Class: Information Technology
BIA
In order for an organization to develop an effective business continuity plan or disaster recovery plan, it must know what information assets it has, their impact on business operations, and the criticality and priorities associated with the information systems and assets. The primary objective of a business impact analysis (BIA) is to identify the assets that are required for continued business operations in the event of an incident or disaster. Thus, a critical step in the development of an effective BIA includes establishing component priorities and determining component reliance and dependencies. Additionally, organizational personnel must know their responsibilities during recovery efforts.
Write a four page paper in which you:

1. Describe the methods for establishing component priorities, including:
a. Business functions and processes
b. BIA scenarios and components
c. Financial and service impact of components not being available
d. Recovery time frameworks
2. Describe the methods for determining component reliance and dependencies, including:
a. Component dependencies
b. Resources required to recover component in the event of failure
c. Human assets needed to recover components
3. Provide recommendations for the development of the BIA, management and other personnel responsibilities, and educating company personnel that would be involved in the recovery efforts.
4. Use the following resources in this assignment:
1. http://www.ready.gov/business-impact-analysis
2. Security policies and Implementations issues(see attachment)
3. Information Security principles and practices(see attachment)
4. Choose one more


Please follow these formatting requirements:
? Be typed, double spaced, using Times New Roman font (size 12), with one-inch margins on all sides; citations and references must follow APA format.

Instructions:

The most important product of the business continuity plan is the business impact analysis. Business impact analysis involves identifying the critical business functions within the organization to determine the impact of not performing those critical functions. Not all business functions are critical to the survival of an organization, so examining functions and operations allows organizations to build contingencies. Understanding how different functions of an organization might be impacted by an unexpected event or disaster allows leaders to examine and prioritize the organization?s requirements to survive a disaster or crisis.

This assignment is comprised of two main components:

Complete the Business Function and Criticality Matrix Worksheet.
Identify the organization's major business functions and processes.
Using the criticality categories outlined in the worksheet, identify the criticality of each business process.
Using the data from the Business Function and Criticality Matrix Worksheet and the Risk and Vulnerability Analysis Worksheet from Unit 4, write a Business Impact Analysis Report. Your Business Impact Analysis Report should:
Drawing from the Business Function and Criticality Matrix Worksheet, describe and prioritize the mission-critical business processes and functions.
Determine any resource interdependencies of those business functions within the organization.
Identify the maximum tolerable downtime for each function including acceptable recovery times for each division or department involved in the mission-critical function. Consider that time should be managed in terms of money.
Drawing on the high-priority threats identified in the Risk and Vulnerability Analysis assignment, determine the impact on the organization and those mission-critical functions if each one of those events were to occur. Be sure to consider the financial, operational, and legal impact on the functions.
Analyze the impact to the organization as a whole based on those threats and mission-critical functions. Identify both the tangible costs, such as repair, replacement of goods, fines, penalties, compensation, and legal costs, and the intangible costs, such as loss of employees, customers, public confidence, market share, and so on.
Identify and evaluate the resources needed for an organization's recovery from a disaster. Resources may include any manual processes or work-around procedures that could keep the organization operating, funding needed for repairs or replacement, and the minimum number of staff you need to operate and begin recovery.

Submit your Business Impact Analysis Report along with the Business Function and Criticality Matrix Worksheet to the assignment area.

Do not Fax

The most important product of the business continuity plan is the business impact analysis. Business impact analysis involves identifying the critical business functions within the organization to determine the impact of not performing those critical functions. Not all business functions are critical to the survival of an organization, so examining functions and operations allows organizations to build contingencies. Understanding how different functions of an organization might be impacted by an unexpected event or disaster allows leaders to examine and prioritize the organization?s requirements to survive a disaster or crisis.

This assignment is comprised of two main components:

Complete the Business Function and Criticality Matrix Worksheet.
Identify the organization's major business functions and processes.
Using the criticality categories outlined in the worksheet, identify the criticality of each business process.
Using the data from the Business Function and Criticality Matrix Worksheet and the Risk and Vulnerability Analysis Worksheet from Unit 4, write a Business Impact Analysis Report. Your Business Impact Analysis Report should:
Drawing from the Business Function and Criticality Matrix Worksheet, describe and prioritize the mission-critical business processes and functions.
Determine any resource interdependencies of those business functions within the organization.
Identify the maximum tolerable downtime for each function including acceptable recovery times for each division or department involved in the mission-critical function. Consider that time should be managed in terms of money.
Drawing on the high-priority threats identified in the Risk and Vulnerability Analysis assignment, determine the impact on the organization and those mission-critical functions if each one of those events were to occur. Be sure to consider the financial, operational, and legal impact on the functions.
Analyze the impact to the organization as a whole based on those threats and mission-critical functions. Identify both the tangible costs, such as repair, replacement of goods, fines, penalties, compensation, and legal costs, and the intangible costs, such as loss of employees, customers, public confidence, market share, and so on.
Identify and evaluate the resources needed for an organization's recovery from a disaster. Resources may include any manual processes or work-around procedures that could keep the organization operating, funding needed for repairs or replacement, and the minimum number of staff you need to operate and begin recovery.
Submit your Business Impact Analysis Report along with the Business Function and Criticality Matrix Worksheet to the assignment area.

Do Not Fax

"Write a 8 page paper evaluating the business impact, operations management issues, and effectiveness of business decision-making relating to the 2011 Japanese Earthquake."

Following are several good references:

http://gcn.com/articles/2011/03/14/japan-quake-disrupts-world-technology-supply-chain.aspx
http://www.businessweek.com/managing/content/mar2011/ca20110331_329432.htm
http://www.dnb.fi/Global/News/Documents/Mitigating_Supply_Chain%20Risks_UK.pdf
http://www.alom.com/resources/focus.asp?file=004.inc
http://ops.fhwa.dot.gov/freight/freight_analysis/fd/index.htm
http://hbswk.hbs.edu/item/6684.html
http://www.drj.com/2011-articles/summer-2011-volume-24-issue-3/lessons-learned-from-the-japan-earthquake.html

TITLE: ORGANIZATIONAL ANALYSIS COMMANDER CARRIER GROUP SEVEN; UNITED STATES NAVY
Organizational Analysis Paper.
1. Write a 5 page, APA FORMAT, 12/ARIAL, organizational analysis paper on your organization (COMMANDER CARRIER GROUP, UNITED STATES NAVY) covered from the documentation below.
2. This paper should express your sociological view introduced in this course have impacted your perceptions.
3. Ref: J. Post, A. Lawrence, & Weber J (Eds.), Contemporary Business Issues with Readings (9th ed., pp. 1-247). 1999. New York: McGraw-Hill Primis Custom Publishing.
-------------------------------------------------------------
COURSE OBJECTIVES
Business Organizations in Society
? Recognize the roles and responsibilities that a business has within the community.
? Analyze the contemporary relationship between business and society.
? Describe how capitalism has influenced the role of business in society.
? Differentiate between the social realities of high- and low-income workers.
Organizations and the Ethical Environment
? Analyze how ethics play a part in business decisions.
? Examine the underlying issues of an organization?s mission statement.
Business Organizations and Government in a Global Society
? Examine the impact of globalization on business practices.
? Recognize the issues resulting from diverse groups entering American business organizations.
The Business Organization and the Individual
? Examine the relationship between employer and employee.
? Illustrate how entitlement impacts organizational culture.
? Recognize recent changes in philosophy regarding employee rights and responsibilities.
Social Issues
? Identify family issues that impact the work environment.
? Examine the impact of underlying social processes on business organizations.
Technology Issues
? Examine the impact of technology on contemporary organizations.
? Compare the past and present influence of technology on business organizations.
-------------------------------------------------------------
THE COPORATION AND ITS STAKEHOLDERS
1. Why are business, government, and society an interactive system?
a. Business decisions impact society (general public)
b. Government decisions impact business
c. Both government and Business impact the general public
2. What kind of involvement does business have with other segments of society?
a. Business and society decisions have a social impact society can influence whether a business firm will prosper or fail. Businesses will fail if the people and government demand to much and the people will fail when the Business fails by losing jobs and products.
3. Who are corporation?s primary and secondary stakeholders?
a. PRIMARY (directly)
1. WHOLESALERS
2. EMPLOYEES
3. STOCKHOLDERS
4. CREDITORS
5. SUPPLIERS
6. CUSTOMERS
7. COMPETITORS
b. SECONDARY (indirectly)
1. LOCAL COMMUNITIES
2. FEDERAL/STATE/LOCAL GOVERNEMENT
3. FOREIGN GOVERNEMENTS
4. SOCIAL ACTIVIST GROUPS
5. MEDIA
6. BUSINESS SUPPORT GROUPS
7. GENERAL PUBLIC
4. Why are stakeholders important to a corporation and how can they affect its success?
a. Stakeholders may damage or halt a company?s operation, but they can come to aid and support a company that is in trouble. Stakeholders can exercise their economic, political, and other powers in ways that benefit or challenge the organization.
5. What major forces of change are reshaping the business environment for companies?
a. FORCE 1: Strategic and Social Challenges, Strategic rethinking or reengineering business operations
b. FORCE 2: Ethical Expectations and Public Values, the public wants corporate manager to apply ethical principles in business decisions
c. FORCE 3: Global Economic Change,
d. FORCE 4: The Changing Role of Government and Public Policy, democratic reforms, eg glasnost (openness) and perestroika (reform, reconstruction and renewal) in the Soviet Union
e. FORCE 5: Ecological and Natural Resource Concerns, strike a balance between industrial production and nature?s limits
f. FORCE 6: Technology and New Knowledge,
6. How do globalization, ecological concerns, and ethical norms affect corporate stakeholders? Companies should have a strategy that combines business goals and broad social interests.
-------------------------------------------------------------
BUSINESS AND PUBLIC ISSUES
1. Why do the expectations of stakeholders matter to organizations and managers?
a. If expectations are unmet, it can trigger an action that can put pressure on business and government
2. What is the life cycle through which public issues evolve?
a. PHASE 1 CHANGING STAKEHOLDER EXPECTIONS
b. PHASE 2 POLITICAL ACTION
c. PHASE 3 FORMAL GOVERNMENT ACTION
d. PHASE 4 LEGAL IMPLEMENTATION
3. What is the mission and purpose of a company?s public affairs function?
a. Collecting and analyzing the social and political environment
4. What strategies can an organization use to cope with specific public issues?
a. Develop a proactive strategy to address public issues
5. What activities make up an issues management system?
a. ISSUE IDENTIFICATION-scanning newspapers
b. ISSUES ANALYSIS-identify the facts and analysis
c. POLICY OPTIONS- develop course of actions
d. PROGRAM DESIGN- design and implement
6. What are the elements of effective crisis management?
a. Respond to short-term and immediate shocks; accidents, distress
7. What must a company do to strategically manage its stakeholder relations?
a. Be aware of company stakeholders
b. Proactive thinking and planning ahead
c. Company should manage issues carefully and consistently
-------------------------------------------------------------
Corporate Social Responsibility
1. What is the basic meaning of corporate social responsibility?
a. Means that a corporation should be held accountable for any of its actions that effect people, their communities, and their environment.
2. Where and when did the idea of social responsibility originate?
a. Adopted by business leader early twentieth century, considering all corporate stakeholders when making business decisions
3. What must a company do to be considered socially responsible?
a. Philanthropic contributions (charity principle)
b. Business manager act a public trustee recognizing that business and society are intertwined and interdependent (stewardship principle)
c. Employee volunteerism
4. Is corporate social responsibility practiced by businesses around the world?
a. Yes, however they reflect cultural values and traditions of their particular country
5. What are the limits of corporate social responsibility?
a. Legitimacy
b. Costs
c. Efficiency
d. Scope and Complexity
6. How does business meet its economic and legal obligations while being socially responsible?
a. Following an enlightened self-interest approach, a firm may be economically rewarded while society benefits from the firm?s actions.
b. Abiding by legal requirements can also guide businesses in serving various groups in society.
c. Managers should consider all of the company?s stakeholders and their interests.
-------------------------------------------------------------
Socially Responsive Management
1. What groups and social forces changed the way management responds to the social environment?
a. Consumer advocates
b. Environmentalists
c. Anti-War Activist
d. African-American groups
e. Women groups
f. Communities protested
2. What influences and forces should be monitored by managers when developing a socially responsive program?
a. The processes a firm establishes to address social demands initiated by corporate stakeholders within the macroenvironment of business segments
i. Economic Segment
ii. Political Segment
iii. Social Segment
iv. Technological Segment
3. What are the stages in the model of social responsiveness?
a. Policy Stage
i. Aware of the surrounding environment
b. Learning Stage
i. Identify the social problem
ii. Specialized learning
iii. Administrative learning
c. Organizational commitment Stage
i. Normal part of doing business
4. What elements are critical for a business to effectively manage the corporate social environment?
a. Top Management philosophy
b. Socially responsive Strategy
c. Socially responsive structure
d. Line manager involvement
5. Can a firm?s management of the social environment be assessed?
a. Corporate social audits
b. Performance audits
-------------------------------------------------------------
MISSION STATEMENT

COMMANDER CARRIER GROUP MISSIONS are to plan and conduct operations/exercises in surface, subsurface, and air strike warfare as directed by the numbered Fleet Commander as well as participate in the development of tactical doctrine. In addition, provide assistance to the Type Commanders in the preparation of employment schedules and to supervise operational training and all elements of combat effectiveness. Further the staff will ensure that assigned ships are maintained at the highest possible standard of operational and material readiness.
-------------------------------------------------------------
Mission statement Activity Sheet
Question #1: Do you believe the mission of your organization truly reflects what the organization actually does? Why or why not?
Answer # 1: The mission statement truly reflects the organizational activities as it gives a guideline as well that what the staff is expected to do and the highest level of commitment that is needed for the job. Obviously the organization do a lot more than the activities mentioned, for e.g., strategically and security analysis but the main job is, whatever the work is do it effectively.
Question #2: What impact do the mission statements in your group have on the employees in the organization? For example, are employees specifically mentioned in any of the mission statements? How is the impact felt?
Answer # 2: The vision of a company can not completed by considering its employees. When we talk about the preparation of employment schedules, supervising operational training and combat effectiveness, we highlight the importance of human capital in our organization.
Question #3: What impact do the mission statements in your group have on society at large? (This includes local, state, national, and even international society.)
Answer # 3: The impact of the mission statement can be felt in the organization as different department work together to achieve the goals as stated in the mission statement. If we talk in a broader term this impact can be felt at the societal level, as it requires them to work efficiently and effectively. Internationally it acts as torchbearer for all naval forces who are working outside the country. The mission statement is essential for the organization, as the people know how and where to efficiently use their human resources.
Question #4: For each of the mission statements, is the organization?s emphasis on: 1) people, 2) productivity, 3) money, 4) principle, or 5) some other emphasis? Who is the target audience for the mission statement?
Answer # 4: The mission statement targets mainly the employees of the organization. It gives them motivation and a clear vision. In fact it emphasize on productivity by people who abide by the principle. If we take an overview of the statement, it is a comprehensive guideline that specify a general job description, requires discipline and high level of commitment and alertness from the staff.
Question #5: Pick out "key words" in each statement that are meant to define impacts on social processes and/or society in some way. Key words are action words or phrases that set the tone for the statement. (Some key words are: ethics, profit, respect, community, vision, etc.)
Answer # 5: Some key words mentioned in the mission statement are tactical doctrine, assistance, effectiveness and highest possible standard. One can clearly understand by these terms that sheer hard working and devotion could be the key to success in the organization.

Management Information Systems ? Information Security

Text: Michael E. Whitman & Herbert J. Mattord , Principles of Information Security ? 4th Edition ?- Cengage
Read chapters 4,5,6 and & 7. Write an 8 page paper answering the Case Exercise Questions below:

Chapter 4
As Charlie wrapped up the meeting, he ticked off a few key reminders for everyone involved in the asset identification project.
?Okay, everyone, before we finish, please remember that you should try to make your asset lists complete, but be sure to focus your attention on the more valuable assets first. Also, remember that we evaluate our assets based in business impact to profitability first, and then economic cost of placement. Make sure you check with me about any questions that come up. We will schedule our next meeting in two weeks, so please have your draft inventories ready?

1) Did Charlie effectively organize the work before the meeting? Why or why not? Make a list of the important issues you think should be covered by the work plan. For each issue provide a short explanation.
2) Will the company get useful information from the team it has assembled? Why or why not?
3) Why might some attendees resist the goals of the meeting? Does it seem that each person invited was briefed on the importance of the event and the issues behind it?

Chapter 5
Charlie sat at his desk the morning after his nightmare. He had answered the most pressing email in his inbox and had a piping hot cup of coffee at his elbow. He looked down at a blank legal pad ready to make notes about what to do in case his nightmare became reality.

1) What would be the first note you would write down if you were Charlie?
2) What else should be on Charlie?s list?

Chapter 6
The next morning at 8am, Kelvin called the meeting to order. The first person to address the group was the network design consultant, Susan Hamir. She reviewed the critical points from her earlier design report, going over the options it had presented and outlining the tradeoffs in those design choices. When she finished, she sat down and Kelvin addressed the group again. ?We need to break the logjam on this design issue. We have all the right people in the room to make the right choice for the company. Now here are the questions I want us to consider over the next three hours.? Kelvin pressed the key on his PC to show a slide with a list of discussion questions on the projector screen.

1) What questions do you think Kelvin should have included on his slide to start the discussion?
2) If the questions to be answered were broken down into two categories, they would be cost versus maintaining high security while kkeping flexibility. Which is most important for SLS?


Chapter 7
Miller Harrison was still working his way down his attack protocol. Nmap started out as it usually did: giving the program identification and version number. Then it started reporting back on the first host in the SLS network. It reported all of the open ports on this server. Then the program moved on to a second host and began reporting back open ports on that system, too. Once it reached the third host, however, it suddenly stopped. Miller restarted Nmap, using the last host IP as the starting point for the next scan. No response, he opened up another command window and tried to ping the first host he had just port-scanned. No luck. He tried to ping SLS firewall. Nothing. He happened to know the IP address for the SLS edge router. He pinged that and got the same result. He had been blackholes ? meaning his IP address had been put on a list of addresses from which the SLS edge router would no longer accept packets. This was, ironically, his own doing. The IDPS he had been helping SLS configure seemed to be working just fine at the moment. His attempt to hack the SLS network was shut down cold.

1) Do you think Miller is out of options as he pursues his vendetta? If you think there are additional actions he could take in his efforts to damage the SLS network, what are they?
2) Suppose a system administrator at SLS happened to read the details of this case. What steps should he or she take to improve the company?s information security program?

This paper is geared towards Information Security management, not IS technology per sa.

Assignment: Perform an in-depth analysis of an organization within information security management on a particular company that you may work for or know very well. The assignment should be written along the lines of Harvard Business or Sloan Management review case studies. The length should be between 3000 to 6000 words. It should describe the firms information technology and information security strategy. It should identify important issues that confront the organization. You should base your conclusions on standard information security practices. To conceptualize the assignment, imagine that you are on the research staff at a consulting group and you are writing a report about the strategic prospects of a client (information security posture). You should place a heavy emphasis on analysis and evaluation in your term paper. It should identify important issues that confront the organization.

OSI Inc. Global IT Mission Statement

The Global Information Technology Organization is to create a world class IT support system for OSI Systems and all its entities. IT will map technology with the human-user element creating solutions that the organizations will incorporate in their operations to achieve higher productivity- cost, efficiency-cost, and become more competitive in their business. IT will go beyond the traditional supporting role and address each department within each division and apply technology to enable their respective areas to achieve their predetermined goals that are aligned with the companys long and short term objectives. Meeting goals, achieving success, and evaluating services will be the cornerstone of the global IT organization.

OSI is composed of 3 divisions and corporate headquarters: Rapiscan Systems, OSI Optoelectronics and SpaceLabs Healthcare.

OSI Corporate is composed of:

Finance
Human Resources
Information Technology
Internal Audit
Law Department
Travel

Background: OSI Systems, Inc is a worldwide company based in California that develops and markets security and inspection systems such as airport security X-ray machines and metal detectors, medical monitoring anesthesia systems, and optoelectronic devices. OSI Inc. had sales of $595 million with net income of over $25 million. As of June 2010, the company employs approximately 2,460 personnel globally and includes subsidiary companies Spacelabs Healthcare, Rapiscan Systems and OSI Optoelectronics. OSI Systems, through its subsidiaries, have offices and plants in Malaysia, England, Australia, Africa, and the United States and Canada making it a truly global manufacturer. All subsidiaries and offices are connected globally to OSI through OSIs world-wide intranet system. Third party vendors are connected to the companys extranet.
With this backdrop in place it is easy to picture the potential scale of possible security problems and vulnerabilities facing the company. In this light, a throughout information security examination and evaluation of OSIs information security posture and practices will be conducted. This examination will be composed of the following information security components:
1. Corporate and IT Organizational structure including rules and resources with respect to information security
2. Stakeholders (users, managers, and designers) interacting with information security.
3. Security technology (technical platform)
4. Tasks associated with information security (goals and deliverables)
5. Information Security risks

Each main corporate office and facility plant has as its information technology security framework a combination of dual firewalls with appropriate DMZ zones within the firewall routers for outside user access along with numerous intrusion detection and protection hardware and software. OSI uses dual T1 lines for interconnection among its corporate entities. OSI also utilizes advanced virus protection and encryption technologies to ensure secure and safe operation and transfer of its data and applications. OSI also has several global and IT secure policies in place to ensure its security posture for both technology used and their internal personnel.
Interview questions with John Loo, senior director of Global IT services are below. A Contingency Plan (CP) is composed of the following:

1. Do you have a full Contingency plan (CP) in effect composed of BIA (Business Impact Analysis) ??" included in this are an Incident Response (IR), Disaster Recovery (DR) Plan and a Business Continuity (BP) plan? Do you have a Security Incident Response Team (SIRT) as well. His response was that he did not have a not have such a large encompassing plan due to the relative smallness of the company as compared to a General Electric or IBM. In fact many contend that this type of security philosophy is penny wise and foolish (Whitman & Mattord, 2010. 171). He said he had just a Disaster recovery plan which did not include an SIRT team. He said that he does not have a list of personnel that he calls from but basis his team on the immediate threat at hand. In the event of a vulnerability attack on the network, Mr. Loo would base the severity of the attack and that he himself would determine if it was just an incident or a major disaster. From there he would then determine the extra personnel that would be needed to take care of the threat. Again, no security team list is in place.
2. Do you classify, profile and describe any of the potential threats, vulnerabilities, and attacks, such denial-of-service, zombie attacks, etc., with a before, during, and after response description so that if any of these threats appear, you would have an adequate response against them? Again his response was that he did not put together such a listing profile because of the enormity and sheer number of different threats and vulnerabilities and the small size of his company. Mr. Loo also indicated that his primary fear or concern for security was simply having someone walk into an OSI facility, plant or office and plug their laptop into the network and be able to hack or password into the network and interrupt or steal company data.
3. If you Mr. Loo get sick, injured or die, who will follow into your place during an emergency? His answer was that he has back-up managerial personnel from Global IT and Telecom management to fill ??" in, in case he is absent.
4. Do you do practice or test any vulnerability attack scenarios, such as a simple desk check, structured walk-through, simulation, or full-interruption scenario, so that you know what to expect and do in a real-life situation? Mr. Loo indicated that he does not do any testing at all. It is all in his head.
5. Concerning a natural disaster within the business continuity and strategy plan, do you have a disaster recovery in place in case of a man-made or natural disaster that would destroy the corporate data center and its data? Mr. Loo indicated that he does have a back-up - a warm back-up site facility in Issaquah Washington. It is not a hot site where the company can immediately turn things on and start operating. Although all of the applications are loaded in the servers, the back-up data tapes and disks are stored in Burbank, CA and that they would have to be carried and sent over to Issaquah and then loaded into the databases and tested before operation can begin. That would take anywhere from 10 hours to 2 days for completion. If the situation was not totally disabling, he would just send the disks and tapes to the Torrance California facility and restore the servers from there. That would take less than a day.
6. Are all of the third party vendors that do business with the company on-board with back-up computing resources and services if needed? Mr. Loo indicated that he has agreements with all the vendors during an emergency or disaster but that he does not contact them frequently if at all and that he assumes that the facilities are on board with any disaster that may happen. This non-action can be very dangerous.
. Concerning crisis management and the press, how would you handle it? He said that he will be the main point of contact for the CEO and for newspaper and TV announcements to let the public know the situation of the disaster.
8. Since OSI has a risk assessment department, are they involved at all in the assessment of a disaster to the company? He said they were not involved in this area and that all planning and assessment was done in IT.
9. What is the relationship between the organizational structure of the IT department and its relationship with the CEO, as stipulated in the organizational hierarchy chart? Mr. Loo indicated that although there is no Chief Information Security Officer (CISO) between him and the CIO, the CIO is firmly committed to obtaining the resources and expenses for fully implementing proper security within the company. Unfortunately, the CIO himself does not directly report to the CEO but to the non-technical CFO Mr. Edick and that sometimes it is very difficult to obtain additional money and resources to fully implement all of Global ITs plans for security since the company has never had an IT or security real emergency before. Although it is quite common and natural for many companies, both small and large to place their security department or group within the IT organizational structure, this is not the best place for it. Given the seriousness for destructiveness due to loss data and networks, many organizations place their security group either within Legal or Insurance and Risk Management departments. Since OSI is small it is just within the IT department. Another factor is that the CIO and CEO are brothers and that can provide for a conflict of interest. This is why the CIO does not report directly to the CEO. This conflict imperils information security. Most experts agree that the CIO or CISO should report directly to the COO or President of the company. In case they do not. See diagram.
10. What are the duties and responsibilities of the individual stakeholders (users, managers, designers, and vendors) interacting with information security and that of Critical Electronic Data? See the Critical Electronic Data Policy attachment.
11. What is OSIs Global IT Security policy? See attachment file.
12. Do you provide for advanced IT and security training for your IT employees? Yes, we have extensive online and conventional training courses for our employees, including information security.
13. Stakeholders (users, managers, and designers) interacting with information security. Mr Loo indicated that Business unit managers are responsible for enforcing IT security policy and that individual users are also responible foull following IT policy concerninguser accounts and proper use of the computer. See policy documents
14. As far as risk management is concerned and even though the company the company
As defined by the U.S. General Accounting Office, a stakeholder is "an individual or group with an interest in the success of an organization in delivering intended results and maintaining the viability of the organization's products and services. Stakeholders influence programs, products, and services." (Allen, 2005) Information security planning should include the views of stakeholders, especially when you are planning for information security projects. The stakeholders buy-in is key to the success of information security in an organization. With the company's success in mind, decisions are less likely to be made based on personal beliefs when stakeholders views are considered.
Allen, J. (2005). Governing for Security: Project Stakeholders Interests. News at SEI. Retrieved on 5SEPT10 from http://www.sei.cmu.edu/library/abstracts/news-at-sei/securitymatters20054.cfm

Diver, S. (2006). Information Security Policy-A Development Guide for Large and Small Companies. SANS Institute InfoSec Reading Room. Retrieved on 30 Sept 10 from http://www.sans.org/reading_room/whitepapers/policyissues/information-security-policy-development-guide-large-small-companies_1331

Regardless of the size of the organization, it is important that security functions are perform somewhere in the organization. In chapter 13 of his Book called Information Security Roles & Responsibilities Made Easy, Charles Cresson Wood describes 12 options for placing security (listed below). But the ideal structure is to have information security independently reporting directly to the CEO. While due to budget constraints, many smaller organizations are forced to have security report to sub-organization like information technology or administrative service. In large organizations, information security is more independent and can be their own department. Note, that many laws and regulation require that security be well defined (see Table 1).
Maiwald, Eric & Sieglein, William (2002). Security Planning and Disaster Recovery. New York, NY: McGraw-Hill Professional

There are faxes for this order.

"GOOGLE IN CHINA"
The case should be presented "as if" you were an organizational work team reporting to the executive committe of the focal company of the case. They need to know, what happened, how it has impacted the organization and all of its relevant stakeholders, what the organization did right/wrong and where in the organization the decisions that led to this outcome were located, and what the organization might consider doing in the future in terms of managing its government and society relationships to achieve the desirable outcomes. Thus, the case should include:
1. a synopsis of the case history highlighting the important envets and decisions that created the problem/benefit;
2. a description of the problem. Are there business impacts on the stakeholders and/or the stakeholder impacts on business? If so, what are these impacts and who are these stakeholders.
3. a focused discussion of the organizational decision making-process that led to these impacts; what alternatives did the decision-maker have? What criteria did (s)he use to choose the decisions that he or she made?
4. Any future recommendations and explanation of why these recommendations are being made.

Here is the instruction:
What you have to do is just part 4.:Any future recommendations and explanation of why these recommendations are being made. Again, only part 4. The topic of the case is "google in China." The paper will also be used in presentation, so it is going to helpful if it is well organized (recommendation by recommendation). and there are a lot of things going around google in china such as human rights, government...so on, so you should focus on general recommendation as well as today's current issues. This is Business and Government relations class. I put 0 for no. of resources, but appropriate no. of resources should be used. Please make them clear as possible and too many recommendations are unnecessary. I assume you know better than me.
Thanks, let me know if you have any other questions.

dear writer,
this is my 6 th order. i am having every time same problem. i order and when assignment finish , i work on it 2 more days. i believe that this time it will change. (cross finger)

- please do not use citation for a paragraph which has 200(i mean too many) words. (i have e-book library , i have 3000 books. i can do this easily)
- please do not use citation consecutively.
- please use citation only for supporting your own sentences.
- please be creative , use your own sentences. Yes number of bibliography is 10 but if you think it not necessary, it s ok for me.
- i ll submit as a soft copy, thats why you can use any colourful table, diagram etc.(actually you should),

now task
++++++++++++++++++

Select an American(DONT WORRY I VE CHOOSEN FOR YOU, COMPANY NAME IS :<> AND CRISIS IS <>, publicly listed multinational company; please be sure the firm you select satisfies all three of these criteria. Provide the background and history of your selected company.

Provide an overview of your selected firms Business Continuity and Crisis Management (BCCM) function in actual use (i.e., as executed during a crisis). This crisis must have taken place in the last five years, and must have been a public event. Note that all information you report for the purposes of this assignment MUST be in the public domain.
Provide a Business Impact Analysis of the event in question using only information in the public domain before the event occurred.
Provide a critique of the firms response to this crisis, minimally touching upon the following points:

a) Incident Management

b) Disaster Recovery and Continuity Planning

c) Identify at least three stakeholders(very important).
Insure at least one of these stakeholders are foreign; in other words, not American. Note specific actions of each to the success or failure of the organisations efforts to deal with this crisis

d) The role of external regulation in the risk management framework

Note that it is not necessary that the firms response to the event to be a success; in fact we learn the most by studying failures. Your paper should be structured as a report written to the board, reviewing and critiquing the event and managements actions in retrospect.
Use appendices as necessary to insure a sharp, focused report albeit one with sufficient supporting information.

+++++++++++++++++++++++++++++++++++++


and there is a guide line for marking

????????????
Overview (20%)

The crisis has been clearly and carefully described, in such a manner as to provide a broad overview of key events and their timeline.

Analysis (40%)

A solid, well-supported and critical analysis of the firms response to this crisis is provided. Note that your report must reach a conclusion supported by evidence provided.

Presentation (20%)

Harvard style citations with all sources clearly cited. Your report should employ a standardised structure and layout. Fonts must be used in a consistent manner throughout the document. A table of contents is expected, referencing key sections of your report. Use appendices as intended. Adherence to word count limits.

Sourcing (20%)

Good breadth of CREDIBLE sources cited to support this work. Note that Wikipedia is not to be used as a source, and internet sites must be used in moderation A good balance between books, journals, newspaper articles and internet sources is expected.

????????????????????????????????

and another thing i prepare content example , maybe it gives you idea , of course you dont have to follow ,


#####################
CONTENT
-INTRODUCTION
- THEORETICAL FRAMEWORK OF A CRISIS MANAGEMENT APPROACH TO BUSINESS CONTINUITY
- JET BLUE AIRWAYS VALENTINES DAY ??"BACKGROUND DATA
- JET BLUE AIRWAYSS BCCM
--JET BLUE AIRWAYSS OPERATIONAL MANAGEMENT SYSTEM (OMS)
--PLAN AND ACTIONS DURING THE CRISIS OF THE VALENTINES DAY 2007
--BCCM IMPLEMENTATION
---ORGANIZATIONAL CULTURE ??"INTEGRITY MANAGEMENT
---CHANGE MANGEMENT
--INCIDENCE MANAGEMENT, MAINTENANCE & AUDITING
-SUMMARY
-REFERENCES
######################

as you see assigment is not hard. about JetBlue Airways Valentine's Day 2007 crisis, there are a lot materials on the internet, also this is a very famous case study about BCCM. Even you dont need to go to library or etc. just i need your sentences thats it. if i ll find a useful file i ll send you.

please keep in touch
if you wanna ask any question do not hesitate. however please consider 6 hours time difference.





There are faxes for this order.

The Nike Case:

Your case analysis needs to cover: (Answer the questins in this order)

1. A synopsis of the situation including identifying the key issues in the case

2. A case analysis which includes a discussion on the following points:

a) Discussion of the extent to which Nike is a market-orientated company (culture and processes).

b) Evaluation of Nikes growth strategy.

c) An examination and assessment of Nikes organizational initiatives to strengthen the firms business design.

d) Discuss Nikes new product portfolio and strategic brand management strategies. Indicate any recommended changes.

3. The case study in the text was written in 2006, please conduct some research into what has happened in the past four years ??" How has Nike being doing financially? Has their market share changed? Has been any changes which would impact your answers to section 2?

4. What do you believe are the prospects for Nike in the next three to five years?

The grading rubric for this case is as follows:




0-2
3-5
6-8
9-10


Synopsis
Minimal or no synopsis
Fair synopsis covering a holistic view of the situation plus some of the key issues
Good synopsis covering a holistic view of the situation plus most of the key issues
Comprehensive synopsis covering a holistic view of the situation plus all of the key issues
0-10


0-3
4-8
9-12
13-15


Discussion of the extent to which Nike is a market-orientated company (culture and processes).
Minimal to no analysis
Basic analysis of Nikes culture and process; does not link them to market-orientation
General analysis of Nikes culture and process with a minimal link to market-orientation
Comprehensive analysis of Nikes culture and process, and discussion of the extent to which these attributes make Nike market-oriented
0-15

Evaluation of Nikes growth strategy
Does not describes Nikes growth strategy
Describes Nikes growth strategy but does not offer an analysis
Describes Nikes growth strategy and provides a superficial analysis of the strategy
Describes Nikes growth strategy and conducts a comprehensive analysis of the strategy
0-15

Assessment of Nikes organizational initiatives to strengthen their business design.


Does not identify Nikes organizational initiatives
Description of Nikes organizational initiatives but no link to their business impact
Description of Nikes organizational initiatives with a superficial assessment of their business impact
Description of Nikes organizational initiatives and comprehensive assessment of their business impact
0-15

Discussion of Nikes new product portfolio and strategic brand management strategies. Indicate any recommended changes
Nikes new product portfolio and strategic brand management strategies not identified. No recommended changes identified
Nikes new product portfolio and strategic brand management strategies loosely identified. No recommended changes identified
Nikes new product portfolio and strategic brand management strategies clearly identified. No recommended changes identified
Nikes new product portfolio and strategic brand management strategies clearly identified. Well support recommended changes identified
0-15

Research in the last four years
No or minimal research
Some research analysis with mostly non- scholarly sources
Good research analysis on Nikes financial and competitive position with mostly scholarly sources
Comprehensive research analysis on Nikes financial and competitive position with scholarly sources
0-15


0-2
3-5
6-8
9-10


Nike prospects in the next 3-5 years
No prospects identified
Minimal prospects identified with minimal support
Prospects supported with general arguments
Prospects well supported with substantive arguments
0-10


0
1-2
3-4
5


Writing
No paper
Un-structured case analysis, difficult to read. Spelling mistakes
Well structured case analysis, easy to read. A few spelling mistakes
Well structured case analysis, easy to read. No spelling mistakes
0-5

Total




0-100





There are faxes for this order.

Customer is requesting that (Serban) completes this order.

BUS401 - International Business

Impact of Culture on International Business

Few jobs require the kind of cultural sensitivity as the job of the international trainer. Large numbers of American business people travel the world training business people in everything from management techniques and computers, to human resource management and ethics. But what works in the domestic training session may or may not work in the global training world. Indeed, what may be wonderful in one context may be downright offensive in another. Sensitivity to cultural differences is very important.

Please attempt to find and refer to the below materials for the 2 page paper.

? Wade, Jared (2004),"The Pitfalls of Cross-Cultural Business", Risk Management, March 2004, v 51, Pages: 38-43.

? Gibson, R. (2006), Small Business (A Special Report); Foreign Flavors: When going abroad, you should think of franchising as a cookie-cutter business; Unless, of course, you want to succeed. Wall Street Journal September 25, 2006, Page R. 8.

? First, please identify some "cultural mistakes" from the first article listed above ("The pitfalls of cross-cultural business").

? Second, please select a company from the second article ("Small Business- A special report") and then analyze that company's "cultural" approaches.

? Discuss how the company you selected (e.g. focus on an international company of your choice from the second article) approaches foreign markets from the perspective of culture, and comment on how they should manage "cultural mistakes" that involve "cultural differences".

Assignment No. 2 Security Risk Analysis
The purpose of this exercise is to have you think and work in terms of system security risks to the enterprise, and thereby to introduce you to the need for security policies.
Ajax Inc. hand-delivers legal documents on behalf of clients. Ajax keeps detailed records of the delivery process on behalf of clients. You have been tasked to manage the security of mobile devices and a mobile device information tracking system through http://AjaxDelivery.org (lets say). The mobile devices are carried by employees and are location-aware. Thus, for example, a manager knows where all of his people and all of his packages are at all times.
Selected data are retained and much of it is confidential. Consider locations themselves to be sensitive data: For example, client A may not want it known that they are communicating with company B. The system enables authorized clients and authorized company personnel to access particular records created during the preceding three years. For example, logging on to http://AjaxDelivery.org and looking up John Does mobile device information, an authorized user can conveniently view Does movement in the Southern Illinois region during a designated time period
Restrict your response to a maximum of five pages of 12-point type and use the following sections. You may include appendices for reference. These will be read on an as-needed basis only and are excluded from page limits.
If you make assumptions that are not mentioned in this problem statement, please tell us what they are.
2.1. Identification and Description
Identify and describe what you consider to be the most important organizational security risk and the most important technical security risk that threaten the security of this system. These risks should be
concrete
realistic
specific to this application, and
not solvable on a just single occasion or by using a remedial application alone (such as an anti-virus application)
Divide your response to this in two parts as follows.
2.1.1: Description of the Organizational Risk
2.1.2: Description of the Technical risk
2.2. Management
Explain how you would manage each of the two risks described in Part 2.1 and describe the residual risk (i.e., the risk that remains after you have carried out the actions and measures described).
Divide your response to this in two parts as follows.
2.2.1: Management of the Organizational Risk
2.2.2: Management of the Technical risk
Be as concrete as you can and express the content largely in your own words. As always, all work must conform to the academic conduct instructions referenced in the syllabus.

HINTS:
As usual, keep in mind the criteria for all homework. Use them to self-evaluate ??" and improve accordingly ??" your own work using them before handing it in
Be careful to distinguish between organizational and technical risks. The notes cover this but here is a brief example. Organizational: backup procedures in terms of who does what and when ; Technical: A program that scans file names and reports anomalies . If in doubt, this is a good topic to discuss with your facilitator.
Write in terms of the particular business in question here; avoid writing generically because the latter is not usually clear or original
Use this weeks lecture notes referencing risk
Greene, page 353, discusses risk assessment and business impact analysis. You may want to tailor some of this to the particular risks that you identify.
Erbschloe discusses risk assessment data of several types on page 52. His checklist approach will give you ideas about where risks could exist in this system. Note, however, that the risks you are required to describe are system- not physical risks, which Erbschloe includes. He shows reporting forms on pp72-73.
Peltier discusses specific measures for risk management on page 250. These should give you ideas. Notice that the procedures are concrete. Tailor yours to the problem described where possible.
The CIA, DREAD and STRIDE checklists and methodologies may help you to identify risks.
Consider security issues that expose the organization to violations of regulations. Could this be applicable here?
As with all homeworks the page limits are provided as an outside limit: Dont artificially force your response to fit the maximum number of pages. There may be many excellent responses that require fewer pages than the maximum.


There are faxes for this order.

Change is constant in organizations. Changes occur in operations, technology, personnel, regulations, and every other area. Change management has several discrete steps. Prepare a post in which you discuss the key steps to auditing. Specifically, address why an audit plan should include:
The audit scope, timeline, requirements, and constraints.
A review of an organization's risks and risk management strategies.
A review of business impact.
A review of plan development activities.
A review of test plans.
A review of training plans.
A review of change management and plan maintenance

Memo format

You are a consulting team formed to advise Dirt Bikes USA on how to address the IS-related responsibilities of the organization. A number of the areas and initial questions should be relatively obvious based on the readings, for example;



Business continuity planning and disaster recovery

some ideas to touch on

Continuity Planning

Focuses on restoring business operations after a disaster

Identifies critical systems and business processes

Determines action plans for handling mission-critical functions when systems go down

Must be continually revisited for updates and refinement

Plans address loss of facilities, personnel, or critical systems

Coordinated with disaster recovery plans

Business managers and IT specialists work together

Business impact analysis

Disaster Recovery

Provide hot sites housing spare computers at locations around the country for unning critical applications in an emergency

o Comdisco disk recovery services

o Sun guard availability services

Plans for events:

o Power outages floods earthquakes terrorist attacks

Dirt Bikes is concerned with:

o Power outages

o Vandalism

o Computer viruses

Child Adoption as a Business

There is a huge need for child adoption in our society. Many couples go through the long, stressful and expensive process to adopt a child. But what is it from the other side: What is a child adoption as a business? In my research paper I would like to try to answer some questions: What kinds of organizations are involved in this business? Who gets the profit if there is one? What kind of problems is this business having? How does this business impact our society, science technology etc.?

Please use no more then four sources from Internet Web site.

Read The Following:

Sunsweet Growers Cultivates Its Supply Chain

Sunsweet Growers Inc. is an agricultural cooperative headquartered in Yuba City, California, and is the largest handler of dried tree fruits in the world. Sunsweet processes and markets 40,000 cases of dried fruit every day. In addition to dried cranberries, apricots, pineapples, and many other fruits, Sunsweet produces more than 50,000 tons of prunes annually for over one-third of the global market. With 400 member-owners of orchards located primarily in the Sacramento and San Joaquin valleys of central California, Sunsweet has unique supply chain management issues. Most companies are constrained by either demand or supply, but not both. But in Sunsweets case, both demand and supply are determined by factors that the company does not control. Sunsweet cannot control its supply, which is determined by the weather and growing season, or its demand, which is set by the market.

Like many manufacturers, Sunsweet sees spikes in demand for its products around holidays, such as Christmas and Easter. The growers harvest their fruit in August, September, and October, triggering a furious effort at the processing plant to dry, store, and package the fruit for delivery to retail stores. However, with the source limited to 400 growers in one geographic area, the supply of fruit varies significantly from year to year. When demand peaked around the holidays, Sunsweet often found itself shelling out extra money to pay workers overtime in order to fulfill its orders. Scheduling and planning the production and distribution of dozens of varieties and sizes of fruits in packaging bearing 20 different languages was a complex operation.

Sunsweet needed to improve scheduling and line utilization while reducing inventory, transportation costs, and order lead time. To address these supply chain management issues, Sunsweet adopted a sales and operations planning (S&OP) program, which seeks to balance demand and supply on a regular and formal basis and keep them balanced as conditions change. S&OP helps businesses routinely handle unexpected events such as unanticipated demand, shortages in supply, and production disruptions. Prior to implementing S&OP, Sunsweet managed its supply chain with a paper-based spreadsheet system. That system became increasingly inadequate as the business grew more complex due to outdated data, difficulty in supporting collaboration, and a lack of powerful tools for representing the business problem. Sunsweets planners spent too much managing the spreadsheets, and performing tasks such as cost analysis often required up to three days of work. The company wanted to perform planning and analysis tasks in hours, not days, and the ability to model multiple versions of a production plan to schedule its plant production resources more efficiently. Sunsweet found the solution in the Zemeter S&OP supply chain management suite from Supply Chain Consultants.

With Zemeter replacing the old Excel-based system, Sunsweet revamped its forecast meetings. Previously, each group involved in the supply chain went to those monthly meetings with their own set of data and little understanding of any other departments data. One of the first, and most important, steps that Sunsweet took under its new S&OP project was to scrub all of its data and unify them in one database. Using one set of data was key to getting all supply chain participants to work most effectively with each other for the good of the whole cooperative. Of course, getting line manufacturing supervisors, customer service representatives, schedulers, salespeople, engineers, and others on board with the new program required careful change management. Sunsweets managers realized that it was important to show the value of S&OP early in the transformation. Such value would be demonstrated in the first phase of a five-phase implementation??"demand visibility. By its very nature, improving demand visibility necessitated better communication and decision making at every level. It was also during this phase that all of Sunsweets various groups first gained access to the same data and each others goals.

Sunsweet needed just four weeks to implement the demand visibility phase. By its end, Sunsweet had also established parameters for training users, tested the scalability of the program, and initiated the program without disrupting the existing workflow. The next phase of the S&OP project was demand planning. This phase provided Sunsweets complete forecasting solution, which, in addition to providing a demand plan routinely, tracked and maintained improvements to the plan. Specific capabilities included creating and updating statistical forecasts, preparing plans for price changes and promotions, and analyzing demand data such as orders and shipments. Zemeters Demand Planner module analyzes input from multiple sources and outputs the best plan from the proposals. Sunsweet gained an objective method of balancing sales forecasts and operational plans. Demand Planner also helped Sunsweet improve the accuracy of its operational budget.

The demand planning phase included implementation of an early-warning system that dispenses e-mail alerts to the proper employees under various circumstances. The alerts give departments a head start in reviewing metrics when events dictate that plans might need to be altered to keep operations in sync. For example, an increase in new customers or a change in the most popular items for a particular customer would be cause for a review. Continuous planning taking into account the latest available data became a key element of the companys business processes.

Inventory planning was the third phase of the S&OP project. The new inventory systems calculated current inventory and used data about inventory history to detect trends and predict problems before they caused significant losses. In phase four, Sunsweet addressed supply planning. The cooperative added a Supply Planner module to raise the effectiveness of planning across its network of suppliers, with particular attention to maintaining a uniform labor force throughout the year. By taking into consideration the limits on production and supply in conjunction with a 15-month rolling forecast, Sunsweet evened out its production requirements instead of basing them on seasonal demands. The fifth phase of the implementation was finite scheduling, which had to do with the daily operational activities at the cooperatives plant headquarters. Finite scheduling handles fruit-size issues, material availability, overtime and downtime, changeover times on the packing lines, and other shift and workday oriented issues.
Prior to implementing the S&OP program, Sunsweet left tasks such as sales forecasting, operational planning, inventory planning, and finite scheduling to monthly meetings using summarized sales information. These meetings resulted in a tendency to meet sales forecasts and customer requirements with little consideration for operational costs. With Zemeter in place, Sunsweet moved its planning processes to weekly meetings using the latest information. With everyone sharing the most up-to-date information about finite scheduling, daily production, and inventory levels, Sunsweet was better positioned to meet customer demands without throwing off operational costs and long-term production plans.

Sunsweet achieved its return on investment in its S&OP system in about half the time it anticipated??"six and a half months??"while the implementation was still ongoing. Sunsweet improved the accuracy of its forecasts by 15 to 20 percent while reducing the amount of time necessary to make forecasts. The early warning e-mail alert system moved up responses to problems such as supply shortages and order discrepancies by two to three weeks. Planning and cost analysis tasks that used to take days using spreadsheets are now completed in four to five hours. Information from the system enabled Sunsweet to reduce the number of production lines, production line changeovers, inventory, and transportatio costs, and cut overtime from 30 percent down to 10 percent. Another by-product of the program was a more efficient and collaborative environment. The integration of data across the company ushered in cross-functional metrics, such as measurements of how well current inventory supports forecasts.

Once the S&OP program was implemented, several obstacles remained. In some cases, the problem was modern supply chain software, which is very liberal in permitting custom configurations. As the circumstances surrounding an organizations business processes change, workers may find it difficult to make the necessary changes in the custom-configured software. Instead, with easy access to desktop productivity tools, they introduce ad-hoc solutions into the process, thereby weakening the mainstream system. Sunsweet mitigated this concern by incorporating the desktop into the integrated S&OP system. Employees were still able to work with data on their desktops, but the scrubbed and validated data on the system remained reliable. In some supply chain planning implementations, only a few planners are responsible for the bulk of the application setup. When these planners move on to other tasks or other jobs, they take the knowledge of the initial setup methodology with them. Sunsweet avoided this complication by involving a wide swath of the organization in the planning phases. Furthermore, a large portion of the organization maintains access to the integrated data.

Another complexity of S&OP is that it addresses problems in the supply chain before they surface. This can create a false sense of security and lead to the conclusion that planning is no longer a critical issue.

Rather than remaining dedicated to continuous planning, an organization may drop it as a high priority and begin to streamline the process. Sunsweet still confronts this issue regularly, looking for ways to stress that continuous refinement and improvement are paramount to a successful S&OP. Successful S&OP programs include processes to sustain them. Among these are continuing education and training for departments whose decisions impact the sup- ply chain; encouragement of management training; ensuring transparency of decisions affecting the supply chain and supply chain data; development of a structure and budget that leave room for responding to crises; and recognition of achievements.

Today, Sunsweet is more successful at deploying its assets to satisfy demand projections. The cooperative has reduced inventory and transportations costs.



Answer The Following Question:

1. What are the constraints on Sunsweet Growerss supply chain?

2. What problems did Sunsweet Growers encounter as a result of these constraints? What was their business impact?

4. How did S&OP software help Sunsweet Growers better manage its supply chain?

5. What additional ways can you think of for Sunsweet Growers to ease its supply chain concerns?

Provide a three page, double-spaced, Times New Roman, 12 point summary of the article "Electronic Security Information Documentation" available below. The paper should include a referenced (footnotes or endnotes) analysis indicting agreement or disagreement with the author. It is important that that you use references to back up some of your statements.



Electronic Information Security Documentation
Peggy Fung1 , Lam-for Kwok1, Dennis Longley2
1 Department of Computer Science
City University Of Hong Kong
Kowloon, Hong Kong
2 Information Security Research Centre
Queensland University of Technology
Brisbane, Australia
[email protected] [email protected] [email protected]
Abstract
Effective security management depends upon good risk
management, which is itself based upon a reliable risk
assessment, involving data collection of all the facets
influencing system risk. Such data collection is often an
extremely onerous task, particularly if a substantial proportion
of the required information is not adequately documented.
Hence comprehensive, updated information security
documentation is a keystone of good information security
management. Whilst the recently emerging information security
management standards provide some implicit guidance on the
development of documentation; there is relatively little support
available for security officers attempting to develop and
maintain such documentation.
Traditionally textual security documents are not necessarily the
most appropriate format for describing the security of large
complex, networked systems, subject to frequent updates. It has
been suggested [1], [2] that a security officer?s workstation,
with a database and GUIs, may present a more effective form of
security documentation. However, such a tool requires a welldeveloped
model of the information system and, as discussed in
this paper, a standardised means of representing security
entities.
This paper proposes an information security model to facilitate
the development of electronic security documentation. A
proposed security entity classification scheme is first described.
Such a classification scheme and the use of object identifiers to
identify security entities greatly facilitates the development of a
security officer?s workstation. The potential of the model for
risk assessment and security design is described.
A prototype model was developed in Visual Basic to test the
concepts proposed, and a Java based model is currently under
development at the City University of Hong Kong..
Keywords: Information Security Management, Risk Analysis,
Information Security Standards, Information Security
Documentation.
1 Introduction
In the past three decades there has been a sharp increase
in the awareness of the potential deleterious impacts,
arising from inadequate information security.
Copyright ? 2003, Australian Computer Society, Inc. This
paper appeared at the Australasian Information Security
Workshop 2003 (AISW2003), Adelaide, Australia. Conferences
in Research and Practice in Information Technology, Vol. 21. C.
Johnson, P. Montague and C. Steketee, Eds. Reproduction for
academic, not-for profit purposes permitted provided this text is
included.
Unfortunately the scale of the problem has escalated more
rapidly than the commitment to combat it. Moreover, in
many cases, the media emphasis on hackers and viruses
has distorted the debate and tended to divert senior
management awareness from the more fundamental
aspects of information security.
In particular there may be a sharper focus on technical
solutions, to well advertised attacks, than on the
fundamental necessity to view information security as an
organisation wide business/ management / technology
issue.
Organisational security officers are charged with ensuring
the security of information assets and systems. As such,
they are perilously located between management and
technology. They are required to ensure that the
technological systems are implemented and operated in
such a manner, that the business risk to organisational
information assets and systems is contained within
acceptable boundaries. In effect they are required to
assess the level of business risk from an information
security viewpoint, and to recommend operational or
technical changes designed to bring that risk down to
some acceptable, but often unspecified, level.
The first step in such a risk assessment involves a major
data collection and evaluation process. This process is
often extremely time consuming, disruptive and
expensive. Hence, there is a temptation to work with
over-simplified models of the information system, and to
request highly subjective estimates of risk-related data
from I.T. staff.
Subjective risk assessments bode ill for a security officer
in a highly complex, networked environment, particularly
when information security failures may have significant
impacts on the financial well being or the regulatory or
contractual obligations of that organisation. In the
aftermath of a serious information security failure,
security officers may well be called upon to supply
convincing, documented, evidence that their risk
assessment recommendations, to senior management,
were well founded.
Hence one can easily demonstrate the importance of
comprehensive, timely, risk and security documentation,
to organisational security officers. Unfortunately, there
appears to be minimal support systems available to
security officers tasked with the development,
maintenance and interpretation of such documentation.
Information security management standards such as
German IT Baseline Protection Manual Standard Security
Safeguards [3], BS7799 [4], and ISO17799 [5] do provide
an infrastructure of information security management and
hence some guidance on the structure of security
documentation. Nevertheless it is interesting to compare
the emphasis on bookkeeping in the training of financial
auditors, with the average educational/training courses for
security personnel. In general there is a significant lack of
guidance, let alone tools to aid the security officer in the
documentation task.
In this paper, we discuss the importance and role of
information security documentation. In particular it is
suggested that a commonly agreed information security
model, and a common method of security entity
classification, would facilitate the development of
software tools for the production and utilisation of such
documentation.
2 Role of Information Security Documentation
2.1 Support for Risk Assessment
The information security industry has made significant
advances to meet the perceived threats to organisational
information security. Originally, outside the military
sector, the major threat identified by the finance and
banking industry was the security of electronic
transactions, and security manufacturers supplied
hardware cryptographic systems to this market. The
advent of viruses in the late 1980s spurred a new industry
in anti-viral software. Later the development of the
Internet as a common communication channel for
organisations, expanded the hacker community and the
production of firewalls to thwart them. PKI companies
provided cryptographic software the emerging Ecommerce
market, and many organisations now invest in
various access tokens such as smart and magnetic stripe
cards. The biotechnology industry is also continually
gearing itself up for its promised future.
Nevertheless security officers can face a difficult task, in
convincing management that these vendor products
represent only a part of the solution. Individual
countermeasures must be embedded within a coherent
information security infrastructure, if the organisational
operations are to be adequately protected.
The development of such an infrastructure must itself be
guided by effective risk assessment projects. The
importance of effective risk analysis was recognised in
the early 1970s[8], and there was a strong move by some
governments to facilitate the adoption of such
methodologies in sensitive computing systems.
Risk analysis includes the identification of assets, threats,
vulnerabilities, countermeasures and the evaluation of
loss expectancy. An information security risk analysis
study defines the IT environment under consideration and
recommends corrective actions.
Risk analysis projects were relatively expensive, even in
the mainframe computing era, because they involve the
collection and evaluation of a significant volume of data
including: ? the intrinsic threats, the IT system, its
physical and operating environment, the assets to be
protected and the business functions dependent on those
assets.
Such risk studies were either conducted by in-house staff
or external consultants. In general the in-house staff often
lacked extensive experience of the subjective aspects of
risk evaluation, and consultants had no previous
knowledge or experience of the organisational system
under study. Generally the existing documentation was
inadequate, in terms of its content, detail and currency,
for risk assessment. Hence the initial familiarisation
process was normally accompanied with a major task of
data collection.
The magnitude of this initial familiarisation task escalated
rapidly, as systems evolved from batch processing
mainframes to current complex, multi site networked,
client server scenarios. Moreover, the batch processing
mainframe environment was stable for long periods,
usually between purchases of the mainframe equipment.
Hence risk assessment recommendations had a long halflife,
significantly reducing the average annual cost of
such studies.
In the current climate the complexity and volatility of
information systems is such that:

The risk assessors, must at the outset, have
significant knowledge of the organisational system,
its environment and the business functions that it
supports.

The system documentation must be sufficiently
versatile, comprehensive and timely to reduce the
data collection task to achievable levels.

The cost of risk assessment updates must be
minimised.
There appear to be two conclusions from the above:

IT systems must be fully documented, from a
security viewpoint, and such documentation must be
regularly updated.

The abovementioned security documentation must
be in a format that significantly reduces the cost and
effort of risk assessment exercises.
2.2 Due Diligence
The evolution of IT systems, described above, clearly
escalated the magnitude and complexity of the
organisational security officer?s task. This development
in IT systems was moreover accompanied by increasing
integration of the IT systems into the organisational
business functions, to the extent that the health of the
business functions were inextricably linked to that of the
supporting computing and computing systems.
Computing downtimes, causing merely minor irritation in
the erstwhile mainframe era, would be life threatening to
most modern corporations.
Hence the security officer is not only faced with a major
task of risk assessment in a complex environment, the
potential penalties associated with inadequacies, in the
subsequent recommendations, have also escalated.
Unfortunately given the probabilistic nature of risk
assessment, there can be never be a guarantee of incident
free operation for the IT system over a long period of
time.
In a post security incident environment the security
officer must demonstrate that the security systems
implemented were reasonably compatible with the true
level and nature of the system risk. Moreover, current I.T
system failures may have serious consequences for the
financial well being of the organisation, and for its
compliance with regulatory and contractual obligations.
In the current climate management may well be formally
required to demonstrate due diligence in the protection of
information assets and systems.
Macro risk assessments, based upon apocryphal,
subjective assessments, are likely to be unconvincing in
the witness stand. Today?s security officers would be well
advised to equip themselves with comprehensive security
documentation, and associated risk assessment strategies,
as evidence that they had acted with a high level of
professional competence.
2.3 Security Documentation Requirements
It is much easier to make a case for the development of
comprehensive security documentation, that to actually
produce the documentation itself. In many cases advice
takes the form ? I would not start from here?.
The information security management standards do
provide an infrastructure for information security
management, which at least suggests a structure for the
documentation. A recent paper by the authors [6]
suggested the type of current organisational
documentation and data that should be collected and
packaged to form an initial set of information security
documentation.
In this paper the necessary facets of security
documentation are described and some insight into recent
work on an Information Security Model is discussed.
At the outset the question arises ? what is being described
by the security documentation? Most system
documentation is designed to assist operators and
developers in the performance of their tasks. Security
documentation is not however aimed normal system
operation, but rather at the circumstances in which the
system fails, in some sense. Hence security
documentation should provide a detailed description of an
agreed security model for the system. In other words an
organisation?s security documentation should contain the
local parameters of a generally accepted information
security model.
The proposed model need not be described in
conventional textual format. Given the complexity,
magnitude and volatility of modern information systems,
some form of database representation is more appropriate.
Moreover such a database should be supported with
software tools and GUIs to facilitate the development,
updating, investigation, risk analysis and security
reporting.
If a common model were employed by organisations then
third party vendors would be encouraged develop support
software. Moreover, given a common format of security
documentation one could envisage situations in which
external security advice and expertise were readily
absorbed by an organisation. Hence it is possible to
envisage a system in which CERT Advisories are
automatically downloaded and added to the security
database. The security software could then generate a
report on the implications of the reported attack for the
organisation.
3 A Proposed Model
3.1 Overview
The Risk Data Repository [1], [2] is a risk analysis model,
developed some years ago, which aimed to integrate all
available organisational data related to security. The
model had the ability to evolve over time as it
incorporated newly acquired data. The RDR described
entities in term of their roles from a security viewpoint,
and demonstrated the inter-relationships of security data.
The RDR essentially comprised three domains:
Environment, Platforms and Assets. The environment
domain included elements that effectively hosted or
supported the operation of the information processing
system: equipment, building, staff. The platform domain
was the logical description of the information processing
system and its defences. The assets domain described the
data and processes, to be protected, because misuse of
these assets would have a deleterious effect on the
organisational business operations.
The RDR comprised a database and graphical facilities to
trace the inter-relationship of security entities. Hence it
was possible to trace the effect of a threat of fire in a
building to the potential business impact. Experience with
the RDR demonstrated three significant aspects of such
security modelling:

the difficulty of describing the wide range of security
entities concerned with risk assessment and security
modelling;

problems of importing data from other RDRs; and

problems arising from the hard coding of security
expertise in the model.
It was clear that a major problem in the development of
such an organisational risk database lay with the
classification of the various entities. There appears to be
no common directory to describe such items as: Threats,
Computing Hardware, Buildings, Services, Users,
Information Assets, Access Control Policies, etc.
In the development of an Information Security Model, to
replace the RDR, the concept of Environment, Platform
and Assets was extended to five categories:

Systems: includes hardware, software, platforms,
networks, applications, users and information assets.

Environment: includes locations (sites, buildings,
floors and rooms) and services (power, cabling, air
conditioning, water and communications).

Security: includes threats, countermeasures, Threat
Trees and Threat Countermeasure Diagrams.

Procedure: includes external procedures, such as
government legislation and international standards,
and internal procedures: organization policies,
guidelines etc.

Relationships: security depends critically upon the
context of entities and this context is described by
relationships. For example, hardware is located in a
building, networks are connected to other networks,
and a security policy complies with a Standard?s
recommendation. Relationships among the various
entities are defined here.
Each of the above classes has a number of subclasses and
the whole set of entities can be described as a directory
tree. Borrowing the concepts of X.500[7] the various
subclasses and subsequent entities can be classified with
object identifiers, representing the set of nodes traversed
from the root to that entity (See Fig 1).
The proposed classification system has a number of
immediate advantages, from a risk assessment and
security documentation viewpoint. Firstly each entity is
uniquely and succinctly identified by its object identifier,
indicating its position in the directory tree.
Secondly the classification provides a top down model
with the major entities specified at an early stage of
development. For example, a building, floor and room are
each subclasses of the parent - site. It is well recognised in
risk assessment that the preliminary investigation involves
consideration of the major entities, followed by a
subsequent refinement into more detailed areas, as the
analysis identifies the risk priorities. Risk assessment
models that require full system details to be entered at the
outset hit major data collection problems.
The top down approach is also facilitated by the
Platforms entities under Systems entities. Platforms are
large IT systems comprising all the other Systems entities,
Hardware, Software, Networks, Users and Assets.
Defining Platforms at an early stage facilitates a largescale
organizational model, e.g. Platforms, located on
Sites.
A further advantage of the classification scheme is that it
facilitates the importation of data from another risk
database, assuming both databases have followed the
same classification model. Hence mergers within
branches of an organization, with consequent integration
of systems, can be readily handled, from a risk assessment
/ security documentation viewpoint.
The classification system described so far provides only
an inventory of the security entities. Security relevant
details of those entities, e.g. vulnerability to flooding for a
site, communication protocol of a network, issue date of a
security manual, are also stored in the database. Given the
diverse nature of the entities such attribute information is
stored as a tuple, e.g. PROTOCOL, TCP/IP>.
Risk assessment and security documentation are,
essentially concerned with the relationships between these
entities, i.e. the Web Server is Located in the IT Building,
and there be will a wide diversity of such linkages. Given
the importance of these linkages, to the role of the model,
they are themselves classified as security entities i.e.
Relationships. Hence the linkages, or relationships can be
structured into classes and sub-classes, with each class
and sub class given an object identifier. Such linkages can
be stored as a simple tuple: < Linkage OI, Incident Entity
OI, Target Entity OI>, represents a linkage between two
entities, similarly linkages involving three or more entities
can be unambiguously defined.
For example, the relationship
Server A is located in Building B can be represented by
the tuple <5.1.1.2.1.3, 1.1.1.3.2, 2.1.3.2>. Where

5.1 Relationships between two entities

5.1.1 incident entity is a Systems (1)

5.1.1.2 target entity is an Environment (2)

5.1.1.2.1 relationship class is
Environment/Locations (ID = 1)

5.1.1.2.1.3 particular Location Link (ID = 3).

1.1 Sytems/Hardware

1.1.1 Computing Hardware (ID = 1)

1.1.1.3 Server Class (ID = 3)

1.1.1.3.2 Server A (ID = 2).

2.1Environment/Location

2.1.3 HQ Site (ID = 3)

2.1.3.2 Building B (ID = 2).
The model entities, attributes and relationships can
provide an overview of the current systems, e.g. major
platforms, the major components of such platforms:
networks, computing systems, users, information assets,
the sites where the platforms are located, the services they
Fig 1. Directory Tree For Security Entities
comROOT
Systems(1) Environment(2 Security(3) Procedures(4)Relationships(5)
Locations(1) Services(2)
Fig 2.Effect Of Intrinsic Threat On Business Operation
CAUSING FINANCIAL LOSS TO
CAUSING DAMAGE TO
INTRINSIC THREAT
ORGANISATIONAL
PLATFORM
INFORMATION
ASSET
BUSINESS
OPERATION
ACTS ON
depend upon etc. The model can also be refined with
increasing level of detail, e.g. the sub-networks that form
the major networks etc.
The relationships can be employed to facilitate crossreferences
between documentation. For example, the
Procedures Class can refer both to internal and external
documentation. Hence chapter and paragraphs of
standards, and security manuals may be given object
identifiers. A Compliance relationship, between
paragraphs in internal security manuals and corresponding
paragraphs in BS 7799, would facilitate internal audits.
3.2 Threat Trees
Risk Assessment is concerned with the ultimate effect of
intrinsic threats, e.g. fire, loss of external services,
international network failures, on business operations
(See Fig 2). An important role of the security
documentation, and hence the proposed model is to
facilitate the tracing of such threat scenarios.
From the work on the model conducted so far, it would
appear that the classification scheme, and in particular the
classification of relationships, significantly facilitates
such threat tracing.
The threat transmission illustrated in Fig 2 is in effect a
series of statements along the following lines:
Incident Threat acting on Incident Entity causes Target
Threat to act upon Target Entity (Fig 3). For example:

Fire acting upon Building causing Physical Damage
to Equipment (located in Building).
Threats are security entities classified in the model and
are classified within the Security class. The concept of a
Threat acting upon an Entity is embodied in a
Threat_Entity relationship i.e. the tuple Entity_OI, Threat_OI, Entity_OI>
The Risk Assessment diagram (Fig 2) may hence be
represented as a Threat Tree (Fig 4) where each node
represents a Threat_Entity relationship caused by the
parent Threat_Entity. Relationship. The Threat Tree
recognises that a Threat_Entity may spread to many target
entities. At this stage it should also be stated that the
Threat_Entity transmission need not be restricted to a
tree, since a Threat_Entity node can have more than one
parent. The model can deal with these situations but for
simplicity they are not discussed here.
The concept of threat trees is well known, but a major
problem with such trees lies in the effort required for their
development. One of the more interesting facets, of the
proposed model, is that it opens up the possibility of an
automatic construction of threat trees. Consider first
manual development of threat trees in the context of the
model.
The starting point is the root node, i.e. interest is focused
upon the effect of a particular threat acting upon a
particular entity, or more simply upon a particular
Threat_Entity.
At this stage some security expertise is required to predict
the effect of this Threat_Entity on other entities in the
organizational database. For example, a security officer
would predict that a fire in a room would damage
equipment in that room. In effect a Relationship between
Threat_Entities, which are themselves Relationships, is
developed. This Relationship between Threat_Entities is
termed a TETE in the model. Hence:

Incident Threat_Entity Room_OI>

Target Threat_Entity Damage_OI, Equipment_OI>

TETE defines the linking of the Threat_Entities <
TETE_1_OI, TE_1_OI, TE_2_OI>
Given a database of all possible Threat_Entities and
TETEs, developed by a security officer, then threat trees
could be automatically produced for any root
Threat_Entity as described below:
1. Starting with the root Threat_Entity, TE_1_OI,
check all TETE entries TE_c_OI> for those where TE_b_OI = TE_1_OI.
2. Extract TE_c_OI from TETE_a_OI ? this is a
child node in the threat tree.
3. Repeat 1 ? 2 until no more TETEs found.
4. Repeat 1- 3 for the next child node in the threat
tree.
CAUSES
INCIDENT THREAT ACTING ON INCIDENT ENTITY
TARGET THREAT ACTING ON TARGET ENTITY
Fig 3. A Threat Entity Causes A Resultant Threat Entity
This procedure does provide for the automatic
development of threat trees, but at a massive cost of
manual development of possibly billions of TETEs. Some
results of the model, however, suggests that multiple
TETEs describing, for example, fires in every room in the
organization, and the equipment stored in each individual
room, can be replaced by a single TETE using object
identifiers with wild cards.
As a simple example of this approach consider the
observation that a fire in a building, with OI 2/1/1/1, is
could affect all floors of that building, and such floors can
be represented with wild card OIs 2/1/1/1/*. Hence we
can replace individual TETEs representing the spread to
each individual floor with a single TETE along the lines <
TETE_a_OI, TE_b_OI, TE-c_OI > where
TE_b_OI is < TE_b_OI, Threat_Fire_OI, 2/1/1/1 >
TE_c_OI is < TE_c_OI, Threat_Fire_OI, 2/1/1/1/* >
Using a comprehensive wild card approach security
expertise can be embodied in a minimal number of
TETEs, which can then be used to develop automatic
threat trees.
The work conducted so far has found that this approach is
quite versatile, to mention a few of the findings:

TETEs can be defined to incorporate the concept of
required linking between incident and target entities.
For example for a fire in a room to spread to
equipment, such equipment must be Located in that
room. This type of condition can be included as an
attribute of the TETE

The transfer of a Threat is not deterministic, it is
required that some estimate of the probability of the
threat transfer be included as an attribute of the
TETEs.

If wild card TETEs is defined then the probability of
a particular threat transfer can be made dependent
upon some attribute of the target entity.
TETEs effectively represent security expertise, and are
therefore developed by the security officer. Suppose
however a large organisation has adopted this model for
its various branches, each with its own security database.
Given the common means of classification it is clear that
TETEs representing common security knowledge can be
developed by head office (say) and imported into branch
databases.
3.3 Security Design
Security documentation should also play a role in the
design of security systems, following the identification of
significant areas of risk.
The threat trees provide an insight into the path from an
intrinsic threat to an undesirable business impact. Having
identified such a path, as a priority security task to be
addressed, the role of the security design is to reduce the
probability associated with this path. Consider the threat
tree illustrated in Fig 4, it can be considered that
additional security is required to reduce the probability of
the three transfer Threat /Entity 1 ? Threat/ Entity 1.2 and
/ or Threat /Entity 1.2 ? Threat/ Entity 1.2.1.
The security measures, physical or procedural, to be
deployed clearly depend upon the nature of the TETE
linking the nodes of the tree. In effect, the role of the
countermeasure is to reduce the attribute of the TETE
describing the probability of the threat transfer.
The threat trees can thus play an important role in security
design, inasmuch as they help to define the type and
placement of the countermeasures.
The RDR included the concept of Threat Countermeasure
Diagrams (TCD) to describe that aspect of security design
concerned with the effectiveness of countermeasures, and
such diagrams have been incorporated into this model.
The TCD is based upon the concept that countermeasures
are themselves subject to threats that can either result in
the countermeasure being bypassed or rendered
ineffective. Threats to countermeasures are countered by
additional countermeasures. For example, it is well
known that firewalls are vulnerable to illicit
reconfiguration, and must be protected by effective access
control. Threat Countermeasure Diagrams are trees of
countermeasures designed to ensure the security
effectiveness of the root countermeasure.
TCDs like TETEs represent security expertise, since they
demonstrate the effective deployment of countermeasures.
Hence given acceptance of the classification scheme they
can be imported into databases. Interestingly the use of
object identifier wild cards seems to allow a TCD to be
customized to its environment. Hence it would appear to
be possible for a generic imported TCD to take account of
local conditions.
4 Conclusion
The information security environment has undergone
radical changes over the last decade. Organisations are
now highly dependent upon the effective operation of
their information systems, and these systems have become
complex and highly vulnerable to external influences.
Hence effective information security risk management is
now a vital component of an organisation?s viability.
Such risk management has also been impacted by the
escalation of system complexity coupled with the
increasing vulnerability and strategic importance of the
information systems. Effective risk management, in turn
relies upon reliable and timely risk assessments.
THREAT / ENTITY 1
THREAT / ENTITY 1.1 THREAT / ENTITY 1.2
THREAT / ENTITY 1.2.1
Fig 4. Threat Tree
The cost of risk assessment exercises increases sharply
with system complexity, and a major component of such
costs lies in the collection of the wide range of security
relevant data. Moreover in an security officers now must
provide convincing evidence of the actions taken by the
organization, to identify and address the threats to their
information systems.
This paper has emphasized the importance of effective
security documentation in the above scenario. It has also
noted the lack of tools and support to assist security
officers in the development of such documentation.
The paper suggests that conventional textual
documentation may be replaced by an electronic database
and supporting software. Such a database, and associated
software tools, must developed around a common
information security model and this paper describes such
an approach.
It has been demonstrated that a standardised classification
of security entities, using object identifiers, facilitates the
development and implementation of such a model. The
work conducted so far has indicated how the model may
be deployed in risk assessment and security design.
Moreover the model provides an opportunity for the
importation of security expertise from vendors, advisory
bodies, etc.
A prototype model based upon Visual Basic has been
developed to test the concepts and a more comprehensive
Java based software package is currently under
development at the City University of Hong Kong.
5 References
[1] Kwok, L.F. (1997): A hypertext information
security model for organizations, Information
Management and Computer Security, Vol. 5
No.4, pp 138-48.
[2] Anderson AM, Longley D and Kwok LF (1994):
Security Modeling for Organizations, Proc. 2nd
ACM Conf on Computer and Communications
Security, Fairfax VA, pp. 241-250.
[3] IT Baseline Protection Manual Standard Security
Safeguards,
URL:http://www.bsi.bund.de/english/index.htm
[4] British Standards Institute (1999), BS7799: 1999
Information security management, Part 1 Code of
practice for information security management,
Specification for information security
management systems.
[5] ISO/IEC 17799 (April 2001): Code of practice for
information security management URL:
http://www.bsi-global.com
[6] Kwok, L.F, Fung, P.K., and Longley, D (2001):
Security Documentation, information Security
Management & Small Systems Security, IFIP
TC11.1/WG11.2, 18th Annual Working Conf. On
Information Security Management & Small
Systems Security, Las Vegas, USA, pp127-140.
[7] The Directory. CCITT REC. X.500-X.521
ISO/IEC Standard 9594:1993
[8] Federal Information Processing Standards
Publication 31. Guidelines for Automatic Data
Processing Physical Security and Risk
Management, Springfield: National Technical
Information Service, June 1974.

Create a report based on attached ppt and guideline below.
The final report is largely a written report of the PowerPoint presentation. Consider them as outlines for your final report. The final report can be structured to your taste and preference; however, make sure that it includes:
? Executive Summary ? Summarizes the opportunity, recommendation, and business impact
? Introduction and Background - An introduction to the organizational context and what has led to this organizational problem.
? Opportunity or Problem Definition - A description of the problem/opportunity you are investigating, why you are doing this, and what the project objectives are. Be sure to describe problem to be solved in business terms either linked to business objectives or pain points. Identify the key stakeholders.
? Alternatives considered and your Recommended Solution ? You may have several ?COULD-BE? solutions, but your final ?TO-BE? solution should be described and give the rationale for its selection over other alternatives. Recall our discussion on ?satisficing? ? one that is good enough, one that can be afforded, one that can be implemented in the time available, etc.
? Benefits estimates and assumptions ? Describe in business terms the expected benefits. This is largely a discussion of how you ?Bridge the gap?. Include any assumptions.
? Cost estimates and assumptions - what are the major costs categories for this project (e.g. development, software acquisition and installation, capital equipment and maintenance, staff retraining, etc.)? Give an estimate of what the cost ranges will be for this project. Estimate broadly based on your knowledge. Include how long it will take to implement and what capital and on-going costs may be required. For example, this may be a major factor in justifying the project in the first place. The investment in your recommendation is to provide long-term operational savings. Be sure to explicitly state how you are using any technology in your redesign effort.
? Risks factors and mitigation ? What are the major risks in this project and how might you mitigate those risks?
? Implementation Timeline ? Provide a high-level outline of how you the project would be implemented.

Short answer to 4 four questions (about 1/2 page each question):

1. Explain the links between poverty, conflict (such as war), natural disasters, and modern-day slavery. Use one or two specific examples to further your argument.

2. What makes modern-day slavery distinct from the African Slave Trade of the 1700s and 1800s? Provide at least three differences.

3. Explain how NightLight Design, a jewelry business, impacts the sex industry in Bangkok,Thailand. How could this commercial enterprise serve as a business model for other companieslooking to fight modern-day slavery?

4. How do cultural, religious, and societal norms in Cambodia and Thailand help or hinder sexual slavery? Provide at least two specific examples to bolster your argument.

The Minnesota Consulting Group (MCG) is a 50-person consulting services practice focusing on telecommunications and systems administration that has Minnesota offices in Minneapolis, St. Paul, and Rochester. MCG has had some business opportunities in Wisconsin and Iowa and is considering branching out further within those states by adding offices in Madison, WI and Cedar Rapids, IA. Much of its projects and ongoing account work have been in retail operations.

As a telecommunications practice, MCG has assisted organizations in business and market planning, technological evaluations, and education for IT organizations that are planning to expand their own telecommunications infrastructure services and support. MCG began with technical specialists and, over time, an increasing amount of MCG business consists of auditing, governance, and business advisory activities. Because of current economic forces, MCG is considering branching out into other service industries such as health care and insurance.

MCG?s published areas of expertise include the following:

Network assessment
System architecture assessment
Risk assessment and business impact analysis
Information technology governance
System administration staffing
Minnesota Consulting Group: Key Personnel

Principal Consultant?Amy Smith
Business Process Consultant?Becky Fredrickson
Business Process Consultant?George Conrad
Sr. System Administrator?Dave Baker
Sr. Technology Consultant?Mary Williams
Background: Central Medical Group

One of MCG's larger clients is the 560-bed Central Medical Group (CMG)?a nonprofit managed health care organization that provides an entire spectrum of health care services, including health insurance, primary care, and specialty care. Along with a primary care facility and teaching hospital, physicians and affiliated staff travel to more than 60 satellite primary care clinics to provide medical coverage across a 15-county region in the state of Minnesota. CMG is affiliated with specialty clinics and medical networks for pharmacy, dental, and employee assistance counseling services. CMG is presently considering expansion into additional counties in Minnesota and may be interested in branching into western Wisconsin and northern Iowa to provide a broader range of coverage for its members. Its mission as a nonprofit organization is to provide the community and regions that they serve with high-quality, cost-effective, accessible health care.

Central Medical Group's IT department consists of about 70 people. The department is broken up into a technical services group and an application development group. Project managers, business analysts, and application developers are within the application development group. Software applications (primarily .NET and informatics data warehousing) that are developed in-house are also supported by the same developers who built the applications.

Technical services contains a database and applications team, an infrastructure team, and a quality control team, each with a department manager. Quality control consists of testing and defect management, test data management, and internal auditing/compliance. Infrastructure includes disaster recovery planning, desktop support, security, and data center management. Database and applications consists of EDI coordination, database administration, data and code migrations, and application support for third-party purchased applications and tools. EDI coordination is an important role with claims processing and enrollment integration with 80 trading partners, 3,000 providers, secured transactions, and approximately 5 million electronic claims per year.

From CMG's perspective, Minnesota Consulting Group handles telecommunications installation, after-hours support to handle telecommunications issues, and staff augmentation to support the infrastructure team by adding resources for special, unstaffed data center or disaster recovery projects. Staff augmentation can also provide support coverage for 2?3 months when staff turnover occurs. Minnesota Consulting Group has provided these services for 3 years through an annual support contract along with statements of work for project and staff augmentation. As CMG IT staff gains expertise and additional personnel, an annual evaluation is held to determine whether or not to renew MCG services for the following year. MCG won this work through a competitive bid process, and Central Medical Group is not planning to replace MCG with another vendor but may bring those services completely in-house as CMG continues to grow and mature.

CMG?s IT Department: Key Personnel for this Scenario (out of 70 people)

VP of Technology?Fred Moore
Director of Technical Services?Brian Walters
Manager of Database/Applications?Jim Hanson
Lead Database Administrator?Diane Lau
Manager of Infrastructure?Julie Nelson
Lead System Administrator?Toby Johnson
External Forces Driving Projects

Regarding governance, risk, and compliance, both MCG and CMG have been recently focused on Information Technology Infrastructure Library (ITIL) policies and HIPAA 4010 compliance. However, CMG is taking steps to prepare for the National Association of Insurance Commissioners (NAIC) Model Audit Rule (MAR) compliance in 2010. The Model Audit Rule is similar to the Sarbanes Oxley Act, with an expanded focus on key business process controls, general computer controls, and the financial reporting process.

Both organizations are adding additional resources in the areas of governance, auditing, and process redesign for compliance. HIPAA 5010 updates are planned for 2009, and ICD-10 updates are planned for 2010. State government programs and mandates also create business opportunities along with operational challenges with responding to those mandates. CMG is systematically improving its internal processes and is planning to be more proactive than reactive in handling work assignments around infrastructure improvements.

Infrastructure, Network, and Application Architecture

Medical claims processing and insurance operations is the most dynamic part of the operation, and you will focus your time on those areas. The primary database platform is primarily Oracle running under AIX with some SQL servers running under NT based on third-party application purchases that only run under NT. Application and Web servers are NT servers with VMware (roughly 50 processors) running under Microsoft Windows. VMware has demonstrated some clear advantages for this organization, but one of the challenges with VMware is that SQL server software vendors want to run their application on their own hardware instead of a virtual machine. A storage area network (SAN) environment is used to provide direct access storage at about 3,000 Gb, and it is operating at near (85%) capacity.

The current environment consists of development (sized at about 30% of production), disaster recovery/operational recovery servers, and production servers. The business area consists of about 300 Wintel desktop and laptop computers. The VP of Technology is interested in replacing AIX with Linux and is considering some proof of concept projects to explore that option.

Project Overview

You are a principal consultant for Minnesota Consulting Group, and this is your first assignment in which you will be responsible for the entire client engagement. The environment is consultant friendly but dynamic, with frequent organizational and business changes. CMG is a growing organization, and staff reductions are not being discussed, so morale is high. However, 25% of the technical services department has been with CMG for less than 1 year because of that growth. The training budget is respectable, and everyone has typically 5?10 days annually planned for training. Process improvements and document management could be expanded to help the teams handle the increased business volume, an increasing need for governance, and the expansion of individual and team responsibilities.

The organization has some plans to become even more diverse with a tentative acquisition of a pharmacy benefit plan system. Discussions are at the preliminary stages, but this could provide integration opportunities along with the potential to sell ownership shares of a pharmacy benefit plan to other regional nonprofit entities that did not provide pharmacy benefits to their members.

Also, CMG is considering expansion into other markets, and its current environment and infrastructure may not be sized appropriately to handle the increase in both staff and membership that a new market would bring. Direct growth through acquiring another smaller medical claims and insurance entity is not currently being considered, but the management team is open to the possibility if the right opportunity became available. Again, this organization is nonprofit, but it is run in a businesslike manner regarding cost containment and providing quality service for CMG members. Geographical growth is a part of the organization?s long-term goals and objectives to extend services to those members.


--------------------------------------------------------------------------------

In this assignment, you will be in the role of Dave Baker, the Senior System Administrator from Minnesota Consulting Group (MCG). In a 1?2-page report, do the following:

Explain the OSI reference model and TCP/IP protocol architecture.
Explain the similarities and differences between them.
Explain the importance of using a layered model.
Differentiate between a confirmed service and a nonconfirmed service with respect to service primitives.

Business plan for a website that connects between freelancers in the middle east and people who can use their Talents and abilities. The website has to be a combination of the below websites:
- www.freelancer.com
- www.guru.com
- www.craigslist.com
The Plan should include the following:
- Cheapest but Reliable Developing Method (specify the candidate companies): (buying a ready made Template or building from scratch).
- Best Marketing strategy
- How to maintain the website on the long run
- Best way to generate money from the website.
- Cost

Business-Level and Corporate-Level Strategies


Choose an industry you have not yet written about in this course, and one publicly traded corporation within that industry (Not WalMart or Google). Research the company on its own Website, the public filings on the Securities and Exchange Commission EDGAR database (http://www.sec.gov/edgar.shtml), and any other sources you can find.

1.Analyze the business-level strategies for the corporation you chose to determine the business-level strategy you think is most important to the long-term success of the firm and whether or not you judge this to be a good choice. Justify your opinion.

2.Analyze the corporate-level strategies for the corporation you chose to determine the corporate-level strategy you think is most important to the long-term success of the firm and whether or not you judge this to be a good choice. Justify your opinion.

3.Analyze the competitive environment to determine the corporation's most significant competitor. Compare their strategies at each level and evaluate which company you think is most likely to be successful in the long term. Justify your choice.

4.Determine whether your choice from Question 3 would differ in slow-cycle and fast-cycle markets.

5.Use at least three (3) quality references. Note: Wikipedia and other Websites do not quality as academic resources.

Your assignment must follow these formatting requirements:

Business Model Innovation

Innovation Topic is considered to be one of the key drivers of business post the Global Financial Crisis.
There are many aspects of innovation within business, including process, technological and application.
Businesses can innovate to provide a strategic move forward or to block a competitor.

* This is not a technology solution.
* It is not required to add any part about the company history, it would not count in your score anyway
* Its important to answer the "target points to be covered" in a separate secessions and paragraphs so it would be easy to
* You should look at the bigger picture implications of the case and provide focused on how to solutions by offering
relevant scenarios that demonstrate how not should do.


*****The target company to be analyzed is the Maersk which considered as one of the biggest shipping companies
around the world.

**************The target points to be covered in details****************
1- What are the benefits of the innovation process?
2- What are the risk associated to the innovation implementation and the rewards the company will get from applying
the innovative polices?
3- How the innovation will effect on the company internally and externally (for example the effect on the share price
and the market share and the competition, competition conditions and the other issues)
4- Are the company strategies are built over and based on the innovation or not and which part of the technology?
5- How the innovative strategy will look like in the company product, process and customer?
6- The answer should cover the following questions
why to innovate ?what are the motives?
How to innovate?
What are the ??"ve and +ve of innovation on the company?
what are the risks associated with innovation to the company?
what is the effect of the innovation on the company competition?
what are the impacts on the company future and current position?
7-What are the different series of scenarios to potentially compete with the innovation as it enters any market.
There are faxes for this order.

Business 104 : Introduce to Business Assignment.

Step:

1. Read textbook

2. summarize main idea of each chapters.

3. write 14 short essays for each chapter which should be 200~250 words.

Each essay should include main idea of each chapters.

The essay does not have to include everything in the chapter, but main idea should be included.

Essays have to follow introduction-body-conclusion structure.



The assignment is individual 14 essays that each one summarizes each chapter with the main idea with 200~250 words.

The assignment should be approximately 250X14=3500words. Each essay does not have to include title but please indicate which chapter is.

You can access to the textbook via online.

here's the address for the textbook access,

http://www.coursesmart.com/

I will notify you the email address and the password of my account for the website via "talk with writer board"

You can access to "My bookshelf" after sign in, and you will find textbook named "Business"

Please ask me anytime if you have question.

BUSINESS MANAGEMENT
BUSINESS OPERATIONS AND SYSTEMS
FINAL YEAR

QUESTION

Part 1
Outline the essential components for effective business operations management for a UK business of your choice whose products are delivered to the door (e.g. Amazon). In the context of the company you have selected evaluate "The parcel delivery conundrum" using an appropriate systems methodology and support your discussion with appropriate business operations models.? You should include CATWOE, Root Definition and produce a detailed Rich Picture? (hand drawn) to illustrate your answer.
Part 2
Recommend how the business should respond to this conundrum (keeping in mind the possible technological and environmental (CO2) impact). By means of a business process plan illustrate the changes including ?AS IS? and ?TO BE?.
Part 3
Discuss the managerial qualities and resources that are necessary for effective implementation of the new process. By means of relevant models discuss how the business performance can be measured post implementation.