Technical Project Paper: Information Systems Security

 

Suppose you are the IT professional in charge of security for a small pharmacy that has recently opened within a shopping mall. The daily operation of a pharmacy is a unique business that requires a combination of both physical and logical access controls geared towards protecting medication and funds located on the premises, as well as the personally identifiable information and protected health information of your customers that resides on your system. Your supervisor has tasked you with identifying inherent risks associated with your pharmacy and establishing strong physical and logical access control methods to mitigate the identified risks.

1) Firewall (1)	4) Desktop computers (4)
2) Windows 2012 Active Directory Domain Controllers (DC) (1)	5) Dedicated T1 Connection (1)
3) File Server (1)

 

Picture:

http://imgur.com/a/KKBxS

Write an eight to ten (8-10) page paper in which you:

1.    Identify at least five (5) potential physical threats that require attention.

2.    Determine the impact of at least five (5) potential logical threats that require attention.

3.    Detail the security controls (i.e., administrative, preventative, detective, and corrective) that the pharmacy could implement in order to protect it from the five (5) selected physical threats.

4.    Explain in detail the security controls (i.e., administrative, preventative, detective, and corrective) that could be implemented to protect from the five (5) selected logical threats.

5.    For each of the five (5) selected physical threats, choose a strategy for addressing the risk (i.e., risk mitigation, risk assignment, risk acceptance, or risk avoidance). Justify your chosen strategies.

6.    For each of the five (5) selected logical threats, choose a strategy for handling the risk (i.e., risk mitigation, risk assignment, risk acceptance, or risk avoidance). Justify your chosen strategies.

7.    Use at least five (5) quality resources in this assignment (no more than 2-3 years old) from material outside the textbook. Note: Wikipedia and similar Websites do not qualify as quality resources.

Your assignment must follow these formatting requirements:

·         Be typed, double spaced, using Times New Roman font (size 12), with one-inch margins on all sides; citations and references must follow APA or school-specific format. Check with your professor for any additional instructions.

·         Include a cover page containing the title of the assignment, the student’s name, the professor’s name, the course title, and the date. The cover page and the reference page are not included in the required assignment page length.

The specific course learning outcomes associated with this assignment are:

·         Explain the concepts of information systems security as applied to an IT infrastructure.

·         Describe how malicious attacks, threats, and vulnerabilities impact an IT infrastructure.

·         Explain the means attackers use to compromise systems and networks, and defenses used by organizations.

·         Explain the role of access controls in implementing a security policy.

·         Explain how businesses apply cryptography in maintaining information security.

·         Analyze the importance of network principles and architecture to security operations.

·         Use technology and information resources to research issues in information systems security.

·         Write clearly and concisely about network security topics using proper writing mechanics and technical style conventions. 

 

Rubric

 

 

	Technical Project Paper: Information Systems Security
Criteria	Unacceptable Below 60% F	Meets Minimum Expectations 60-69% D	Fair 70-79% C	Proficient 80-89% B	Exemplary 90-100% A
1. Identify at least five (5) potential physical threats that require attention. Weight: 10%	Did not submit or incompletely identified at least five (5) potential physical threats that require attention.	Insufficiently identified at least five (5) potential physical threats that require attention.	Partially identified at least five (5) potential physical threats that require attention.	Satisfactorily identified at least five (5) potential physical threats that require attention.	Thoroughly identified at least five (5) potential physical threats that require attention.
2. Determine the impact of at least five (5) potential logical threats that require attention. Weight: 10%	Did not submit or incompletely determined the impact of at least five (5) potential logical threats that require attention.	Insufficiently determined the impact of at least five (5) potential logical threats that require attention.	Partially determined the impact of at least five (5) potential logical threats that require attention.	Satisfactorily determined the impact of at least five (5) potential logical threats that require attention.	Thoroughly determined the impact of at least five (5) potential logical threats that require attention.
3. Detail the security controls (i.e., administrative, preventative, detective, and corrective) that the pharmacy could implement in order to protect it from the five (5) selected physical threats. Weight: 10%	Did not submit or incompletely detailed the security controls (i.e., administrative, preventative, detective, and corrective) that the pharmacy could implement in order to protect it from the five (5) selected physical threats.	Insufficiently detailed the security controls (i.e., administrative, preventative, detective, and corrective) that the pharmacy could implement in order to protect it from the five (5) selected physical threats.	Partially detailed the security controls (i.e., administrative, preventative, detective, and corrective) that the pharmacy could implement in order to protect it from the five (5) selected physical threats.	Satisfactorily detailed the security controls (i.e., administrative, preventative, detective, and corrective) that the pharmacy could implement in order to protect it from the five (5) selected physical threats.	Thoroughly detailed the security controls (i.e., administrative, preventative, detective, and corrective) that the pharmacy could implement in order to protect it from the five (5) selected physical threats.
4. Explain in detail the security controls (i.e., administrative, preventative, detective, and corrective) that could be implemented to protect from the five (5) selected logical threats. Weight: 10%	Did not submit or incompletely explained in detail the security controls (i.e., administrative, preventative, detective, and corrective) that could be implemented to protect from the five (5) selected logical threats.	Insufficiently explained in detail the security controls (i.e., administrative, preventative, detective, and corrective) that could be implemented to protect from the five (5) selected logical threats.	Partially explained in detail the security controls (i.e., administrative, preventative, detective, and corrective) that could be implemented to protect from the five (5) selected logical threats.	Satisfactorily explained in detail the security controls (i.e., administrative, preventative, detective, and corrective) that could be implemented to protect from the five (5) selected logical threats.	Thoroughly explained in detail the security controls (i.e., administrative, preventative, detective, and corrective) that could be implemented to protect from the five (5) selected logical threats.
5. For each of the five (5) selected physical threats, choose a strategy for addressing the risk (i.e., risk mitigation, risk assignment, risk acceptance, or risk avoidance). Justify your chosen strategies. Weight: 10%	Did not submit or incompletely chose a strategy for addressing the risk (i.e., risk mitigation, risk assignment, risk acceptance, or risk avoidance) for each of the five (5) selected physical threats. Did not submit or incompletely justified your chosen strategies.	Insufficiently chose a strategy for addressing the risk (i.e., risk mitigation, risk assignment, risk acceptance, or risk avoidance) for each of the five (5) selected physical threats.Insufficientlyjustified your chosen strategies.	Partially chosea strategy for addressing the risk (i.e., risk mitigation, risk assignment, risk acceptance, or risk avoidance) for each of the five (5) selected physical threats.Partially justified your chosen strategies.	Satisfactorily chose a strategy for addressing the risk (i.e., risk mitigation, risk assignment, risk acceptance, or risk avoidance) for each of the five (5) selected physical threats.Satisfactorilyjustified your chosen strategies.	Thoroughly chose a strategy for addressing the risk (i.e., risk mitigation, risk assignment, risk acceptance, or risk avoidance) for each of the five (5) selected physical threats.Thoroughlyjustified your chosen strategies.
6. For each of the five (5) selected logical threats, choose a strategy for handling the risk (i.e., risk mitigation, risk assignment, risk acceptance, or risk avoidance). Justify your chosen strategies. Weight: 10%	Did not submit or incompletely chose a strategy for handling the risk (i.e., risk mitigation, risk assignment, risk acceptance, or risk avoidance) for each of the five (5) selected logical threats. Did not submit or incompletely justified your chosen strategies.	Insufficiently chose a strategy for handling the risk (i.e., risk mitigation, risk assignment, risk acceptance, or risk avoidance) for each of the five (5) selected logical threats. Insufficiently justified your chosen strategies.	Partially chosea strategy for handling the risk (i.e., risk mitigation, risk assignment, risk acceptance, or risk avoidance) for each of the five (5) selected logical threats. Partially justified your chosen strategies.	Satisfactorily chose a strategy for handling the risk (i.e., risk mitigation, risk assignment, risk acceptance, or risk avoidance) for each of the five (5) selected logical threats. Satisfactorily justified your chosen strategies.	Thoroughly chose a strategy for handling the risk (i.e., risk mitigation, risk assignment, risk acceptance, or risk avoidance) for each of the five (5) selected logical threats. Thoroughly justified your chosen strategies.
7. 5 references Weight: 5%	No references provided	Does not meet the required number of references; all references poor quality choices.	Does not meet the required number of references; some references poor quality choices.	Meets number of required references; all references high quality choices.	Exceeds number of required references; all references high quality choices.
8. Clarity, writing mechanics, and formatting requirements Weight: 10%	More than 8 errors present	7-8 errors present	5-6 errors present	3-4 errors present	0-2 errors present

New materials often lead to new technologies that change society. Describe how silicon-based semiconductors revolutionized computing.

Annotated Bibliography

Under the Final Paper tab in this classroom, determine which case you will be researching for your Final Paper. Provide a description of the case you will be researching. Then, find at least six scholarly sources that are connected with the ethical dilemma and/or case-related content that you will be using to complete your Final Paper. Provide an annotated bibliography of these six (or more) sources.

• APA formatted citation
• A description of the article:
  • What does it address?
  • What were the outcomes or conclusions?
• How does this apply to your case study analysis?
  • Does it provide insights into an ethical concept?
  • Is it a similar case to the one you are analyzing?
  • Does it offer suggestions from best practices in ethical decision making?

Your paper should be at least two pages in length, excluding title and reference pages, and formatted according to APA style as outlined in the Ashford Writing Center.  Visit the Ashford Writing Center and view this Sample Annotated Bibliography for an example of correct annotated bibliography form. 

 

Final Paper

Review the three scenarios below. Choose one of them and address the questions asked within your selected scenario in the form of a written analysis. 

Scenario No. 1: HIPAA Privacy Rule
Case Study: Imagine that you are the privacy officer for a small town hospital. You receive a report that there is a breach of privacy. You are informed that a 15-year-old girl is received at the emergency with an emergency labor. The baby is delivered in the emergency room as there is no time to move the patient to the obstetrics (OB) department. In addition to the emergency delivery, the baby is born with multiple medical problems. Once the mother and baby are moved to obstetrics and neonate, care is given to both. 

The OB nurse who took care of the mother and baby completes her shift, and she goes home to her own daughter to have a talk with her. She sits her daughter down and pleads with the girl to tell her if she ever has any problems, especially when it comes to pregnancy. The nurse tells her daughter the story about the young patient who delivered that evening, and she accidentally mentions the patient’s name. The patient’s name is one of those odd names that immediately triggers the nurse’s daughter to relay that she knows the patient. The mother/nurse, realizing that she made a big mistake by mentioning the patient’s name, pleads with her daughter not to say anything. Needless to say, word shoots through the four high schools in the town the next day.

The nurse returns to work the following evening, and she contacts you to hand in her badge and keys, stating that she knows she made a mistake by breaching the young patient’s privacy and she knows she is going to be fired. In addition to the breach of the obstetrics nurse, you learn that the patient hid her pregnancy from her family, and to make matters worse, her aunt and mother are both nurses at the hospital. You know both of these nurses on a professional and personal level. 

Scenario No. 1 HIPAA Privacy Rule Project Assignment:
Research the HIPAA Privacy Rule here: 

U.S. Department of Health and Human Services. (2002). Standards for privacy of individually identifiable health information; Final Rule. Federal Register, 67(157), 53182-53273. Retrieved from http://www.hhs.gov/ocr/privacy/hipaa/administrative/privacyrule/privrulepd.pdf.

Then, perform additional research regarding the HIPAA Privacy Rule and prepare your Final Paper by analyzing the issues through these questions in regards to the above scenario:

1. Analyze the specific requirements needed to perform this investigation.
2. Identify whether this incident was an actual breach of privacy according to the HIPAA law.
3. Examine the differences and similarities between the hospital’s stance and HIPAA as to whether the nurse should be fired from her job.
4. Explain why you would fire or not fire the nurse immediately or whether you would put her on administrative leave awaiting the details of the investigation.

Scenario No. 2: DNR
Project Assignment: Review your State Government’s website and search for its official Do Not Resuscitate (DNR) Form. Along with the form will be information and instructions regarding the form. In addition, research three area hospitals to determine if they provide separate DNR forms. Then, perform additional research regarding DNR and prepare your Final Paper by analyzing the issues through these steps:

1. Analyze the requirements of your State Government’s DNR.
2. Identify the requirements of the three hospital’s DNRs.
3. Examine the differences and similarities between the state’s and the three hospital’s DNR requirements, and address the following questions: 
   • What are they?
   • Which one should you follow?
4. Explain how a DNR is applied if a patient is under hospice care and EMTs are called.

Scenario No. 3: Institutional Code of Ethics
Project Assignment: Codes of ethics are standards that outline how individuals or groups of people are to act. The healthcare/medical community has its own code of ethics, which is outlined in the American Medical Association’s Code of Medical Ethics. Review the following:

1. AMA’s Code of Medical Ethics here: 
   American Medical Association. (2013).  AMA’s code of medical ethics. Retrieved from http://www.ama-assn.org/ama/pub/physician-resources/medical-ethics/code-medical-ethics.page.
2. Three local or regional hospitals’ codes of ethics.
3. Various scholarly research on healthcare codes of ethics  (at least seven additional sources).

Then, prepare your Final Paper by analyzing the issues through these steps:

1. Analyze the specific requirements of a code of ethics.
2. Identify three critical elements of the AMA’s code that you believe are most important.
3. Examine the differences and similarities between the AMA’s Code of Medical Ethics requirements and the code requirements of the three hospitals that you researched.
4. Explain why certain individuals and/or groups (please name these) should follow a hospital’s code of ethics.  

Writing the Final Paper

The Final Paper:

1. Must be eight to ten double-spaced pages in length, excluding title and reference pages, and formatted according to APA style as outlined in the Ashford Writing Center.
2. Must include a title page with the following:
   1. Title of paper
   2. Student’s name
   3. Course name and number
   4. Instructor’s name
   5. Date submitted
3. Must begin with an introductory paragraph that has a succinct thesis statement.
4. Must address the topic of the paper with critical thought.
5. Must end with a conclusion that reaffirms your thesis.
6. Must use at least eight scholarly sources (not including the course text) that were published within the last five years, including a minimum of four sources from academic journals found in the Ashford University Library.
7. Must document all sources in APA style, as outlined in the Ashford Writing Center.
8. Must include a separate reference page, formatted according to APA style as outlined in the Ashford Writing Center.

 

Option 1: Portfolio Project: Medical Errors

Submit a paper that identifies and examines two distinct types of sentinel events that frequently occur in healthcare organizations. The error types that you select must be significantly different; for example, patient suicide and wrong-site surgery.

In writing this paper, you should consider and address (as necessary) the following:

1. What system factors influence organizational performance?
2. How do accreditation standards or government regulations guide performance and process design?
3. What is the role of the quality or risk manager in addressing the issues?
4. What processes and techniques can be used to investigate, prevent, and control these types of events now and in the future?
5. What measures can be used to assess the performance of the organization and the risk management plan in this area as it relates to patient safety?
6. What impact could these events have on organizational performance, compliance, and accreditation?

Your paper should be well-written and meet the following requirements:

• 8-10 pages in length.
• Formatted according to the CSU-Global Guide to Writing and APA Requirements.
• Include at least six references from the peer-reviewed articles. The CSU-Global Library is a good place to find peer-reviewed articles.

 

Week 5 Discussions:

 

 

 

1.       From the e-Activity, analyze the situation from the company you selected and the internal controls that may have been compromised to allow the problem to occur and the resulting financial impact to the business. Propose a plan to prevent this type of situation in the future.

 

Match the situation with the primary components of the fraud triangle factor (opportunity, financial pressure, or rationalization) that best describes it and specifically create strategies to address this component of the triangle to prevent recurrence for the above-mentioned company.

 

 

 

2.       Assess the external and internal factors that influence credit policy and decision making  within a company that extends credit to its customer when providing a good or service on account. Indicate the factor of most significance in today’s business environment. Provide support for your rationale.

 

Assuming that a certain percentage of customers will be deemed high risk, recommend a strategy to minimize a company’s bad debt exposure. Indicate how the company would implement the strategy. Provide support for your recommendation.