CYB 410 Module Two Activity Guidelines 

Comparing Privacy Protection Laws

Overview

Protecting personal information is an increasingly relevant issue facing both companies and individuals. In response to this, state legislation is evolving in an attempt to increase protections for customers. At the federal level, the Privacy Act of 1974 governs the personally identifiable information of individuals that is maintained by federal agencies. A need grew for legislation at the state level for additional consumer protections that wasn’t addressed by federal regulations. Because of the more needs-based way these laws developed, there is significant variation in existing state laws.

In this activity, you will explore the privacy protection laws of multiple states. When researching the laws in your own state, include such terms in your search as security breach notification, attorney general, privacy protection law, and so on.

Prompt

After reviewing the resources for this module, address the critical elements listed below.

1. Comparing Privacy Protection Laws
   1. What state from the provided resources offers the best privacy protection laws for consumers?
   2. How do these privacy protection laws compare to the state you live in? Include at least one source for your research.
   3. As a consumer, would you change anything about the privacy protection laws in the state you live in?
   4. Does reviewing the notifications of breaches from the state of California make you reconsider your consumer habits? Why, or why not?

What to Submit

Your submission should be 2–3 pages in length. Use double spacing, 12-point Times New Roman font, and one-inch margins. Any citations should be cited according to APA style. Use a file name that includes the course code, the assignment title, and your name—for example, CYB_123_Assignment_Firstname_Lastname.docx.

 BUS6600: Survey of Business Concepts | M1 - Quiz

Score for this quiz: 100 out of 100

Submitted Jan 14 at 8:18pm

This attempt took 22 minutes.

Question 1                                            4 pts
Which statement best describes the main difference between B2B and B2C transactions?

• B2B transactions involve sales in foreign markets while B2C e-commerce is restricted to domestic markets.
• B2B transactions involve transactions where the buyers and sellers are both businesses, while B2C involves transactions between businesses and consumers.
• B2B transactions focus on financial transactions while B2C e-commerce focuses on the sale of manufactured goods.
• B2B transactions refer to business between nonprofit organizations while B2C e-commerce is carried out by business firms seeking to earn a profit.

 
Question 2                                            4 pts
When we compare the factors of production in wealthy versus poor nations, we find

• poor and wealthy nations (both) have an abundance of knowledge; it is the land that varies, with rich nations always having more.
• poor nations have plenty of land and knowledge, but very little labor.
• wealthy nations have land and labor, while poor nations have capital and entrepreneurship.
• wealthy nations have knowledge and entrepreneurial opportunities, while poor nations are often lacking in these areas.

 
Question 3                                            4 pts
Efficiency in distribution systems around the world has led to

• reduced standards of living around the world.
• increased world trade.
• decreased world trade.
• decreased international competition.

Question 4                                            4 pts
An entity that seeks to earn a profit by providing a good or service is known as a(n)

• industry.
• service.
• business.
• corporation.

Question 5                                            4 pts
World trade has both benefits and costs. Which statement best attests to this fact?

• Engaging in international trade can significantly lower the costs of parts and products, but it also carries the risk of substantial disruptions if supply chain issues arise.
• Economists are convinced that global job creation will never occur if our politicians support world trade.
• The standard of living for citizens in developing nations has significantly decreased due to globalization.
• The U.S. economy and all businesses that participate in this economy were negatively impacted by recent wars.

Question 6                                             4 pts
The service industry represents about __________ of U.S. workers.

• 25%
• 45%
• 65%
• 85%

Question 7                                            4 pts
Two factors of production that seem to contribute the most to a nation's ability to create wealth are

• land and capital.
• entrepreneurship and labor.
• entrepreneurship and knowledge.
• land and labor.

Question 8                                            4 pts
Greening refers to

• the need for more carbon dioxide in our air.
• firms acquiring more greenbacks (U.S. dollars) from world trade.
• the agricultural industry's push to develop and produce new green vegetables to feed the world.
• finding ways to save energy and lessen the harm on our environment.

Question 9                                            4 pts
Employers provide tools and technology for their employees in order to

• increase the cost of production and profitability.
• improve their efficiency and productivity.
• reduce corruption in business and eliminate scandals.
• encourage the private ownership of businesses.

Question 10                                             4 pts
The threat of terrorism more often __________ the cost of operating a business.

• decreases
• stabilizes
• determines
• increases

Question 11                                            4 pts
In order to compete well and gain market share, contemporary businesses are changing to be more

• customer-driven.
• production-driven.
• cash-driven.
• management-driven.

Question 12                                            4 pts
What is the most accurate statement about the impact of business on society?

• When businesses earn a profit for their owners, they usually do so at the expense of the rest of society, which proves it is never a win-win situation.
• Businesses can have a positive impact on both the standard of living and the quality of life within a society.
• Businesses often improve the quality of life, but can do little to improve the standard of living for most people.
• While businesses often improve the standard of living within a society, they can do little to improve the quality of life.

Question 13                                             4 pts
__________ unemployment refers to persons who purposefully quit their jobs and have not yet found a new job.

• Frictional
• Seasonal
• Structural
• Cyclical

 
Question 14                                            4 pts
Which policy suggests Keynesian economic theory?

• proposing long-term solutions in order to create wider swings in the business cycle
• creating a national banking system that owns and operates most of the global and regional banks
• reducing government involvement in the free-market economy
• short-term increases in government spending to stimulate the economy

 
Question 15                                            4 pts
Which topic would be emphasized in a microeconomics class?

• how market conditions determine the price of a specific product
• the nation's unemployment rate
• how a nation's GDP is computed
• how the government can provide adequate health care

Question 16                                            4 pts
An oligopoly is a market that is characterized by

• several small firms that compete primarily by differentiating their products.
• a few large sellers who dominate the market.
• a large number of small companies all producing very similar products.
• one seller that totally dominates the supply of the product.

Question 17                                            4 pts
Thomas Malthus was pessimistic about the ability of a society to achieve high standards of living for most of its citizens because he believed that

• the wealthy will never promote freedom of choice for workers.
• high tax rates would eventually undermine people's incentives to work hard and create wealth.
• significant population growth would result in shortages of food and resources.
• government has a natural tendency to run deficits that would eventually bankrupt a nation.

Question 18                                             4 pts
Today, the economic systems of most nations could most accurately be classified as

• command economies.
• pure socialism.
• pure capitalism.
• mixed economies.

Question 19                                            4 pts
Just a few sellers dominate the markets for laundry detergents, soft drinks, and automobiles. Economists would classify these markets as

• perfect competition.
• oligopolies.
• monopolistic competition.
• monopolies.

Question 20                                            4 pts
Which statement about capitalism is the most accurate?

• A drawback of capitalism is that people have little freedom to pursue their own goals.
• Capitalism is characterized by unequal distribution of wealth and income.
• A strength of capitalism is its ability to deal with environmental problems.
• In capitalist economies, most resources are owned by the government.

Question 21                                            4 pts
The __________ system provides the least incentive to work hard or to produce quality goods or services.

• mixed economy
• socialist
• communist
• capitalist

 
Question 22                                            4 pts
When the supply curve and demand curve for a particular good are shown together on a single graph, the point at which the two curves intersect identifies the

• amount of time it takes to bring together the buyers and sellers of the good.
• total profit earned by producers.
• total amount of labor needed to produce the good.
• equilibrium price of the good.

Question 23                                             4 pts
The quantity of a good or service that producers are willing to sell at different prices during a specific time period is known as the

• utility of that product or service.
• demand for that product or service.
• elasticity of that product or service.
• supply of that product or service.

 
Question 24                                            4 pts
A command economic system is characterized by

• reliance on the forces of supply and demand to determine what is produced.
• an extremely rapid rate of economic growth.
• reliance on the government to determine what is produced and who gets the output.
• freedom of choice and freedom of competition.

Question 25                                            4 pts
Which statement about business cycles in the United States is most accurate?
Group of answer choices

• Business cycles occur precisely every five years.
• Seasonal business cycles occur within a year.
• Business cycles are impossible to identify.
• Long-term business cycles have only two phases—boom and bust.

A free market is one where decisions regarding what and how much to produce are made by the market itself. This market is made up of buyers and sellers negotiating prices for goods and services. It is generally accepted that there are four degrees of competition within a free-market system. These include perfect competition, monopolistic competition, oligopoly, and monopoly.

One benefit of the free market is that it allows open competition among companies. Businesses must provide customers with high-quality products at fair prices with good service. If they don't, they lose customers to businesses that do.

Select the degree of competition that best describes each listed industry or business based on the description.

Automotive Industry: In this industry, there are a few sellers that tend to dominate the market.

• Perfect Competition
• Monopolistic Competition
• Oligopoly
• Monopoly

Beef Industry: There are many different suppliers of these products, which prevents any one of them from setting prices.

• Perfect Competition
• Monopolistic Competition
• Oligopoly
• Monopoly

Soda Industry: In this industry the products are very similar, although consumers perceive them as being very different.

• Perfect Competition
• Monopolistic Competition
• Oligopoly
• Monopoly

Agricultural Commodities: There are many different growers of these products, which prevents any one of them from setting prices.

• Perfect Competition
• Monopolistic Competition
• Oligopoly
• Monopoly

Airline Industry: In this industry, there are a few sellers that tend to dominate the market.

• Perfect Competition
• Monopolistic Competition
• Oligopoly
• Monopoly

Athletic Shoe Industry: In this industry the products are very similar, although consumers perceive them as being very different.

• Perfect Competition
• Monopolistic Competition
• Oligopoly
• Monopoly

ACME Light and Power: Through special legislation, this supplier is the sole provider of electricity to its local municipalities.

• Perfect Competition
• Monopolistic Competition
• Oligopoly
• Monopoly

Cable Television Industry: In smaller markets, one company is the sole provider of cable television service to consumers in local municipalities.

• Perfect Competition
• Monopolistic Competition
• Oligopoly
• Monopoly

Overview

Journals are private and between you and the instructor only. Approach these activities as an opportunity to reflect upon and apply what you learn each week based on the assigned readings, discussions, and activities. As a successful professional, you will need good reflective and writing skills. Journal activities offer you the opportunity to develop these skills further. The journal entries in this course are graded separately.

Prompt

First, complete the assigned readings for the week. Then discuss the importance of prioritizing cybersecurity risk when it comes to protecting sensitive data, maintaining trust with stakeholders, and mitigating financial and reputational harm. Your entry should include some thoughts on how increased cybersecurity awareness and proactive risk management contribute to a safer and more resilient digital environment for all.

Your journal entry should be 2 paragraphs long and fully address the prompt provided.

In your response, you must address the following critical elements:

1. Critical Thinking and Reflection: Support the claims with relevant examples of previous and logical thought processes.
2. Integration and Application: Show good depth of knowledge of the module content and demonstrate that the module content has been read.
3. Voice: Write in a style that is appropriate for the intended audience and use a consistent voice throughout.

What to Submit

Submit your journal assignment as a Microsoft Word document with double spacing, 12-point Times New Roman font, and one-inch margins. Responses should be at least 2 paragraphs long and address the points indicated in the journal prompt for each module.

Possible Points: 30

Begin by introducing yourself to the class. Include your major and anything you would like to share about yourself. Then address the prompt below.

For your initial post, think about your own personal data and the devices you use at home. In what areas are you the most vulnerable? You might consider areas such as saving passwords in a browser, buying products online, using social media, or saving photos in the cloud. What are your critical risks from these vulnerabilities? Have you taken any steps to address those risks? If so, what have you done?

In your response posts, evaluate which tenet of the confidentiality, integrity, and availability (CIA) triad is most affected by your classmates’ identified risks. Examine how that tenet could be used to inform good decision making.

To complete this assignment, review the Discussion Rubric.

CJ 4440 Final Exam: Week #9: December 9 - December 15, 2024 
Attempt 1 
Score for this quiz: 34 out of 35
Submitted Dec 12 at 4:26am
This attempt took 126 minutes.

 
Question 1             1 / 1 pts
1. Which Sri Lankan terrorist front organizations used varying measures to obtain financial and political support?

A) Harakat-ul-Ansur (HUA)

B) The Lal Masgid (Red Mosque)

C) Federation of Associations of Canadian Tamils (FACT)

D) Lashkar-e-Taiba (Army of the Pure)

 
Question 2                   1 / 1 pts
2. Which country was the first to provide trained and armed "Sky Marshals" on airplanes to prevent hijacking of commercial airlines?

A) Israel

B) United States

C) England

D) France
 
Question 3                                   1 / 1 pts
3. Which step is not part of the security risk assessment related to managing and mitigating potential threats?

A) Examination of steps already completed to reduce risks and hazards

B) Unstructured and limited examination of existing risks and hazards

C) Further steps to reduce risks and hazards

D) Systematic examination of significant hazards that can provide harm

 
 
Question 4                                  1 / 1 pts
4. Under Homeland Security Presidential Directive 6, the Department of Homeland Security Security established Terrorist Screening Centers (TSCs) in September 2003 to consolidate the watch list for the lawful use of terrorist information in screening processess.

• True 
• False 

 
Question 5                                             1 / 1 pts
5. According to the United Nation, the United States failed and allowed the genocide in Rwanda in 1994.

• True 
• False 

 
Question 6                               1 / 1 pts
6. Historically drugs activities in Central America has not been used to significantly aid terrorism in that region.

• True 
• False 

 
Question 7                                 1 / 1 pts
7. The USA Patriot Act was enacted with nearly partisan votes in both the Senate and House to provide law enforcement with new authority to enhance detection and prevention of terrorism.

• True 
• False 

 
Question 8                                       1 / 1 pts
8. The British government defines terrorism as "any activity that involves an act that is dangerous to human life or potentially destructive of critical infrastructure or key resources;..."

• True 
• False 

 
Question 9                              1 / 1 pts
9. Based on your reading which of the government agency listed define terrorism as "is intended to produce fear in someone other than the victim"?

A) Federal Bureau of Investigation (FBI)

B) U.S. Department of State

C) U.S. Department of Defense (DOD)

D) U.S. Department of Homeland Security (DHS)

 
Question 10                                1 / 1 pts
10. Which U.S. President ignored Russian action in the south Caucasus region because Vladimir Putin support the U.S. role in combating terrorism?

A) Bill Clinton

B) George W. Bush

C) Barrack Obama

D) Donald Trump

 
Question 11                                       9 / 10 pts
Assume you are the outgoing Department of Homeland Security (DHS) Secretary on January 1, 2025, nineteen days before the inauguration of the 47th President of the United States. DHS received an in-person classified briefing from the Director of the Central Intelligence Agency (CIA) and the Director of the Federal Bureau of Investigation (FBI) regarding the CIA's creditable human asset who has passed several polygraph examinations revealing that at least 19 terrorists are planning to enter the United States over the next two weeks and planned to launch multiple attacks on this nation during the inauguration on January 20, 2024. Based on your reading and knowledge gained during this course, describe what authority and tools are available within the current national security apparatus to prevent this potential terrorist incident. Consider using and describing such important assets as the Terrorist Screening Centers (TSCs) and the Foreign Intelligence Surveillance Court (FISA Court) in your well-written essay. Because the inauguration is held at the United States Capitol, is additional authority granted for law enforcement and intelligence operations to include engagement with the FBI and CIA to detect, arrest, and prevent potential terrorism on January 20, 2024? To receive full credit, a well-written essay will have between 300 and 400 words with at least three (3) in-text citations and three (3) different references listed below the essay. 

Excellent grammar with references and in-text citations is required, with attention to the accurate use of quotations.

Students are reminded to use only their work production for this assignment with strict attention to the following plagiarism policy:

Your Answer:
As the outgoing Secretary of Homeland Security, I understand the urgency of deploying every available authority and tool to counter the credible terrorist threat targeting the 2025 inauguration. Under the Homeland Security Act of 2002 and the Uniting and Strengthening America by Providing Appropriate Tools Required to Intercept and Obstruct Terrorism (USA PATRIOT) Act, the Department of Homeland Security (DHS) has significant authority to coordinate nationwide counterterrorism operations and enhance intelligence sharing among agencies, including the Federal Bureau of Investigation (FBI) and the Central Intelligence Agency (CIA). A key resource in these efforts is the FBI’s Terrorist Screening Center (TSC), which maintains the Terrorist Screening Database (TSDB). This database allows the identification and vetting of individuals traveling into or within the United States (US), with enhanced screening facilitated by Customs and Border Protection (CBP) and the National Targeting Center (NTC) at ports of entry (Radvanovsky & McDougall, 2023).

In addition to these measures, the Foreign Intelligence Surveillance Court (FISA Court) provides a critical legal avenue for monitoring suspected terrorists. Through the Foreign Intelligence Surveillance Act (FISA), in collaboration with the FBI and CIA, DHS can secure ..... [ BUY TO SEE FULL ANSWER ]

Question 12                                         15 / 15 pts 

Based on your reading about the historical foundation of terrorism and the rise of Islamic extremism in the Middle East, should the United States continue its military engagement in that region or change foreign policy to include the withdrawal of civilians and military troops and reduction of funding for counterterrorism program in the region? To receive full credit, your well-written essay will have between 350 and 450 words, with at least three in-text citations and three different references listed below the response. Your well-written essay response must be relevant and provide an analysis of the justification for your position with data on the overall goal of the United States' current foreign policy concerning counterterrorism with the use of funding and military intervention in the Middle East as part of our national security strategy. In essence, can the tools and authority granted within the Uniting and Strengthening America by Providing Appropriate Tools Required to Intercept and Obstruct Terrorism legislation continue to prevent terrorism in the United States without deployment of armed forces in the Middle East as a deterrent to terrorism? 

This is an essay response, not a discussion board posting, and good grammar with references and in-text citations is required.  

Your Answer:
The United States (U.S) military engagement in the Middle East has long been critical to its counterterrorism strategy. Still, the question remains whether continued military involvement is the most effective approach. I will evaluate the justification for U.S. military presence in the region and the potential for a strategic shift toward non-military counterterrorism efforts, particularly in light of the provisions established under the Uniting and Strengthening America by Providing Appropriate Tools Required to Intercept and Obstruct Terrorism (USA PATRIOT) Act.

The main goal of U.S. counterterrorism policy is to prevent terrorist attacks against American interests and citizens. Military interventions, particularly in Iraq and Afghanistan, have aimed at disrupting terrorist networks, eliminating key figures, and preventing safe havens for groups like al-Qaeda and ISIS (Islamic State of Iraq and Syria). However, prolonged military presence in the region has also contributed to anti-American sentiments and served as .... [ BUY TO SEE FULL ANSWER ]

System and Communication Security Paper

Overview

As you have learned, this course employs a targeted approach to measuring your mastery of the course competencies. Your competency project for this course is a composition demonstrating mastery of the key skills in automating security-relevant tasks, implementing public key infrastructure (PKI) technology using a certificate authority (CA) server, and hardening computer systems. PKI is a common protection technology used in the industry and comes in many different forms. Using a CA server is one method that provides security to a large infrastructure. Important skills for a security analyst are automating security controls to save time and resources. This can be done through hardening scripts and system checklists.

The project is divided into three milestones, which will be submitted at various points throughout the course to scaffold learning and ensure quality final submissions. In Milestone One, due in Module Three, you will develop an automated script and submit your Milestone One Worksheet. In Milestone Two, due in Module Four, you will submit your completed checklist and analysis Word document. In Milestone Three, due in Module Five, you will submit your Milestone Three Worksheet. The final product will be submitted in Module Seven. Some of its parts will require the CYB 300 Sandbox environment.

In this assignment, you will demonstrate your mastery of the following course competencies:

• Implement a public key infrastructure (PKI)
• Securely configure (harden) a common computer operating system according to appropriate security standards and organizational requirements
• Use a scripting language to automate security-relevant tasks

Scenario

Part I
In Milestone One, you developed a script to create a baseline for newly acquired computer assets. In this project, some of these assets are being relocated to a remote location with additional requirements. Develop a script to implement this new baseline configuration to meet the following requirements:

1. Rename computer to First Initial_Last Name (use your first initial and your last name)
2. Change time zone to the time zone associated with Denver, Colorado
3. Get a list of running processes
4. Set idle lock time for screensaver to 3 minutes
5. Send the output of the last 50 entries in the /var/log/messages log to a text file named “SecurityLog_LastName.txt”

Part II
For this part, you will document the commands to create a CA. As a result of relocation, in addition to the scripts associated with the baseline hardening, you need to create a new CA for this remote location that meets the following set of security requirements:

1. Hash value = SHA256
2. Key type = AES 256
3. Key length = 4096
4. Common Name = CN = Colorado Office Root, C=US, ST-CO,O-your_name-Org
5. Validity period = One Year

Part III
For this part, you will discuss the importance of industry guidelines, organizational baselines, and checklists as they pertain to system and communication security.

Prompt

You must address the critical elements listed below. Most of the critical elements align with the competencies (shown in brackets).

1. Automated Hardening Scripts: Compose a single executable script to automate hardening tasks to meet the requirements in the scenario.
   1. Screenshot of a single executable script in the Linux shell environment
   2. Screenshots that evidence each requirement has been met
   3. One of the main reasons that practitioners use automated scripts is to save time by avoiding manual configurations. Describe additional benefits of using automated scripts for configuring systems in a secure manner for organizations.
2. Certificate Authority:
   1. Provide a screenshot of the OpenSSL commands to create a CA with settings that meet the organizational requirements
   2. Discuss how to create Certificate Signing Requests (CSRs) for the servers and workstations in the new location and submit to the CA for approval (CA Applied)
   3. Discuss how implementing PKI addresses two of the Fundamental Security Design Principles and how this maintains the tenets of the confidentiality, integrity, and availability (CIA) triad in an organization
3. Hardening Systems:
   1. Discuss how to make the transition from industry guidelines to a baseline that is appropriate for your organization
   2. Create an operating system security-configuration checklist representing the elements used in Part I: Automated Hardening Scripts
   3. Explain why operating system security-configuration checklists are an important part of the cybersecurity practices in an organization

Scripting Administrative Tasks

Overview

Scripting is an essential skill that helps all IT professionals increase productivity and handle tasks that are repetitive in nature. Learning how to write or modify scripts can save you an immense amount of time. Using the Linux Bash scripting provides an avenue to manipulate the internals of a computer while abiding by policies and security controls that have been put in place within the computer. It should be noted that Bash scripts do not circumvent user rights and privileges. Therefore, if you are trying to run a script and your access is denied to any of the commands, you need to seek to escalate your privileges for that script to run. This is a key safety control in operating systems to ensure individuals cannot perform tasks above their security levels.

You will be working in the CYB 300 Sandbox environment. Your submission will include three documents: two .txt script files and a Word document containing screenshots.

Note: The Learning Management System will not accept .sh files for submission. You can open your .sh file in a text editor and save the file as a .txt file for submission.

Scenario

You are an analyst at a small firm, and your manager has tasked you with writing a script to automate tasks. To test your script, you have been given a sandbox environment that mimics your live Linux system. Your manager has identified the need for scripts to automate the following tasks, to be divided up by you and your coworkers:

• Create three groups: Human Resources, Finance, and Sales. Create 12 user accounts and place them in one of the three groups. Set the passwords to NewP@$$w0rd
• Create a script to back up the /home directory as a compressed tar file to a folder called /backup
• Use the Ping utility to report connections of all IP addresses that end in an odd number in the network, and output them to a text file called ping.txt
• Create a user group named Audit and include all the employees of the HR and Finance organizational units
• Find all users with inactive and disabled accounts across all organizational units and output the list to a text file named inactive_users.txt
• Get a list of all running processes and output the list to a text file named running_processes.txt

Your work assignment is to select two of the above tasks and create a script to automate each one that you have chosen.

Prompt

In this assignment, incorporate the following elements in each script:

• Repetition structure
• Compound conditional statement
• Variable declaration and usage

For each element, add a comment describing the element for each of the three requirements above. You must also add your name, date, and course title as a comment at the beginning of your script. Each script must contain at least four comments.

You must address the critical elements listed below.

1. Automated Script One
   1. Script contains a repetition structure
   2. Script contains a compound conditional statement
   3. Script contains variable declaration and usage
   1. Script file
   2. Results: Provide screenshot evidence that the script has performed the desired task
2. Automated Script Two
   1. Script contains a repetition structure
   2. Script contains a compound conditional statement
   3. Script contains variable declaration and usage
   1. Script file
   2. Results: Provide screenshot evidence that the script has performed the desired task
3. Scripting Best Practices
   1. Name, date, and course title
   2. Comments for the three required elements of the script
   1. Code is properly commented and contains the following comments:

PKI, FSDP, and CIA

Overview

In previous coursework, you have explored the Fundamental Security Design Principles (FSDP) and the confidentiality, integrity, and availability (CIA) triad. It is important that we correlate how public key infrastructure (PKI) and these security controls interact with each other. When you examine the FSDPs and explain how they interact with PKI and the CIA triad, you develop analysis skills that enhance your skill set as a security analyst. A key takeaway from this assignment is a playbook-worthy artifact that encourages you to synthesize ideas on how security methodologies can be taken to the next level. It is important that we use frameworks like the FSDP and the CIA triad as they apply to contemporary topics; this will help you develop the next generation of protections that are found in industry security practices.

The purpose of this assignment is to prepare you to discuss the FSDPs in your final project, which will be submitted in Module Seven.

Prompt

Complete the table and answer the short- response questions in your Milestone Three Worksheet, which is linked in the milestone assignment in Module Five of your course. You must address the critical elements listed below.

1. Security Analysis Table: Complete the table by filling in the columns for the following FSDPs. Describe how they relate to PKI and the CIA triad.
   1. Isolation
   2. Modularity
   3. Minimization of Implementation
   4. Layering
   5. Least Privilege
   6. Fail-Safe Defaults/Fail Secure
   7. Trust Relations
2. Scenario-Based Short Response Questions
   1. Temporary Contractor: The use of certificates of authority (CAs) as part of PKI provides a mechanism for key management and secure communications. If you were asked to provide access to information systems to a temporary contractor, what areas of a PKI and CIA triad would you be concerned with? Which of the FSDPs most applies here?
   2. Cryptography: As part of PKI, a cryptographic system is established. Explain how cryptography is used and what forms of implementation can be accomplished.

CYB 300 Milestone Three Worksheet

1. Security Analysis Table

2. Scenario-Based Short Response Questions
   1. Temporary Contractor: The use of CAs as part of PKI provides a mechanism for key management and secure communications. If you were asked to provide access to information systems to a temporary contractor, what areas of a PKI and CIA triad would you be concerned with? Which of the FSDPs most applies here?
3. 2. Cryptography: As part of PKI, a cryptographic system is established. Explain how cryptography is used and what forms of implementation can be accomplished.

Checklist Analysis and Modification

Overview

Checklists play an important role in the maintenance and protection of systems. They also play a part in hardening a system. Most security analysts identify components and settings within systems that need to be modified to enhance security. Following checklists, engineers can implement the identified security enhancements from the analysts. Certificate Authority (CA) is part of public key infrastructure (PKI) that helps secure the communications within a system. In this activity, you will evaluate an existing checklist to ensure that it is relevant and up to date. Additionally, you will be asked to update the checklist according to directions in your scenario. These checklist elements rely heavily on the steps you completed in your lab in Module Three and your lab this week in Module Four. Make sure you complete your Module Four lab before beginning your milestone. Refer to that lab if you have any questions.

Your submission will include two documents: one for Part I and a second for Part II. For Part II, use the checklist template provided.

The purpose of this assignment is to explore the use of checklists. Your work on this milestone will contribute to your Final Project, where you will need to create a checklist. Furthermore, the revised checklist created in this milestone can be used as a guide for your work in Part II of your final project, which will be submitted in Module Seven.

Scenario

Your manager has provided a checklist for setting up a CA server. They would like you to review the checklist for several criteria. It is essential to verify that the checklist covers the elements needed for a CA server. They would like you to identify any possible gaps within the checklist. Your manager is aware that the checklist is old and there are items on the checklist that may require updates. Your manager has prioritized three new items for the checklist, which include automatic certificate revocation, encryption, and validity period of certificates. Your manager needs your recommendations as a security analyst for those three areas in the checklist. They would like you to fill in the Requirements and Control Overview sections of the checklist for those areas.

Your manager has identified three parameters that should be added to the Root Certificate Requirements section of the checklist. These parameters are an essential part of the root certificate and should be present for the requirements to be implemented.

Parameters

Prompt

Review the Milestone Two Checklist, which is linked in Module Four of your course, and address the critical elements listed below.

Part I: Analysis of Existing Checklist

1. Evaluate the checklist: Provide feedback on the Milestone Two Checklist provided by your manager. Identify at least two areas of the checklist that require updating or improvement. Note: The checklist you are evaluating is modeled after section 4.5 of the NIST 800-70, Guidelines for Checklist Users and Developers.
2. Evaluate the applicability of the checklist. Given the requirements in the scenario, is the checklist accurate in addressing the needs identified? Justify your evaluation.

Part II: Additional Checklist Elements

1. Add additional checklist elements for automatic certificate revocation. Complete the Requirements and Control Overview sections for additional elements.
2. Add additional checklist elements for encryption. Complete the Requirements and Control Overview sections for additional elements.
3. Add additional checklist elements for the validity period of the certificate. Complete the Requirements and Control Overview sections for additional elements.
4. Add identified parameters to the Root Certificate Requirements section of the checklist.

CA Server Root Certificate Requirements Checklist (CA-1)

Requirements

1. Identify information systems that support organizational missions/business functions
2. Identify and select the following types of information system accounts that support organizational missions/business functions: [administrative, service]
3. Identify authorities from each department for root certificate assignment approval
4. Secure protocols used, TLS v1.2
5. Client renegotiation disabled
6. Account notification to CA authorities:
   1. When user or system accounts are terminated
   2. When individual information system usage changes
   3. When account inactivity is for a period of 90 days
7. Authorize root certificate assignment for information systems based on:
   1. A valid access authorization
   2. Other attributes as required by the organization or associated missions/business functions
8. <Add element for automatic certificate revocation here>
1. <Add element for encryption here>
10. <Add element for validity period of the certificate here>

CA-1 Root Certificate Requirements

Control Overview