Solution Manual For Management of Cybersecurity 7th Edition by Michael E. Whitman, Herbert J. Matto

Solution and Answer Guide MICHAEL E. WHITMAN AND HERBERT J. MATTORD, MANAGEMENT OF CYBERSECURITY, 7E, 2026, 9798214011738; CHAPTER 01: INTRODUCTION TO THE MANAGEMENT OF CYBERSECURITY

TABLE OF CONTENTS Review Questions ........................................................................................................................................ 1 Exercises ...................................................................................................................................................... 4

REVIEW QUESTIONS 1.

What has caused cybersecurity to evolve beyond the responsibility of just the IT department?

Solution Guidance: The evolution of cybersecurity beyond the IT department‘s sole responsibility is due to technology permeating every facet of the business environment, making business places more fluid and information processing decentralized. This necessitates the involvement of all employees, especially managers, in cybersecurity efforts.

2.

How do organizations ensure that their cybersecurity planning and decisions involve the appropriate parties?

Solution Guidance: Organizations ensure their cybersecurity planning and decisions involve the appropriate parties by including three distinct groups of managers and professionals—those in the field of cybersecurity, those in the field of IT, and those from the rest of the organization—working together to reach a consensus on protecting the organization‘s information assets.

3.

What are the key characteristics of information that make it valuable to an organization?

Solution Guidance: The key characteristics of information that make it valuable to an organization are expressed in the C.I.A. triad, which stands for confidentiality, integrity, and availability. Modern extensions of the triad include privacy, authenticity, possession, and utility.

4.

What measures can be used to protect the confidentiality of information?

Solution Guidance: Measures to protect the confidentiality of information include information classification, secure document and data storage, the application of general security policies, education, training, and awareness for information custodians and end users, and cryptography (encryption).

5.

How is the integrity of information protected against corruption and damage?

Solution Guidance: The integrity of information is protected by employing a variety of error-control techniques during transmission, including the use of redundancy bits, check bits, algorithms, hash values, and error-correcting codes to ensure the information remains whole, complete, and uncorrupted.

6.

What role does authentication play in the access control mechanism of information systems?

© 2026 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

1

Solution Guidance: Authentication plays a critical role by requiring the validation and verification of an entity‘s asserted identity, ensuring that a user (or system) is the entity it claims to be before granting access to information assets.

7.

How does knowing the threats faced by an organization assist in cybersecurity management?

Solution Guidance: Knowing the threats faced by an organization assists in cybersecurity management by enabling informed decisions about protecting the organization‘s people, applications, data, and information systems from potential adverse effects.

8.

What role does Internet connectivity play in the exposure of organizations to external threats?

Solution Guidance: Internet connectivity increases the exposure of organizations to external threats because a typical organization with an online connection faces over 3.7 billion potential hackers, given the extensive number of Internet users worldwide.

9.

How do DoS and DDoS attacks affect targeted systems?

Solution Guidance: DoS and DDoS attacks overwhelm a target‘s ability to handle incoming communications, prohibiting legitimate users from accessing affected systems and potentially leading to system overload and inability to perform ordinary functions.

10. What is the significance of implementing contingency plans for forces of nature in cybersecurity?

Solution Guidance: Implementing contingency plans for forces of nature is significant in cybersecurity because these events usually occur with little warning and are beyond anyone‘s control, necessitating measures to limit damage and prepare for continued operations through disaster recovery, business continuity, and incident response plans.

11. What role do human errors play in cybersecurity threats, and how can they be mitigated?

Solution Guidance: Human errors play a significant role in cybersecurity threats, as they can lead to the unintentional disclosure, modification, or deletion of data. These errors can often be prevented with training, ongoing awareness activities, and controls to minimize the risk of mistakes leading to security breaches.

12. Why is technological obsolescence considered a cybersecurity threat, and how should organizations address it?

Solution Guidance: Technological obsolescence is considered a cybersecurity threat because outdated infrastructure can lead to unreliable and untrustworthy systems vulnerable to attacks. Organizations should proactively analyze current technology usage, plan for upgrades, and take immediate action to replace obsolete technology and mitigate risks.

13. What is the fundamental difference between management and leadership?

Solution Guidance: The fundamental difference between management and leadership is that management involves administering resources to achieve objectives, while leadership focuses on influencing others to achieve an objective by providing purpose, direction, and motivation.

14. What are the three basic behavioral types of leaders?

Solution Guidance: The three basic behavioral types of leaders are autocratic, who reserve all decision making for themselves; democratic, who seek input from interested parties; and laissez-faire, who allow the process to develop with minimal intervention.

15. How does the POLC management theory framework differ from traditional management theory?

© 2026 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

2

Solution Guidance: The POLC management theory framework differs from traditional management theory by focusing on planning, organizing, leading, and controlling, whereas traditional management theory emphasizes planning, organizing, staffing, directing, and controlling.

16. What is the role of contingency planning within the context of organizational management?

Solution Guidance: Contingency planning plays a role within organizational management by preparing for non-normal business operations and unexpected events, ensuring the organization can continue operations during unforeseen circumstances.

17. How can managers ensure the effectiveness of their chosen solution to a problem?

Solution Guidance: Managers can ensure the effectiveness of their chosen solution to a problem by carefully monitoring its implementation and evaluating its success in solving the problem, making adjustments as necessary.

18. What factors should be considered in the analysis and comparison of possible solutions to a problem?

Solution Guidance: Factors to consider in the analysis and comparison of possible solutions include economic feasibility, technological feasibility, behavioral feasibility, and operational feasibility.

19. Describe a method for generating ideas during the problem-solving process.

Solution Guidance: A method for generating ideas during the problem-solving process is brainstorming, in which a group of individuals rapidly suggests as many ideas as possible without regard for practicality, followed by a review to identify feasible options.

20. What differentiates the goals of the cybersecurity management team from those of the IT management team?

Solution Guidance: The goals of the cybersecurity management team differ from those of the IT management team in that cybersecurity focuses on ensuring the confidentiality, integrity, and availability of information, which may slow down information flow for security purposes, whereas the IT team‘s primary focus is the effective and efficient processing of information.

21. What are the ―six Ps‖ that constitute the unique functions of cybersecurity management?

Solution Guidance: The six functions of cybersecurity management are planning, policy, programs, protection, people, and project management.

22. How is the cybersecurity strategy developed within an organization?

Solution Guidance: The cybersecurity strategy is developed by translating the overall company strategy into strategies for each subordinate unit, including IT, and then using them with the IT strategy to develop the cybersecurity strategy in close collaboration with all senior managers.

23. What types of cybersecurity plans are necessary to support both normal and non-normal operations?

Solution Guidance: Types of cybersecurity plans necessary to support both normal and non-normal operations include incident response planning, business continuity planning, disaster recovery planning, policy planning, personnel planning, technology rollout planning, risk management planning, and security program planning.

24. What are the three general categories of cybersecurity policy?

Solution Guidance: The three general categories of cybersecurity policy are program policy, which sets the cybersecurity climate across the organization; issue-specific policies, which define acceptable behavior

© 2026 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

3

within specific organizational resources; and system-specific policies, which merge technical and managerial intent for the implementation of a given technology.

25. What role do people play in a cybersecurity program?

Solution Guidance: People play the most critical role in the cybersecurity program, encompassing security personnel (the professional cybersecurity employees), the security of personnel (protection of employees and their information), and aspects of the security education, training, and awareness program.

26. How does project management apply to cybersecurity management?

Solution Guidance: Project management applies to cybersecurity management by identifying and controlling the resources applied to cybersecurity projects, measuring progress, and adjusting the process as necessary to ensure the successful implementation of cybersecurity initiatives.

EXERCISES 1.

Consider the information stored in your personal computer. Do you currently have information stored on your computer that is critical to your personal life? If that information became compromised or lost, what effect would it have on you?

Solution Guidance: This answer will be unique to each student. A typical personal computer stores a wide range of information that is critical to the personal and professional life of its owner. This information can include personal identification details, financial records, personal photographs and videos, emails and personal correspondence, work-related documents, and other sensitive data. The compromise or loss of this information can have several effects on the owner, including: Identity theft—Personal identification information, such as Social Security numbers, addresses, and bank account details, can be used by cybercriminals to commit identity theft, leading to unauthorized financial transactions and legal implications.

Financial loss—Compromised financial records, including bank statements, credit card information, and investment details, can lead to direct financial loss. Cybercriminals can use this information to siphon funds from bank accounts or make unauthorized purchases.

Loss of privacy—Personal photographs, videos, and correspondences, if accessed without authorization, can lead to a significant invasion of privacy. This could result in emotional distress and even reputational damage if such information is made public.

Professional repercussions—Work-related documents and communications stored on personal computers are often confidential. Their unauthorized access or loss can not only affect the individual‘s employment but also have legal ramifications for breaching confidentiality agreements.

Emotional impact—The loss of personal memories, such as photographs or videos, that cannot be replaced can have a profound emotional impact on individuals.

Data recovery costs—Attempting to recover lost data can be expensive, especially if professional services are required. There‘s also no guarantee of full recovery, which could compound the loss further.

Protecting the information stored on personal computers involves implementing robust security measures, including the use of strong, unique passwords, enabling two-factor authentication where possible, regular software updates, and maintaining backups of critical data. Additionally, being vigilant about phishing attempts and other forms of social engineering attacks can help mitigate the risk of data compromise.

© 2026 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

4

2.

Using the web, research the malware named Stuxnet. When was it discovered? What kind of systems does it target? Who created it and what is it used for?

Solution Guidance: Stuxnet was discovered in June 2010 by Sergey Ulasen from the Belarusian antivirus company VirusBlokAda. It is a highly sophisticated computer worm that targets Siemens industrial control systems, specifically supervisory control and data acquisition (SCADA) systems used to control and monitor industrial processes. Stuxnet is notable for its ability to infect programmable logic controllers (PLCs) by subverting the Step-7 software application used to reprogram these devices. The worm‘s primary focus was on compromising Iranian nuclear facilities, particularly their uranium enrichment infrastructure.

More than 60 percent of the computers infected worldwide were located in Iran, indicating a specific focus on this nation‘s nuclear program.

The creation of Stuxnet is widely attributed to a joint effort by the United States and Israeli governments, under a covert operation known as Operation Olympic Games. This operation was part of an extensive cyberwarfare campaign to hinder Iran‘s nuclear program capabilities. The worm‘s design allowed it to spread via USB flash drives, crossing air gaps intended to isolate sensitive systems from network attacks.

Despite its targeted nature, Stuxnet also inadvertently spread beyond its intended targets, causing unintended global proliferation.

Stuxnet represents a significant milestone in cyberwarfare, being the first discovered malware to spy on and subvert industrial systems, and it highlighted the potential for cyberattacks to cause physical damage to critical infrastructure. The worm‘s discovery has led to increased awareness and concern about the security of industrial control systems and the potential implications of cyberwarfare on national and global security.

For detailed information, you may refer to the comprehensive analyses provided by Wikipedia, Britannica, and Avast.

3.

Search the web for ―The Official Phreaker‘s Manual.‖ What information in this manual might help a security administrator protect a communications system?

Solution Guidance: ―The Official Phreaker‘s Manual‖ and related information on phreaking provide valuable insights for security administrators aiming to protect communication systems. The manual and historical accounts of phreaking reveal several techniques that could be exploited to bypass security measures in telecommunications systems. Understanding these techniques can help administrators fortify their defenses against similar vulnerabilities.

Knowledge of system vulnerabilities—The manual details various technical aspects and vulnerabilities of telecommunications systems, such as the use of specific frequencies to manipulate phone systems. By understanding these vulnerabilities, administrators can better secure systems against unauthorized access or manipulation.

Insight into hacker mindset and techniques—Phreaking history shows how enthusiasts experimented with and exploited telecommunications systems, including the use of tone generators and social engineering.

This insight helps administrators anticipate potential security threats and implement more effective countermeasures.

Specific attack methods—The manual outlines specific methods such as blue boxing, which involves generating tones to make free long-distance calls, and switch hooking, a method to place calls from locked telephones. By understanding these methods, security professionals can develop targeted strategies to detect and prevent such attacks.

Evolution of telecommunication security—The transition from in-band signaling to more secure systems like SS7 demonstrates how telecommunications security has evolved in response to phreaking activities.

Security administrators can use this historical perspective to appreciate the importance of ongoing security updates and vigilance.

© 2026 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

5

Security enhancements—The manual‘s discussion of technologies and methodologies, including how calls are routed and managed within telecommunications networks, offers practical knowledge for enhancing security protocols and infrastructure design.

Security administrators should focus on continuously updating their knowledge base with information on both historical and emerging threats. Regular security audits, investing in modern security technologies, and fostering a culture of security awareness within organizations are crucial steps in protecting communications systems against potential breaches.

4.

The chapter discussed many threats and vulnerabilities to cybersecurity. Using the web, find at least two other sources of information about threats and vulnerabilities. Begin with www.securityfocus.com and use a keyword search on ―threats.‖ Solution Guidance: Reliable sources for information about cybersecurity threats and vulnerabilities include: CVE Details (www.cvedetails.com): This website provides a database of publicly disclosed cybersecurity vulnerabilities. It allows users to search for vulnerabilities based on different criteria, including software, vendor, or the specific type of vulnerability. This resource is invaluable for understanding specific vulnerabilities that could impact systems and the potential threats exploiting these vulnerabilities.

National Vulnerability Database (NVD; www.nist.gov/nvd): Managed by the National Institute of Standards and Technology (NIST), the NVD is the U.S. government repository of standards-based vulnerability management data. This data enables automation of vulnerability management, security measurement, and compliance. The NVD includes databases of security checklist references, securityrelated software flaws, misconfigurations, product names, and impact metrics.

For security administrators looking to protect communication systems, understanding the nature of threats and vulnerabilities is critical. By staying informed through the sources described above and other reputable sources, security professionals can better anticipate potential security issues and implement effective defenses.

5.

Using the categories of threats mentioned in this chapter and the various attacks described, review several current media sources and identify examples of each threat.

Solution Guidance: This will be a unique response for each student.

Solution and Answer Guide MICHAEL E. WHITMAN AND HERBERT J. MATTORD, MANAGEMENT OF CYBERSECURITY, 7E, 2026, 9798214011738; CHAPTER 02: GOVERNANCE AND S TRATEGIC P LANNING FOR CYBERSECURITY

TABLE OF CONTENTS Review Questions ........................................................................................................................................ 6 Exercises ...................................................................................................................................................... 9

REVIEW QUESTIONS 6.

What is the primary goal of planning within organizations?

© 2026 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

6

Solution Guidance: The primary goal of planning is to manage and allocate resources effectively to achieve specific organizational goals.

7.

How does planning benefit cybersecurity management?

Solution Guidance: Planning enables cybersecurity managers to allocate resources strategically for the long-term viability of cybersecurity programs.

8.

What role does the chief security officer play in planning?

Solution Guidance: The CSO is crucial in generating responses to immediate threats and planning for the long-term security of the organization.

9.

Why is an ethical perspective important in organizational planning?

Solution Guidance: An ethical perspective ensures that the organization‘s actions align with ethical standards and regulations, preventing lapses in integrity.

10. How does a mission statement influence an organization?

Solution Guidance: A mission statement defines the organization‘s business and operational areas, guiding its strategic direction and objectives.

11. What is the function of a vision statement in planning?

Solution Guidance: A vision statement outlines the organization‘s future aspirations, helping to steer longterm goals and objectives.

12. Describe the importance of values statements in organizations.

Solution Guidance: Values statements establish the principles and standards of behavior for the organization, influencing its culture and ethics.

13. What are the key components of strategic planning?

Solution Guidance: Strategic planning involves defining long-term directions, allocating resources, and setting goals to navigate an ever-changing environment.

14. How is cybersecurity integrated into strategic planning?

Solution Guidance: Cybersecurity is integrated by supporting all organizational units beyond IT to align with overall business strategies.

15. What are tactical plans and how do they relate to strategic plans?

Solution Guidance: Tactical plans break down strategic goals into actionable objectives, focusing on the short to medium term.

16. Explain the relationship between operational and tactical planning.

Solution Guidance: Operational plans implement the objectives set by tactical plans, focusing on daily activities and short-term goals.

17. Why is cybersecurity governance crucial for organizations?

Solution Guidance: Cybersecurity governance ensures strategic direction, risk management, and responsible use of resources in protecting information assets.

18. What outcomes are expected from effective cybersecurity governance?

© 2026 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

7

Solution Guidance: Expected outcomes include strategic alignment with business goals, effective risk management, and optimized resource utilization.

19. How does the ISO/IEC 27014:2020 standard contribute to cybersecurity governance?

Solution Guidance: It provides high-level recommendations for assessing and improving cybersecurity governance within organizations.

20. What challenges does security convergence aim to address?

Solution Guidance: Security convergence aims to reduce costs and improve outcomes by integrating physical and cybersecurity efforts.

21. What are the benefits of a top-down approach to cybersecurity implementation?

Solution Guidance: Benefits include strong management support, clear planning, and effective integration of cybersecurity across the organization.

22. Why is the involvement of end users important in cybersecurity planning?

Solution Guidance: Involving end users ensures that cybersecurity initiatives are practical, understandable, and meet the needs of those most affected.

23. What factors influence corporate readiness for cybersecurity?

Solution Guidance: Factors include the company‘s view of cybersecurity, its business goals, and regulatory requirements.

24. How does understanding the security department‘s maturity status aid planning?

Solution Guidance: It helps in developing a roadmap to the desired end state and identifying areas for improvement.

25. Why are regulatory requirements important in cybersecurity planning?

Solution Guidance: They dictate specific security measures needed for compliance within particular industries.

26. What is the role of continuous learning in cybersecurity?

Solution Guidance: Continuous learning is essential for keeping up with new threats and ensuring the cybersecurity program evolves effectively.

27. What key elements should a strategic cybersecurity plan include?

Solution Guidance: Elements include risk assessment and mitigation, strategic security planning, and marketing the security program to the business.

28. How do cybersecurity programs evolve from a bottom-up approach?

Solution Guidance: They start as grassroots efforts by administrators to improve system security, eventually gaining formal recognition and support.

29. What advantages do integrating physical and cybersecurity efforts offer?

Solution Guidance: Integrated efforts can lead to cost savings and more effective management of security risks across the organization.

30. Why is a champion necessary for the success of top-down cybersecurity initiatives?

© 2026 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

8

Solution Guidance: A champion ensures high-level support and influence, which is critical for the project‘s acceptance and implementation across the organization.

31. How can cybersecurity governance increase an organization‘s share value?

Solution Guidance: Effective cybersecurity governance can significantly increase an organization‘s share value by enhancing security and reducing operational risks.

32. Describe the role of continuous learning in cybersecurity management.

Solution Guidance: Continuous learning ensures that cybersecurity practices and policies remain effective and responsive to evolving threats and technologies.

EXERCISES 1.

Using a web search engine, find an article from a reputable source, published within the past six months, that reports on the risk coming from inside the organization compared to the risk coming from outside. If the article notes that this relative risk is changing, how is it changing, and to what is the change attributed?

Solution Guidance: A 2023 article in Digital Guardian discussed the risks of insiders versus outsiders in terms of cybersecurity. The article highlights that insiders often pose a bigger threat, not necessarily through malice but through actions that inadvertently open doors for external bad actors. Malicious outsiders focus on tricking insiders to gain access, leveraging the fact that insiders have the keys to the kingdom. Despite the minority of breaches being directly attributed to insiders, negligent or accidental actions by insiders play a significant role in facilitating external attacks. The article emphasizes the importance of organizations prioritizing protection against insider threats through both technical and managerial controls and fostering a culture of trust and security awareness.

2.

Using a web search engine, find five examples of values, vision, and mission statements as well as public declarations of organizational strategy. Do these examples express concern for the security of corporate information?

Solution Guidance: Several examples of values, vision, and mission statements from reputable companies can be found. These statements often emphasize the organization‘s goals and priorities but do not always explicitly mention the security of corporate information. Here are summaries from selected companies: Tesla focuses on accelerating the world‘s transition to sustainable energy. Tesla‘s mission encompasses a broad vision of sustainability and innovation without a direct mention of corporate cybersecurity.

Patagonia is dedicated to saving the planet, a mission that underlines its commitment to environmental conservation. While its mission is clear and impactful, the mission statement does not directly address corporate cybersecurity.

Disney aims to entertain, inform, and inspire people around the globe with unparalleled storytelling. This statement highlights its role in the entertainment industry and its ambition to be the world‘s premier entertainment company without explicitly discussing the security of corporate information.

T-Mobile states its goal to redefine how consumers and businesses buy wireless services through product and service innovation. The mission emphasizes customer service and innovation but does not specifically mention cybersecurity.

PayPal‘s mission is to democratize financial services so that everyone, regardless of background or economic standing, has access to affordable, convenient, and secure products and services. While PayPal‘s mission implies a concern for security, it broadly focuses on financial services accessibility rather than the security of corporate information itself.

© 2026 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

9

While these mission and vision statements reflect each company‘s overarching goals and values, they tend to focus more on product, service, and ethical goals rather than the specifics of cybersecurity management.

PayPal comes closest to addressing security concerns, given its emphasis on providing secure financial services, which implicitly includes the security of corporate and customer data.

3.

Search your institution‘s published documents (or another organization‘s), including its webpages. Locate its values, vision, and/or mission statement, as well as strategic goals. Identify any references to cybersecurity. Also, look for any planning documents related to cybersecurity.

Solution Guidance: Student responses to this question will be very localized. At a minimum, responses should include the location of the documents and a short summary of each.

4.

Use a web search engine to find a general encyclopedic article on agile approaches to an SDLC. You might use a search phrase of ―agile SDLC wiki.‖ Read the article. What differentiates agile development from traditional development?

Solution Guidance: Agile development and traditional development, often exemplified by the Waterfall model, are two distinct approaches to software development, each with its unique methodologies, practices, and philosophies.

The choice between agile and traditional development methods depends on the project‘s nature, requirements, stakeholders‘ needs, and the team‘s flexibility. Agile is particularly beneficial for projects where requirements are expected to change or are not fully understood at the outset. Traditional methods might be more suitable for projects with very clear, unchanging requirements or where a structured, phased approach is necessary.

5.

Use a web search engine to explore converged approaches to enterprise risk management. You should use the search phrases ―converged enterprise risk management‖ and ―all hazard risk management.‖ Read at least three posts you find for each search term.

Solution Guidance: Student responses might include observations about whether convergence is increasing or decreasing. Students might also offer opinions about these changes in convergence.

6.

Next, find and read the article at https://www.securityexecutivecouncil.com/spotlight/?sid=30603. How does an ―ordinary‖ approach to governing the security process in a company differ from the converged models you read about in Exercise 5?

Solution Guidance: An ―ordinary‖ approach to security governance typically involves managing physical and cybersecurity operations separately, leading to potential gaps in overall security. Conversely, converged security models integrate cybersecurity and IT strategies with physical security measures. This holistic approach enhances awareness, strengthens protection of facilities, people, and data, and addresses the interconnectedness of systems in today‘s digital landscape. Converged security recognizes the importance of collaboration between previously siloed teams to secure critical assets more effectively.

Solution and Answer Guide MICHAEL E. WHITMAN AND HERBERT J. MATTORD, MANAGEMENT OF CYBERSECURITY, 7E, 2026, 9798214011738; CHAPTER 03: RISK MANAGEMENT: ASSESSING RISK

TABLE OF CONTENTS Review Questions ...................................................................................................................................... 11 Exercises .................................................................................................................................................... 14

© 2026 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

10

REVIEW QUESTIONS 7.

What is the foundational philosophy of cybersecurity strategy as suggested by Sun Tzu‘s observations?

Solution Guidance: The foundational philosophy of cybersecurity strategy, as suggested by Sun Tzu‘s observations, emphasizes the importance of knowing both oneself and the enemy to reduce risk in cybersecurity management.

8.

What are the four key components of the cybersecurity RM process?

Solution Guidance: The four key components are risk identification, risk analysis, risk evaluation, and risk treatment.

9.

How does the chapter suggest organizations should approach the adoption of an RM framework and process?

Solution Guidance: Organizations should adapt the RM framework and process to fit their specific needs, indicating that there is no one-size-fits-all solution.

10. What role does continuous improvement play in the RM framework?

Solution Guidance: Continuous improvement plays a crucial role in RM by ensuring the program is constantly reviewed and improved to enhance its effectiveness over time.

11. What is the significance of risk tolerance and risk appetite in the RM process?

Solution Guidance: Risk tolerance and risk appetite are significant because they define the range of acceptable risks for the organization and guide the decision-making process for which risks are acceptable and which require mitigation.

12. What steps are involved in the implementation of the RM plan?

Solution Guidance: The implementation of the RM plan involves specifying a leader and project manager, laying out a detailed implementation methodology, and selecting a rollout method, such as pilot testing or a phased approach, to carefully monitor and address issues during the implementation.

13. What are the main tasks involved in establishing the context within the RM process?

Solution Guidance: Establishing the context involves understanding the organization‘s internal and external operating environments and other factors that could impact the RM process.

14. How does the RM process approach the identification of risks?

Solution Guidance: The RM process approaches the identification of risks by creating an inventory of information assets, classifying and organizing those assets meaningfully, assigning value to each information asset, identifying threats to the assets, and pinpointing vulnerabilities.

15. What does analyzing risk in the RM process entail?

Solution Guidance: Analyzing risk entails determining the likelihood that vulnerable systems will be attacked, estimating the impact of an attack on each information asset, and assessing the relative risk facing the organization‘s information assets.

16. How is the evaluation of risk to the organization‘s key assets conducted in the RM process?

© 2026 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

11

Solution Guidance: The evaluation of risk involves comparing identified uncontrolled risks against the organization‘s risk appetite, identifying individual risk tolerances for each information asset, and synthesizing these into a coherent risk appetite statement.

17. What steps are involved in treating unacceptable risks in the RM process?

Solution Guidance: Treating unacceptable risks involves determining which treatment or control strategy is best considering the value of the information asset, acquiring or installing appropriate controls, and overseeing processes to ensure that the controls remain effective.

18. What is the primary goal of risk identification in the context of RM? Solution Guidance: The primary goal of risk identification is to recognize, enumerate, and document risks to an organization‘s information assets.

19. How does the process of identifying information assets begin?

Solution Guidance: The process of identifying information assets begins with cataloging the assets, including people, procedures, data, software, hardware, and networking elements.

20. What is a challenge in the RM process?

Solution Guidance: One of the toughest challenges in RM is identifying information assets with precision.

21. How does an organization approach the classification and categorization of information assets?

Solution Guidance: An organization should review its initial inventory of information assets to determine whether the asset categories are meaningful to its RM program. If necessary, the organization can adjust the categories to better meet the needs of the program.

22. What criteria are suggested for assessing the value of information assets?

Solution Guidance: Criteria for assessing the value of information assets include determining which assets are critical to the success of the organization, which contribute the most to revenue generation or profitability, which are expensive to maintain or replace, which are difficult to protect, and those whose loss or compromise would cause the greatest liability or embarrassment.

23. How should an organization prioritize information assets?

Solution Guidance: Information assets can be prioritized through a weighted table analysis, in which each asset is evaluated against relevant criteria with assigned weights and then ranked based on their weighted scores.

24. What is the significance of the Threats–Vulnerabilities–Assets (TVA) worksheet as described?

Solution Guidance: The TVA worksheet is significant because it provides a methodical way to examine the exposure of assets to various threats by documenting the relationship among threats, vulnerabilities, and assets, thereby serving as a foundational step for the risk assessment process.

25. What is the purpose of risk analysis in the context of RM? Solution Guidance: The purpose of risk analysis in the context of RM is to determine the extent to which an organization‘s information assets are exposed to risk by assigning a risk rating value or score to each specific vulnerability.

26. How is the likelihood of a threat event determined according to NIST?

© 2026 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

12

Solution Guidance: According to NIST, the likelihood of a threat event is determined by assessing the probability that a given threat can exploit a set of vulnerabilities, considering factors such as adversary intent, capability, and targeting as well as historical evidence and empirical data.

27. What factors are considered in assessing the potential impact of a threat event on asset value?

Solution Guidance: In assessing the potential impact of a threat event on asset value, factors considered include the magnitude of harm resulting from unauthorized disclosure, modification, destruction of information, or loss of availability. Other factors involve the harm experienced by various stakeholders, including the organization and its operations, assets, and individuals.

28. What is risk aggregation, and how does it simplify the risk assessment process?

Solution Guidance: Risk aggregation is the process of merging or combining groups of assets, threats, and associated risks into more general categories to simplify risk assessment. It helps manage the scope and scale of risk assessments by rolling up discrete or lower-level risks into a higher-level risk overview.

29. How does uncertainty factor into the risk determination process?

Solution Guidance: Uncertainty factors into risk determination by accounting for the limitations and imperfections in knowledge about vulnerabilities, threats, and controls. Estimations and judgments by managers are needed to account for unknown or unpredictable elements in risk assessment.

30. What is risk evaluation in the context of RM? Solution Guidance: Risk evaluation is the process of comparing an information asset‘s risk rating to the numerical representation of the organization‘s risk appetite or threshold to determine if risk treatment is required.

31. Why is it important to document the results of risk assessment?

Solution Guidance: Documenting the results of risk assessment is important because it allows the organization to make informed choices from the best available information and provides continuity for future iterations of the process.

32. What factors contribute to the decision-making process when evaluating if the current level of risk is acceptable?

Solution Guidance: The decision-making process when evaluating the current level of risk requires extensive input from the RM process team, recommendations, and cost estimates. It might also require a formal presentation to provide multiple options for reducing the risk.

33. How can the treatment of risk in one information asset affect other information assets?

Solution Guidance: The treatment of risk in one information asset can positively or negatively affect the level of risk in other information assets depending on the solutions implemented, such as upgrading the organization‘s firewall or changing the effectiveness of a control.

34. What are the options available to an organization during risk treatment?

Solution Guidance: During risk treatment, an organization‘s options include removing the information asset from harm‘s way, modifying its current protection, and passing the responsibility for its administration and/or protection to third parties.

35. What role does feedback play in the RM process?

© 2026 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

13

Solution Guidance: Feedback plays a critical role in RM, as it is used to improve not only the process but also the framework based on the successes and challenges encountered. Feedback requires formal mechanisms for submission to the framework team.

EXERCISES 36. If an organization has three information assets to evaluate for RM purposes, as shown in the following list, which vulnerability should be evaluated for additional controls first? Which vulnerability should be evaluated last? 

Switch L47 connects a network to the Internet. It has two vulnerabilities: (1) susceptibility to hardware failure, with a likelihood of 2, and (2) susceptibility to an SNMP buffer overflow attack, with a likelihood of 1. There is a 75 percent certainty of the assumptions and data.



Server WebSrv6 hosts a company website and performs e-commerce transactions. It has web server software that is vulnerable to attack via invalid Unicode values. The likelihood of such an attack is estimated at 3. The server has been assigned an impact value of 5. There is an 80 percent certainty of the assumptions and data.



Operators use the MGMT45 control console to monitor operations in the server room. It has no passwords and is susceptible to unlogged misuse by the operators. Estimates show the likelihood of misuse is 2. There are no controls in place on this asset, which has an impact rating of 4. There is a 90 percent certainty of the assumptions and data.

Solution Guidance: To determine which vulnerability should be evaluated first and last for additional controls, consider both the likelihood of each vulnerability being exploited and the impact of such exploitation, along with the certainty of the assumptions and data provided. A higher impact and likelihood indicate a higher priority for evaluation, while a lower combination suggests a lower priority. Additionally, the certainty factor can influence the urgency for reevaluation of the assumptions and controls in place.

For the provided data, calculate a simple risk score by multiplying the likelihood by the impact. While the certainty of assumptions and data doesn‘t directly change the risk score, it should be considered when deciding on the urgency of action required because lower certainty might require quicker reassessment to ensure the accuracy of the risk evaluation.

Switch L47 

Hardware failure: Likelihood = 2 (No impact value provided, making it challenging to calculate a risk score without assuming a generic impact value)



SNMP buffer overflow attack: Likelihood = 1 (Similarly, no impact value is given)

Server WebSrv6 

Vulnerable to invalid Unicode values attack: Likelihood = 3, Impact = 5



Risk Score = Likelihood × Impact = 3 × 5 = 15

MGMT45 Control Console 

Susceptibility to unlogged misuse: Likelihood = 2, Impact = 4



Risk Score = Likelihood × Impact = 2 × 4 = 8

Given the information and assuming the need to infer the impact of the switch‘s vulnerabilities or treat them as less critical because they were not directly mentioned, Server WebSrv6‘s vulnerability should be

© 2026 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

14

evaluated for additional controls first due to the highest calculated risk score of 15, indicating a higher combination of likelihood and impact.

Switch L47‘s SNMP buffer overflow attack, with a likelihood of 1 and assuming a lower impact due to not being explicitly mentioned, should be evaluated last among the vulnerabilities with provided data, implying the lowest urgency based on the given information. However, without impact values for Switch L47‘s vulnerabilities, this prioritization focuses solely on the vulnerabilities with complete data. The hardware failure‘s evaluation sequence would need reconsideration after specifying its impact level.

In practice, the absence of impact values for Switch L47 requires stakeholders to define these values based on potential consequences to the organization‘s operations, assets, or individuals to accurately prioritize risk treatment efforts.

37. Using the web, search for at least three tools to automate risk assessment. Collect information on automated risk assessment tools. What do they cost? What features do they provide? What are the advantages and disadvantages of each one?

Solution Guidance: Here are three automated risk assessment tools, their features, costs (where available), and potential advantages and disadvantages: LogicGate Risk Cloud 

Features: Provides a cloud-based solution for governance, risk, and compliance (GRC) with a nocode app builder, prebuilt templates, and workflow customization



Advantages: Offers a comprehensive view of risk programs with flexibility due to its no-code solution and integration capabilities with various platforms like Jira, Slack, and DocuSign



Disadvantages: While highly customizable, it might require a learning curve to fully exploit its features and integrations

Fusion Risk Management 

Features: Focuses on operational resilience, including business continuity, RM, and crisis management, with a platform that can be tailored to fit unique organizational needs



Advantages: Offers a single platform for resilience, eliminating the need for multiple modules and fostering data-backed decisions with Fusion Analytics



Disadvantages: The customization and breadth of features might require a substantial setup phase to align with specific organizational needs

MindBridge 

Features: An AI-powered platform for financial integrity and risk discovery, offering tools and analytics for auditors, accountants, and financial professionals



Advantages: Utilizes AI for enhanced risk discovery over 100 percent of transactions and is used by notable institutions like the Bank of England



Disadvantages: Primarily focused on financial data, which might not cover all types of risks organizations face

Cost information for these tools is not always transparently available, as it often depends on the scale of the implementation, the specific needs of the organization, and other factors like the level of support required.

It‘s common for companies to provide pricing upon request to tailor the cost according to the scope of deployment.

© 2026 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

15

For precise cost details, features, and a deeper dive into each tool‘s capabilities, contact the providers directly or visit their official websites for the most up-to-date information and to request demos, if available.

This summary provides a glimpse into what each tool offers, but the choice should be guided by your specific RM needs, budget constraints, and integration requirements with existing systems.

38. Using a data classification scheme, identify and classify the information contained in your personal computer or personal digital assistant. Based on the potential for misuse or embarrassment, what information is confidential, sensitive but unclassified, and suitable for public release?

Solution Guidance: This will vary based on each student‘s context and situation. An example could be similar to the following: Classifying the information contained in a typical personal computer can be approached by using a standard data classification scheme that categorizes data based on sensitivity and the potential impact of exposure or unauthorized access. A common classification includes categories such as Confidential, Sensitive but Unclassified, and Public. Here‘s how information on a personal computer might be classified under these categories: Confidential 

Personal identifiable information (PII): Includes Social Security numbers, credit card numbers, and personal financial records; exposure could lead to identity theft or financial fraud



Passwords and login credentials: Access to personal accounts, email, and work-related systems



Private communications: Personal or business emails, messages, and correspondence that contain sensitive information



Personal photos and videos: Especially those of a personal or intimate nature that have not been shared publicly



Work-related documents: Documents containing trade secrets, proprietary information, or any information covered under nondisclosure agreements

Sensitive but Unclassified 

Personal health records: Medical history, prescriptions, and any health-related information that is private but not as critical as PII in terms of potential financial fraud



Employment records: Resumes, job applications, and performance reviews that are sensitive but might not have severe consequences if exposed



Informal personal documents: Diaries, notes, or journals that contain personal information the individual may want to keep private but doesn‘t pose a financial risk

Public 

Publicly shared files: Information already shared on social media or public websites, including published articles, public blog posts, or any content explicitly intended for public view



Music, movies, and software: Assuming these are legally obtained and not under restrictive licenses, the information is generally considered suitable for public access



Educational materials: Information and documents related to publicly available educational courses, as well as open-source learning materials

© 2026 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

16

For each category, the potential for misuse or embarrassment varies significantly: 

Confidential information has the highest risk, with potential financial, legal, and personal repercussions if misused or disclosed without authorization.



Sensitive but Unclassified information could cause personal embarrassment or discomfort if disclosed but might not carry the same level of financial or legal risk.



Public information is already available or deemed suitable for release, so it poses minimal risk if further shared.

It‘s crucial for individuals to rigorously secure information classified as confidential, using strong passwords, encryption, and cautious sharing practices. Sensitive information should also be protected, albeit with an understanding that the potential impact of disclosure is less severe than for confidential data.

Public information, while low risk, should still be shared responsibly, respecting privacy, copyright laws, and the potential impact on others.

39. Using the asset valuation method presented in this chapter, conduct a preliminary risk assessment on the information contained in your home. Answer each of the valuation questions listed in this chapter. What would it cost if you lost all your data?

Solution Guidance: This answer will vary based on each student‘s context and situation. An example could be similar to the following.

A preliminary risk assessment using the asset valuation method can be adapted to evaluate the potential risks associated with the loss of data in a home environment.

Identification of information assets: This includes personal documents, financial records, personal photos and videos, emails and communications, and any work-related documents stored on personal devices.

Classifying and categorizing information assets: Information can be categorized into the following categories. 

Confidential—Financial records, passwords, personal identification documents



Sensitive but Unclassified—Personal emails, work documents not classified as confidential, personal photos, and health records



Public—Information already shared in public domains, such as social media posts, published work, or public communications

Assessing the value of information assets: The loss of confidential and sensitive information can lead to identity theft, financial loss, legal issues, and personal embarrassment. The cost of losing all data could be substantial, considering potential financial losses, the cost of recovering or replicating the data, and the emotional distress associated with personal memories (photos/videos).

Prioritizing information assets: Financial records and personal identification documents are typically of the highest priority due to their potential for misuse. Personal photos and communications may hold sentimental value and be irreplaceable, highlighting the importance of backups and secure storage.

Determining the likelihood of a threat event and assessing potential impact: Threats such as malware, phishing, theft, or accidental deletion could pose significant risks to these assets. The impact would vary, with financial data exposure potentially leading to significant financial loss and identity theft, while the loss of personal memories could have a profound emotional impact.

© 2026 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

17

Mitigation and applicable controls: Implementing cybersecurity measures (antivirus, firewalls, secure passwords), regular backups, and educating household members on safe Internet practices are key strategies to mitigate these risks.

Continuous improvement: Regularly updating security measures, conducting periodic risk assessments, and staying informed about new threats are essential steps in managing and reducing risk over time.

In summary, the potential cost of losing all data on a typical home‘s personal computer can vary widely but is often significant, particularly when considering the combined financial, legal, emotional, and reputational impacts. Implementing a robust RM strategy, including regular backups and cybersecurity measures, is essential for protecting these valuable assets.

Solution and Answer Guide MICHAEL E. WHITMAN AND HERBERT J. MATTORD, MANAGEMENT OF CYBERSECURITY, 7E, 2026, 9798214011738; CHAPTER 04: RISK MANAGEMENT: T REATING RISK

TABLE OF CONTENTS Review Questions ...................................................................................................................................... 18 Exercises .................................................................................................................................................... 21

REVIEW QUESTIONS 40. What are the four basic strategies for treating risks identified by the risk management (RM) process team?

Solution Guidance: The four basic strategies for treating risks are mitigation, transference, acceptance, and termination.

41. How does the risk mitigation strategy aim to reduce risk?

Solution Guidance: The risk mitigation strategy aims to reduce risk by applying controls and safeguards that eliminate or reduce the remaining uncontrolled risk—for example, countering threats, removing vulnerabilities, limiting access, and improving protective safeguards.

42. What is the purpose of the transference risk treatment strategy?

Solution Guidance: The purpose of the transference risk treatment strategy is to shift risk to other assets, processes, or organizations, effectively sharing or transferring the risk to another entity.

43. Under what circumstances might an organization choose the acceptance risk treatment strategy?

Solution Guidance: An organization might choose the acceptance risk treatment strategy when it determines that the cost of implementing and maintaining controls to treat the risk does not justify the security expenditure. This is a conscious business decision to accept the current level of residual risk.

44. What actions are involved in the termination risk treatment strategy?

Solution Guidance: The termination risk treatment strategy involves removing or discontinuing the information asset from the organization‘s operating environment to eliminate all risk associated with it. For example, the organization can shut down the asset or disable its connectivity to potential threats.

© 2026 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

18

45. Why is continuous feedback important in the RM process?

Solution Guidance: Continuous feedback is important in RM to improve not only the process itself but also the framework. Feedback from the process team can be used to address challenges and enhance the effectiveness of RM activities.

46. What distinguishes risk mitigation from contingency planning (CP) mitigation?

Solution Guidance: Risk mitigation focuses on applying additional controls and safeguards to reduce risk, while CP mitigation is about planning and preparation to minimize the damage from incidents or disasters through quick detection, response, and recovery.

47. How can organizations effectively implement the transference risk treatment strategy?

Solution Guidance: Organizations can effectively implement the transference risk treatment strategy by utilizing service level agreements with external entities to ensure that they meet the desired level of security for valued information assets, thus transferring the risk.

48. What is the significance of assessing risk treatment strategies in the context of an organization‘s risk appetite?

Solution Guidance: Assessing risk treatment strategies in the context of an organization‘s risk appetite is significant because it helps the organization select appropriate strategies that align with its tolerance for risk, ensuring that only unacceptable levels of risk are treated and in a manner that is consistent with the organization‘s overall strategic objectives.

49. What is the primary goal of a cybersecurity program in the context of managing residual risk?

Solution Guidance: The primary goal of a cybersecurity program is to align residual risk with the organization‘s risk appetite, acknowledging that bringing residual risk to zero is virtually impossible while still providing value to the organization.

50. How does the concept of risk appetite influence an organization‘s decision making in cybersecurity?

Solution Guidance: Risk appetite influences an organization‘s decision making by determining the quantity and nature of risk it is willing to accept, balancing the costs and usability of information assets against potential losses if the assets were exploited.

51. What are some of the guidelines for selecting a risk treatment strategy?

Solution Guidance: Guidelines for selecting a risk treatment strategy include implementing cybersecurity controls for important assets with vulnerabilities, applying layered protections to minimize risk, increasing the attacker‘s cost, and applying design principles to limit the extent of an attack.

52. What role does an action plan play in risk treatment strategy selection?

Solution Guidance: An action plan documents the chosen treatment strategies for each threat– vulnerability–asset triplet, including any residual risk, and outlines concrete tasks with assigned accountability, possibly including hardware and software requirements, budget estimates, and timelines.

53. How is economic feasibility evaluated in the context of cybersecurity controls?

Solution Guidance: Economic feasibility is evaluated by comparing the costs of implementing cybersecurity controls against the value of the information assets they protect, which ensures that the cost of protection does not exceed the asset‘s worth. This comparison is often made using a cost–benefit analysis.

54. What are the challenges associated with determining the cost of safeguarding information?

© 2026 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

19

Solution Guidance: Challenges include identifying costs related to development, acquisition, training, implementation, maintenance, potential loss from asset compromise, and the difficulty in quantifying some of these aspects accurately.

55. How can the value of information assets and the benefit of using controls be determined?

Solution Guidance: The value can be determined through asset valuation processes, considering costs related to creation, maintenance, replacement, provision, and protection of the information. Other considerations include the value to owners, intellectual property value, and potential loss from unavailability.

56. What does the annualized loss expectancy (ALE) represent, and how is it calculated?

Solution Guidance: The ALE represents the potential loss per year from the successful exploitation of a vulnerability. It is calculated as the product of the single loss expectancy and the annualized rate of occurrence.

57. What alternative models to cost–benefit analysis might an organization consider for justifying risk treatments?

Solution Guidance: Alternatives include benchmarking, due care and due diligence, best business practices, the gold standard, and government recommendations. Each offers a different approach to evaluating and justifying the implementation of risk treatments.

58. What is the OCTAVE method, and who promoted it?

Solution Guidance: The Operationally Critical Threat, Asset, and Vulnerability Evaluation (OCTAVE) method is a risk evaluation methodology promoted by Carnegie Mellon University‘s Software Engineering Institute to balance the protection of critical information assets against the costs of protective and detection controls.

59. What does FAIR stand for, and what is its purpose in RM? Solution Guidance: FAIR stands for Factor Analysis of Information Risk, a framework developed by Jack A. Jones to help organizations understand, analyze, and measure information risk, ultimately leading to more cost-effective information RM. 60. How has the FAIR framework been institutionalized or adopted by organizations or standards?

Solution Guidance: The FAIR framework was adopted by the Open Group as an international standard for RM and rebranded as Open FAIR™. Its principles were incorporated into analytical software suites like RiskCalibrator by CXOWARE, later known as RiskLens.

61. What ISO standards are specifically focused on RM, and what updates were made in 2018?

Solution Guidance: ISO standards specifically focused on RM include ISO 27005 and ISO 31000, both of which were updated in 2018 to create a unified approach to RM. 62. What is the primary purpose of the NIST Risk Management Framework (RMF)?

Solution Guidance: The RMF is designed to integrate RM into all operations and decisions of an organization, promoting the concept of timely RM, continuous monitoring, and the use of automation for cost-effective, risk-based decisions.

63. Can you describe the seven steps of the RMF?

© 2026 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

20

Solution Guidance: The seven steps of the RMF include preparing for the RMF, categorizing the system and information, selecting controls, implementing the controls, assessing the controls, authorizing the system, and continuously monitoring the system and controls.

64. How does MITRE‘s approach to RM differ from other methodologies?

Solution Guidance: MITRE‘s approach to RM, aimed at federally funded research and development groups, involves a four-step process of risk identification, risk impact assessment, risk prioritization analysis, and risk mitigation planning, implementation, and monitoring, which is outlined in their systems engineering guide.

65. What role does the European Network and Information Security Agency (ENISA) play in comparing RM tools?

Solution Guidance: ENISA ranks RM tools using 22 different attributes and provides a utility on its website that enables users to compare RM methods or tools, thereby assisting in the selection of appropriate RM methodologies.

66. What considerations should an organization take into account when selecting an RM model?

Solution Guidance: When selecting an RM model, an organization should consider its specific needs, understand what each model offers, potentially hire a consulting firm for a tailored solution, and engage with cybersecurity professionals to learn from their experiences and preferences, recognizing that what works for one organization may not necessarily work for another.

EXERCISES 67. Using the following table, calculate the SLE, ARO, and ALE for each threat category listed.

XYZ Software Company (Asset value: $1,200,000 in projected revenues) Threat Category

Cost per Incident

Frequency of Occurrence

Programmer mistakes

$5,000

1 per week

Loss of intellectual property

$75,000

1 per year

Software piracy

$500

1 per week

Theft of information (hacker)

$2,500

1 per quarter

Theft of information (employee)

$5,000

1 per 6 months

Web defacement

$500

1 per month

Theft of equipment

$5,000

1 per year

Viruses, worms, Trojan horses

$1,500

1 per week

Denial-of-service attack

$2,500

1 per quarter

Earthquake

$250,000

1 per 20 years

Flood

$250,000

1 per 10 years

Fire

$500,000

1 per 10 years

© 2026 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

21

Solution Guidance: Here are the calculated SLE, ARO, and ALE for each threat category listed for XYZ Software: 

Programmer mistakes—SLE, $5,000; ARO, 52 times per year; ALE, $260,000



Loss of intellectual property—SLE, $75,000; ARO, one time per year; ALE, $75,000



Software piracy—SLE, $500; ARO, 52 times per year; ALE, $26,000



Theft of information (hacker)—SLE, $2,500; ARO, four times per year; ALE, $10,000



Theft of information (employee)—SLE, $5,000; ARO, two times per year; ALE, $10,000



Web defacement—SLE, $500; ARO, 12 times per year; ALE, $6,000



Theft of equipment—SLE, $5,000; ARO, one time per year; ALE, $5,000



Viruses, worms, Trojan horses—SLE, $1,500; ARO, 52 times per year; ALE, $78,000



Denial-of-service attack—SLE, $2,500; ARO, four times per year; ALE, $10,000



Earthquake—SLE, $250,000; ARO, 0.05 time per year (1 per 20 years); ALE, $12,500



Flood—SLE, $250,000; ARO, 0.1 time per year (1 per 10 years); ALE, $25,000



Fire—SLE, $500,000; ARO, 0.1 time per year (1 per 10 years); ALE, $50,000

68. How do you think the XYZ Software Company arrived at the values shown in the table in Exercise 1? For each row in the table, describe how you might go about determining the cost per incident and the frequency of occurrence.

Solution Guidance: To arrive at the values shown in the table for each threat category, XYZ Software likely followed a systematic approach involving historical data analysis, risk assessments, and possibly simulations. Here‘s a detailed breakdown of how they might determine the cost per incident and the frequency of occurrence for each category: 

Programmer mistakes Cost per incident—Estimation based on past incidents involving programming errors that led to system downtime, data correction, or recovery activities, including labor costs for identifying and fixing the issues Frequency of occurrence—Analysis of historical incident logs to track how often programming mistakes have led to identifiable losses



Loss of intellectual property (IP) Cost per incident—Assessment of the potential market value of lost IP, legal fees, and any associated costs from breach incidents or espionage activities Frequency of occurrence—Review of industry benchmarks and internal audit logs for incidents of IP theft or leaks



Software piracy Cost per incident—Calculation based on the lost sales revenue from pirated copies and potential legal and enforcement costs

© 2026 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

22

Frequency of occurrence—Monitoring piracy forums and customer reports and utilizing software to detect unauthorized use 

Theft of information (hacker) Cost per incident—Estimation from direct losses, system analysis and recovery efforts, and potential fines or legal costs from data breaches Frequency of occurrence—Evaluation of security incident reports and threat intelligence feeds for patterns of hacker activities



Theft of information (employee) Cost per incident—Derived from the impact assessment of previous insider threats, including unauthorized disclosures or sales of company data Frequency of occurrence—Analysis of internal security logs and incident reports alongside periodic security audits



Web defacement Cost per incident—Calculation based on website restoration costs, potential lost revenue during downtime, and brand damage assessment Frequency of occurrence—Monitoring of web defacement archives and tracking incidents through web application firewall logs



Theft of equipment Cost per incident—Valuation of stolen assets plus potential data loss, downtime, and replacement costs Frequency of occurrence—Review of physical security breaches and inventory discrepancies over time



Viruses, worms, Trojan horses Cost per incident—Based on the cost of system cleanup, data recovery, and potential losses from disrupted operations Frequency of occurrence—Tracking of antivirus and security solution alerts alongside industry infection rates



Denial-of-service (DoS) attack Cost per incident—Assessment of lost productivity, potential customer impact, and mitigation or countermeasure deployment costs Frequency of occurrence—Analysis of network traffic logs and incident reports for patterns indicative of DoS attacks



Earthquake Cost per incident—Evaluation of historical damage costs to the region, insurance estimates, and specific vulnerability assessments of company infrastructure Frequency of occurrence—Consultation with geological studies and historical data on regional seismic activity

© 2026 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

23



Flood Cost per incident—Estimation from regional flood history, potential water damage to assets, and business continuity disruption Frequency of occurrence—Analysis of flood zone data and historical weather patterns



Fire Cost per incident—Calculation of historical fire incidents, including asset damage, recovery costs, and potential operational downtime Frequency of occurrence—Review of fire department statistics, insurance data, and internal safety incident logs

XYZ Software Company likely combines these methods with RM frameworks, industry standards (e.g., ISO 27005, NIST), and expert consultations to refine its estimates and ensure they align with its risk appetite and management strategy.

69. How could we determine an exposure factor (EF) if there is no percentage of exposure given? Which method is easier for determining the SLE: a percentage of value lost or cost per incident?

Solution Guidance: Determining the EF without a directly given percentage involves understanding the potential impact of a threat on the asset in question. The EF is essentially a measure of the severity of a given threat‘s impact, expressed as a percentage of the asset‘s total value that would be lost or adversely affected if the threat were realized. To estimate the EF when a percentage is not readily provided, one might follow these steps: 

Asset valuation—Clearly define and assess the value of the asset. This can include tangible and intangible aspects depending on the asset type (e.g., physical equipment, data, brand reputation).



Impact analysis—Conduct a qualitative and quantitative analysis of the potential impacts a threat could have on the asset. This may involve: o

Scenario analysis to explore different ways a threat could manifest and affect the asset

o

Historical data review to assess past incidents of a similar nature and their impacts

o

Consultation with experts or stakeholders to gauge the potential impacts based on their experience and knowledge



Percentage estimation—Based on the impact analysis, estimate the portion of the asset‘s value that could be lost or impaired. This requires a comprehensive understanding of the asset‘s operational, financial, and strategic importance to the organization.



Validation and adjustment—Validate the EF estimation through peer review, simulations, or comparison with industry benchmarks. Adjust the EF as necessary to align with realistic expectations and organizational risk tolerance.

Comparing Methods for Determining SLE 

Percentage of value lost (exposure factor)—This method involves calculating the SLE by multiplying the total value of the asset (asset value, AV) by the EF, which represents the percentage of the asset‘s value that would be lost due to a specific threat. The formula is SLE = AV × EF. This method is inherently tied to the value of the asset and the proportional impact of the threat, making it suitable for assets with well-understood values when the impacts of threats can be reliably estimated as a proportion of those values.

© 2026 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

24



Cost per incident—This approach directly uses or estimates the cost associated with a specific threat occurrence, bypassing the need to calculate the asset‘s total value and the proportional impact. The SLE in this case is essentially the cost per incident.

Which Method Is Easier?

The ease of determining the SLE depends on the context and available information: 

For well-valued assets and well-understood threats, using a percentage of value lost can be straightforward and provide a clear linkage between the asset‘s value and the potential impact of threats.



When direct costs are easier to estimate or are readily available, such as through historical data or industry benchmarks, the cost-per-incident method might be simpler and more direct.

In practice, the choice between these methods often depends on the nature of the assets, the types of threats, and the availability of data to support the calculations.

70. Assume a year has passed and XYZ has improved its cybersecurity. Using the following table, calculate the SLE, ARO, and ALE for each threat category listed here: XYZ Software Company (Asset value: $1,200,000 in projected revenues)

Threat Category

Cost per Incident

Frequency of Occurrence

Cost of Controls

Type of Control

Programmer mistakes

$5,000

1 per month

$20,000

Training

Loss of intellectual property

$75,000

1 per 2 years

$15,000

Firewall/intrusion detection system (IDS)

Software piracy

$500

1 per month

$30,000

Firewall/IDS

Theft of information (hacker)

$2,500

1 per 6 months

$15,000

Firewall/IDS

Theft of information (employee)

$5,000

1 per year

$15,000

Physical security

Web defacement

$500

1 per quarter

$10,000

Firewall

Theft of equipment

$5,000

1 per 2 years

$15,000

Physical security

Viruses, worms, Trojan horses

$1,500

1 per month

$15,000

Antivirus

Denial-of-service attack

$2,500

1 per 6 months

$10,000

Firewall

Earthquake

$250,000

1 per 20 years

$5,000

Insurance/backups

Flood

$50,000

1 per 10 years

$10,000

Insurance/backups

Fire

$100,000

1 per 10 years

$10,000

Insurance/backups

Solution Guidance: After implementing cybersecurity improvements and considering the costs of controls, here are the net ALE values after accounting for the cost of controls: 

Programmer mistakes—Net ALE after control is $40,000



Loss of intellectual property—Net ALE after control is $22,500

© 2026 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

25



Software piracy—Net ALE after control is –$24,000; this indicates a savings or net positive impact due to controls



Theft of information (hacker)—Net ALE after control is –$10,000; savings are due to effective controls



Theft of information (employee)—Net ALE after control is –$10,000; savings indicate the control‘s effectiveness



Web defacement—Net ALE after control is –$8,000; savings are due to controls



Theft of equipment—Net ALE after control is –$12,500; this indicates a positive impact of controls



Viruses, worms, Trojan horses—Net ALE after control is $3,000



Denial-of-service attack—Net ALE after control is –$5,000; savings are due to controls



Earthquake—Net ALE after control is $7,500



Flood—Net ALE after control is –$5,000; this indicates savings from controls



Fire—Net ALE after control is $0.0; break-even or no net loss after considering controls

The calculations show the effectiveness of cybersecurity controls in reducing or even negating the ALE for several threat categories. Negative values indicate that the cost of implementing controls exceeds the expected annual loss, suggesting a net positive investment in those controls.

71. In the table in Exercise 4, why have some values changed in the Cost per Incident and Frequency of Occurrence columns? How could a control affect one but not the other?

Solution Guidance: The changes in the Cost per Incident and Frequency of Occurrence columns for XYZ Software Company over a year, with improved cybersecurity, can be attributed to the implementation of specific controls designed to mitigate various threats. Controls can affect either the cost per incident, the frequency of occurrence, or both, depending on their nature and how they‘re applied. Here‘s how each control type might affect these values: 

Training (programmer mistakes)—Improved training can reduce the frequency of programmer mistakes by enhancing skills and awareness. However, if a mistake does occur, the cost to rectify it might not change significantly; hence, the cost per incident remains the same but the frequency decreases.



Firewall/intrusion detection systems (loss of intellectual property, software piracy, theft of information by hacker)—These controls are designed to prevent unauthorized access, thereby reducing the frequency of incidents. The cost per incident remains unchanged because these measures do not affect the financial impact of each individual breach that occurs.



Physical security (theft of information by employee, theft of equipment)—Strengthening physical security can deter theft, impacting the frequency of such incidents. The cost per incident remains constant because the value of what‘s stolen or the cost to replace it doesn‘t change with the implementation of physical controls.



Antivirus (viruses, worms, Trojan horses)—Antivirus software can significantly reduce the frequency of malware infections by detecting and neutralizing threats. The cost per incident is affected minimally because the control primarily prevents the occurrence rather than reducing the cost of recovery.



Insurance/backups (earthquake, flood, fire)—Insurance and backups can drastically reduce the cost per incident by providing financial coverage or recovery options after disasters, though they do not affect the natural frequency of such events.

© 2026 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

26

How Could a Control Affect One but Not the Other?

Frequency of occurrence—Controls that prevent or deter threats can reduce how often incidents occur without necessarily impacting the cost of each incident. For example, better training or firewalls can stop threats before they materialize, lowering the frequency.

Cost per incident—Some controls are designed to minimize the impact of an incident rather than prevent it outright. For example, insurance doesn‘t prevent natural disasters but reduces the financial impact on the company. Similarly, improved incident response can lessen the cost of dealing with a breach without changing how often breaches occur.

Controls are tailored to the nature of the threat and the specific vulnerabilities of an organization. The effectiveness of a control in altering either the cost or frequency of incidents (or both) depends on how well it addresses the root cause of the threat and the company‘s specific RM strategy.

72. Assume that the costs of controls presented in the table in Exercise 4 are unique costs directly associated with protecting against that threat. In other words, do not worry about overlapping costs between threats.

Calculate the CBA for each control. Are they worth the costs listed?

Solution Guidance: For XYZ Software Company, the CBA for each control against the respective threats has been calculated and shown in the following list. The CBA value indicates whether the savings from preventing the threats (in terms of reduced ALE) exceed the costs of implementing the controls. A positive CBA suggests that the control is cost-effective, while a negative CBA suggests it might not be worth the investment. Here are the results: 

Programmer mistakes—The cost is $40,000. The control is worth the cost.



Loss of intellectual property—The cost is $22,500. The control is worth the cost.



Software piracy—The cost is –$24,000. The control is not worth the cost based on this analysis.



Theft of information (hacker)—The cost is –$10,000. The control is not worth the cost based on this analysis.



Theft of information (employee)—The cost is –$10,000. The control is not worth the cost based on this analysis.



Web defacement—The cost is –$8,000. The control is not worth the cost based on this analysis.



Theft of equipment—The cost is –$12,500. The control is not worth the cost based on this analysis.



Viruses, worms, Trojan horses—The cost is $3,000. The control is worth the cost.



Denial-of-service attack—The cost is –$5,000. The control is not worth the cost based on this analysis.



Earthquake—The cost is $7,500. The control is worth the cost.



Flood—The cost is –$5,000. The control is not worth the cost based on this analysis.



Fire—The cost is $0. The control neither adds nor subtracts value based on this analysis; it breaks even.

These results suggest that controls for programmer mistakes, loss of intellectual property, viruses, worms, Trojan horses, and earthquake threats provide a positive return on investment. Other controls do not appear to be cost-effective based on the calculated CBAs, which do not take into account factors like reputational damage, indirect costs, or overlapping benefits of controls for multiple threats.

73. Using the web, research the costs associated with the following items when implemented by a firm with 1,000 employees and 100 servers:

© 2026 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

27



Managed antivirus software licenses (not open source) for 500 workstations



Cisco commercial firewalls (other than residential models)



Tripwire host-based IDS for 10 servers



Java programming continuing education training program for 10 employees



Check Point firewall solutions

Solution Guidance: The cost of managed antivirus software can vary significantly based on the features offered, such as standard versus advanced detection techniques like heuristic analysis, in-memory scanning, and sandboxing. Generally, for a one-year subscription covering one to three devices, the cost can be up to $50 for standard features and up to $150 for advanced features. However, these are only estimates; actual costs depend on the specific antivirus company.

For detailed pricing related to specific controls, students may be challenged to find pricing for them.

Visiting the official websites or contacting sales representatives of these companies is the only practical way to get an understanding of the costs and get the most accurate and current information.

Solution and Answer Guide MICHAEL E. WHITMAN AND HERBERT J. MATTORD, MANAGEMENT OF CYBERSECURITY, 7E, 2026, 9798214011738; CHAPTER 05: COMPLIANCE: LAW AND ETHICS

TABLE OF CONTENTS Review Questions ...................................................................................................................................... 28 Exercises .................................................................................................................................................... 31

REVIEW QUESTIONS 74. How does Jean Jacques Rousseau‘s concept from The Social Contract relate to modern cybersecurity laws?

Solution Guidance: Rousseau‘s concept suggests that laws, including those governing cybersecurity, are rules that societies create to balance individual rights with the needs of the state, embodying the trade-off between personal freedom and social order.

75. What distinguishes law from ethics in the context of cybersecurity?

Solution Guidance: The key distinction between law and ethics in cybersecurity is that law carries the sanction of a governing authority, whereas ethics are based on cultural mores and do not have such sanctions.

76. Why are ethics particularly important for cybersecurity professionals?

Solution Guidance: Ethics are particularly important for cybersecurity professionals because they are trusted with sensitive information and must maintain the highest ethical standards to protect this information and ensure accountability.

77. Can you describe the different ethical frameworks that inform decision making in cybersecurity?

© 2026 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

28

Solution Guidance: The different ethical frameworks include normative ethics, which deals with right or wrong actions; meta-ethics, focusing on the meaning of ethical judgments; descriptive ethics, which studies past choices; applied ethics, applying moral codes to realistic situations; and deontological ethics, emphasizing intentions and motives over consequences.

78. In what ways can the deployment of IT systems lead to ethical dilemmas?

Solution Guidance: The deployment of IT systems can lead to ethical dilemmas when systems without proper ethical considerations allow for misuse of information, potentially leading to privacy violations and enabling unauthorized access to sensitive data.

79. What role do education and training play in promoting ethical behavior among cybersecurity professionals?

Solution Guidance: Education and training are crucial for promoting ethical behavior among cybersecurity professionals by keeping them informed about legal and ethical obligations, expected behaviors, and the importance of protecting information.

80. How can organizations deter unethical and illegal behavior in cybersecurity?

Solution Guidance: Organizations can deter unethical and illegal behavior by implementing a combination of policies, education, training, and technical controls, creating a culture of compliance and awareness about the consequences of such behavior.

81. What impact do codes of ethics have on the judgment of individuals regarding computer use?

Solution Guidance: Codes of ethics can positively influence an individual‘s judgment regarding computer use, encouraging ethical behavior and decision making.

82. How can the loss of licensing or certification from a violation of a code of conduct affect a cybersecurity professional?

Solution Guidance: The loss of licensing or certification due to a violation of a code of conduct can significantly reduce a cybersecurity professional‘s marketability and potential earning power.

83. What long-term value does a cybersecurity certification provide to its holders?

Solution Guidance: A cybersecurity certification provides long-term value by enhancing the economic prospects of certificate holders and granting the certification authority influence over members‘ ethical responsibilities.

84. What is the primary focus of (ISC)²?

Solution Guidance: The primary focus of (ISC)² is on education and certification in cybersecurity, managing a body of knowledge, and evaluating examinations for cybersecurity certifications.

85. How does SANS contribute to the cybersecurity profession?

Solution Guidance: SANS contributes to the cybersecurity profession by offering training and education for IT and cybersecurity professionals and managing certifications through the Global Information Assurance Certification (GIAC).

86. What ethical principles does ISACA‘s code of ethics emphasize for its members and certification holders?

Solution Guidance: ISACA‘s code of ethics emphasizes support for effective governance and management of enterprise information systems, performing duties with objectivity and professional care, maintaining confidentiality, and promoting the professional education of stakeholders in audit control, security, and risk management.

87. How does ISSA aim to promote cybersecurity awareness and education? © 2026 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

29

Solution Guidance: ISSA promotes cybersecurity awareness and education by conducting conferences and regional meetings, managing publications, and providing information resources, with a primary mission of bringing together qualified practitioners for information exchange and educational development.

88. What is the primary reason for cybersecurity and IT professionals to understand the industry‘s legal framework?

Solution Guidance: Cybersecurity and IT professionals need to understand the legal framework to ensure compliance with legal and regulatory requirements, especially when handling sensitive information such as PII, PHI, and financial data.

89. How are laws within the United States categorized based on their origins?

Solution Guidance: In the United States, laws are categorized based on their origins in constitutional law, statutory law, regulatory or administrative law, and common law, case law, and precedent.

90. What distinguishes civil law from criminal law in the United States?

Solution Guidance: Civil law pertains to relationships and disputes between individuals and organizations and seeks redress in civil court. Criminal law addresses violations harmful to society and is enforced and prosecuted by the state.

91. Can you explain the distinction between private law and public law?

Solution Guidance: Private law regulates relationships among individuals and between individuals and organizations, while public law regulates the structure and administration of government agencies and their interactions with citizens, employees, and other governments.

92. What is the significance of the Computer Fraud and Abuse (CFA) Act of 1986 in computer-related federal laws?

Solution Guidance: The CFA Act is significant because it formally criminalizes unauthorized access to computers containing nationally significant information. It serves as the cornerstone of many computerrelated federal laws.

93. How does the Privacy Act of 1974 regulate the government‘s use of personal information?

Solution Guidance: The Privacy Act regulates the government‘s use of personal information by ensuring that agencies protect its privacy, holding them responsible for unauthorized releases.

94. What are the core objectives of the Health Insurance Portability and Accountability Act (HIPAA)?

Solution Guidance: HIPAA aims to protect the confidentiality and security of healthcare data by establishing standards for electronic data interchange and enforcing strict penalties for noncompliance.

95. How does the Sarbanes-Oxley (SOX) Act of 2002 impact cybersecurity practices within organizations?

Solution Guidance: The act impacts cybersecurity practices by requiring CEOs and CFOs to ensure the integrity, availability, and confidentiality of financial reporting and record-keeping systems, involving the CIO and CSO in the process.

96. What is the purpose of the Payment Card Industry Data Security Standard (PCI DSS)?

Solution Guidance: The purpose of PCI DSS is to reduce credit card fraud by mandating a set of industry standards for any organization that handles credit, debit, and specialty payment cards, focusing on securing payment systems and protecting cardholder data.

97. What constitutes organizational liability in the absence of criminal conduct?

© 2026 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

30

Solution Guidance: Organizational liability can be applied to conduct even when no law or contract has been breached; it includes the obligation to make payment or restitution for a wrongful act causing harm.

98. What is the difference between due care and due diligence in organizational contexts?

Solution Guidance: Due care involves measures an organization takes to ensure every employee knows acceptable behaviors, while due diligence refers to the reasonable steps taken to meet obligations imposed by laws or regulations.

99. How can jurisdiction impact the legal authority over an individual or organization?

Solution Guidance: Jurisdiction is the area within which an entity such as a court or law enforcement agency can make legal decisions. Jurisdiction over individuals or organizations can extend beyond a court or agency‘s normal boundaries through long-arm jurisdiction.

100. What was the primary role of the FBI‘s National Infrastructure Protection Center established in 1998?

Solution Guidance: It served as the U.S. government‘s focal point for threat assessment and the warning, investigation, and response to threats or attacks against critical U.S. infrastructures.

101. What are the components of the DHS‘s National Protection and Programs Directorate?

Solution Guidance: The components include the Federal Protective Service, Office of Biometric Identity Management, Office of Cyber and Infrastructure Analysis, Office of Cybersecurity and Communications, and Office of Infrastructure Protection.

102. What is InfraGard, and how does it serve its members?

Solution Guidance: InfraGard is a U.S. association of regional FBI chapters and affiliations of public, private, and academic organizations that exchange information on protecting critical national information resources, offering tools like intrusion alert networks and secure communication platforms.

103. What is the main responsibility of the National Security Agency (NSA) in terms of cybersecurity?

Solution Guidance: The NSA is responsible for the security of communications and information systems at many federal government agencies associated with national security. The NSA produces foreign intelligence information and protects U.S. information systems.

104. How does the U.S. Secret Service contribute to cybersecurity?

Solution Guidance: The Secret Service is charged with detecting and arresting people who commit federal offenses related to computer fraud and false identification crimes. The Secret Service protects financial transactions and data on U.S. networks.

EXERCISES 105. (ISC)2 has several certifications. Use a web browser to read about (ISC) 2 certifications. What does CISSP stand for? Using the Internet, find out which continuing education is required for the holder of a CISSP to remain current and in good standing.

Solution Guidance: CISSP stands for Certified Information Systems Security Professional, a certification offered by (ISC)² that validates an individual‘s expertise in designing, implementing, and managing a bestin-class cybersecurity program.

To maintain the CISSP certification in good standing, holders are required to earn 120 Continuing Professional Education (CPE) credits every three years, with a recommendation to earn at least 40 CPEs

© 2026 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

31

annually to stay current. The CPE credits are divided into two groups: ―Group A‖ credits for activities directly related to the domains of the certification and ―Group B‖ credits for activities that contribute to professional development outside of the main domains. Failure to meet these CPE requirements can lead to suspension and potential loss of certification. CISSP holders must also pay an annual maintenance fee.

For more detailed information on the types of activities that qualify for CPE credits and how to calculate them, see the Infosec Institute‘s guide on earning CPE credits to maintain the CISSP and renewal requirements for the CISSP. 106. Use a web browser to explore the career options in cybersecurity at the U.S. National Security Agency. For what kinds of cybersecurity jobs does the NSA recruit? What qualifications do the jobs require?

Solution Guidance: The NSA recruits for a broad range of cybersecurity roles aimed at protecting and defending U.S. government IT systems and exploiting adversaries‘ intelligence. These roles include positions for cybersecurity professionals, computer scientists, intelligence analysts, and more, requiring skills in areas such as computer science, data science, engineering, and relevant technical and analytical expertise. For more detailed information on specific roles and qualifications, visit the NSA careers page.

107. Using the resources available in your library, find out what laws your state has passed to prosecute computer crimes.

Solution Guidance: Student responses will be location-specific. A representative answer might look like: The state of Georgia has established laws to address computer crimes, including computer theft, computer trespass, computer invasion of privacy, and computer forgery, among others. For example, computer theft involves the unauthorized use of a computer for purposes such as taking property, obtaining property by deceit, or converting property in violation of an agreement. Penalties for these crimes can be up to $50,000 in fines or up to 15 years in prison, depending on the offense. Disclosure of computer passwords leading to damages over $500 can result in fines up to $5,000 or one year in prison.

108. Go to www.eff.org. What is this group‘s mission and what are its current top concerns?

Solution Guidance: The Electronic Frontier Foundation (EFF) is dedicated to defending digital privacy, free speech, and innovation. Currently, the EFF is focused on issues like data privacy for personal information collected by cars, the privacy and equity concerns surrounding California‘s mobile driver‘s license rollout, and the potentially harmful effects of the Kids Online Safety Act on minors‘ access to information. For more details, visit their website.

109. Consider the ethical scenarios on computer use that were presented earlier in this chapter and note your responses. Bring your answers to class to compare them with those of your peers.

Solution Guidance: Student responses will vary by individual. The key elements to consider are whether the students take a stand and choose an answer. They should be able to articulate a basis for their position.

Solution and Answer Guide MICHAEL E. WHITMAN AND HERBERT J. MATTORD, MANAGEMENT OF CYBERSECURITY, 7E, 2026, 9798214011738; CHAPTER 06 CYBERSECURITY POLICY

TABLE OF CONTENTS Review Questions ........................................................................................................................................ 1

© 2026 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

32

Exercises ...................................................................................................................................................... 4

REVIEW QUESTIONS 110. What is the purpose of cybersecurity policies in an organization?

Solution Guidance: Cybersecurity policies are designed to direct and regulate employee behavior in an organization to create a secure, productive, and effective work environment.

111. How do policies, standards, procedures, and guidelines differ in terms of their function within an organization?

Solution Guidance: Policies provide the rules for behavior within an organization, standards detail how to comply with these rules, procedures offer step-by-step instructions for compliance, and guidelines suggest nonmandatory recommendations to help employees meet the intent of the policy.

112. What is the bull‘s-eye model in cybersecurity, and how is it used?

Solution Guidance: The bull‘s-eye model is a framework used in cybersecurity to prioritize complex changes by addressing issues from the general to the specific, starting with policy and moving toward networks, systems, and applications.

113. Why is it important for policies to be aligned with the organization‘s needs?

Solution Guidance: Policies must be aligned with the organization‘s needs to ensure that they contribute to the organization‘s success and do not demoralize employees by being overly complex or irrelevant.

114. What are the potential consequences of not having effective cybersecurity policies?

Solution Guidance: Ineffective policies can lead to legal disputes, financial damages, or even the bankruptcy of an organization if they fail to properly manage and mitigate risks associated with inappropriate employee behavior.

115. How can cybersecurity policies impact the success of a cybersecurity program?

Solution Guidance: Cybersecurity policies are foundational to a cybersecurity program‘s success, providing structure and guidelines necessary for securing information resources and establishing a culture of security within the organization.

116. What steps should be taken to develop sound cybersecurity policies?

Solution Guidance: Developing sound cybersecurity policies involves engaging stakeholders, ensuring policies comply with legal requirements, clearly defining acceptable and unacceptable behaviors, and supporting the policies with proper administration and enforcement mechanisms.

117. What role do cybersecurity policies play in legal disputes regarding management‘s due diligence?

Solution Guidance: Cybersecurity policies act as important reference documents in legal disputes, providing evidence of management‘s intent and due diligence in securing information assets.

118. What are the key elements that should be included in a comprehensive cybersecurity program policy?

Solution Guidance: A comprehensive CPP should include an overview of the corporate philosophy on cybersecurity, information on the structure of the cybersecurity organization, responsibilities shared by all organization members, and those unique to each role.

© 2026 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

33

119. Why is it important for a cybersecurity program policy to include specific cybersecurity roles and responsibilities?

Solution Guidance: A CPP should include specific cybersecurity roles and responsibilities to clearly define the staffing structure designed to support cybersecurity within the organization and to delineate the obligations of various stakeholders.

120. What justifies the need for an organization to have a robust cybersecurity program?

Solution Guidance: The need for a robust cybersecurity program is justified by the importance of protecting critical information about customers, employees, or markets, fulfilling both legal and ethical obligations.

121. How should an organization handle the enforcement of its cybersecurity policies?

Solution Guidance: An organization should handle the enforcement of its cybersecurity policies by ensuring that they are applied consistently and that any nonenforcement does not imply consent. This maintains the integrity and effectiveness of the security measures.

122. What actions should be considered if a violation of law is discovered within an organization?

Solution Guidance: If a violation of law is discovered within an organization, management must seriously consider prosecution for all known violations to enforce accountability and deter future infractions.

123. Under what circumstances can an organization revoke a user‘s IT privileges?

Solution Guidance: An organization can revoke a user‘s IT privileges if they engage in activities that interfere with the normal and proper operation of the organization‘s information systems or adversely affect the ability of others to use these systems.

124. What specific measures should be taken when integrating cybersecurity standards into industry-specific systems?

Solution Guidance: When integrating cybersecurity standards into industry-specific systems, designers and technical staff should employ controls that meet or exceed industry standards, such as encryption and key management in banking, to ensure compliance and security.

125. What is the purpose of issue-specific policies in an organization?

Solution Guidance: The purpose of issue-specific policies in an organization is to provide detailed, targeted instructions for all members regarding the use of specific resources, ensuring that technologybased resources are used appropriately and legally.

126. What are some examples of technologies that an issue-specific policy might cover?

Solution Guidance: Issue-specific policies might cover the use of email, instant messaging, the Internet, and company networks as well as malware protection requirements and the use of externally issued hardware or software on company assets.

127. What constitutes a misuse of an organization‘s resources?

Solution Guidance: Any use of an organization‘s resources that is not explicitly identified in the issuespecific policies is considered a misuse, including using company systems for unapproved personal activities.

128.

How does an organization manage violations of policies?

© 2026 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

34

Solution Guidance: An organization should have established procedures for reporting violations and specify penalties for such violations, ensuring compliance through enforcement and potential disciplinary actions.

129. What are the procedures for modifying an issue-specific policy?

Solution Guidance: The procedures for modifying an issue-specific policy include a scheduled review and a methodology for modification, which is overseen by designated individuals or groups within the organization.

130. How does an organization limit its liability in the event of policy violations by employees?

Solution Guidance: An organization limits its liability through disclaimers and statements indicating that it does not protect employees who violate policies and laws using company technology, and may even assist in their prosecution.

131. What are the benefits and drawbacks of modular policy document organization?

Solution Guidance: Modular policy document organization offers a balance between ease of policy development and effective management, but it can be more expensive and difficult to manage compared to individual or comprehensive policies.

132. What are system-specific policies and how are they typically developed?

Solution Guidance: System-specific policies are detailed instructions that dictate the configuration, implementation, and management of specific technologies within an organization. They are typically developed independently of issue-specific policies.

133. Why are managerial guidance system-specific policies important in an organization?

Solution Guidance: Managerial guidance system-specific policies are important because they provide both the intent and direction for technology deployment within the organization, ensuring continuity and alignment between management‘s objectives and the actual implementation by IT staff.

134. How do access control lists function within an organization‘s technology systems?

Solution Guidance: Access control lists function by controlling access to systems, including file storage systems, object brokers, and other network communication devices, by permitting or denying user actions based on established rules.

135. What are some typical components of a system-specific policy?

Solution Guidance: A typical system-specific policy may include managerial intent, guidance on technology configuration and operation, access control measures, and specific procedures for using and maintaining the technology.

136. Can a system-specific policy serve as a stand-alone document, and if so, how?

Solution Guidance: Yes, a system-specific policy can serve as a stand-alone document. It should encapsulate all necessary guidelines and procedures for a particular technology, making it comprehensible and implementable independently of other policies.

137. What role does technology play in the execution of system-specific policies?

Solution Guidance: Technology plays a crucial role in the execution of system-specific policies, as they are directly concerned with the configuration, management, and usage of technology to support organizational operations and security.

© 2026 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

35

138. How do issue-specific policies differ from system-specific policies in terms of development and focus?

Solution Guidance: Issue-specific policies are generally developed with broader issues in mind that might affect the entire organization, unlike system-specific policies, which focus on particular systems and their technical and managerial aspects.

139. What could be the consequences of not adhering to system-specific policies within an organization?

Solution Guidance: Not adhering to system-specific policies can lead to inconsistencies in system configuration, potential security breaches, and operational disruptions, which could negatively impact an organization‘s integrity and security.

140. How might system-specific policies evolve over time in a typical organization?

Solution Guidance: System-specific policies might evolve over time as technologies and organizational priorities change, requiring updates to ensure that the policies remain relevant and effective in guiding the use of technology according to current needs and threats.

141. What are the initial steps recommended when developing a cybersecurity policy?

Solution Guidance: The initial steps include conducting a risk assessment, consulting existing policies, and identifying essential policy messages that need communication.

142. How should the cybersecurity policy‘s audience be assessed before disseminating policy materials?

Solution Guidance: The audience should be evaluated in terms of their literacy, computer knowledge, and receptiveness to cybersecurity messages.

143. What factors should be considered when matching cybersecurity messages to different audiences?

Solution Guidance: Factors include the literacy and computer knowledge of the audience as well as the corporate culture surrounding cybersecurity.

144. What are the challenges associated with policy dissemination and how can they be addressed?

Solution Guidance: Challenges include ensuring the policy reaches all users, which can be addressed by using a combination of electronic and hard-copy distribution methods and maintaining an audit log for tracking.

145. What are some methods to ensure employees understand and comply with cybersecurity policies?

Solution Guidance: Methods include providing the policy in clear language, using assessments like quizzes to measure understanding, and incorporating the policy into regular training programs.

146. How should the compliance of cybersecurity policies be monitored and enforced?

Solution Guidance: Compliance should be enforced through regular audits, clear disciplinary processes, and by ensuring policies are uniformly applied across the organization.

147. What steps should be taken if the number of policy messages is too large to communicate at once?

Solution Guidance: The messages should be categorized and issued in phases to manage the complexity and ensure clarity of communication.

148. How can the effectiveness of a cybersecurity policy be enhanced after initial approval and implementation?

Solution Guidance: Effectiveness can be enhanced by continual monitoring, regular updates based on feedback, and ongoing training and awareness programs.

149. What role does top management play in cybersecurity policy development?

© 2026 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

36

Solution Guidance: Top management is crucial for approving the policy, providing resources, and ensuring that the policy aligns with organizational objectives.

150. What are the three general causes of unethical and illegal behavior?

Solution Guidance: The three general causes are ignorance, accident, and intent.

151. Why is ignorance of policy and procedures considered excusable?

Solution Guidance: Ignorance of policy and procedures is considered excusable because it can be addressed through education, training, and the dissemination of organizational policies.

152. What is necessary to successfully prosecute offenders with criminal or unethical intent?

Solution Guidance: To successfully prosecute offenders, it is often necessary to establish the criminal intent of the person or organization performing the act.

153. What three conditions must be present to provide deterrence through policies and penalties?

Solution Guidance: The three conditions that must be present to provide deterrence are fear of the penalty, the probability of being apprehended, and the probability of the penalty being applied.

154. Why do threats of informal reprimand or verbal warnings not have the same impact as more severe penalties?

Solution Guidance: Threats of informal reprimand or verbal warnings do not have the same impact because potential offenders must fear the penalty for deterrence to be effective, which is less likely with mild consequences.

155. How can knowing the penalties and enforcement procedures for policies help employees focus on their work?

Solution Guidance: Knowing the penalties and enforcement procedures helps employees focus on their work by removing uncertainties about the consequences of unacceptable behavior, thus allowing them to concentrate on business activities.

EXERCISES 156. Go to the International Information System Security Certification Consortium (ISC) 2 website at www.isc2.org and look for the information security common body of knowledge (CBK). When you review the list of areas in the CBK, is policy listed? Why do you think this is so?

Solution Guidance: The (ISC)² CBK outlines a set of domains that are deemed essential for information security professionals. The CBK is structured into the following eight primary domains: 1. Security and Risk Management 2. Asset Security 3. Security Architecture and Engineering 4. Communication and Network Security 5. Identity and Access Management 6. Security Assessment and Testing

© 2026 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

37

7. Security Operations 8. Software Development Security Although ―policy‖ is not listed as a stand-alone domain, it is implicitly integral to several of the domains, particularly Security and Risk Management, which involves understanding and applying security policies, standards, and procedures to manage risks and ensure compliance within an organization. The role of policy is critical across many aspects of security, as it helps establish the framework and guidelines under which more technical aspects are executed.

Policy is probably not listed as a distinct domain because it is foundational to so many aspects of information security; thus, it permeates multiple domains rather than being confined to one. This approach emphasizes the pervasive and overarching role of policy in the field of information security.

157. Search your institution‘s intranet or website for its cybersecurity policies (perhaps listed as information security policies). Do you find an enterprise cybersecurity policy? What issue-specific cybersecurity policies can you locate? Are all of these policies issued or coordinated by the same individual or office, or are they scattered throughout the institution?

Solution Guidance: Each student response will vary. An example response follows.

At Kennesaw State University (KSU), the cybersecurity policies, including information security policies, are coordinated primarily through the Office of Cybersecurity under University Information Technology Services (UITS). This office is responsible for the comprehensive planning and implementation of the university‘s Information Security Plan. This plan integrates security practices with the educational mission of KSU and includes various tools, services, and guidance for securing the IT environment.

The cybersecurity policies at KSU are not scattered but appear to be centrally coordinated by the Office of Cybersecurity. This centralization helps maintain consistency across the university‘s policies, standards, and guidelines, which are crucial for effective information security governance.

Overall, KSU‘s approach to cybersecurity policy and education seems well integrated and coordinated, primarily through a dedicated cybersecurity office, which ensures that policies are consistent and aligned with the university‘s broader security and educational goals.

158. Using the framework presented in this chapter, evaluate the comprehensiveness of each policy you located in Exercise 2. Which areas are missing?

Solution Guidance: ―Each student response will vary. An example response follows.

To evaluate the comprehensiveness of the cybersecurity policies at KSU using the provided framework, we must align the university‘s policy components with the key elements specified in the framework.

Evaluation of KSU’s Cybersecurity Policies Policy Purpose and Scope: KSU‘s policies are generally centered around creating a secure IT environment integrated with its educational mission, suggesting a broad scope and clear purpose.

Definitions: It is not specified if KSU‘s policies include a section for definitions, which might be an area of improvement.

Roles and Responsibilities: The Office of Cybersecurity seems to coordinate all cybersecurity activities, indicating defined roles and centralized responsibilities.

Data Governance and Asset Management: These areas are not explicitly mentioned in the sources reviewed, indicating potential gaps.

© 2026 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

38

Access Control and Physical Security: Specific policies for these areas are not detailed in the available information, suggesting another potential gap.

Operations Security, Communications Security, and Privacy: There is no detailed information available in the public sources, implying these areas might not be explicitly covered or publicly detailed.

Incident Response: KSU likely has incident response measures as part of its cybersecurity strategy, although specifics are not detailed publicly.

Business Continuity and Disaster Recovery: These areas are not explicitly covered in the available information.

Compliance and Legal Considerations: While the academic programs are structured to align with industry standards, specific compliance and legal considerations in KSU‘s policies are not mentioned.

Missing Areas KSU‘s publicly available policy information lacks detailed coverage in several critical areas, such as data governance, asset management, privacy, and specific compliance measures, among others. Enhancing transparency and detailing in these areas could improve the comprehensiveness and effectiveness of their cybersecurity policies.

159. Using the framework presented in this chapter, draft a sample issue-specific policy for an organization. At the beginning of your document, describe the organization for which you are creating the policy and then complete the policy using the framework.

Solution Guidance: Each student response will vary. An example response follows.

Issue-Specific Policy for Cybertech Innovations Inc. Organization Description Cybertech Innovations Inc. is a medium-sized enterprise specializing in the development of cybersecurity solutions, including software and consulting services, for clients in various sectors such as finance, healthcare, and education. The company employs around 300 staff members and handles sensitive data and intellectual property on a daily basis.

1. Statement of Purpose Scope and Applicability: This policy provides guidelines on the acceptable use of Cybertech Innovations Inc.‘s email systems. It is applicable to all employees and contractors of Cybertech Innovations Inc. who have access to company email systems.

Objective: To ensure that the email systems are used in a secure and efficient manner that protects the company and its clients.

Responsibility: The IT Department is responsible for implementing this policy, while all employees and contractors are accountable for adhering to its terms.

2. Authorized Uses User Access: Authorized users are employees and contractors of Cybertech Innovations Inc. who have received official email accounts.

Fair and Responsible Use: The email system is to be used primarily for business-related purposes. Limited personal use is allowed, provided it does not interfere with work responsibilities or consume significant resources.

© 2026 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

39

Protection of Privacy: Users must respect the privacy of others and safeguard sensitive information transmitted over email, adhering to confidentiality agreements and data protection laws.

3. Prohibited Uses Disruptive Use or Misuse: The use of the email system in a way that could interfere with others‘ work, overload the system, or compromise network security is prohibited.

Criminal Use: Using the email system for illegal activities is strictly forbidden and will be reported to authorities.

Offensive or Harassing Materials: Sending or distributing offensive, harassing, or inappropriate content is strictly prohibited.

Copyrighted, Licensed, or Other Intellectual Property: Users must not violate intellectual property rights through the unauthorized sharing of copyrighted materials.

Other Restrictions: Any action not explicitly authorized or covered under authorized uses is considered a violation.

4. Systems Management Management of Stored Materials: All emails and attached documents must be managed in accordance with the company‘s data retention policy.

Employee Monitoring: The company reserves the right to monitor email traffic and content to ensure compliance with this policy.

Virus Protection: Users must ensure that all attachments are scanned with company-provided antivirus software before opening them.

Physical and Electronic Cybersecurity: Adequate measures must be taken to protect both the physical and digital integrity of the email systems.

5. Violations of Policy Procedures for Reporting Violations: Employees should report any suspected policy violations to their supervisor or directly to the IT department.

Penalties for Violations: Violations of this policy can result in disciplinary action, up to and including termination of employment.

6. Policy Review and Modification Scheduled Review of Policy: This policy will be reviewed annually or as needed to adapt to new cybersecurity threats.

Procedures for Modification: Any changes to this policy must be approved by the Board of Directors and communicated to all users by the IT Department.

7. Limitations of Liability Statements of Liability: Cybertech Innovations Inc. is not liable for any loss or damage arising from the failure of an employee or contractor to comply with this policy.

Other Disclaimers: The company disclaims any responsibility for incidents that occur due to unauthorized or unintended use of the email systems.

© 2026 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

40

160. Search for sample cybersecurity policies on the web. Identify five cybersecurity program policies and five issue-specific policies and bring them to class. Compare these with the framework presented in this chapter and comment on the policies‘ comprehensiveness.

Solution Guidance: Each student will provide a unique response.

Solution and Answer Guide MICHAEL E. WHITMAN AND HERBERT J. MATTORD, MANAGEMENT OF CYBERSECURITY, 7E, 2026, 9798214011738; CHAPTER 07 DEVELOPING THE CYBERSECURITY PROGRAM

TABLE OF CONTENTS Review Questions ........................................................................................................................................ 1 Exercises ...................................................................................................................................................... 4

REVIEW QUESTIONS 161. What is the primary purpose of a cybersecurity program within an organization?

Solution Guidance: The primary purpose of a cybersecurity program is to manage the risks to an organization‘s information assets through a comprehensive set of activities, resources, personnel, and technologies.

162. How does an organization‘s culture influence the structure and support of a cybersecurity program?

Solution Guidance: Organizational culture significantly influences the cybersecurity program; if the culture values cybersecurity highly, the program is likely to be larger and better supported, both financially and in terms of resources.

163. Describe the relationship between organization size and cybersecurity staffing.

Solution Guidance: The size of an organization directly affects its cybersecurity staffing. Larger organizations typically have more dedicated cybersecurity personnel and resources, while smaller organizations might have minimal staffing, often combining IT and cybersecurity roles.

164. What are the critical success functions of a cybersecurity program?

Solution Guidance: Critical success functions include risk assessment, risk management, systems testing, policy maintenance, legal assessment, incident response, planning, measurement, compliance, centralized authentication, systems cybersecurity administration, training, network security administration, and vulnerability assessment.

165. How does an organization‘s budget impact a cybersecurity program?

Solution Guidance: The budget for cybersecurity, which is often a fraction of the IT budget, significantly impacts the program‘s scope and effectiveness. Executive management plays a key role in determining the size of this budget.

166. What is the strategic importance of aligning cybersecurity programs with organizational culture?

© 2026 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

41

Solution Guidance: Aligning cybersecurity programs with organizational culture is crucial, as misalignment can lead to conflicts that diminish the effectiveness of the efforts.

167. What role does training play in a cybersecurity program?

Solution Guidance: Training is vital for educating general staff on cybersecurity topics, IT staff on technical controls, and cybersecurity staff on specialized areas. Training enhances the overall security posture of the organization.

168. How do smaller organizations typically manage cybersecurity?

Solution Guidance: Due to limited resources, smaller organizations often rely on a single individual who may handle multiple roles, including cybersecurity. They might use cost-effective solutions like freeware or open-source software for cybersecurity tasks.

169. What are some common locations within an organization where the cybersecurity department is positioned?

Solution Guidance: Common locations for the cybersecurity department within an organization include the IT division, a separate security division, or an administrative services division.

170. Why might there be a conflict of interest when the cybersecurity department is placed within the IT division?

Solution Guidance: There might be a conflict of interest because the goals of IT, such as maximizing efficiency and ease of access, can sometimes contradict the security measures implemented by the cybersecurity department, which may slow down processes or limit access.

171. What are the advantages of having the cybersecurity department report directly to the CEO? Solution Guidance: Reporting directly to the CEO helps ensure that cybersecurity is seen as a priority, enhances the department‘s objectivity, and increases its ability to secure necessary resources and management attention.

172. How does positioning the cybersecurity department outside the IT division benefit an organization?

Solution Guidance: Positioning the cybersecurity department outside the IT division can help avoid conflicts of interest and ensure that cybersecurity measures are implemented more effectively without being compromised by other IT priorities.

173. What is the role of a cybersecurity management committee within an organization?

Solution Guidance: A cybersecurity management committee acts as a sounding board, provides management direction, and facilitates communication paths within the organization, enhancing the governance of cybersecurity activities.

174. Describe an organizational structure where the cybersecurity department reports to an administrative services division.

Solution Guidance: In this structure, the cybersecurity department advises and performs services for the entire organization, similar to a human resources department, and focuses on securing all forms of information across the organization.

175. What are some challenges associated with having the cybersecurity department report to a division that handles physical security?

Solution Guidance: Challenges include cultural differences between IT and physical security personnel, potential underestimation of needed resources, and a lack of appreciation of IT issues by managers from a physical security background.

© 2026 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

42

176. Why is it recommended to separate cybersecurity management from IT management in larger organizations?

Solution Guidance: These functions should be separated to prevent conflicts of interest and to ensure that cybersecurity decisions are made with a focus on security rather than being influenced by IT priorities.

177. What could be the potential drawbacks of a cybersecurity department reporting to a strategy and planning division?

Solution Guidance: Potential drawbacks include the risk of neglecting operational and administrative aspects of cybersecurity due to the division‘s strategic focus, which might prioritize long-term planning over immediate needs.

178. What are some of the elements included in a comprehensive cybersecurity program, according to NIST? Solution Guidance: A comprehensive cybersecurity program includes elements such as policy, program management, risk management, life-cycle planning, and personnel/user issues.

179. What role do the organization‘s vision and mission statements play in formulating a cybersecurity program?

Solution Guidance: The organization‘s vision and mission statements help formulate the mission statement for the cybersecurity program by guiding the level at which the cybersecurity program operates.

180. How does a well-structured cybersecurity program incorporate human resources activities?

Solution Guidance: A well-structured cybersecurity program incorporates proper procedures into all human resources activities, including hiring, training, promotion, and termination practices, to maintain a secure environment.

181. Why do some organizations choose to outsource parts of their cybersecurity program?

Solution Guidance: Some organizations outsource parts of their cybersecurity program because they have insufficient internal staff to handle cybersecurity tasks or they want to bring in specialized expertise from third parties.

182. What are the implications of having cybersecurity requirements defined by government regulations for certain industries?

Solution Guidance: Industries such as banking and healthcare have cybersecurity requirements defined by government regulations, which means they must adhere to specific standards and practices to comply with these regulations. These requirements impact how their cybersecurity programs are structured.

183. How should cybersecurity programs be tailored to fit an organization?

Solution Guidance: Cybersecurity programs should be tailored to fit an organization‘s unique size, products, services, regulatory obligations, and the specific characteristics that are crucial to its operations and risk management.

184. What factors contribute to the shortfall in the cybersecurity workforce?

Solution Guidance: The shortfall in the cybersecurity workforce is attributed to challenges such as finding enough talent, high turnover rates, noncompetitive wages, and insufficient budgets for massive hiring.

185. How does the cybersecurity function support an organization‘s strategic objectives?

Solution Guidance: The cybersecurity function supports an organization‘s strategic objectives by laying out the mission and scope of responsibilities, describing the resources, tools, and processes used, and balancing the costs of the program with the benefits of managing cybersecurity risks. © 2026 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

43

186. What is the main purpose of implementing a SETA program in an organization?

Solution Guidance: The main purpose of a SETA program is to improve the protection of information assets by providing targeted knowledge, skills, and guidance activities for employees.

187. How does a SETA program enhance employee accountability?

Solution Guidance: A SETA program enhances employee accountability by holding individuals responsible for their actions, which reduces the likelihood of cybersecurity breaches.

188. What are the three elements of a SETA program, as mentioned in the text?

Solution Guidance: The three elements of a SETA program are cybersecurity education, cybersecurity training, and cybersecurity awareness.

189. Why might an organization choose to outsource the components of a SETA program?

Solution Guidance: An organization might choose to outsource components of a SETA program if it is not able or willing to develop these components in-house or if outsourcing is more cost-effective.

190. How do cybersecurity education, training, and awareness differ in their approach and objectives?

Solution Guidance: Cybersecurity education seeks to impart in-depth knowledge necessary for designing and implementing cybersecurity measures. Training focuses on developing skills for secure operation of information assets, while awareness aims to keep security at the forefront of users‘ minds through constant reminders and updates.

191. What teaching methods are used in SETA programs to engage different types of learners?

Solution Guidance: SETA programs utilize a variety of teaching methods, including media videos, newsletters, posters, formal training, workshops, hands-on practice, theoretical instruction, and seminars.

192. What assessment methods are employed in SETA programs to measure the effectiveness of cybersecurity education, training, and awareness?

Solution Guidance: Assessment methods used in SETA programs include true/false or multiple-choice questions to identify learning, problem-solving exercises to apply learning, and essay writing to interpret learning.

193. How does continuous retraining in cybersecurity contribute to an organization‘s security posture?

Solution Guidance: Continuous retraining in cybersecurity helps ensure that employees remain knowledgeable about current threats and security practices, thereby maintaining and enhancing the organization‘s security posture over time.

194. What role does cybersecurity awareness play in the overall security strategy of an organization?

Solution Guidance: Cybersecurity awareness plays a crucial role in the overall security strategy of an organization by keeping security issues prominent in employees‘ minds, thereby promoting behavior that protects information assets and reduces the risk of breaches.

195. What is the role of project management in cybersecurity?

Solution Guidance: Project management in cybersecurity involves identifying and controlling resources, measuring progress, and making adjustments to achieve the goals of cybersecurity projects.

196. What is the importance of project management skills for cybersecurity professionals?

© 2026 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

44

Solution Guidance: Project management skills are important for cybersecurity professionals because they help ensure the quality and effectiveness of each part of the cybersecurity process.

197. How do organizations benefit from prioritizing project management skills?

Solution Guidance: Organizations benefit from prioritizing project management skills by ensuring thorough methodology implementation, creating efficient project plans, and reducing ambiguity and confusion in project roles, which enhances overall project success.

198. What are some characteristics of project success?

Solution Guidance: A project is deemed successful if it is completed on time or early, stays within or under budget, and meets all specified deliverables and quality requirements outlined in the approved project definition.

199. What challenges might arise in managing cybersecurity projects, and how should they be addressed?

Solution Guidance: Challenges in managing cybersecurity projects include aligning IT staff with project objectives and managing new technology integration. These should be addressed by educating, informing, and including all stakeholders to ensure support and success.

200. Describe how new technologies impact cybersecurity.

Solution Guidance: New technologies can pose risks and challenges for cybersecurity projects because they may require consensus building around technology choices and additional training for project team members, increasing the risk of human resource turnover.

EXERCISES 201. Assume a smaller organization has a plan to implement a cybersecurity program with three full-time staff and two or three groups of part-time roles from other parts of the business. What titles and roles do you recommend for the three full-time staff? What groups would commonly supply the part-time staff?

Solution Guidance: For a smaller organization implementing a cybersecurity program with three full-time staff members, it‘s crucial to have roles that cover the broad spectrum of cybersecurity responsibilities while ensuring effective management and operational capability. Here are recommended titles and roles for the full-time staff.

Cybersecurity manager or chief information security officer (CISO)—This individual would oversee the entire cybersecurity program and be responsible for strategic planning, policy development, and overall leadership in cybersecurity initiatives. The CISO ensures the alignment of cybersecurity strategies with business objectives and compliance with regulations.

Cybersecurity analyst—This role involves more hands-on responsibilities, such as threat analysis, monitoring security systems for incidents, and implementing security measures. The analyst would also be involved in vulnerability assessments, security audits, and preparing reports for the cybersecurity manager.

Cybersecurity technician or engineer—Focused on technical aspects, this staff member would manage the tools and systems that protect the organization‘s data. This includes configuring firewalls, intrusion detection systems, and other security software as well as handling the operational aspects of cybersecurity responses.

For the part-time roles, groups commonly involved would include the following: IT department—Staff from the IT department can support cybersecurity initiatives part-time, given their technical expertise and involvement in managing the organization‘s technology infrastructure.

© 2026 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

45

Risk management—Employees who are part of risk management or compliance teams can contribute parttime by aligning cybersecurity measures with broader risk management strategies and regulatory requirements.

Human resources department—HR personnel can assist part-time by managing cybersecurity training and awareness programs and ensuring that all employees are educated about security best practices and policies.

These recommendations ensure that the cybersecurity team has comprehensive coverage of managerial, analytical, and technical tasks while leveraging existing resources within the organization to enhance the cybersecurity program.

202. Assume that you are asked to recommend professional credentials for certain roles in cybersecurity at a larger organization. What is your recommendation for the credential to be held by the CSO? How about for a cybersecurity manager? What would be your recommended certifications for the senior technical staff?

For the last question, pick three technical roles and note the job title and recommended credentials for each.

Solution Guidance: In a larger organization where the scale and complexity of cybersecurity needs are greater, professional credentials play a crucial role in ensuring that staff have the requisite knowledge and skills. Here are the recommended credentials for various cybersecurity roles.

Chief Security Officer (CSO) For the CSO, who is responsible for overseeing the organization‘s entire cybersecurity environment, the following certifications are highly regarded: Certified Information Systems Security Professional (CISSP)—Globally recognized and covers extensive aspects of cybersecurity, including management and technical controls Certified Information Security Manager (CISM)—Ideal for individuals looking to focus on governance, risk management, and compliance alongside the strategic aspects of security Cybersecurity Manager For a cybersecurity manager, who typically handles more focused aspects of the security operations or oversees specific security projects: CISSP—Useful for a broad understanding of security issues CISM—Focuses on the management side of information security and aligns well with business strategies Certified Information Systems Auditor (CISA)—Useful for managers who are involved in auditing, controlling, and assurance of information systems Senior Technical Staff For senior technical roles, specialized certifications that match their job responsibilities are essential. Here are three technical roles and the recommended credentials for each: Network Security Engineer CISSP—Provides a strong foundation in network security and other critical security principles Cisco Certified Network Professional Security (CCNP Security)—Specific to Cisco networks, this certification covers crucial network security techniques and protocols Security Software Developer Certified Secure Software Lifecycle Professional (CSSLP)—Ideal for those involved in software development, focusing on applying security principles throughout the software development life cycle

© 2026 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

46

GIAC Secure Software Programmer (GSSP)—Specific to secure coding practices and helps developers understand how to write code that is secure from the outset Penetration Tester Offensive Security Certified Professional (OSCP)—Known for its rigor and real-world utility and highly respected among penetration testers for its focus on offensive security techniques Certified Ethical Hacker (CEH)—Provides knowledge on how to think like a hacker to identify vulnerabilities in an organization‘s network defenses These certifications are designed to validate the expertise required for each role, ensuring that the staff not only have theoretical knowledge but also practical skills applicable to their specific job functions in cybersecurity.

203. Search the term ―security awareness‖ on the Internet. Choose two or three sites that offer materials and services and describe what they offer.

Solution Guidance: Student answers will vary. The following providers offer comprehensive security awareness materials and services: SANS Security Awareness—SANS offers a wide range of security awareness training solutions tailored to various roles within an organization. Their offerings include computer-based training modules, phishing simulation tools, specialized role-based training for technical staff, and risk assessments to target training effectively. They focus on creating culturally relevant and effective programs that are easy to implement and help in building a mature awareness program.

Security Mentor—This organization provides security awareness training designed to drive real behavior and culture change. Their training modules include interactive content like serious games, and they offer a variety of graphical materials like posters and cartoons to support visual learning. This approach is aimed at making the learning experience engaging and impactful, equipping employees with the necessary cybersecurity skills and knowledge.

204. Design three cybersecurity posters on various aspects of cybersecurity using a graphics presentation program and clip art. Bring the posters to class and discuss the methods you used to develop your materials.

Solution Guidance: This is a creative activity, so each student will have a different response.

205. Examine your institution‘s website and identify full- and part-time cybersecurity jobs. Create an organizational chart showing the reporting structures for these positions.

Solution Guidance: Each answer will vary. Here is an example: Kennesaw State University offers a variety of job opportunities, including positions in cybersecurity. To find current job openings, interested applicants must navigate the KSU Human Resources website, where all positions are listed and can be applied for online. Potential applicants can find full-time and part-time cybersecurity jobs, read job descriptions, understand the required qualifications, and submit applications.

Sufficient public information is not available to generate a specific organizational chart showing all reporting structures. However, the chart would typically show cybersecurity positions under the IT department and reporting to either the IT manager or directly to the chief information officer, depending on the specific role and structure of the organization.

Solution and Answer Guide © 2026 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

47

MICHAEL E. WHITMAN AND HERBERT J. MATTORD, MANAGEMENT OF CYBERSECURITY, 7E, 2026, 9798214011738; CHAPTER 08 CYBERSECURITY M ANAGEMENT MODELS

TABLE OF CONTENTS Review Questions ........................................................................................................................................ 1 Exercises ...................................................................................................................................................... 4

REVIEW QUESTIONS 206. What are the primary functions of a cybersecurity framework or model within an organization?

Solution Guidance: The primary function of a cybersecurity framework or model within an organization is to provide a specification to be followed during the design, selection, and implementation of a cybersecurity program, including policies, education, training programs, and technological controls.

207. How do the terms ―framework,‖ ―model,‖ and ―blueprint‖ differ in the context of cybersecurity?

Solution Guidance: In the context of cybersecurity, a framework or model is a generic outline for a cybersecurity program, while a blueprint is a customized version of the framework with detailed implementation plans specific to an organization.

208. Why might an organization choose to adapt portions of different cybersecurity frameworks?

Solution Guidance: An organization might choose to adapt portions of different cybersecurity frameworks because each cybersecurity environment is unique, and what works well for one organization may not precisely fit another.

209. What role does benchmarking play in the development of a cybersecurity blueprint?

Solution Guidance: Benchmarking plays a role in the development of a cybersecurity blueprint by providing comparisons of an organization‘s performance against industry standards or other organizations, helping to identify effective controls and practices.

210. What are the four general control categories provided by ISO/IEC 27002:2022?

Solution Guidance: The four general control categories provided by ISO/IEC 27002:2022 are organizational controls, people controls, physical controls, and technological controls.

211. How does ISO/IEC 27001 differ from ISO/IEC 27002 in terms of their content and purpose?

Solution Guidance: ISO/IEC 27001 provides information on how to implement the controls outlined in ISO/IEC 27002 and sets up an information security management system, whereas ISO/IEC 27002 offers a broad overview and guidelines for various areas of cybersecurity.

212. What is the importance of the COSO framework in cybersecurity?

Solution Guidance: The COSO framework is important in cybersecurity because it provides a comprehensive internal control system that includes components applicable to IT systems with cybersecurity controls, helping organizations manage risks and ensure compliance with regulations.

213. What advantages do NIST special publications offer compared to other cybersecurity documentation sources?

© 2026 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

48

Solution Guidance: NIST special publications offer the advantages of being publicly available at no charge and having been extensively reviewed by government and industry professionals, making them reliable resources for designing custom cybersecurity frameworks.

214. What is the role of cybersecurity architecture models in an organization?

Solution Guidance: Cybersecurity architecture models illustrate cybersecurity implementations and help organizations quickly make improvements through adaptation by providing a basic approach for implementation.

215. How does the trusted computing base contribute to a computer system‘s security?

Solution Guidance: The trusted computing base contributes to a computer system‘s security by encompassing all the hardware, firmware, and software responsible for enforcing the cybersecurity policy, ensuring the system‘s integrity and reliability.

216. What is the primary purpose of the Trusted Computer System Evaluation Criteria?

Solution Guidance: The primary purpose is to define the criteria for assessing the access controls in a computer system and to evaluate products based on their level of protection.

217. What are covert channels, and how do they pose a challenge to cybersecurity?

Solution Guidance: Covert channels are unauthorized or unintended methods of communication hidden within a computer system. They pose a challenge to cybersecurity because they could leak sensitive information without detection.

218. What is the significance of the evaluation assurance level in the Common Criteria framework?

Solution Guidance: Its significance is that it provides a rating scale to determine the confidence level in the security of a target of evaluation. The scale ranges from functionally tested (EAL1) to formally verified design and tested (EAL7).

219. How do the concepts of a protection profile and security target function within the Common Criteria?

Solution Guidance: Within the Common Criteria, the protection profile functions as a user-generated specification for cybersecurity requirements. The security target describes the cybersecurity properties of the target of evaluation.

220. What are the two types of covert channels defined by TCSEC, and how do they differ?

Solution Guidance: The two types of covert channels defined by TCSEC are storage channels, which communicate by modifying a stored object, and timing channels, which communicate by managing the relative timing of events.

221. Why is the concept of a reference monitor important in the context of the trusted computing base?

Solution Guidance: The concept of a reference monitor is important in the context of the trusted computing base because it manages access controls and ensures that access to objects by subjects is mediated effectively, maintaining the system‘s security integrity.

222. What are the four general processes involved in access control?

Solution Guidance: The four general processes involved in access control are identification, authentication, authorization, and accountability.

223. How does the principle of least privilege contribute to cybersecurity?

© 2026 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

49

Solution Guidance: The principle of least privilege contributes to cybersecurity by ensuring that users have only the minimum level of access necessary to perform their assigned duties, thereby reducing the risk of unauthorized access or data manipulation.

224. What is the purpose of the separation of duties in an organization‘s access control policy?

Solution Guidance: The purpose of the separation of duties in an organization‘s access control policy is to prevent misuse or fraud by ensuring that no single individual has control over all aspects of any significant task.

225. How do directive access controls differ from deterrent access controls?

Solution Guidance: Directive access controls involve administrative controls such as policies and training designed to proscribe certain user behaviors, while deterrent access controls discourage or deter potential security incidents through measures like warning signs.

226. What are the three main categories of access controls based on their operational impact, as described in the NIST special publication series?

Solution Guidance: The three main categories are managerial controls, operational (or administrative) controls, and technical controls.

227. What is a mandatory access control and how does it function?

Solution Guidance: A mandatory access control is a required, structured data classification scheme that assigns sensitivity or classification levels to information and users, mandating access based on these classifications and limiting user control over access decisions.

228. What are the three classification levels used by the U.S. government for National Security Information, as defined in Executive Order 13526?

Solution Guidance: The three classification levels used by the U.S. government for National Security Information are Top Secret, Secret, and Confidential.

229. How does a lattice-based access control model work in regulating access?

Solution Guidance: A lattice-based access control model works by assigning users a matrix of authorizations for specific areas of access, specifying the level of access each user has to each resource based on the classification authorizations they possess.

230. What are discretionary access controls and how are they typically implemented in personal computer operating systems?

Solution Guidance: Discretionary access controls allow users to control and provide access to information or resources at their discretion. They are typically implemented in personal computer operating systems through mechanisms like shared drive folders and individual file permissions.

231. What is the primary focus of the Bell-LaPadula (BLP) confidentiality model?

Solution Guidance: The primary focus of the model is to ensure the confidentiality of data by using mandatory access controls, data classification, and information security clearances.

232. How does the simple security property function in the BLP model?

Solution Guidance: In the BLP model, the simple security property prohibits a subject with a lower clearance from reading an object with a higher classification level, but it allows a higher-clearance subject to read objects at a lower level.

233. What is the primary difference between the BLP model and the Biba integrity model? © 2026 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

50

Solution Guidance: The primary difference between the models is that BLP focuses on maintaining data confidentiality and the Biba model focuses on maintaining data integrity.

234. What are the two main properties of the Biba integrity model?

Solution Guidance: The two main properties of the Biba integrity model are the simple integrity property, which restricts reading data from lower integrity levels, and the integrity * property, which restricts writing data to higher integrity levels.

235. What is the purpose of the Clark-Wilson integrity model in a commercial environment?

Solution Guidance: The purpose of the Clark-Wilson integrity model in a commercial environment is to ensure data integrity through change control principles by restricting unauthorized changes and maintaining internal and external consistency.

236. How does the Graham-Denning access control model structure its components?

Solution Guidance: The Graham-Denning access control model structures its components into three parts: a set of objects, a set of subjects, and a set of rights. Subjects consist of a process and a domain, while rights govern how subjects may manipulate objects.

237. What is the significance of the eight primitive protection rights in the Graham-Denning model?

Solution Guidance: The eight primitive protection rights in the Graham-Denning model are significant because they define the basic operations that subjects can execute to interact with objects or other subjects.

These operations include creating or deleting objects and granting access rights.

238. How does the Harrison-Ruzzo-Ullman model address changes to access rights and system states?

Solution Guidance: The model addresses changes to access rights and system states by providing a set of commands for creating and deleting subjects and objects and for modifying access rights within an access control matrix.

239. What problem does the Brewer-Nash model, also known as the Chinese Wall, aim to solve?

Solution Guidance: The Brewer-Nash model aims to solve the problem of preventing conflicts of interest by restricting access to conflicting sets of data, ensuring that users cannot access both sets of data simultaneously.

EXERCISES 240. Visit the U.S. Postal Service webpage for Handbook 805 at http://about.usps.com/handbooks/as805.pdf.

Review the contents page of this extensive manual. Compare this program to the NIST documents outlined in this chapter. Which areas are similar to those covered in the NIST documents? Which areas are different?

Solution Guidance: The USPS Handbook AS-805, titled ―Information Security,‖ outlines comprehensive information security policies and procedures similar to those found in the NIST documents, specifically Special Publication 800-53.

Similar Areas Access control—Both documents emphasize limiting system access to authorized users and ensuring that access is appropriate for the tasks performed. This includes user identification, authentication, and the management of access rights.

© 2026 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

51

Incident response—Both the USPS Handbook and NIST SP 800-53 emphasize the importance of having robust incident response protocols. These protocols include procedures for detecting, reporting, and responding to security incidents.

Audit and accountability—Both documents highlight the need for audit mechanisms to ensure compliance with security policies and to monitor the integrity of information systems. They require logging, monitoring, and reviewing user activities to detect and respond to inappropriate actions.

Configuration management—The USPS Handbook and NIST SP 800-53 both address the importance of maintaining secure configurations for information systems. This includes the proper management of system settings, software updates, and patch management to protect against vulnerabilities.

System and communications protection—Both sets of guidelines mandate measures to safeguard system communications and ensure the secure exchange of information. This includes encryption, secure protocols, and network security controls.

Different Areas Postal-specific policies—The USPS Handbook includes specific policies tailored to the postal environment, such as protecting mail processing equipment and ensuring the physical security of postal facilities. NIST documents generally provide broader guidelines applicable to various industries.

Compliance with postal regulations—The USPS Handbook incorporates compliance requirements specific to postal regulations and policies, which might not be directly addressed in NIST documents. This includes adherence to postal-specific privacy policies and operational standards.

Supplier security requirements—The USPS Handbook includes detailed requirements for suppliers and third-party contractors, ensuring they adhere to USPS security policies. While NIST also addresses thirdparty security, the USPS document provides more specific guidelines pertinent to its operations.

For further details, you can refer to the USPS Handbook AS-805 at https://about.usps.com/postalbulletin/2011/pb22318/html/updt_002.htm and at about.usps.com/handbooks/as805i/welcome.htm.

241. Compare the ISO/IEC 27001 outline with the NIST documents discussed in this chapter. Which areas, if any, are missing from the NIST documents? Identify the strengths and weaknesses of the NIST programs compared to the ISO standard.

Solution Guidance: A possible answer is shown as follows.

Similarities Between ISO/IEC 27001 and NIST Documents Risk management—Both ISO/IEC 27001 and NIST emphasize risk management as a core component.

ISO/IEC 27001 includes risk assessment and treatment as part of its standard, which aligns closely with NIST SP 800-30, a guide for conducting risk assessments.

Security controls—Both frameworks provide a comprehensive set of security controls. ISO/IEC 27001 refers to ISO/IEC 27002 for its control set, which includes similar controls found in NIST SP 800-53, such as access control, incident response, and system and information integrity.

Continuous improvement—Both standards promote a continuous improvement process. ISO/IEC 27001 uses the Plan-Do-Check-Act cycle, while NIST frameworks encourage continuous monitoring and regular reassessment of controls and risks.

Leadership and support—Both ISO/IEC 27001 and NIST documents emphasize the importance of leadership and support in implementing and maintaining an effective information security management system (ISMS).

© 2026 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

52

Differences Between ISO/IEC 27001 and NIST Documents Certification—One major difference is that ISO/IEC 27001 is designed to be a certifiable standard, allowing organizations to achieve certification through an accredited body. NIST standards, while rigorous and comprehensive, are not designed for certification but for providing guidelines and best practices.

Scope and applicability—ISO/IEC 27001 is an international standard applicable to any organization, regardless of size or industry. NIST standards, particularly those like NIST SP 800-53, are primarily tailored for federal information systems and organizations but are also widely adopted in the private sector.

Control structure—ISO/IEC 27001 organizes its controls in a way that supports the establishment and maintenance of an ISMS, focusing on management systems. NIST SP 800-53 provides a more granular set of controls with a focus on system security, which are often used for specific systems within an organization.

Implementation guidance—NIST documents often provide more detailed guidance on the implementation of controls. For example, NIST SP 800-37 offers in-depth procedures for applying the Risk Management Framework across the system development life cycle, whereas ISO/IEC 27001 provides a higher-level framework that organizations can adapt to their specific needs.

Strengths of NIST Programs Detail and specificity—NIST provides detailed and specific guidance that can be directly implemented, making it very practical for organizations seeking step-by-step instructions.

Free access—NIST publications are publicly available at no cost, making them accessible to any organization.

Comprehensive control families—NIST SP 800-53‘s comprehensive control families cover a wide range of security and privacy requirements, supporting a holistic approach to information security.

Weaknesses of NIST Programs Complexity—The detailed nature of NIST guidelines can sometimes be overwhelming, particularly for smaller organizations with limited resources.

Federal focus—Some aspects of NIST standards are specifically tailored to federal systems, which might require adaptation for other types of organizations.

Strengths of ISO/IEC 27001 Certifiable—The ability to achieve certification provides organizations with a recognized credential that can enhance reputation and trust with stakeholders.

Global acceptance—As an international standard, ISO/IEC 27001 is widely accepted across different countries and industries, facilitating global operations.

Management system focus—Its focus on the management system level helps integrate information security into overall business processes.

Weaknesses of ISO/IEC 27001 Cost—Achieving and maintaining certification can be expensive and resource-intensive.

General guidelines—The higher-level nature of the guidelines may require organizations to develop more detailed implementation procedures internally.

© 2026 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

53

Both NIST and ISO/IEC 27001 have their unique strengths and cater to different needs depending on the organizational context and requirements. Adopting elements from both can often provide a balanced and robust approach to information security management.

242. Search the Internet for ―cybersecurity best practices.‖ Compare your findings to the recommended practices outlined in the NIST documents.

Solution Guidance: A possible answer is shown as follows.

Similarities Between Cybersecurity Best Practices and NIST Recommendations Strong passwords and multifactor authentication (MFA)—Both the general best practices and NIST emphasize the importance of using strong, complex passwords and enabling MFA to protect accounts from unauthorized access. NIST‘s guidelines highlight the importance of password management and authentication controls (NIST SP 800-63).

Regular software updates and patch management—Keeping systems and software updated is a critical practice highlighted both in general best practices and NIST documents. Regular patching helps protect against known vulnerabilities, as emphasized in NIST SP 800-40.

Incident response planning—Both recommend having a robust incident response plan. General best practices advise preparing for breaches with a defined response strategy, which aligns with NIST SP 80061‘s guidelines on incident handling.

Least privilege principle—The practice of granting users the minimum necessary access aligns with NIST‘s Access Control family in NIST SP 800-53, which advocates for the principle of least privilege to reduce potential insider threats and unauthorized access.

Regular audits and assessments—Conducting regular cybersecurity audits is a common recommendation.

NIST SP 800-30 and SP 800-53 emphasize continuous monitoring and periodic assessments to ensure compliance and identify vulnerabilities.

Differences Between Cybersecurity Best Practices and NIST Recommendations Zero-trust security model—While widely recommended in recent best practices, the Zero-Trust model is a newer approach that might not be as explicitly detailed in some older NIST documents. However, its principles are covered under various NIST guidelines focusing on strict access controls and continuous verification. (Recent updates in NIST frameworks are starting to reflect this model more explicitly.)

Use of artificial intelligence (AI) for threat detection—Current best practices highlight the use of AI for proactive threat detection and response, which is not as prominently covered in traditional NIST documents. However, NIST is incorporating AI discussions in more recent publications.

Physical security measures—General best practices often emphasize physical security (e.g., securing server rooms and protecting devices from theft), which is covered in NIST guidelines but might not be as prominently highlighted in some best-practice summaries.

Vendor and third-party management—Best practices suggest regular audits of third-party vendors and consolidating vendors to minimize risk, which is less emphasized in older NIST documents but is addressed in newer guidelines under supply chain risk management (NIST SP 800-161).

Strengths of NIST Programs Comprehensive framework—NIST provides a detailed, structured approach to cybersecurity, covering a wide range of controls and best practices that can be customized to fit different organizations.

© 2026 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

54

Publicly available resources—NIST documents are freely accessible, making them widely available for organizations to use without additional costs.

Detailed implementation guidelines—NIST offers specific, actionable steps for implementing various controls, which can be very useful for organizations looking for detailed guidance.

Weaknesses of NIST Programs Complexity and length—The detailed nature of NIST documents can be overwhelming, especially for smaller organizations with limited resources.

Federal focus—Some NIST guidelines are tailored specifically for federal agencies, which might require adaptation for private-sector organizations.

Conclusion Both general best practices and NIST guidelines provide valuable recommendations for enhancing cybersecurity. Organizations can benefit from using a combination of both, leveraging the detailed and comprehensive nature of NIST guidelines alongside the practical and up-to-date insights from general best practices.

243. Search the Internet for ―data classification model.‖ Identify two such models and then compare and contrast the categories those models use for the various levels of classification.

Solution Guidance: A possible answer could compare and contrast the NIST and ISO/IEC 27001 data classification models as follows.

NIST Data Classification Model The NIST data classification model is designed to help organizations manage their data by categorizing it based on its sensitivity and the level of protection required. This model generally includes the following categories: Public—Information that is intended for public dissemination and poses no risk if disclosed Internal—Information that is not intended for public release but poses minimal risk if disclosed Confidential—Sensitive information that could cause harm to the organization or individuals if disclosed Restricted—Highly sensitive information that could cause severe damage to the organization or individuals if disclosed These classifications help organizations apply appropriate security measures to protect data based on its sensitivity and criticality.

ISO/IEC 27001 Data Classification Model The ISO/IEC 27001 standard provides a framework for an ISMS, including data classification. The ISO model typically includes these categories: Public—Similar to NIST, this category is for information intended for public access with no security concerns Internal use only—Information meant for internal operations, with limited risk if disclosed Confidential—Information that is sensitive and should only be accessible to authorized personnel to avoid potential harm

© 2026 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

55

Highly confidential/restricted—The most sensitive information, requiring strict access controls and robust protection measures to prevent significant harm ISO/IEC 27001 focuses on protecting information based on its value, criticality, and sensitivity, ensuring that appropriate security controls are in place to safeguard each category.

Similarities Sensitivity-based classification—Both models classify data based on its sensitivity and the potential impact of its disclosure.

Multiple levels of classification—Both models use multiple levels to differentiate between varying degrees of sensitivity and required protection.

Public category—Both models include a category for information intended for public access, which poses no risk if disclosed.

Differences Terminology—The specific terms used for each classification level can vary. For example, NIST uses ―Internal‖ whereas ISO/IEC 27001 might use ―Internal Use Only.‖ Focus and structure—NIST‘s model is part of a broader set of guidelines for federal information systems, whereas ISO/IEC 27001 provides an international standard for information security management applicable to various types of organizations.

Implementation guidance—ISO/IEC 27001 includes detailed requirements for implementing an ISMS; NIST provides more prescriptive guidelines and controls, particularly tailored to federal agencies.

By understanding and comparing these models, organizations can better tailor their data classification strategies to meet their specific needs and regulatory requirements, ensuring robust protection for their information assets.

244. Search the Internet for information on the Treadway Commission. What was it, and what is its major legacy in the field of cybersecurity?

Solution Guidance: A possible answer is shown as follows.

The Treadway Commission, formally known as the National Commission on Fraudulent Financial Reporting, was established in 1985 as an independent private-sector initiative. It was sponsored by five major professional associations in the United States: the American Accounting Association, the American Institute of Certified Public Accountants, Financial Executives International, the Institute of Internal Auditors, and the National Association of Accountants (now the Institute of Management Accountants).

The commission‘s first chairman was James C. Treadway.

The most significant contribution of the Treadway Commission to cybersecurity is through the Committee of Sponsoring Organizations (COSO), which it established. COSO‘s major output, the Internal Control– Integrated Framework, initially published in 1992 and updated in 2013, has become a cornerstone for internal control and risk management practices globally. This framework provides a structured approach for organizations to design, implement, and assess internal controls, ensuring reliability in financial reporting and compliance with laws and regulations.

Impact on Cybersecurity Enhanced internal controls—COSO‘s framework emphasizes robust internal controls, which are fundamental to securing information systems and protecting data integrity. Effective internal controls help

© 2026 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

56

mitigate risks associated with cybersecurity threats by ensuring that controls are in place to detect, prevent, and respond to incidents.

Risk management—COSO‘s enterprise risk management framework integrates broader risk management practices into organizational processes, including cybersecurity risks. This approach helps organizations identify, assess, and manage risks systematically, ensuring that cybersecurity is part of the overall risk management strategy.

Fraud prevention—The original focus of the Treadway Commission on preventing fraudulent financial reporting has clear parallels in cybersecurity. The principles and practices recommended by COSO to prevent fraud are applicable to preventing cyber fraud and data breaches. For instance, segregation of duties and continuous monitoring are practices that enhance both financial and information security.

In summary, the Treadway Commission‘s legacy, particularly through COSO, has significantly influenced the development of robust internal controls and comprehensive risk management practices. These contributions are crucial in today‘s cybersecurity landscape, where protecting organizational assets and data integrity is paramount.

Solution and Answer Guide MICHAEL E. WHITMAN AND HERBERT J. MATTORD, MANAGEMENT OF CYBERSECURITY, 7E, 2026, 9798214011738; CHAPTER 09 CYBERSECURITY M ANAGEMENT PRACTICES

TABLE OF CONTENTS Review Questions ........................................................................................................................................ 1 Exercises ...................................................................................................................................................... 4

REVIEW QUESTIONS 245. Why is it important to include cybersecurity responsibilities in every employee‘s job description and performance reviews?

Solution Guidance: Including cybersecurity responsibilities in job descriptions and performance reviews is important because it helps make everyone in the organization take cybersecurity more seriously.

246. What should organizations avoid including in job descriptions for cybersecurity positions, and why?

Solution Guidance: Organizations should avoid including details of access privileges and the type and sensitivity of company information in job descriptions to prevent potential security risks from individuals seeking to exploit such information.

247. How can the cybersecurity department support HR personnel during the hiring process?

Solution Guidance: The cybersecurity department can support HR personnel by educating them about various relevant certifications, specific experiences required for each credential, and the qualifications of a good candidate, and by advising them to limit information about the organization‘s cybersecurity and systems during interviews.

248. What is the purpose of conducting background checks before extending a job offer to a candidate?

© 2026 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

57

Solution Guidance: The purpose of conducting background checks before extending a job offer is to uncover past criminal behavior or other information that suggests a potential for future misconduct or vulnerabilities that might make a candidate susceptible to coercion or blackmail.

249. What should a new employee‘s cybersecurity orientation cover?

Solution Guidance: A new employee‘s cybersecurity orientation should cover policies, cybersecurity procedures, access levels, and training on the secure use of IT systems to ensure they are thoroughly briefed on the cybersecurity components of their new positions.

250. How can periodic SETA activities benefit an organization‘s cybersecurity?

Solution Guidance: Periodic SETA activities can benefit an organization‘s cybersecurity by keeping cybersecurity at the forefront of employees‘ minds, minimizing employee mistakes, and increasing the level of cybersecurity awareness among all employees.

251. Why might an organization incorporate cybersecurity expectations into employee performance evaluations?

Solution Guidance: An organization might incorporate cybersecurity expectations into employee performance evaluations to heighten cybersecurity awareness and motivate employees to take more care when performing cybersecurity tasks.

252. What are some cybersecurity concerns when an employee leaves an organization?

Solution Guidance: Some cybersecurity concerns when an employee leaves an organization include ensuring that their access to systems is disabled, securing their hard drives, returning organizational property, and conducting an exit interview to remind them of any contractual obligations.

253. How can the practice of separation of duties enhance an organization‘s cybersecurity?

Solution Guidance: The practice of separation of duties can enhance an organization‘s cybersecurity by making it difficult for an individual to violate cybersecurity protocols and breach the confidentiality, integrity, or availability of information, as it requires collusion between multiple individuals to perform unauthorized activities.

254. What is the primary purpose of a cybersecurity performance management program?

Solution Guidance: The primary purpose of a cybersecurity performance management program is to design, implement, and manage specific measurements to determine the effectiveness of cybersecurity efforts within an organization.

255. How does NIST SP 800-55, Rev. 1 contribute to the development of a cybersecurity performance measurement program?

Solution Guidance: NIST SP 800-55, Rev. 1 provides guidelines and factors critical to the success of a cybersecurity performance measurement program, including the importance of quantifiable measures, management support, and the use of practical cybersecurity policies and procedures.

256. Why is it important for measures to yield quantifiable information in a cybersecurity performance measurement program?

Solution Guidance: Quantifiable information, such as percentages, averages, and other numbers, is essential for tracking performance, directing resources, and ensuring the effectiveness of cybersecurity efforts through objective and measurable data.

257. What are the three types of measures commonly used to assess cybersecurity performance?

© 2026 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

58

Solution Guidance: The three types of measures are those that determine the effectiveness of executing cybersecurity policy, those that determine the effectiveness and efficiency of delivering cybersecurity services, and those that assess the impact of incidents or other cybersecurity events on the organization.

258. How can an organization ensure that its cybersecurity performance measures are aligned with its overall mission?

Solution Guidance: An organization can ensure alignment by designing performance measures that support managerial decision making, increase accountability, and align cybersecurity performance and objectives with the organization‘s overall mission and strategic goals.

259. What are some of the critical factors for the success of a cybersecurity performance measurement program, as identified by NIST SP 800-55, Rev. 1?

Solution Guidance: Critical factors include strong upper-level management support, practical cybersecurity policies and procedures, quantifiable performance measures, and results-oriented measures analysis to apply lessons learned and improve effectiveness.

260. Why is it necessary to periodically review the results of a cybersecurity performance measurement program?

Solution Guidance: Periodic review is necessary to ensure that the measures remain relevant and useful, allowing the organization to continuously improve its cybersecurity efforts and adapt to new challenges and requirements.

261. What is the role of the CSO in the development of a cybersecurity performance measurement program?

Solution Guidance: The CSO is a key participant who assists in building the case for the program, answering critical questions about measures collection, and ensuring that the program demonstrates value to the organization.

262. How does the concept of key performance indicators (KPIs) differ from general performance measures in the context of cybersecurity?

Solution Guidance: KPIs are a subset of performance measures that hold strategic interest to the organization, meaning they are prioritized for collection, analysis, and reporting because they have significant influence on future cybersecurity efforts and organizational goals.

263. What is benchmarking in the context of cybersecurity, and how can it be used by organizations?

Solution Guidance: Benchmarking in cybersecurity is a method in which organizations compare their cybersecurity efforts against the practices of similar organizations or industry standards to identify recommended or best practices that can be adapted to improve their own cybersecurity posture.

264. What is the difference between due care and due diligence in cybersecurity?

Solution Guidance: Due care refers to the legal standard requiring organizations to act as a ―reasonable and prudent‖ entity would act under similar circumstances, while due diligence involves maintaining these standards to ensure they continue to provide the required level of protection over time.

265. Why might some organizations be unable to implement the best, most technologically advanced cybersecurity controls?

Solution Guidance: Some organizations may lack the financial resources, personnel, or other necessary means to implement state-of-the-art cybersecurity controls, making it crucial for them to achieve a reasonable level of protection across all areas before attempting to meet the highest standards in specific areas.

© 2026 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

59

266. How do recommended practices differ from best practices in cybersecurity?

Solution Guidance: Recommended practices aim to provide a superior level of performance in information protection and balance access needs with protection, whereas best practices are considered among the best in the industry, even though not all aspects of a best practice might be the best.

267. What are some key considerations when selecting recommended practices for an organization‘s cybersecurity program?

Solution Guidance: Key considerations include the similarity of the target organization to one‘s own, the relevance of the industry, the similarity of the challenges, having a comparable organizational structure and available resources, and whether the threat environment is similar to the one assumed by the recommended practice.

268. What are the limitations of benchmarking in cybersecurity?

Solution Guidance: Limitations include the reluctance of organizations to share detailed results of successful attacks, significant differences between organizations that make direct comparisons difficult, and the fact that recommended practices are constantly evolving and may not address current threats.

269. What is baselining, and how does it support cybersecurity management?

Solution Guidance: Baselining, also known as internal benchmarking, involves an initial assessment of an organization‘s current performance to establish a reference point, which is later used to measure progress and identify areas needing improvement, thus supporting ongoing cybersecurity management.

270. How does the ISO 27001 certification process benefit organizations, and what are its steps?

Solution Guidance: The ISO 27001 certification process benefits organizations by reducing incident costs, improving operations, and enhancing public trust. The steps include an initial assessment, creating a certification manual, and verifying compliance to ultimately receive the certification.

271. Why is it important for cybersecurity programs to keep abreast of new threats, and how can organizations achieve this?

Solution Guidance: It is important to stay updated on new threats because preparing for past threats does not necessarily protect against future ones. Organizations can achieve this by continuously monitoring the cybersecurity landscape, participating in professional associations, and regularly updating their practices and technologies.

EXERCISES 272. Search the web for the term ―cybersecurity best practices.‖ Compare your findings to the recommended practices outlined in the NIST special publications on cybersecurity documents.

Solution Guidance: Based on the information gathered from various sources on the web and the NIST special publications, here is a comparative analysis of cybersecurity best practices: Common Cybersecurity Best Practices 

Multifactor authentication (MFA): This is a widely recommended practice that requires users to verify their identity through two or more methods, significantly reducing the risk of unauthorized access. Both NIST and sources like Coursera and PhoenixNAP emphasize the importance of MFA.

© 2026 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

60



Regular software updates and patch management: Ensuring that all software is up to date with the latest patches is crucial to closing known vulnerabilities. This practice is highlighted across multiple sources, including CISA and CrowdStrike.



Cybersecurity awareness training: Training employees to recognize and respond to cyber threats is essential. Human error is a significant factor in many cyber incidents. Regular training sessions and phishing simulations are recommended by NIST and other sources such as Coursera and PhoenixNAP.



Zero trust architecture: Adopting a zero trust model, which involves never trusting any device or user by default and always verifying their identity and access levels, is gaining traction. This approach is promoted by Gartner and NIST.



Security audits and assessments: Conducting regular audits to identify vulnerabilities and ensure compliance with security policies is crucial. This practice is recommended by both NIST and other cybersecurity experts.



Incident response planning: Developing and regularly updating an incident response plan to effectively manage and mitigate the impact of cyber incidents is essential. This includes establishing a cyber incident response team and conducting simulations to test the plan.



Data encryption: Encrypting data at rest, in transit, and in use to protect its confidentiality and integrity is a fundamental practice. This is consistently highlighted in NIST publications and other cybersecurity guidelines.

Comparison with NIST Special Publications NIST special publications, such as NIST SP 800-53 and NIST SP 800-55, align closely with cybersecurity best practices. NIST emphasizes a comprehensive approach that includes the following: 

Access control: Implementing policies and procedures to control who has access to information systems and data



Awareness and training: Regular training programs to ensure all personnel are aware of cybersecurity risks and practices



Audit and accountability: Regular auditing of information systems to ensure compliance with security policies and to detect any security breaches



Configuration management: Managing and documenting the configuration of information systems to ensure security and reduce vulnerabilities



Contingency planning: Preparing for potential cybersecurity incidents with plans that include response and recovery procedures

Both NIST and the reviewed web sources emphasize the importance of a layered and comprehensive cybersecurity strategy that incorporates technical solutions, policy frameworks, and continuous monitoring and improvement.

In summary, there is a strong alignment between general cybersecurity best practices found on the web and the detailed guidelines provided in the NIST special publications. Implementing these practices helps organizations build a robust cybersecurity posture capable of defending against a wide range of threats.

273. Search the web for several cybersecurity-related job postings. Do the postings align with the concerns outlined in this chapter? Why or why not?

Solution Guidance: A possible answer is provided here.

© 2026 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

61

Cybersecurity Job Postings and their Alignment with NIST Concerns Based on a review of several cybersecurity job postings to assess their alignment with the concerns outlined in the chapter, here are some key aspects and how they align with the concerns: 

Job descriptions: Many job postings clearly outline responsibilities and required skills without disclosing sensitive information about the systems or data involved. For instance, postings for roles such as cybersecurity analyst and information system security officer focus on skills and responsibilities rather than access privileges or sensitive information specifics.



Interviews and background checks: The postings indicate that organizations prioritize thorough background checks and rigorous interview processes. For example, the FBI‘s Special Agent position emphasizes strict standards of conduct and the need for a security clearance, highlighting the importance of background checks and controlled information disclosure during the hiring process.



On-the-job cybersecurity training: Continuous education and training are often mentioned, reflecting the emphasis on keeping cybersecurity knowledge up to date. Positions such as cybersecurity analyst at various companies highlight the need for ongoing training and certification maintenance, ensuring that employees stay informed about the latest threats and best practices.



Cybersecurity responsibilities in job performance: Many job descriptions include specific cybersecurity responsibilities, indicating that performance evaluations may consider how well these duties are executed. For instance, roles at Lockheed Martin and Apple include responsibilities such as conducting security assessments and managing security operations, which align with integrating cybersecurity tasks into job performance reviews.



Termination issues: While the postings themselves do not detail termination processes, the structured nature of cybersecurity roles implies that organizations have protocols for handling sensitive information and system access during employee transitions. This is inferred from the detailed responsibilities and security measures outlined in the job descriptions, ensuring controlled access and mitigation of insider threats.

Conclusion Overall, the job postings align well with the concerns outlined in the chapter. They emphasize thorough vetting processes, detailed job responsibilities without revealing sensitive information, continuous training, and structured roles that integrate cybersecurity into daily responsibilities. These practices help ensure that employees are well-prepared to manage cybersecurity risks and maintain the integrity of the organization‘s information systems.

274. Visit the websites of three major technology organizations: Microsoft, Oracle, and Cisco. Also, go to two more sites of technology organizations that you choose on your own. Search the websites for best cybersecurity practices. What do you find?

Solution Guidance: Summaries of cybersecurity best practices from major technology organizations are provided here.

Microsoft Microsoft emphasizes several key cybersecurity best practices across various resources. 

Zero trust security model: Microsoft advocates for a zero trust approach, which assumes breaches are inevitable and requires verification for every access attempt. This approach is integrated across user accounts, devices, applications, and data. Microsoft provides detailed guidance on

© 2026 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

62

implementing the zero trust approach, including specific steps and tools to enhance security posture (Microsoft Learn). 

Azure security: For securing Azure environments, Microsoft recommends using Defender for Cloud to monitor the security state of resources and integrating with security information and event management (SIEM) solutions like Microsoft Sentinel. Key practices include using secure scores to benchmark against industry standards, automating security tasks, and employing MFA (Microsoft Learn).



Cloud data security: Microsoft outlines best practices for securing data in the cloud, such as choosing reputable cloud service providers, using strong authentication methods like MFA, implementing encryption for data at rest and in transit, and protecting data wherever it resides using tools like Microsoft Purview (Microsoft Security Blog).



Cybersecurity awareness: Microsoft emphasizes the importance of continuous cybersecurity training to combat threats like phishing and malware. Regular updates, MFA, and using password managers are recommended to enhance personal and organizational security (Microsoft Security Blog).

Oracle Oracle focuses on comprehensive security measures to protect data and applications. 

Database security: Oracle recommends encrypting sensitive data, using strong authentication mechanisms, and regularly updating security patches to protect databases. Oracle Advanced Security provides transparent data encryption and data redaction features.



Cloud security: Oracle Cloud Infrastructure (OCI) offers security-first design principles, including identity and access management, network security, and continuous monitoring. Oracle emphasizes the importance of understanding the shared responsibility model in the cloud.



Identity management: Oracle Identity and Access Management solutions help organizations manage user identities and access rights across applications and data. Best practices include implementing least privilege access, conducting regular audits, and using MFA.

Cisco Cisco provides extensive guidelines for network and endpoint security. 

Network security: Cisco recommends implementing a multilayered security approach, using firewalls, intrusion prevention systems, and secure access service edge solutions. Network segmentation and secure remote access are also key practices.



Endpoint security: Cisco‘s best practices for endpoint security include using advanced malware protection, using endpoint detection and response solutions, and ensuring regular software updates and patches.



Security awareness: Cisco emphasizes the importance of security awareness training for employees, highlighting common threats like phishing and social engineering attacks. Regular training sessions and simulated attacks help build resilience.

IBM IBM focuses on integrating security into every aspect of the IT environment.

© 2026 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

63



Security intelligence and analytics: IBM‘s QRadar SIEM helps organizations detect and respond to threats by analyzing data across the IT infrastructure. Best practices include continuous monitoring, automated threat detection, and incident response.



Data protection: IBM recommends encrypting sensitive data, implementing robust access controls, and regularly auditing security measures. IBM Guardium provides real-time data protection and monitoring.



Cloud security: IBM cloud security best practices include understanding the shared responsibility model, using encryption, and employing identity and access management tools to secure cloud environments.

Google Cloud Google Cloud emphasizes security by design. 

Zero trust architecture: Google promotes the BeyondCorp framework, which shifts access controls from the network perimeter to individual users and devices. This approach enhances security for remote work environments.



Data encryption: Google Cloud ensures data is encrypted at rest and in transit. Tools like Google Cloud Key Management Service (KMS) help manage encryption keys securely.



Identity and access management: Google Cloud IAM provides fine-grained access controls and MFA to secure resources and data.

By implementing these best practices, organizations can significantly enhance their cybersecurity posture and protect against a wide range of threats.

275. Download and review NIST SP 800-55, Rev. 1: ―Performance Measurement Guide for Information Security.‖ Using this document, identify five measures for your home computing systems and network that could yield interesting results.

Solution Guidance: Here are five measures for a typical home computing system and network that could yield interesting results.

Antivirus Software Coverage l 

Measure: Percentage of devices running up-to-date antivirus software



Relevance: This measure helps ensure that all home computing devices are protected against malware, which is crucial for maintaining security and preventing infections.



Expected outcome: High percentage, indicating robust antivirus protection

Patch Management 

Measure: Percentage of systems with up-to-date operating system and application patches



Relevance: Regularly updated systems are less vulnerable to exploits that could compromise security.



Expected outcome: High compliance rate, indicating effective patch management practices

User Awareness Training 

Measure: Percentage of users who have completed cybersecurity awareness training

© 2026 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

64



Relevance: Training users on cybersecurity best practices helps reduce the likelihood of successful phishing attacks and other social engineering tactics.



Expected outcome: High percentage of trained users, reflecting a well-informed user base

Backup Frequency 

Measure: Frequency of data backups performed on home systems



Relevance: Regular backups ensure data can be restored in case of data loss incidents, such as ransomware attacks or hardware failures.



Expected outcome: Regular backups (e.g., daily or weekly) to ensure data integrity and availability

Firewall Configuration 

Measure: Percentage of devices with a properly configured firewall



Relevance: Firewalls help protect home networks by blocking unauthorized access and filtering harmful traffic.



Expected outcome: High percentage of devices with active and properly configured firewalls

These measures provide a comprehensive view of the security posture of home computing environments, ensuring that critical aspects such as malware protection, patch management, user awareness, data backup, and network defense are adequately addressed. Implementing and monitoring these measures can significantly enhance the overall security of home systems.

276. Using the template provided in Table 9-1, develop documentation for one of the performance measurements you selected in Exercise 4.

Solution Guidance: The following answer is an example of documenting performance measurements for backup frequency.

Measurement ID 

backup_frequency_home

Goals 

Strategic goal: Ensure data integrity and availability for home computing systems.



Cybersecurity goal: Maintain regular and consistent data backups to protect against data loss incidents.

Measure 

Statement of measure: The frequency of data backups performed on home systems, expressed as the number of backups per specified time period (e.g., daily, weekly, monthly)

Measure Type 

Type: Implementation

Formula Calculation 

\( \text{Number of backups performed in a time period} \div \text{Total number of systems} \times 100 \)

Target Thresholds 

Final target: 100 percent of systems have at least one backup per week.

© 2026 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

65



Interim target: 75 percent of systems have at least one backup per week.

Implementation Evidence: Manual Data Collection 

Are regular backups scheduled? Yes/No



Are logs maintained for backup activities? Yes/No



How many systems are included in the backup schedule?



How often are backups performed?

Implementation Evidence: Automated Data Collection 

Number of successful backups logged by backup software



Alerts for missed or failed backups

Frequency 

Data collection: Weekly



Reporting: Monthly

Responsible Parties 

Information owner: Home network administrator (user)



Information collector: Backup software logs, manual checks by the user



Information customer: User or household members responsible for IT security

Data Source 

Source: Backup software logs, manual tracking sheets, alert systems

Reporting Format 

Bar charts showing the percentage of systems with regular backups



Line charts tracking backup frequency over time



Reports highlighting systems with missed or failed backups

Additional Notes 

Importance: Regular backups are crucial for data recovery in case of accidental deletion, hardware failure, or ransomware attacks.



Best practices: Utilize automated backup solutions to ensure consistency and reliability. Regularly test backup restorations to verify data integrity.

Solution and Answer Guide MICHAEL E. WHITMAN AND HERBERT J. MATTORD, MANAGEMENT OF CYBERSECURITY, 7E, 2026, 9798214011738; CHAPTER 10 PLANNING FOR CONTINGENCIES

TABLE OF CONTENTS Review Questions ........................................................................................................................................ 1 © 2026 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

66

Exercises ...................................................................................................................................................... 4

REVIEW QUESTIONS 277. What is the primary goal of contingency planning in an organization?

Solution Guidance: The primary goal of contingency planning is to restore normal modes of operation with minimal cost and disruption to business activities after an adverse event.

278. How does a business impact analysis assist in contingency planning?

Solution Guidance: A business impact analysis assists in contingency planning by identifying and prioritizing business processes and information systems that are critical to an organization‘s success, helping to ensure that these processes and systems can be recovered quickly and effectively after an adverse event.

279. What are the four major components of contingency planning mentioned in the text?

Solution Guidance: The four major components of contingency planning are the business impact analysis, incident response plan, disaster recovery plan, and business continuity plan.

280. Why is the involvement of the general business community of interest important in contingency planning?

Solution Guidance: Their involvement is important in contingency planning because it ensures that the plan gains the support of all members of the organization and is actively supported and monitored by the entire business community.

281. What is the function of the recovery point objective in contingency planning?

Solution Guidance: The function of the recovery point objective in contingency planning is to determine the maximum amount of data loss that an organization can tolerate. It specifies the point in time to which systems will be recovered.

282. Describe the role of the contingency planning management team in the contingency planning process.

Solution Guidance: The role of the contingency planning management team is to collect information about the organization and its threats, conduct the business impact analysis, and coordinate the development of contingency plans for incident response, disaster recovery, and business continuity.

283. How does NIST SP 800-34, Rev. 1 influence contingency planning practices?

Solution Guidance: NIST SP 800-34, Rev. 1 influences contingency planning practices by providing a comprehensive guide for developing effective contingency plans, offering steps and methodologies for creating policies, conducting a business impact analysis, identifying preventive controls, and ensuring plan testing, training, and maintenance.

284. What is the importance of the disaster recovery plan in contingency planning?

Solution Guidance: The importance of the disaster recovery plan in contingency planning lies in its focus on restoring operations at the primary site after a disaster, ensuring that the organization can recover its critical systems and resume normal operations as quickly as possible.

285. Why is it essential to regularly update contingency plans?

© 2026 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

67

Solution Guidance: It is essential to regularly update contingency plans to ensure they remain current with system enhancements and organizational changes, maintaining their effectiveness and relevance in the face of evolving threats and operational requirements.

286. What is the primary goal of an incident response plan within an organization?

Solution Guidance: The primary goal of an incident response plan is to prepare for, detect, respond to, and recover from incidents in a quick and efficient manner to minimize the impact on the organization.

287. How does NIST SP 800-61, Rev. 2 contribute to the development of an organization‘s incident response plan?

Solution Guidance: NIST SP 800-61, Rev. 2 provides guidelines and recommendations for creating an effective incident response plan, including key components such as incident detection, analysis, containment, eradication, recovery, and post-incident activities.

288. What are the three phases of incident response actions, as outlined in the chapter?

Solution Guidance: The three phases of incident response actions are Detect, Respond, and Recover.

289. What is the purpose of having a cybersecurity incident response team in an organization?

Solution Guidance: The purpose of having a cybersecurity incident response team is to ensure that a group of IT and cybersecurity professionals are prepared to detect, respond to, and recover from incidents in a coordinated and effective manner.

290. Why is it important for an incident response policy to have the full support of top management?

Solution Guidance: It is important for an incident response policy to have the full support of top management to ensure that the policy is effectively implemented, that it is understood by all affected parties, and that necessary resources and authority are allocated for its execution.

291. What are the key components of a typical incident response policy, as identified by NIST SP 800-61, Rev. 2?

Solution Guidance: The key components of a typical incident response policy include a statement of management commitment, purpose and objectives, scope, definition of incidents and related terms, organizational structure, roles and responsibilities, reporting requirements, and guidelines for external communications and information sharing.

292. What steps should be taken during the incident containment phase?

Solution Guidance: During the incident containment phase, steps should be taken to stop the incident and mitigate its impact. These steps include disabling compromised accounts, reconfiguring firewalls, disabling affected processes or services, and disconnecting systems from the network if necessary.

293. How does digital forensics assist in the incident response process?

Solution Guidance: Digital forensics assists in the incident response process by preserving, identifying, extracting, documenting, and interpreting digital media to investigate what happened, how it happened, and potentially why it happened, which is crucial for both root cause analysis and legal proceedings.

294. What is the difference between the ―protect and forget‖ and ―apprehend and prosecute‖ philosophies in incident and disaster handling?

Solution Guidance: The ―protect and forget‖ philosophy focuses on defending information assets and preventing reoccurrence without concern for identifying or prosecuting the attacker, whereas the

© 2026 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

68

―apprehend and prosecute‖ philosophy aims to identify and prosecute the attacker in addition to defending assets and preventing future incidents.

295. What is the role of the disaster recovery planning process in an organization?

Solution Guidance: The role of the disaster recovery planning process is to prepare for and recover from a disaster, whether natural or man-made, ensuring the organization can continue functioning or quickly restore operations after a disaster.

296. How does an organization determine when to escalate an incident to a disaster?

Solution Guidance: A An organization escalates an incident to a disaster when it is unable to contain or control the impact of the incident or when the damage or destruction from the incident is so severe that the organization cannot quickly recover from it.

297. What are the primary responsibilities of the disaster recovery planning team?

Solution Guidance: The primary responsibilities of the disaster recovery planning team include organizing and preparing disaster recovery response teams, developing the disaster recovery plan, and ensuring the plan is tested, trained, and maintained.

298. What is the importance of the business impact analysis in the DRP process?

Solution Guidance: The business impact analysis is important in the DRP process because it provides relevant information that helps in understanding the potential impacts of disasters, identifying critical business functions, and prioritizing recovery efforts.

299. Describe the purpose of the disaster recovery policy within an organization.

Solution Guidance: The purpose of the disaster recovery policy is to provide direction and guidance for all disaster recovery operations, outline the roles and responsibilities, specify resource requirements, and define training, exercise, and maintenance schedules for the disaster recovery plan.

300. How are disasters classified based on their rate of occurrence?

Solution Guidance: Disasters are classified based on their rate of occurrence as either slow-onset disasters, which build up gradually over time, or rapid-onset disasters, which occur suddenly with little warning.

301. What steps should be included in a simple disaster recovery plan outline?

Solution Guidance: A simple disaster recovery plan outline should include the name and location of the company or branch, the dates of completion and update of the plan, staff to be called in the event of a disaster, emergency services to be called, locations of in-house emergency equipment and supplies, sources of off-site equipment and supplies, a salvage priority list, disaster recovery procedures, and follow-up assessment.

302. Why is cross-training employees important in disaster recovery planning?

Solution Guidance: Cross-training employees is important in disaster recovery planning because it ensures that operations and a sense of normalcy can be restored quickly by having multiple employees with the necessary organizational knowledge to perform essential functions.

303. What key elements should the disaster recovery planning team incorporate into the disaster recovery plan to ensure readiness?

Solution Guidance: The key elements that the team should incorporate into the disaster recovery plan include clear delegation of roles and responsibilities, execution of the alert roster and notification of key

© 2026 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

69

personnel, clear establishment of priorities, procedures for documentation of the disaster, action steps to mitigate the impact, and alternative implementations for various system components.

304. What is the purpose of business continuity planning, and why is it important for an organization?

Solution Guidance: The purpose of business continuity planning is to ensure that critical business processes can continue if a disaster occurs, enabling the organization to stay in business and maintain operations during and after the disaster.

305. Describe the difference between a hot site, a warm site, and a cold site in the context of business continuity.

Solution Guidance: A hot site is a fully configured computing facility with all necessary services and equipment ready for immediate use; a warm site provides some equipment and services but lacks fully installed software applications; and a cold site is an empty facility with basic utilities but no computing equipment or active services.

306. How did the COVID-19 pandemic impact the way organizations approached business continuity?

Solution Guidance: The pandemic forced many organizations to quickly implement virtual operations, remote work, and other alternatives, significantly impacting their approach to business continuity by emphasizing the need for flexibility and virtual work options.

307. What are the key sections of a business continuity policy, and what is their significance?

Solution Guidance: The key sections of a business continuity policy include its purpose, scope, roles and responsibilities, resource requirements, training requirements, exercise and testing schedules, plan maintenance schedule, and special considerations. Each section outlines essential elements for planning and executing business continuity operations.

308. Explain the concept of business resumption planning and how it relates to disaster recovery and business continuity.

Solution Guidance: Business resumption planning integrates disaster recovery and business continuity efforts into a comprehensive plan to ensure that an organization can recover and resume operations after a disaster, supporting both disaster recovery and business continuity operations.

309. What role does the crisis management planning team play during a disaster, and what are its primary responsibilities?

Solution Guidance: The crisis management planning team plans and prepares for dealing with human injury, emotional trauma, and loss of life during a disaster, with primary responsibilities that include verifying personnel status, activating the alert roster, and coordinating with emergency services.

310. How does a timeshare strategy differ from a service bureau strategy in the context of business continuity?

Solution Guidance: A timeshare strategy involves co-leasing facilities with a business partner or sister organization to reduce costs, whereas a service bureau strategy contracts with an agency to provide business continuity facilities for a fee, offering guaranteed space but potentially higher costs and the need for periodic contract renegotiation.

311. What are the benefits and disadvantages of using a rolling mobile site as a business continuity strategy?

Solution Guidance: The benefits of a rolling mobile site include immediate availability of temporary facilities and close proximity to the disaster site, while disadvantages may include logistical challenges and the need for mobile infrastructure.

312. Why is plan maintenance a critical part of the business continuity plan, and what does it typically involve?

© 2026 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

70

Solution Guidance: Plan maintenance is critical to ensure that the business continuity plan remains effective and up to date. Maintenance involves regular reviews, updates, and testing to address any changes in the organization‘s operations or potential new threats.

313. What is the purpose of testing contingency plans, and what can be done once vulnerabilities are identified during the testing process?

Solution Guidance: The purpose of testing contingency plans is to identify vulnerabilities, faults, and inefficient processes. Once these are identified, improvements can be made to ensure the plan is reliable in times of need.

314. Describe the desk-check strategy and its primary benefit Solution Guidance: The desk-check strategy involves distributing copies of appropriate plans to all individuals assigned roles during an incident or disaster, ensuring at least a nominal update and validating the components‘ feasibility and effectiveness.

315. How does a structured walk-through differ from a desk check in testing contingency plans?

Solution Guidance: A structured walk-through involves individuals walking through an organization or alternate site to discuss the steps they would take during a contingency planning event, whereas a desk check involves reviewing the plan without any physical walk-through.

316. What makes simulations more structured compared to walk-throughs, and what do they typically involve?

Solution Guidance: Simulations are more structured because they are driven by a scenario and involve performing communications and specifying physical tasks as if an actual incident occurred, whereas walkthroughs simply discuss the plan.

317. Why is full-interruption testing considered the most rigorous strategy, and what are the challenges associated with it?

Solution Guidance: Full-interruption testing is considered the most rigorous because it requires following all procedures, including interruption of service and data restoration, but it is often too intrusive for most businesses and is typically performed after normal business hours.

318. What are the benefits of conducting periodic talk-throughs or walk-throughs of contingency planning component plans?

Solution Guidance: Conducting periodic talk-throughs or walk-throughs ensures that the plans are regularly updated, preventing erosion of the team‘s ability to respond to incidents and avoiding greater damage than the incident itself.

319. According to the text, why is cross-training important in the context of contingency planning?

Solution Guidance: Cross-training is important because, in a real incident or disaster, some employees may not be available, and alternates need to be trained to perform those duties to ensure continuity of operations.

320. How has the COVID-19 pandemic influenced organizational culture, according to a University of California, Berkeley study?

Solution Guidance: The pandemic has led organizations to emphasize cultural elements like flexibility, transparency, supportiveness, decisiveness, and confronting conflict while deemphasizing customer orientation, individualism, detail orientation, results orientation, and collaboration.

321. What are some key lessons learned from the COVID-19 pandemic regarding contingency planning and organizational operations?

© 2026 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

71

Solution Guidance: Key lessons from the pandemic include the reduced importance of physical meetings, the efficiency of virtual meetings, and the realization that many activities previously considered critical may not be essential for effective operations.

EXERCISES 322. Using a web search engine, search for ―disaster recovery” and “business continuity.‖ How many responses do you get for each term? Note how many companies do not distinguish between the two.

Solution Guidance: When searching for ―disaster recovery‖ and ―business continuity,‖ you‘ll find a significant number of responses for each term, indicating their widespread relevance and importance in business operations. Specifically, ―disaster recovery‖ focuses on restoring IT systems after a crisis, while ―business continuity‖ involves maintaining business operations during and after a disruption.

For ―disaster recovery,‖ search results typically highlight the steps and processes involved in recovering IT systems, data, and infrastructure. Key components include conducting a business impact analysis, analyzing risks, creating an asset inventory, and establishing roles and responsibilities for recovery efforts.

On the other hand, ―business continuity‖ encompasses a broader strategy that includes disaster recovery as one component. Business continuity planning involves identifying potential threats to business operations, developing plans to mitigate those threats, and ensuring that critical functions can continue during a disruption. It also emphasizes the importance of regular testing, training, and updating of the plan to ensure its effectiveness.

Many companies do not clearly distinguish between disaster recovery and business continuity, often treating disaster recovery plans as a subset of the broader business continuity strategy. For instance, while disaster recovery specifically addresses IT and data recovery, business continuity planning includes maintaining all essential business functions, such as communications, customer service, and supply chain management. This overlap can sometimes lead to confusion, but both are critical for comprehensive risk management and organizational resilience.

Companies like IBM and Microsoft outline detailed steps for both business continuity and disaster recovery, underscoring the need for a coordinated approach to handle disruptions effectively. Regular testing and refinement of these plans are crucial to ensure readiness and minimize downtime during actual incidents.

In summary, while there is some overlap, disaster recovery is a component of the larger business continuity plan, and both are essential for ensuring organizational resilience during and after disruptions.

323. Go to http://csrc.nist.gov. Click the plus sign (+) next to Publications, select NIST Special Publications (SPs), and then locate SP 800-34, ―Contingency Planning Guide for Federal Information Systems.‖ Download and review this document. Summarize the key points for an in-class discussion.

Solution Guidance: NIST Special Publication 800-34 provides a comprehensive guide for contingency planning for information technology systems. Here are the key points: Introduction to Contingency Planning 

Contingency planning is essential for the recovery and continuation of critical IT systems in the event of an emergency. This process includes preparing for and mitigating the effects of unplanned disruptions.

Contingency Planning Process

© 2026 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

72



Developing the contingency planning policy statement: Establishing the foundation for the contingency planning process and setting the organizational scope



Conducting the business impact analysis: Identifying critical functions, resources, and interdependencies to assess the potential impact of disruptions



Identifying preventive controls: Implementing measures to reduce the effects of system disruptions and increase system availability and reliability



Developing recovery strategies: Formulating strategies to restore IT functions rapidly and effectively; this includes identifying alternate sites, backup arrangements, and system recovery procedures



Developing an IT contingency plan: Creating a detailed, written plan that outlines the processes and procedures for restoring IT systems following a disruption



Plan testing, training, and exercises: Ensuring that the plan is viable and effective through regular testing and training exercises



Maintaining the plan: Keeping the plan current by making regular updates to reflect changes in technology, business processes, and organizational structure

Types of Contingency Plans 

Business continuity plan: Focuses on sustaining the organization‘s critical business processes during and after a disruption



Disaster recovery plan: Specifically addresses the restoration of IT systems following a disaster



Incident response plan: Provides guidelines for detecting, responding to, and recovering from incidents such as cyberattacks



Occupant emergency plan: Covers the procedures for safeguarding life and property during immediate physical threats



Continuity of operations plan: Ensures that essential functions can continue during a wide range of emergencies, including natural disasters, terrorist attacks, and technological disruptions

Implementation and Maintenance 

Activation and notification: Defining roles, responsibilities, and procedures for activating the contingency plan and notifying relevant stakeholders



Recovery and reconstitution: Outlining the steps to recover and reconstitute IT systems to full operational status



Documentation: Keeping detailed records of recovery efforts to improve future contingency planning and responses

The document emphasizes the importance of a well-structured contingency planning process that integrates with the overall risk management strategy of the organization. Regular testing, updating, and training are critical to the effectiveness of the contingency plan.

For more detailed information, you can access the full document on the NIST website under Special Publications. The website for NIST SP 800-34 is https://csrc.nist.gov/publications/detail/sp/800-34/rev1/final.

© 2026 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

73

324. Using a web search engine, visit one of the popular disaster recovery or business continuity sites, such as www.disasterrecoveryworld.com, www.drj.com, www.drie.org, www.drii.org, or csrc.nist.gov. Search for ―hot site,” “warm site,” and “cold site.‖ Do the provided descriptions match those in this chapter? Why or why not?

Solution Guidance: The terms ―hot site,‖ ―warm site,‖ and ―cold site‖ are commonly used in disaster recovery and business continuity planning to describe different types of backup locations.

A hot site is a fully operational offsite data center equipped with hardware, software, and network connectivity. It is ready to take over operations immediately or within a very short time after a disaster strikes. Hot sites are maintained in real-time synchronization with the primary site, allowing for minimal disruption and downtime. These sites are crucial for businesses that require continuous availability and cannot afford significant downtime.

A warm site is partially equipped with some hardware and network connectivity but not fully prepared for immediate operation. It typically requires some configuration and data restoration from backups before it can take over business operations. The setup time for a warm site is longer than that for a hot site, but it offers a balance between cost and recovery time, making it suitable for organizations that can tolerate a moderate level of downtime.

A cold site is a basic backup facility with minimal infrastructure. It provides space and power but lacks the necessary hardware and software. In the event of a disaster, equipment and data must be transported to the site and set up from scratch, leading to a longer recovery time. Cold sites are the most cost-effective but least responsive option; they are suitable for businesses that can afford longer downtimes.

The descriptions provided on websites such as DRI International and Disaster Recovery Journal match the definitions and distinctions outlined in typical business continuity and disaster recovery discussions. These sources emphasize the varying degrees of readiness and associated costs, which align with standard industry practices. The main difference lies in the specific details and terminologies used by different organizations to describe the same concepts.

For further details, you can explore the DRI International site at www.drii.org and the Disaster Recovery Journal site at www.drj.com.

325. Using the format provided in the text, design an incident response plan for your home computer. Include actions to be taken if each of the following events occur: 

Virus attack



Power failure



Fire



Burst water pipe



Internet service provider (ISP) failure

What other scenarios do you think are important to plan for?

Solution Guidance: A possible answer is provided.

Actions to Take in a Virus Attack a. Detection 

Install and regularly update antivirus software.



Enable real-time scanning and scheduled full system scans.

© 2026 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

74



Be cautious with email attachments and downloads from untrusted sources.

b. Response 

Isolate the infected computer from the network.



Run a full antivirus scan to identify and remove the virus.



Delete or quarantine infected files as advised by the antivirus software.



Update all software to patch vulnerabilities.



Restore from a known good backup if necessary.

c. Prevention 

Enable automatic updates for the operating system and all installed software.



Use strong, unique passwords for all accounts and change them regularly.



Educate household members about safe online practices.

Actions to Take in a Power Failure a. Detection 

Recognize power loss immediately through inactive devices or lack of lighting.

b. Response 

Save any open work immediately if you have a UPS (uninterruptible power supply) with battery backup.



Shut down the computer properly to prevent data loss and hardware damage.

c. Prevention 

Use a surge protector to guard against power surges.



Consider investing in a UPS for critical devices.



Regularly back up important data to an external drive or cloud storage.

Actions to Take in a Fire a. Detection 

Install smoke detectors in key areas, including near the computer.

b. Response 

Evacuate immediately if a fire is detected.



Do not attempt to save computer equipment if it risks personal safety.



Call emergency services as soon as you are in a safe location.

c. Prevention 

Keep flammable materials away from computer equipment.



Use fire-resistant materials and enclosures for computer setup.

© 2026 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

75



Ensure that electrical wiring and equipment are in good condition to prevent electrical fires.

Actions to Take in Case of a Burst Water Pipe a. Detection 

Regularly check for signs of leaks or moisture near your computer setup.

b. Response 

Immediately turn off the power to the computer to prevent electrical hazards.



Move the computer and other electronic devices to a dry area.



Dry the area thoroughly and repair the burst pipe.

c. Prevention 

Keep computers and electronics elevated and away from potential water sources.



Regularly inspect plumbing for signs of wear or leaks.

Actions to Take in Case of an ISP Failure a. Detection 

Noticeable loss of Internet connectivity on all devices

b. Response 

Check the ISP‘s service status page or contact their customer support for information.



Restart your modem and router.



Use mobile data or a backup Internet source if available.

c. Prevention 

Have a backup Internet solution, such as mobile data or a secondary ISP.



Regularly update the firmware of your networking equipment.

Additional Scenarios to Plan for a. Data theft 

Regularly update security software.



Use encryption for sensitive data.



Implement strong password policies and use two-factor authentication.

b. Hardware failure 

Regularly back up data to prevent loss.



Maintain proper ventilation and clean the computer to prevent overheating.



Replace aging hardware components proactively.

c. Natural disasters such as earthquakes and floods 

Secure computer equipment to prevent it from falling or getting damaged.

© 2026 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

76



Keep important data backed up offsite or in the cloud.



Have a disaster recovery plan in place for quick access to essential services and information.

By addressing these scenarios, you can ensure a comprehensive incident response plan for your home computer, enhancing your preparedness and resilience against various threats.

326. Look for information on incident response on your institution‘s website. Does your institution have a published plan? Identify the areas in an academic institution‘s contingency planning that might differ from those of a for-profit institution.

Solution Guidance: Answers to this question will be very subjective and unique in every setting. Some criteria for assessing the responses are listed here.

Thoroughness of Research Institution‘s published plan: Does the student locate and reference an incident response or contingency plan on their institution‘s website? Are they able to provide specific details or sections from the plan?

Comparison: Does the student identify and explain key areas of contingency planning that differ between academic and for-profit institutions?

Critical Analysis Contextual differences: Does the student recognize and explain how the unique environment and priorities of an academic institution influence its contingency planning compared to a for-profit organization?

Specific areas of difference: Are specific areas such as academic continuity, research data protection, campus safety, and compliance with educational regulations addressed in the comparison?

Use of Sources Citing multiple sources: Does the student reference multiple credible sources to support their findings and comparisons? This could include academic publications, industry standards, and institutional documents.

Clarity and Structure Organized response: Is the response well-organized, with clear headings and logical flow? Are the key points easy to follow?

Clarity of explanation: Are the student‘s explanations clear and concise? Do they avoid unnecessary jargon and explain terms as needed?

Example of a Strong Student Response: Finding the Institution’s Plan ―I located the incident response plan for [university name] on their IT services webpage. The plan outlines procedures for handling cyber incidents, data breaches, and physical security threats. Specific sections cover the roles and responsibilities of the IT staff, communication protocols, and steps for incident containment and recovery.‖ Example of a Strong Student Response: Differences in Contingency Planning ―Academic institutions like [university name] have unique contingency planning needs compared to forprofit organizations. Key differences include: 

Academic continuity: Ensuring that teaching and learning activities can continue during disruptions is a primary concern. This includes online learning platforms, access to digital libraries, and remote communication tools for faculty and students.

© 2026 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

77



Research data protection: Academic institutions manage extensive research data, requiring stringent data backup and disaster recovery measures to protect intellectual property and ongoing research projects.



Campus safety: Contingency planning in academic institutions often involves protocols for campus-wide emergencies, such as active shooter situations, natural disasters, and public health crises.



Regulatory compliance: Institutions must comply with educational regulations and standards, such as FERPA (the Family Educational Rights and Privacy Act), which influences their incident response and contingency planning strategies.‖

Example of a Strong Student Response: Sources ―To support these points, I referenced the incident response frameworks provided by NIST, particularly SP 800-34, which offers guidance on contingency planning for IT systems. Additionally, I consulted articles from EDUCAUSE, a nonprofit association focused on IT in higher education, which highlight best practices for academic continuity and data protection in universities.‖ Conclusion A strong response should demonstrate the student‘s ability to conduct thorough research, provide critical analysis, cite credible sources, and present findings clearly and logically. By addressing these criteria, professors can effectively evaluate the student‘s understanding and application of incident response and disaster recovery concepts in both academic and for-profit contexts.

Solution and Answer Guide MICHAEL E. WHITMAN AND HERBERT J. MATTORD, MANAGEMENT OF CYBERSECURITY, 7E, 2026, 9798214011738; CHAPTER 11 CYBERSECURITY M AINTENANCE

TABLE OF CONTENTS Review Questions ........................................................................................................................................ 1 Exercises ...................................................................................................................................................... 4

REVIEW QUESTIONS 327. What is the purpose of a maintenance model in cybersecurity?

Solution Guidance: A maintenance model ensures continuous monitoring and improvement of a cybersecurity program or operation.

328. What managerial guidance does NIST SP 800-100 provide for cybersecurity managers?

Solution Guidance: NIST SP 800-100 provides guidance for the establishment and implementation of a cybersecurity program, detailing ongoing tasks for cybersecurity managers.

329. Why is continuous review important in a cybersecurity governance program?

© 2026 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

78

Solution Guidance: Continuous review ensures that ongoing cybersecurity activities support the organization‘s mission, that policies and procedures are current, and that controls are effective.

330. What are plans of action and milestones used for in cybersecurity governance?

Solution Guidance: They assist in identifying, assessing, prioritizing, and monitoring the progress of corrective efforts for cybersecurity weaknesses in programs and systems.

331. How does continuous assessment contribute to cybersecurity?

Solution Guidance: Continuous assessment monitors initial cybersecurity implementation, tracks changes, analyzes impacts, adjusts controls, and reports system status to organization officials.

332. What role does configuration management play in monitoring IT systems?

Solution Guidance: Configuration management identifies potential cybersecurity problems in IT systems by monitoring the status of cybersecurity controls.

333. How do incident and event statistics help cybersecurity managers?

Solution Guidance: Incident statistics help managers determine the effectiveness of cybersecurity policies, observe performance trends, and identify the need for policy changes.

334. What is the importance of documenting changes in the systems development life cycle?

Solution Guidance: Documenting these changes ensures that cybersecurity impacts are assessed and that the system‘s cybersecurity plan is updated accordingly.

335. What should a tracking system capture in cybersecurity awareness and training programs?

Solution Guidance: A tracking system should capture key information about program activity, including content, dates, audience, costs, and sources.

336. What does capital planning and investment control aim to achieve in cybersecurity?

Solution Guidance: It aims to allocate funding toward the highest-priority cybersecurity investments to ensure the organization‘s cybersecurity needs are met.

337. How can performance measurement programs benefit cybersecurity?

Solution Guidance: Performance measurement programs assess the effectiveness of cybersecurity controls and provide data for isolating problems, justifying investments, and targeting improvements.

338. What is the help desk‘s role in managing cybersecurity incidents?

Solution Guidance: The help desk distinguishes cybersecurity problems from other issues, tracks activities in resolving complaints, and develops a knowledge base of common problems and solutions.

339. What is the primary objective of the external monitoring domain in a cybersecurity maintenance model?

Solution Guidance: The primary objective of the external monitoring domain is to provide early awareness of new and emerging threats, threat agents, vulnerabilities, and attacks to enable the organization to mount an effective and timely defense.

340. Why do many organizations choose to outsource the external monitoring component of their cybersecurity maintenance model?

Solution Guidance: Many organizations outsource the external monitoring component because service providers can offer a tailored supply of processed intelligence, which is more efficient and cost-effective than managing it in-house.

© 2026 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

79

341. What are some of the sources of external intelligence used for monitoring cybersecurity threats?

Solution Guidance: Sources of external intelligence include vendors, organizations for computer emergency response teams, public network sources, membership sites, and commercial cybersecurity services.

342. How does the internal monitoring domain contribute to an organization‘s cybersecurity maintenance model?

Solution Guidance: The internal monitoring domain contributes by identifying, assessing, and managing the configuration and status of information assets, ensuring an informed awareness of the state of the organization‘s IT systems and cybersecurity defenses.

343. What is the significance of maintaining an inventory of network devices and IT infrastructure within the internal monitoring domain?

Solution Guidance: Maintaining an inventory of network devices and IT infrastructure is significant because it helps in monitoring IT activity, detecting variances, and ensuring the security of the organization‘s systems.

344. What is difference analysis, and how is it used in internal monitoring?

Solution Guidance: Difference analysis is a procedure that compares the current state of a network segment against a known previous state to quickly identify changes and improve cybersecurity awareness.

345. What are the primary objectives of the planning and risk assessment domain in cybersecurity maintenance?

Solution Guidance: The primary objectives are to identify and plan ongoing cybersecurity activities, manage risks introduced by IT projects, and integrate risk assessment throughout the organization.

346. What role does a risk assessment play in a cybersecurity maintenance model?

Solution Guidance: A risk assessment identifies and documents risks introduced by projects, processes, or actions and proposes controls to mitigate those risks, driving changes in the cybersecurity program.

347. Describe the process of vulnerability assessment and remediation.

Solution Guidance: Vulnerability assessment and remediation involve identifying documented vulnerabilities, collecting intelligence about networks and systems, documenting and tracking vulnerabilities, and communicating and remediating them in a timely fashion.

348. What is the difference between penetration testing and vulnerability assessment?

Solution Guidance: Penetration testing simulates an attack to identify weaknesses and provide detailed findings, whereas vulnerability assessment focuses on identifying and documenting vulnerabilities without simulating an attack.

349. Why is policy review an important part of the readiness and review domain?

Solution Guidance: Policy review is important because it ensures that cybersecurity policies are current and sound and provide a solid foundation for the cybersecurity program.

350. What benefits do rehearsals offer in the context of cybersecurity readiness and review?

Solution Guidance: Rehearsals offer the benefits of exercising procedures, identifying shortcomings, improving plans before they are needed, and making personnel more effective during actual events.

© 2026 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

80

EXERCISES 351. Search the web for information on the Forum of Incident Response and Security Teams. In your own words, what is the forum‘s mission?

Solution Guidance: This is a representative answer; actual student answers will vary.

The Forum of Incident Response and Security Teams (FIRST) is a global organization that aims to enhance the coordination and effectiveness of incident response teams. FIRST‘s mission is to promote cooperation and information sharing among these teams to handle major cybersecurity incidents more effectively. By fostering collaboration, FIRST seeks to limit the damage caused by security incidents and improve the overall security posture of its member organizations.

FIRST provides a neutral platform where incident response teams from various sectors, including government, academia, and private industry, can exchange best practices, tools, and strategies. This collaboration helps build trust and improves the collective ability to respond to cybersecurity threats globally. Additionally, FIRST maintains and develops international standards such as the Common Vulnerability Scoring System and the Traffic Light Protocol, which aid in the consistent classification and management of security vulnerabilities and sensitive information sharing.

For more detailed information about FIRST, you can visit their official website at www.first.org.

352. Search the web for two or more sites that discuss the ongoing responsibilities of a cybersecurity manager.

What other components of cybersecurity management can be adapted for use in the cybersecurity management model?

Solution Guidance: This is a representative answer; actual student answers will vary.

The ongoing responsibilities of a cybersecurity manager are crucial for maintaining the integrity, confidentiality, and availability of an organization‘s information systems. Here are some components of cybersecurity management that can be adapted for use in the cybersecurity management model.

Risk management: Risk management is a cyclic and fundamental part of continuous improvement in cybersecurity. Cybersecurity managers must identify, analyze, and manage risks to protect the organization‘s mission and information assets. Risk management involves assessing vulnerabilities, evaluating the impact of threats, and implementing appropriate controls to mitigate risks.

Incident response: Cybersecurity managers must develop and maintain an incident response plan that enables the organization to detect, respond to, and recover from cybersecurity incidents efficiently. This includes training help-desk personnel to distinguish cybersecurity problems and maintaining a knowledge base of common issues and solutions.

Configuration and change management: Effective configuration and change management are essential to ensure that changes to the IT environment do not compromise security. Cybersecurity managers need to oversee the identification, evaluation, and implementation of changes as well as continuously monitor the system for unauthorized modifications.

Awareness and training programs: Maintaining up-to-date awareness and training programs is critical.

Cybersecurity managers should ensure that all employees are aware of cybersecurity policies, procedures, and best practices. These programs should be regularly updated to reflect changes in the cybersecurity landscape and organizational policies.

Continuous monitoring and assessment: Continuous monitoring of cybersecurity controls and system performance is necessary to identify and address potential security issues promptly. This involves using

© 2026 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

81

tools and techniques to collect, analyze, and report on relevant performance data as well as conducting regular assessments to evaluate the effectiveness of security measures.

External Sources SANS Institute: The SANS Institute emphasizes the importance of continuous improvement and risk management in cybersecurity. It provides resources and training for cybersecurity professionals to enhance their skills in risk assessment, incident response, and continuous monitoring. (Reference: ―Continuous Improvement and Risk Management in Cybersecurity,‖ www.sans.org.)

ISACA: ISACA materials discuss the critical role of cybersecurity managers in governance, risk management, and compliance. ISACA offers guidelines on implementing robust risk management frameworks and maintaining effective incident response plans. (Reference: ―Governance, Risk Management, and Compliance in Cybersecurity,‖ www.isaca.org.)

Integration into Cybersecurity Management Model The previously described components can be seamlessly integrated into the cybersecurity management model to create a comprehensive framework that addresses all aspects of cybersecurity management. By incorporating risk management, incident response, configuration and change management, awareness and training programs, and continuous monitoring and assessment, organizations can enhance their cybersecurity posture and better protect their information assets.

Overall, an effective cybersecurity management model must be dynamic and adaptable to the evolving threat landscape. Cybersecurity managers play a pivotal role in ensuring that the model remains relevant and effective through continuous review, improvement, and alignment with organizational goals and regulatory requirements.

353. This chapter mentions several tools that can be used by cybersecurity administrators, network administrators, and attackers alike. Search the web for three to five other tools that fit this description.

What are the risks of using such tools?

Solution Guidance: This is a representative answer; actual student answers will vary.

The chapter mentions several tools that can be used both by cybersecurity professionals and attackers.

These tools often have legitimate purposes but can be misused for malicious activities. Here are additional tools that fit this description, with references to their official websites for more information: Nmap (Network Mapper): Nmap is a powerful network scanning tool used for network discovery and security auditing. It can create a map of the network and identify hosts, services, and open ports. Network administrators use Nmap to perform network inventory, manage service upgrade schedules, and monitor host or service uptime. Attackers can use it to scan networks for vulnerabilities and identify potential targets. For more details, see https://nmap.org.

Wireshark: This network protocol analyzer captures and interactively analyzes network traffic in real time.

Cybersecurity professionals and network administrators use Wireshark to troubleshoot network issues, analyze security events, and develop network protocols. Attackers can use it to capture sensitive data, including passwords and other confidential information transmitted over the network. For more details, see www.wireshark.org.

Metasploit Framework: This penetration testing platform helps security professionals find, exploit, and validate vulnerabilities. Cybersecurity professionals use Metasploit to test and improve the security of their systems by simulating real-world attacks. Attackers can use it to exploit known vulnerabilities and gain unauthorized access to systems. For more details, see www.metasploit.com.

© 2026 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

82

Aircrack-ng: This suite of tools is used for assessing Wi-Fi network security. It includes tools for monitoring, attacking, testing, and cracking Wi-Fi networks. Network administrators use Aircrack-ng to test the security of their wireless networks and ensure they are properly secured. Attackers can use Aircrack-ng to crack WEP/WPA-PSK keys and gain unauthorized access to Wi-Fi networks. For more details, see www.aircrack-ng.org.

John the Ripper: This popular password-cracking tool detects weak passwords. Security administrators use it to identify and strengthen weak passwords within their organizations. Attackers use John the Ripper to crack passwords and gain unauthorized access to systems and accounts. For more details, see www.openwall.com/john.

While powerful and valuable for maintaining and improving cybersecurity, these tools highlight the dualuse nature of many technologies in the field. Cybersecurity professionals must stay informed about these tools and their uses to defend against potential attacks effectively. Professionals must also understand the risks of using such tools lest they insert new vulnerabilities or cause damage or disruption to internal or external systems.

354. Using a web browser and the names of the tools from Exercise 3, find a site that claims to be dedicated to supporting hackers. Do you find any references to other hacker tools? If you do, create a list of the tools along with a short description of what they do and how they work.

Solution Guidance: This is a representative answer; actual student answers will vary.

Here are some additional tools that can be used both by cybersecurity professionals and attackers.

Ettercap: This is a comprehensive suite for man-in-the-middle attacks on local area networks. It supports active and passive dissection of many protocols and includes features for network and host analysis. It can perform ARP poisoning, intercept and log data on a network, and inject data into live connections. It can also sniff SSH connections and perform secure HTTP sniffing. For more details, see www.ettercapproject.org/downloads.html.

Angry IP Scanner: This is a fast and open-source network scanner that is easy to use. It can scan IP addresses and ports on a network. It pings each IP address to check that it‘s alive and then resolves its hostname, determines the MAC address, scans ports, and more. Results can be saved in .csv, .txt, .xml, or IP-Port list files. For more details, see http://angryip.org/download/#windows.

Hashcat: This is one of the fastest password recovery tools available. It is designed to break password hashes using a variety of attack modes. It supports multiple hashing algorithms and can utilize both CPU and GPU power to accelerate the cracking process. It is used for recovering lost passwords, auditing password security, and finding out what data is stored in a hash. For more details, see https://hashcat.net/hashcat.

Burp Suite: This is a comprehensive solution for web application security testing. It includes a variety of tools to support the entire testing process, from initial mapping and analysis of an application‘s attack surface to finding and exploiting security vulnerabilities. Burp Suite allows for automated scanning, manual testing, and real-time analysis. Extensions like BurpBeautifier, Flow, and Logger++ add functionality such as beautifying responses, filtering proxy history, and advanced logging. For more details, see https://portswigger.net/burp.

WiFi Pineapple: This is a versatile wireless auditing platform used to perform penetration tests and security assessments on Wi-Fi networks. It can mimic access points, perform man-in-the-middle attacks, and capture sensitive data. It is widely used for rogue access point attacks and network auditing. For more details, see https://hak5.org/products/wifi-pineapple.

These tools highlight the dual-use nature of many cybersecurity technologies. While they are essential for maintaining and improving security, they can also be used for malicious purposes if they fall into the wrong

© 2026 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

83

hands. It is crucial for cybersecurity professionals to be aware of these tools and understand their capabilities to effectively defend against potential threats.

355. Using the components of risk assessment documentation presented in the chapter, draft a tentative risk assessment of a lab, department, or office at your university. Outline the critical risks you found and discuss them with your class.

Solution Guidance: This is a representative answer; actual student answers will vary.

Overview This risk assessment aims to identify and evaluate the critical risks associated with the Computer Science Department at our university. The assessment will cover various areas, including cybersecurity governance, system vulnerabilities, incident response, and configuration management, as guided by the principles in NIST SP 800-100 and related standards.

Risk Identification Cybersecurity governance: Continuous monitoring to ensure policies and procedures are up to date and effective Systems development life cycle (SDLC): Ensuring that cybersecurity is integrated into each phase of system development and maintenance Configuration management (CM): Maintaining accurate records of system configurations and managing changes effectively Incident response: Having a well-defined incident response plan to detect and respond to cybersecurity incidents rapidly Awareness and training: Ensuring all department members are aware of cybersecurity policies and trained in best practices Risk Analysis Governance risks: Outdated policies, insufficient monitoring, and lack of regular updates SDLC risks: Inadequate integration of cybersecurity in system development, leading to vulnerabilities CM risks: Untracked changes, misconfigurations, and lack of proper documentation Incident response risks: Slow detection and response times, inadequate incident tracking, and insufficient training of help-desk personne Awareness and training risks: Low awareness levels, outdated training materials, and lack of regular training sessions Risk Evaluation Impact of governance risks: Noncompliance with regulations, increased vulnerability to attacks Impact of SDLC risks: Introduction of security flaws in new or updated systems Impact of CM risks: Increased likelihood of unpatched vulnerabilities being exploited Impact of incident response risks: Greater damage from incidents due to delayed responses Impact of awareness and training risks: Higher risk of human error leading to security breaches Risk Mitigation Strategies

© 2026 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

84

Governance: Implement a continuous review process, regularly update policies, and ensure active participation of leadership in cybersecurity planning.

CM: Establish strict protocols for documenting and approving changes and regularly audit system configurations.

Incident response: Develop a comprehensive incident response plan, train help-desk personnel, and use automated tools to track and analyze incidents.

Awareness and training: Conduct regular training sessions, update training materials frequently, and implement a tracking system for training compliance.

Critical Risks Found Outdated cybersecurity policies: Policies that are not regularly reviewed and updated can become ineffective as new threats emerge.

Integration of cybersecurity in SDLC: Without proper integration, new systems may be deployed with inherent vulnerabilities.

Change management: Failure to properly document and manage changes can lead to security gaps that are difficult to detect and address.

Incident response capability: Slow response times and inadequate incident tracking can result in prolonged exposure to threats.

Training and awareness: Insufficient training can lead to human errors, which are often the weakest link in cybersecurity defenses.

Discussion with Class Discuss the critical risks identified in the risk assessment. Emphasize the importance of each component in maintaining a secure environment within the department. Highlight how proactive measures and continuous monitoring can mitigate risks and improve the overall security posture of the department. Encourage class participation in suggesting additional mitigation strategies and discussing real-world examples of similar risks and their impacts.

By following the guidelines and principles outlined in NIST SP 800-100 and incorporating a thorough risk assessment process, the Computer Science Department can enhance its cybersecurity defenses and reduce its exposure to potential threats.

Solution and Answer Guide MICHAEL E. WHITMAN AND HERBERT J. MATTORD, MANAGEMENT OF CYBERSECURITY, 7E, 2026, 9798214011738; CHAPTER 12 CYBERSECURITY P ROTECTION MECHANISMS

TABLE OF CONTENTS Review Questions ........................................................................................................................................ 1 Exercises ...................................................................................................................................................... 4

© 2026 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

85

REVIEW QUESTIONS 356. What role do technical controls play in a cybersecurity program?

Solution Guidance: Technical controls are essential for enforcing policies and managing risks in a cybersecurity program, though they cannot secure an IT environment alone.

357. Why is it difficult to enforce a password policy without technical controls?

Solution Guidance: Enforcing a password policy without technical controls is difficult because it relies on human behavior, which is hard to regulate consistently.

358. What are the four functions involved in access control approaches?

Solution Guidance: The four functions involved in access control approaches are identification, authentication, authorization, and accountability.

359. How does biometric authentication verify a person‘s identity?

Solution Guidance: Biometric authentication verifies a person‘s identity using unique physiological characteristics such as fingerprints, retinal patterns, or voice recognition.

360. What are the three types of authentication mechanisms mentioned in the chapter?

Solution Guidance: The three types of authentication mechanisms are something a person knows, something a person has, and something a person can produce.

361. Why is password complexity important in cybersecurity?

Solution Guidance: Password complexity is important because it makes passwords harder to guess, reducing the risk of unauthorized access through brute-force attacks.

362. What is a virtual password, and how is it created?

Solution Guidance: A virtual password is derived from a passphrase using a set of construction rules, making it easier to remember yet complex enough to be secure.

363. How does a smart card differ from a dumb card in authentication mechanisms?

Solution Guidance: A smart card contains a computer chip that can verify multiple pieces of information, whereas a dumb card only contains digital data like a personal identification number.

364. What is the false reject rate in biometric systems?

Solution Guidance: The false reject rate is the percentage of authorized users who are denied access due to a failure in a biometric device.

365. What is the false accept rate, and why is it significant?

Solution Guidance: The false accept rate is the percentage of unauthorized users allowed access due to a biometric device‘s failure; it represents a serious security risk.

366. What is the crossover error rate in biometric systems?

Solution Guidance: The crossover error rate is the point where the false reject rate equals the false accept rate, indicating an optimal balance for biometric systems.

367. How has the rise of smartphones impacted multifactor authentication?

© 2026 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

86

Solution Guidance: The rise of smartphones has increased the use of out-of-band transmission for authentication codes, often replacing dedicated tokens and enhancing multifactor authentication.

368. What are the primary functions of a firewall in cybersecurity?

Solution Guidance: In cybersecurity, a firewall filters or prevents specific information from moving between an untrusted network (e.g., the Internet) and a trusted network.

369. How do packet filtering firewalls determine whether to drop or forward data packets?

Solution Guidance: Packet filtering firewalls examine the header information of data packets and use configuration rules to decide whether to drop or forward them based on criteria such as IP address, packet type, port request, and other elements present in the packet.

370. What distinguishes an application layer proxy firewall from a standard packet filtering firewall?

Solution Guidance: An application layer proxy firewall can examine the application layer of network traffic and filter based on its header content, whereas a standard packet filtering firewall focuses on packet headers.

371. What capabilities do Unified Threat Management devices provide beyond traditional firewall functions?

Solution Guidance: These devices provide capabilities such as stateful packet inspection, network intrusion detection and prevention, content filtering, spam filtering, and malware scanning in addition to traditional firewall functions.

372. What is the primary disadvantage of using application layer firewalls?

Solution Guidance: The primary disadvantage of application layer firewalls is that they are designed for specific application layer protocols and cannot easily be reconfigured to work with other protocols, requiring additional firewalls for each protocol set.

373. How does a single bastion host architecture function, and what is a significant drawback of this approach?

Solution Guidance: A single bastion host architecture functions as the sole device performing firewall duties between an organization‘s internal network and the external network. A significant drawback is that it lacks defense in depth and can be a single point of failure.

374. How does an intrusion detection and prevention system (IDPS) respond when it detects a violation?

Solution Guidance: When an IDPS detects a violation, it activates an alarm that can be audible and visible or silent. It also sends a message to an administrator or a monitoring company.

375. What are the two basic detection methods used by IDPSs? Solution Guidance: The two basic detection methods used by IDPSs are signature-based detection and statistical anomaly-based detection.

376. What is the primary difference between a host-based IDPS and a network-based IDPS? Solution Guidance: The primary difference is that a host-based IDPS monitors activity only on the system where it resides, whereas a network-based IDPS monitors traffic on a network segment for indications of potential attacks.

377. What is a key challenge associated with signature-based IDPS methods?

Solution Guidance: A key challenge with signature-based IDPS methods is the need for continual updates to the signatures as new attack strategies emerge.

© 2026 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

87

378. Why is proper configuration of an IDPS critical for effective cybersecurity management?

Solution Guidance: Proper configuration of an IDPS is critical because it ensures the system can differentiate between routine operations and actual threats, preventing information overload and ensuring accurate threat detection.

379. What are some common technologies that support the protection of information assets across networks and the Internet?

Solution Guidance: Common technologies that support the protection of information assets across networks and the Internet include firewalls, virtual private networks (VPNs), IDPSs, wireless access points (WAPs), network security protocols, and system scanning tools.

380. What is war driving, and how is it typically conducted?

Solution Guidance: War driving is an attacker technique that involves moving through a geographic area or building while actively scanning for open or unsecured WAPs. In some cities, war-drivers mark these locations with chalk in a practice called war-chalking.

381. Why is Wired Equivalent Privacy considered insecure, and what has replaced it as the industry standard?

Solution Guidance: It is considered insecure because cryptologists discovered several fundamental flaws in it that led to vulnerabilities. It has been replaced by Wi-Fi Protected Access as the industry standard.

382. How does WPA3 enhance security for public Wi-Fi networks, compared to its predecessors?

Solution Guidance: WPA3 enhances security for public Wi-Fi networks by providing encryption even for open networks through its Wi-Fi Certified Enhanced Open certification.

383. What measures can users and organizations take to manage wireless network security effectively?

Solution Guidance: Users and organizations can manage wireless network security effectively by implementing wireless cybersecurity protocols, using VPNs and firewalls, restricting network access to preapproved media access control addresses, and regulating the size of the wireless network footprint.

384. What two key approaches can be taken to secure Bluetooth-enabled devices?

Solution Guidance: To secure Bluetooth-enabled devices, users should turn off Bluetooth when not in use and avoid accepting incoming pairing requests unless they know the requester.

385. How do scanners and analysis tools help cybersecurity administrators?

Solution Guidance: Scanners and analysis tools help cybersecurity administrators by enabling them to see what an attacker sees, identify vulnerabilities in systems and cybersecurity components, and locate unsecured points in the network.

386. What is the process of footprinting in the context of pre-attack data gathering?

Solution Guidance: Footprinting is the organized research and investigation of Internet addresses owned or controlled by a potential target organization to collect information about the target.

387. What conditions must be met to legally use a packet sniffer on a network?

Solution Guidance: To legally use a packet sniffer on an organization‘s behalf, you must be on a network that the organization owns, have direct authorization from the network‘s owners, have the knowledge and consent of the content creators, and have a justifiable business reason.

388. What is the primary purpose of using a port scanner in network security?

© 2026 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

88

Solution Guidance: The primary purpose of using a port scanner in network security is to identify active computers, identify the active ports and services on those computers, and help secure open ports that could be used to send commands or gain unauthorized access.

389. What are the potential drawbacks of using scanning and analysis tools?

Solution Guidance: The potential drawbacks include the inability to simulate human creativity, reliance on pattern recognition that may miss new attack methods, inherent errors and vulnerabilities in the tools themselves, and the risks of using ―hackerware‖ that may infect systems.

390. What are the main categories of log data illustrated in Table 12-4?

Solution Guidance: The main categories of log data are network performance, other network data, system performance, other system data, process performance, other process data, files and directories, users, and applications and services.

391. Why is it important to secure the servers that create and store logs?

Solution Guidance: It is important to secure the servers that create and store logs to protect the log data from unauthorized access and ensure its integrity for accurate auditing and analysis.

392. What are the primary issues involved in log generation?

Solution Guidance: Primary issues in log generation include multiple log sources as well as inconsistent log content, timestamps, and log formats.

393. What functions must be addressed to interpret data from the log generation tier of log management infrastructure?

Solution Guidance: Functions that must be addressed include log parsing, event filtering, and event aggregation.

394. What are some of the important management functions within log storage?

Solution Guidance: Important management functions within log storage include log rotation, log archival, log compression, log reduction, log conversion, log normalization, and ensuring log file integrity.

395. How should cybersecurity professionals approach the implementation of new technologies in an organization?

Solution Guidance: Cybersecurity professionals should take a holistic approach to the implementation of new technologies. They should consider all possible benefits and the total cost of ownership, including acquisition, implementation, maintenance, and any additional risk control requirements.

396. What are the key characteristics of an effective network access control solution?

Solution Guidance: An effective solution must offer scalable capacity, be vendor-neutral, support both wired and wireless delivery, and offer multiple deployment options, including physical and virtual appliances as well as cloud services.

397. Why has the integration of SCADA systems into common network infrastructures created challenges for organizations?

Solution Guidance: The integration of SCADA systems into common network infrastructures has created challenges because it leads to highly complex network environments where IT systems, sensors, actuators, and business appliances are interconnected, making them difficult to manage and secure.

398. What are some of the risks associated with IoT devices in a networked environment?

© 2026 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

89

Solution Guidance: Risks associated with IoT devices in a networked environment include the potential for these devices to be compromised due to insufficient cybersecurity, the possibility of them being used as launching points for attacks against other network assets, and their use as zombies or bots in distributed denial-of-service attacks.

399. How does blockchain technology enhance cybersecurity management systems?

Solution Guidance: Blockchain technology enhances cybersecurity management systems by creating distributed ledgers that increase transparency and accountability, making networks and transactions more efficient and reliable, and improving the overall robustness and effectiveness of cybersecurity controls.

400. What is the primary purpose of cryptography in cybersecurity?

Solution Guidance: The primary purpose of cryptography in cybersecurity is to secure information by converting it into a form that cannot be read by unauthorized individuals.

401. How does symmetric encryption differ from asymmetric encryption?

Solution Guidance: Symmetric encryption uses the same key for both encryption and decryption, whereas asymmetric encryption uses a pair of keys—one public and one private—for encryption and decryption.

402. What is a digital signature, and what role does it play in cybersecurity?

Solution Guidance: A digital signature is an encrypted message that verifies the authenticity of the sender and ensures that the message has not been altered, providing nonrepudiation and integrity in cybersecurity.

403. Explain the concept of a hybrid encryption system.

Solution Guidance: A hybrid encryption system combines symmetric and asymmetric encryption. It uses asymmetric encryption to securely exchange symmetric keys, which are then used for efficient communication.

404. What is the significance of the work factor in cryptography?

Solution Guidance: The work factor in cryptography represents the amount of effort, usually expressed in units of time, required to perform cryptanalysis on an encoded message; in other words, it indicates the strength of the encryption.

405. Describe the process of encryption and decryption in the context of symmetric encryption.

Solution Guidance: In symmetric encryption, encryption converts plaintext into ciphertext using a secret key. Decryption converts the ciphertext back into plaintext using the same key.

406. What are the main functions of a public key infrastructure?

Solution Guidance: Its main functions include issuing digital certificates, managing user enrollment and key generation, verifying certificates, and providing key revocation services.

407. How does the XOR cipher work, and what is its key feature?

Solution Guidance: The XOR cipher works by applying a Boolean XOR function to the plaintext and a key stream, resulting in ciphertext; its key feature is that the process is reversible, allowing the original plaintext to be recovered.

408. How does Secure Multipurpose Internet Mail Extensions enhance email security?

Solution Guidance: It enhances email security by adding encryption and authentication through digital signatures based on public key cryptosystems.

© 2026 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

90

409. What is the primary purpose of the Secure Sockets Layer in online transactions?

Solution Guidance: Its primary purpose in online transactions is to provide cybersecurity by encrypting data transferred between customers‘ browsers and web servers.

410. How does Pretty Good Privacy secure email communication?

Solution Guidance: It secures email communication using the International Data Encryption Algorithm for message encoding and RSA for symmetric key exchange and digital signatures.

411. Describe the role of the key distribution center in the Kerberos authentication system.

Solution Guidance: It generates and issues session keys to authenticate users and services within the network.

412. What are the two modes of operation for IPSec, and how do they differ?

Solution Guidance: The two modes of operation for IPSec are transport mode, which encrypts only the IP data, and tunnel mode, which encrypts the entire IP packet, including the header.

413. Why is key management crucial in cryptographic systems?

Solution Guidance: Key management is crucial in cryptographic systems because losing keys can result in the loss of encrypted data or disruption of services protected by those keys.

414. What are some common applications of cryptographic controls in organizations?

Solution Guidance: Common applications of cryptographic controls include securing email, authenticating e-commerce transactions, protecting remote access through VPNs, and enhancing authentication in access control systems.

EXERCISES 415. Create a spreadsheet in which a user inputs eight values into eight different cells. Then create a row that transposes the cells to simulate a transposition cipher using the example from the text. Remember to work from right to left with the pattern 1 > 3, 2 > 6, 3 > 8, 4 > 1, 5 > 4, 6 > 7, 7 > 5, 8 > 2, where 1 is the rightmost of the eight cells. Input the text ABCDEFGH as single characters into the first row of cells. What is displayed at the end of the simulation?

Solution Guidance: To create the spreadsheet and simulate a transposition cipher, follow these steps using the pattern provided. a.

Open a new spreadsheet in Excel or any similar software.

b.

Input the values ‗A‘, ‗B‘, ‗C‘, ‗D‘, ‗E‘, ‗F‘, ‗G‘, and ‗H‘ into cells A1 through H1, respectively.

The cells should look like this: A1: A, B1: B, C1: C, D1: D, E1: E, F1: F, G1: G, H1: H c.

Create a second row that will contain the transposed values according to the given pattern (1 > 3, 2 > 6, 3 > 8, 4 > 1, 5 > 4, 6 > 7, 7 > 5, 8 > 2, where 1 is the rightmost of the eight cells).

To follow the pattern: 

The value in the 1st cell (H1) goes to the 3rd position in the new row.



The value in the 2nd cell (G1) goes to the 6th position in the new row.

© 2026 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

91



The value in the 3rd cell (F1) goes to the 8th position in the new row.



The value in the 4th cell (E1) goes to the 1st position in the new row.



The value in the 5th cell (D1) goes to the 4th position in the new row.



The value in the 6th cell (C1) goes to the 7th position in the new row.



The value in the 7th cell (B1) goes to the 5th position in the new row.



The value in the 8th cell (A1) goes to the 2nd position in the new row.

So, the transposed row (Row 2) will be arranged as follows: 

A2 (new 1st) = E (from D1)



B2 (new 2nd) = H (from A1)



C2 (new 3rd) = A (from H1)



D2 (new 4th) = D (from E1)



E2 (new 5th) = B (from G1)



F2 (new 6th) = G (from B1)



G2 (new 7th) = F (from C1)



H2 (new 8th) = C (from F1)

Thus, the new row will look like this: A2: E, B2: H, C2: A, D2: D, E2: B, F2: G, G2: F, H2: C The displayed result is E H A D B G F C. This exercise demonstrates a basic form of transposition cipher in which the positions of the characters are shuffled according to a specific pattern. This pattern is applied from right to left, with the positions adjusted as described. This concept can be found in discussions of classical cryptography, such as those in cybersecurity textbooks like the one you are using. For more information on such ciphers, you may refer to standard texts on cryptography, such as Applied Cryptography by Bruce Schneier.

416. Search the Internet for information about a technology called personal or home office firewalls. Examine the various alternatives, select three of the options, and compare their functionalities, cost, features, and types of protection.

Solution Guidance: This is an example answer. Each student will have a unique response.

When selecting a personal or home office firewall, it‘s crucial to compare the functionalities, cost, features, and types of protection each option provides. These criteria are used to evaluate the following three highly recommended firewalls.

Bitdefender Box 2 Functionality: Bitdefender Box 2 offers comprehensive home network protection, including Wi-Fi, computers, and smart devices. It features real-time network monitoring and optimization, providing a high level of security for all connected devices.

© 2026 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

92

Cost: The initial purchase includes a one-year subscription to Bitdefender Total Security. After the first year, ongoing protection requires an annual subscription.

Features: Supports speeds up to 1 Gbps; dual-band AC1900 Wi-Fi capabilities; integration with smart home devices (Google Assistant and Amazon Alexa); advanced parental controls; remote management via mobile app Protection types: Antivirus and antimalware; intrusion prevention; web filtering; device management Pros: Effective antivirus and antimalware protection; smart home compatibility; high-speed support; advanced parental controls Cons: Requires a subscription for advanced features; not compatible with mesh networks or Wi-Fi extenders Zyxel Next Generation VPN Firewall (USG20-VPN) Functionality: Designed for both home and small-office use, this firewall provides secure remote access through VPN capabilities and includes robust local network protection.

Cost: Priced around $89, with additional costs for yearly subscription licenses for application layer features Features: Supports up to 10 secure VPN connections and includes four Ethernet ports and one SFP Gigabit Fiber port; Unified Threat Management capabilities; guided installation process Protection types: Stateful packet inspection firewall; VPN (L2TP/IPSec); web content inspection; application controls; antivirus and intrusion prevention Pros: Reliable and robust hardware; regular updates through the Zyxel OneSecurity service; affordable and suitable for home use Cons: Lower throughput for wide area network connections (200–350 Mbps) Ubiquiti UniFi Security Gateway (USG) Functionality: The UniFi Security Gateway integrates advanced firewall policies and high-performance routing, making it ideal for home and small-office environments.

Cost: Starting at $366 Features: Three Gigabit Ethernet ports; capable of routing up to 1 million packets per second; supports virtual local area networks and VPN server functionality; managed via the UniFi Controller software; quality of service prioritization Protection types: Stateful firewall; VLAN support; VPN (client and site-to-site); network segmentation; Internet and application filtering Pros: High throughput and robust performance; intuitive management interface; versatile for different network setups Cons: Firewall and VPN throughput details not explicitly published or guaranteed These three firewalls provide varying levels of protection, features, and price points, making them suitable for different home and small-office needs. The Bitdefender Box 2 firewall is ideal for those needing comprehensive smart home protection, the Zyxel USG20-VPN offers strong VPN capabilities for remote access, and the Ubiquiti UniFi Security Gateway product provides advanced routing and network management features for more complex setups.

© 2026 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

93

417. Go to the website of VeriSign (part of Symantec), one of the market leaders in digital certificates.

Determine whether VeriSign serves as a registration authority, certificate authority, or both. Download its free guide to PKI and summarize VeriSign‘s services.

Solution Guidance: ―This is an example answer. Each student will have a unique response.

VeriSign, now under Symantec, serves both as a registration authority (RA) and a certificate authority (CA). As a CA, VeriSign issues digital certificates, ensuring the authentication of entities and securing communications. As an RA, it handles the verification of entities that request digital certificates, ensuring that the information provided is accurate and trustworthy before issuing the certificates.

Digital Certificates SSL certificates: VeriSign provides various types of SSL certificates, including Single, Wildcard, and Multi-Domain certificates, and caters to different validation levels such as domain validation, organization validation, and extended validation. These certificates ensure encrypted communication and authenticate the identity of websites.

Code signing certificates: These certificates ensure the authenticity and integrity of software applications by verifying the publisher‘s identity and ensuring that the code has not been tampered with.

Public Key Infrastructure (PKI) PKI services: VeriSign‘s PKI services facilitate secure communication by managing public and private keys used in digital certificates. This includes the issuance, renewal, and revocation of certificates, along with key management and cryptographic functions. Identity Protection and Trust Services VeriSign identity protection: This service provides multifactor authentication to enhance the security of user identities during online transactions.

Trust Services: VeriSign‘s trust services include secure online transactions and digital signatures, ensuring the authenticity and integrity of digital communications and documents.

Domain Name Services Domain name registration: VeriSign operates as a registrar, offering domain name registration services. It also provides tools and services to manage and secure domain names.

DNSSEC services: VeriSign supports DNS Security Extensions (DNSSEC) to protect the integrity and authenticity of domain name system data.

Cybersecurity Solutions VeriSign Registry Lock: This service prevents unauthorized changes to domain names by locking the domain name at the registry level, adding a layer of security against hijacking and other malicious activities.

Downloadable Guide to PKI VeriSign provides a free guide to PKI that details its fundamental principles, its components, and its importance in securing digital communications. This guide serves as a comprehensive resource for understanding how PKI works and how it can be implemented to enhance security across various digital platforms.

For more information on VeriSign‘s services, visit their official website at www.verisign.com.

© 2026 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

94

418. Go to csrc.nist.gov and locate Federal Information Processing Standard (FIPS) 197. What encryption standard does it address? Examine the contents of this publication and describe the algorithm discussed.

How strong is it? How does it encrypt plaintext?

Solution Guidance: This is an example answer. Each student will have a unique response.

FIPS 197 addresses the Advanced Encryption Standard (AES), which is a symmetric block cipher capable of encrypting and decrypting data. AES was selected as the encryption standard to replace the older Data Encryption Standard (DES), offering enhanced security and performance.

Strength and Key Sizes 

AES supports key sizes of 128, 192, and 256 bits.



It processes data in fixed-size blocks of 128 bits.



The algorithm is widely regarded as secure and is used globally to protect sensitive information.

Encryption Process Symmetric key algorithm: AES uses the same key for both encryption and decryption, which means both the sender and receiver must have access to the same secret key.

Substitution-permutation network: AES operates through a series of linked mathematical operations known as substitution-permutation networks. It includes multiple rounds of processing the data, with the number of rounds depending on the key length (10 rounds for 128-bit keys, 12 rounds for 192-bit keys, and 14 rounds for 256-bit keys).

Steps in AES Encryption: Initial Round 

AddRoundKey: Each byte of the state is combined with a block of the round key using bitwise XOR.

Steps in AES Encryption: Main Rounds 

SubBytes: A nonlinear substitution step in which each byte is replaced with another according to a lookup table (S-box)



ShiftRows: A transposition step in which each row of the state is shifted cyclically a certain number of steps



MixColumns: A mixing operation that operates on the columns of the state, combining the 4 bytes in each column



AddRoundKey: The round key is added to the state.

Steps in AES Encryption: Final Round 

SubBytes



ShiftRows



AddRoundKey (the MixColumns step is omitted in the final round)

Security and Strength 

AES is considered highly secure against all known practical attacks. Its design has withstood extensive cryptographic analysis.



The strength of AES depends on the key size; the longer the key, the more secure the encryption.

© 2026 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

95

Use Cases 

AES is used in various applications, including securing online communications, protecting data in transit and at rest, and encrypting sensitive information in databases and files.

For more detailed information, you can download the full FIPS 197 publication from https://csrc.nist.gov/pubs/fips/197/final.

419. Search the Internet for vendors of biometric products. Find one vendor with a product designed to examine each characteristic mentioned in Figure 12-4. What is the crossover error rate associated with each product?

Which product would be more acceptable to users? Which would be preferred by cybersecurity administrators?

Solution Guidance: This is an example answer. Each student will have a unique response.

Here are three vendors with biometric products that cover the characteristics mentioned in Figure 12-4: NEC Corporation Face recognition: NEC‘s NeoFace technology is highly accurate and robust, even in poor recognition environments.

Iris recognition: Provides high security and usability in dark environments and for users wearing heavy clothing Fingerprint and palmprint recognition: Known for high performance and used globally for personal identification Voice recognition: Under development and primarily deployed in Japan Ear acoustic authentication: Uses the echo of sound sent through the ear canal for near-instantaneous authentication Crossover error rate (CER): NEC‘s biometric systems generally have low CERs, with face recognition technology being particularly noted for its accuracy.

BIO-key International PortalGuard: A platform that supports password-free authentication using biometrics MobileAuth with PalmPositive: Uses palm scans for authentication; analyzed on a server for high security Fingerprint scanners: Reliable and widely used in various industries for secure authentication CER: BIO-key‘s solutions are designed for high accuracy; though specific CER values are not mentioned, their biometric solutions are trusted for secure and seamless authentication. iProov Face verifier: Uses Genuine Presence Assurance technology to verify the user‘s identity in real time Palm verifier: Similar technology used to authenticate users via palm scans CER: iProov‘s deep-learning technologies and spoof prevention contribute to low CERs, ensuring high levels of security and user trust.

User Acceptability for the Previously Listed Products Face and palm recognition (iProov): These methods are nonintrusive and can be easily used across various devices, making them more acceptable to users who prefer convenience.

© 2026 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

96

Administrator Preference for the Previously Listed Products NEC‘s multimodal systems: Combines multiple biometric technologies (fingerprint, palmprint, face, iris) for robust security, making it ideal for administrators focused on high security and fraud prevention BIO-key PortalGuard: Offers comprehensive management tools and seamless integration with existing systems, making it a preferred choice for administrators who need flexibility and control over security policies Conclusion Each vendor provides strong biometric authentication solutions tailored to different needs. NEC‘s comprehensive suite covers most biometric characteristics with high accuracy, BIO-key offers flexible and robust authentication methods, and iProov provides highly secure and user-friendly face and palm verification. Administrators are likely to prefer solutions with robust security and management features, whereas users will lean toward nonintrusive, convenient options.

© 2026 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

97