Scenario One:
As a new security analyst in a healthcare firm, you have been tasked
with getting the system fully patched and up to date. To remediate a
vulnerability with third-party software, the vendor requires a clone of
the system (a complete copy of the application, including all its data)
be sent to their facilities so they can do their own testing on it.
Your organization, a healthcare firm, has been experiencing some issues with its information systems. As
a new security analyst, you have been tasked with getting the system fully patched and up to date. You
run into a problem with a third-party vendor, Stellar Technologies. Stellar Technologies created and
maintains a software application called MyPatientRecords. The company is owned by the son of the
chief information security officer (CISO) of the healthcare firm at which you are employed. The software
is used as a primary source for all personally identifiable information for all patients. While you are
doing the scheduled patch management of the network, the MyPatientRecords application stops
working due to a software version compatibility issue. As you look into the compatibility issue, you
discover Stellar Technologies has not patched their own software. You know this may lead to a known
vulnerability called TakeMyData, which might allow external entities to gain unauthorized entry into the
information system. When confronted, Stellar Technologies denies the claim. They require a clone of the
system (a complete copy of the application, including all its data) be sent to their facilities so they can do
their own testing on it. When you bring this up to the CISO during your research, he determines that you
should make the clone of the system and provide it to Stellar Technologies, but that it isn’t necessary to
secure any other approvals or notify anyone else about the situation—including anyone in your own
chain of command within the organization—about the situation.
Overview
Establishing a proactive security culture in an organization is key
to limiting security risks and limiting the dangers of complacency
within the organization. This proactive security mindset is important to
establish from the top of the organization down. Security awareness
training is the first line of defense and is a foundational component of
any well-rounded cybersecurity initiative. If the personnel are not
actively aware, your cybersecurity defense structure can fall apart
regardless of how much you invest in technology.
For this project, you will answer questions related to a security awareness training case study.
This project pulls concepts together from your case study papers and
course discussions, and it serves as the foundation for why integrating
legal and human factors into a security awareness training program is
important. Refer to your module readings and resources for extra help.
In this assignment, you will demonstrate your mastery of the following course competency:
Describe the fundamental concepts of legal and human factors in regard to cybersecurity
Prompt
Specifically, you must address the critical elements listed below.
Security Awareness Training Case Study
Identify security gaps or opportunities in training related to human factors. Describe the impact associated with not addressing each gap or opportunity to individuals and the organization.
Identify security gaps or opportunities in training related to legal factors. Describe the impact associated with not addressing each gap or opportunity to individuals and the organization. Note: You do not need to quote specific laws here; focus on the concepts.
Explain why a proactive security mindset is beneficial for all levels of the organization. Provide examples that support your explanation.
What to Submit
Your polished, finalized submission should be 1 to 2 pages in length
(plus a cover page and references) and should be written in APA format.
Use double spacing, 12-point Times New Roman font, and one-inch margins.
Include at least one reference, which should be cited according to APA
style. Use a file name that includes the course code, the assignment
title, and your name—for example, CYB_200_Project_One_Neo_Anderson.docx.
Rubric
Criteria Exemplary (100%) Proficient (85%) Needs Improvement (55%) Not Evident (0%) Value
Human Factors Meets “Proficient” criteria and
addresses critical element in an exceptionally clear, insightful,
sophisticated, or creative manner Identifies security gaps or
opportunities in training related to human factors and describes the
impact associated with not addressing each gap or opportunity Addresses “Proficient” criteria, but there are gaps in clarity, logic, or detail Does not address critical element, or response is irrelevant 30
Legal Factors Meets “Proficient” criteria and
addresses critical element in an exceptionally clear, insightful,
sophisticated, or creative manner Identifies security gaps or
opportunities in training related to legal factors and describes the
impact associated with not addressing each gap or opportunity Addresses “Proficient” criteria, but there are gaps in clarity, logic, or detail Does not address critical element, or response is irrelevant 30
Proactive Security Mindset Meets “Proficient” criteria and
addresses critical element in an exceptionally clear, insightful,
sophisticated, or creative manner Explains why a proactive security
mind-set is beneficial for all levels of the organization and provides
examples that support the explanation Addresses “Proficient” criteria, but there are gaps in clarity, logic, or detail Does not address critical element, or response is irrelevant 30
Articulation of Response Submission is free of errors related to
citations, grammar, spelling, and organization and is presented in a
professional and easy-to-read format Submission has no major errors related to citations, grammar, spelling, or organization Submission has some errors
related to citations, grammar, spelling, or organization that negatively
impact readability and articulation of main ideas Submission has critical errors related to citations, grammar, spelling, or organization that prevent understanding of ideas 10
Total: 100%
