021214.pdf ). The client has also requested that you address relevant security policies and controls from other sources, including NIST SP-800-53 and the CIS Critical Security Controls. Note: Typical critical infrastructure organizations include: banks / financial institutions, regional healthcare providers (e.g. hospitals or urgent care providers), transportation providers (air, rail, water), telecommunications or Internet services providers or local energy utilities. Read / Research: 1.  Review the National Institute of Standards and Technology Framework for Improving Critical Infrastructure Cybersecurity (pay special attention to Table 2 in http://www.nist.gov/cyberframework/upload/cybersecurity-framework-021214.pdf) 2.  Review the security controls as presented in NIST SP 800-53 http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf  and the CIS Critical Security Controls (https://www.sans.org/critical-security-controls ). Pay special attention to the types of risks / threats which the various controls or control families address or mitigate. 3. Create a company of your own (“fictional”). Research (or develop) the following: a.  mission statement for this client which provides a brief overview of the client’s organization and the critical infrastructure sector in which it operates b.  types of information, information systems, and information infrastructure (networks, communications capabilities) included in its enterprise c.  regulations and laws which it must comply with (paying special attention to those which impact the use of information and information systems) d.  products / services which the organization provides to its customers 5.  Research each of the 15 areas which the client has asked you to address. For each area, you must identify major risks or threats to confidentiality, integrity, and availability. You must also identify security controls which can be used to mitigate these risks. Where appropriate, you must list two or more technologies which will implement those controls. Write: 1.  Develop an introduction to the security policy outline which you will present in your deliverable. 2.  Develop an overview of the client company (mission, functions, information / information systems which need to be protected, laws and regulations, etc.). 3.  Using your research, write a 2 – 3 page outline for an Enterprise IT Security Policy. This outline should address all of the areas requested by the client. For each major area in the outline you must provide a brief introduction which explains what is covered in each area. You must also identify risks / threats to confidentiality, integrity, and availability which are addressed in each area. Provide at least two examples of policies which would implement applicable security controls and, as appropriate, identify two or more protective technologies. 4.  Use the following format for your outline: I.  Enterprise Area [ Descriptive paragraph about this enterprise area and policies required to implement appropriate security for it.] a.  Policy Area #1 b.  Policy Area #2 Example: I.  Access Control [Brief descriptive paragraph for this enterprise area] a.  Implement Separation of Duties [one sentence explanation] b.  Control the Use of Administrative Privileges [one sentence explanation] Formatting: 1.  Use standard APA formatting for the introduction and overview sections of the MS Word document that you submit to your assignment folder. 2.  Use standard outline formatting for the outline. See item #4 under “Write.” 3.  You are expected to credit your sources using in-text citations and reference list entries. Both your citations and your reference list entries must comply with APA 6th edition Style requirements. Failure to credit your sources will result in penalties as provided for under the university's Academic Integrity policy. 4.  You are expected to write grammatically correct English in every assignment that you submit for grading. Do not turn in any work without (a) using spell check, (b) using grammar check, (c) verifying that your punctuation is correct and (d) reviewing your work for correct word usage and correctly structured sentences and paragraphs.Grading Rubric:Outline for an Enterprise IT Security Policy Rubric.docx

Compare and contrast announced penetration testing and unannounced penetration testing. Speculate on whether or not there are instances where unannounced testing is preferred over announced testing. Justify your response. Suggest three (3) penetration testing methods that you would use for a small day care business. Provide a rationale to support your response. Note: The day care is located in the heart of downtown, currently uses a Website, databases, file servers, printers, both wireless (802.11x) and Ethernet access to the Internet, and card readers for physical entry for its employees. 

Question 1Project ScopeYou have been asked to:Design a company web page, orOrganise a 21st birthday party for an important friend, orBuild a garden shedYou can make up a project of your own, of similar complexityPlease choose ONE of the above projects to manage.Using the template provided, create a Scope Statement for your project, taking care to enter information in ALL fields (unless otherwise instructed). Write 200 - 300 words in your scope statement, then upload it for others to read. The instructions for completing the Scope Statement are at the end of the template.Compare your Scope Statement with at least 2 other classmates.Question 2Risk Treatment ExamplesFor each of the following risk treatments, give an exampleEg, an example of “transference” could be to outsource one of the complicated project deliverables to a company that has more experience in this area (but don’t use the example, think of your own).· Avoidance· Mitigation· Transference· AcceptanceQuestion 3Identify a Project that you will be working onWork with your supervisor at your Host Company, to identify a project that you can produce a risk management plan for in weeks 7 and 8.It does not have to be big, just as long as it is a defined piece of work that you can plan, investigate, develop and deliver in your time at the workplace.It can’t be routine, everyday work, such as working on help desk, assembling PC’s, fixing bugs in programs, and so it.Example:Developing an online recording system, a help desk library tool, an online in and out book, a large website enhancement (one that will require a number of weeks), in fact anything that will produce a unique product, service or result.Discuss this with your supervisor. Almost certainly s/he will have been though this with other students before and will know what you are looking for.sample.docsample_friend.doc