Assignment
Part 1: MidCorp is a mid-sized corporation that sells music and movie downloads over the Internet. They're in the same building as Acme and have the same electric power conditions. MidCorp's CFO that each hour of web server downtime costs the company $2,000 in profit from sales. Describe what MidCorp should do with respect to electric power protection. If your recommendation is different from Acme's, explain why. Explicitly state any assumptions you have made.
Part 2: Acme Corporation operates a small server room. They work 9:00 AM to 5:00 PM, five days a week, and can operate for several hours without IT services. However, part of their IT application includes a database system that is sensitive to interruption; it must be shut down properly to avoid corruption. They're based in Tampa; frequent thunderstorms cause brief power "blips." Complete power failures are rare, but do happen two or three times a year and last for several hours. Describe what Acme should do with respect to electric power protection.
Part 3: Using the cost-benefit analysis method described in the lecture, estimate how much money MidCorp should spend on power protection. You will have to make several assumptions to do this. Your answer should contain an "assumptions" section in which you list them. Justify each assumption in one or two sentences.
Part 4: Bruce Schneier says one should consider the following things when considering implementing a security system:
What assets are you trying to protect?
What are the risks to those assets?
How well does the proposed solution mitigate those risks?
What other risks might the proposed solution cause?
What are the costs and trade-offs of the proposed solution?
Assume your cousin lives with a spouse, a pre-teen daughter and a teenage son. Your cousin has asked for advice on whether to install a monitored burglar alarm in their home. What advice do you give? You do not have to find out the cost of burglar alarm systems for this assignment, but address all the rest of Schneier's considerations.
Part 5: The president of Acme Corporation has just learned that the company can be held responsible for what employees write in electronic mail. He is very worried! Acme has a long-standing, but unwritten, practice that brief personal phone calls are permitted at work, so long as they do not interfere with performance. The company president would like to treat email the same way.
In a couple of paragraphs, explain how personal phone calls and personal email messages are alike.
In a couple of more paragraphs, explain how they are different.
Write a draft policy for personal use of Acme's email system. (You don't need the standards and practices for this one, just the policy. Remember, policies state what must happen, may happen, or must not happen. This can be as short as a couple of paragraphs, but a sentence or too will not do.)