Construct responses for each of the topics listed below. Support your responses with clear reasoning and additional sources, as appropriate.
Cite all sources used, including the course text book, and include a reference page. Each topic should include at least two sources. Sources (such as the text book) can be used for multiple topics.
COBIT 5
Discuss the implications of using the COBIT 5 framework within an organization and how the use of that framework will impact communications with an organization's board of directors.
Risk Mitigation
As it’s nearly impossible to mitigate all risks, what risks should an organization mitigate? How should those risks be chosen?
Key Risk Indicators
A key risk indicator (KRI) allows a business to monitor changes in the level of risk. The textbook does a good job of explaining the benefits of using KRIs. What might be some of the drawbacks?
Governance
The word governance has already been used multiple times the textbook. What does governance mean and what role does it play in terms of cyber risk from an internal organization viewpoint?
Measuring Training Programs
Many organizations currently have security training programs. What metrics could be used to evaluate the success or failure these programs?
Legal Challenges
What are the legal challenges faced by companies as they grow from doing business in one state, to doing business nationally, and then to doing business in multiple countries?
Assessing Cybersecurity Program Maturity
If you were the newly appointed CISO for an organization, how would you assess the maturity of the cybersecurity programs in place?
Cybersecurity Hygiene
The readings focus on several cybersecurity systems and controls. With all of the publicity surrounding data breaches and ransomware, what is preventing organizations from adopting systems and controls such as those mentioned in the readings?
Zombie Zero
What sort of policies and procedures would an organization need to protect itself against an attack from malware similar to Zombie Zero? What role does upper management play?