Exercise 2.1: Consider the statement: "an individual threat, like a hacker, can be represented in more than one threat category." If a hacker hacks into a network, copies a few files, defaces the web page, and steals credit card numbers, how many different threat categories does this attack clearly cover given just the information provided? Based on the categories listed in chapter 2 and again in chapter 4, list the categories and explain your reasoning. Base you decision strictly on the information given. Do not speculate or assume. Exercise 2.2: Research and explain your own words what the IT world identifies as intellectual property (IP)? From your research, is it afforded the same protection in every country of the world? Why or Why not? What laws currently protect it in the United States and Europe? Be sure to give examples of what laws are covered? Also, be sure to properly cite your sources. Be thorough in your responses and go beyond the textbook to outside research to support your reasoning.Exercise 2.3: Using the Internet, browse to https://www.us-cert.gov/ncas/current-activity and find the most recent CERT advisory. Describe this advisory in detail and determine what threat group and threat category this advisory warns against. Describe in detail and properly site your sources

Threat modeling begins with a clear understanding of the system in question. There are several areas to consider when trying to understand possible threats to an application: the mobile application structure, the data, identifying threat agents and methods of attack, and controls to prevent attacks. With those aspects in mind, you can create a threat model, which consists of an outline or checklist of items that need to be documented, reviewed, and discussed when developing a mobile application. In this project, you will create a threat model. The length of this threat model should be eight to 10 pages.Step 1: Describe Your Mobile Application ArchitectureIn your role as a cyber threat analyst, you will identify for senior management how a particular mobile application of your choosing conforms to mobile architectures where you are asked to describe device-specific features used by the application, wireless transmission protocols, data transmission mediums, interaction with hardware components, and other applications. You will identify the needs and requirements for application security, computing security, and device management and security. You will describe the operational environment and use cases, and identify the operating system security and enclave/computing environment security concerns, if there are any. This can be fictional or modeled after a real-world application. Be sure to use APA citation format. Step 2: Define the Requirements for Your Mobile ApplicationIn the previous step, you described your app’s architecture. For Step 2 and in the second section of your report, you will define what purpose the mobile app serves from a business perspective and what data the app will store, transmit, and receive. It’s also important to include a data flow diagram to determine exactly how data is handled and managed by the application. You can use fictional information or model it after a real-world application. Here are some questions to consider as you define your requirements:What is the business function of the app? What data does the application store/process (provide data flow diagram)? This diagram should outline network, device file system, and application data flows How is data transmitted between third-party APIs and app(s)? Step 3: Identify Threats and Threat AgentsNow that you have identified the mobile app’s requirements, you will define its threats. In Section 3 of the report, you will identify possible threats to the mobile application and also identify the threat agents. Additionally, you will outline the process for defining what threats apply to your mobile application.For an example of threat agent identification, review Threat Agent Identification Example.For a list of threat agents, review List of Threat Agents.Step 4: Identify Methods of AttackIn the previous step, you identified threat agents. In this step and in Section 4 of the report, you will identify different methods an attacker can use to reach the data. This data can be sensitive information to the device or something sensitive to the app itself. Read these resources on cyberattacks and provide senior management with an understanding of the possible methods of attack of your app.When you have identified the attack methods, move to the next step, where you will analyze threats to your app.Step 5: ControlsYou’ve just identified the methods of attack, and now you will discuss the controls to prevent attacks. Consider the following questions:Note: Not all of the following may apply. You will need to address only the areas that apply to the application you have chosen.What are the controls to prevent an attack? Conduct independent research, then define these controls by platform (e.g., Apple iOS, Android, Windows Mobile, BlackBerry).What are the controls to detect an attack? Define these controls by platform.What are the controls to mitigate/minimize impact of an attack? Define these controls by platform.What are the privacy controls (i.e., controls to protect users’ private information)? An example of this would be a security prompt for users to access an address book or geolocation. Create a mapping of controls to each specific method of attack (defined in the previous step) Step 6: Complete Your Threat ModelYou’ve just discussed the controls to prevent attacks. By now you should have completed all the components of your report. Now, you will compile all your findings and produce your threat model.

Chapter 15 explained ERM and Edmonton. Do you agree with the approach implemented and why? If you could change anything about the implementation of ERM in this case study what would that be and why? Would you implement the same ERM in your current organization (or future organization)? To complete this assignment, you must do the following: A) Create a new thread by Thursday. As indicated above, reflect on the ERM implementation in Edmonton, make recommendations and determine if it can be implemented in your current or future organizations. B) Select AT LEAST 3 other students' threads and post substantive comments on those threads, evaluating the pros and cons of that student’s recommendations. Your comments should extend the conversation started with the thread. Replies should be completed by Sunday. Post 1 yathin An enterprise risk management system is one that uses strategic planning to assess and calculate the possibility of the risk happening. This type of system is essential in enabling a business to identify and manage risks. In the city of Edmonton, after several attempts at ERM, settled on one strategy which focused solely on strategic risk. The risk management system known as The Way Ahead analyzed the risks that the city is likely to face, the available methods of exploiting resources available as well as the factors that were most likely to prevent the city from achieving its goals. The approach implemented in this city using a strategy-based approach. This approach had six key steps, each step being dependent on completion of the previous one. They used a risk scorecard which worked in six steps. First was to identify the viable goals and list of priorities, then the administration needed to link the objectives to the goals such that the degree of risk could be easily determined. Next, the administrative management selected the risks and then assessed the implications of available programs and how they would help to mitigate these risks. From this step, they could plan future initiatives and then provide mitigation methods for the risks. The pilot program produced a risk management system with four steps, from the initial six, which were, weighting the goals and strategic objectives, then assessing risk elements, that is, the ones that were threatening to the strategic objectives, then assessing new risks, and discussing the viable actions to help in their mitigation. This system was effective as it not only focused on the present goals but also the long-term implications of mitigating risk factors. However, the system’s major weakness is that the implementation of this program takes longer than any other ERM framework. Additionally, it is a complex system, making it hard to mitigate risk over shorter periods of time. Even so, this system can work very well if implemented appropriately. This ERM methodology is very recommendable for organizations as it focuses on the future as well. It also has a very robust system of calculating risk possibility. It is therefore recommended for organizations that seek to mitigate risks beyond the current times. Reference: Popivniak, Y. (2019). Cloud-Based Accounting Software: Choice Options In The Light Of Modern International Tendencies. Baltic Journal of Economic Studies, 5(3), 170-177. Schleich, C. W. (2017). Designing a Customer Relationship Management (CRM) System for the Home Automation Industry. California State University, Long Beach. Post 2 Srikanth PM2 Risk Scorecard and ISO 31000 ERM frameworks are powerful tools that are broadly used and Robust. Risk management is a part of the strategic control of any organization. It is the system wherein organizations methodically deal with the dangers connected to their activities. A hit risk control initiative should be proportionate to the extent of uncertainty inside the organization, aligned with other corporate events, comprehensive in its scope, embedded into recurring activities, and dynamic by way of being attentive to changing occasions. An ERM should be consistent, achievable, clean to recognize, and flexible. The contemporary ERM framework is a step-with the aid of-step incremental process in which the ERM team assessed the threat, which supplied them top outcomes-based totally on their KPI and KRI exams. ISO 31000 over the PM2 framework is less complicated to put in force, and it is an international well known in threat control. PM2 It is sturdy, includes complex approaches, and very difficult to carry out, consisting of the mitigation procedure. The focus of change management is the evaluation of immense dangers and the implementation of suitable threat responses. The goal is to gain a maximum sustainable price from all the activities of the corporation. Risk management complements the know-how of the capability upside and downside of the elements which can affect an organization. It increases the possibility of fulfillment and decreases both the probability of failure and the extent of uncertainty related to reaching the objectives of the organization. Combination of PM2 and ISO 31000 model has helped to (Bolman, p- 147, 2017) Monitor and review – establish context Identify Risks – Risk assessment Analyze Risks – Risk assessment Evaluate Risks – Risk assessment Treat Risks – Risk assessment Communicate and consult – Risk assessment A strategic plan is supposed to guide and tell the horizon of the making plan. Current problems and challenges, developments, and possibilities will emerge. An innovative description of Edmonton's future is to align priorities and implement the strategic plan, integration, sustainability, innovation, and transformation. A holistic view of strategic planning is to be interdependent of complicated and support a variety of interrelated ecosystems, along with social and environmental capacities. A manner ahead of strategic goals encompasses maintaining and maintain the surroundings, improve livability, remodel urban form, transportation modes, diversify the financial system, and to make sure economic sustainability. Achieving the imaginative and prescient is the number one purpose that contributes to the achievement of the strategic plan performance in the metropolis of Edmonton. The Way Ahead strategic plan, as the mission-focused at the six crucial boom factors for the city. Urban shape, transportation, Livability, Environment, Financial Sustainability, and Economy. (Fraser, 2014) By integrating ERM with Strategic Planning, the City of Edmonton could be benefited with the subsequent: It can cope with dangers that need outside legislative, regulatory or budgetary guide It can capitalize on the strategic making plans the manner to produce an essential input for ERM It can look at external signs that deliver early warnings and cause preemptive movements. Post 3 Puneeth Strategic Planning: EDMONTON CITY: It is capital city of Alberta which is located in Canadian province. The city is extending its development into various connections. This has gold mines, rail connections and largely densely populated resources. Now, its leading economic growth is building the nation. ERM: There is no eventual development of ERM in the initial period. This might due to imbalance of the infrastructure which they are moving with strategic plan. In order to improve themselves, they conducted several workshop for stabilizing the ERM. In 2013, they explored the ERM into the way ahead strategy plan for mitigating the risks. The time it explored, it determines the effect of investment to rescue the administrations in all levels. There are previous failed attempts made by the office of city auditor (OCA) and administrator jointly made the risk framework know as corporate business risk planning (CBRP) model. This CBRP confines COSO framework, due to the multiple risk management and concerns Edmonton piloted it was not able to implement in the complete way. Governance: The city is embedded with equal responsibility provincial government. Then it is subjected to provincial legislation. The architecture of the city is divided into many layers and divisions. The Edmonton city is maintained under the two-employee model namely city council and city auditor. Auditor Council: This risk management is mainly concerned on the city council audit committee. Report and Responsibility: Before 2005 The known risks are manageable. Strategic risks are not manageable. ERM is not the part of business plan. After 2005 Chief financial officer appointed for ERM program. ERM is added to city council audit committee. Sponsorship and plans are proposed by chief financial officer and audit committee. Post after 2011-2012 A new program manager and ERM discussed with working committee and close the 2005 audit reports. A new ERM program manager is highly responsible for many layers. Transforming Edmonton committee. Leadership on strategic plan. ERM working committee. Development: During the city development the audit reports which are proposed for development in 2005 is truly challenging for development. The mission of goals are divided, down the time for 10 years which 6 different challenges. It’s hard to achieve the objectives, where the city is exponentially developing. After the infrastructure is developed there committee had enough time to take decision on directional plans. In this key aspect the ERM is merged with performance management. This truly identifies outcome decisions and result budgeting. Evolution and Testing: After desired plans are prosed for ERM, the city council committee considered the risk framework with pm2 consulting company. The policies and technology is combined in all means of identifying the score dashboard strategy. The unified pm2 formed 3 constructive layers for the company design. These simply named as strategic, project and operations. Conclusion: The way of development of ERM is combined in all forms. This ensembles all the low level layers to desired level of growing standards. Any ERM forming framework on organization is comparative for development. The aspects Edmonton city has come out with objectives related to strategic development. It feels like ERM is completely supported for developing the strategic plans. If the organization goals on the materializing plans, this strategy is opted solution to learn and grow the standards. The Edmonton city development learnt from their testing ERM from the initial time.