Sem: Dec-2024 Maximum Marks: 50 Examination: End Exam Date: 8/12/2024 Duration: 2.5hrs
Programme code: 18 Programme: MBA for Working Executive	Class: SY	Semester: III Batch- 2023-24
College: K. J. Somaiya Institute of Management	Name of the department/Section/Center: DST
Course Code: 117P18C308	Name of the Course: Information Security Management
Instructions: Do not mix-up the sub questions

Question No.	Max. Marks
Q.1	Using the below written case study, answer the following questions: Background: FutureTech, a rapidly growing technology firm, specializes in cloud-based solutions for businesses. As the company expanded, it started storing vast amounts of sensitive client data, including financial records, personal information, and proprietary business processes. With increasing data breaches reported globally, FutureTech’s leadership recognized the urgency of strengthening its information security systems. The Chief Information Security Officer (CISO), Priya Sharma, was tasked with leading the efforts to enhance the organization’s information security posture. After a preliminary risk assessment, Priya identified several areas of concern: Outdated Software Systems: Many internal applications were running on outdated versions, leaving the organization vulnerable to cyberattacks. Weak Access Controls: Employees had broad access to confidential data, which could potentially lead to insider threats or accidental data exposure. Third-Party Dependencies: FutureTech relied on multiple third-party vendors for software development and cloud services. However, these vendors did not always adhere to stringent security standards, creating potential vulnerabilities. Inadequate Training and Awareness: Employees were not adequately trained in recognizing phishing emails, social engineering attacks, or secure data handling practices. Lack of Incident Response Plan: Although the company had cybersecurity tools in place, there was no formalized incident response plan to handle potential breaches or cyberattacks. The Risk Analysis: Priya initiated a comprehensive risk analysis process, which included: Risk Identification: Listing all potential threats, including cyberattacks, data breaches, insider threats, and vendor-related risks. Risk Assessment: Evaluating the impact and likelihood of each identified risk. For instance, outdated software systems were deemed highly likely to be exploited, with a high impact on operations and reputation if compromised. Risk Prioritization: Using a risk matrix, Priya ranked the identified risks based on their severity. She prioritized addressing software vulnerabilities and strengthening access controls due to their high impact. Risk Mitigation Plan: Priya developed a mitigation plan, including implementing software patches, enforcing multi-factor authentication, conducting regular security audits of third-party vendors, and rolling out mandatory security training for all employees. Ongoing Monitoring and Review: She emphasized the importance of continuously monitoring the effectiveness of these measures and adjusting them based on emerging threats. Challenges Encountered: While implementing the mitigation plan, Priya faced several challenges: Budget Constraints: The finance department was hesitant to allocate significant resources to information security, especially since there had been no major incidents in the past. Resistance to Change: Employees were resistant to new policies, such as stricter password requirements and regular security training sessions. Vendor Pushback: Third-party vendors were slow to implement the recommended security improvements, citing their own cost and operational challenges. Priya understood that achieving a robust security framework was not just a technical issue but also involved change management, effective communication, and stakeholder engagement. What are the key components of an effective risk analysis in information security management? How can FutureTech ensure its risk analysis remains relevant over time? What strategies could Priya use to address the budget constraints and resistance to change from employees? How can the company incentivize its third-party vendors to improve their security posture? Given the constraints faced by FutureTech, what would you prioritize first—enhancing software security, improving access controls, or focusing on employee training? Justify your decision. How critical is having an incident response plan in place for FutureTech? What key elements should be included in such a plan? In your opinion, should FutureTech focus on investing in the latest cybersecurity technologies, or should it prioritize building a security-aware culture within the organization? Why?	30 M
Q.2	(a) Explain the different security objectives. (b) Explain the different types of access control mechanisms used in an organization.	(10 M)
Q.3	Write a short note on the following(Any two): Firewall Intrusion Detection Systems HIPAA Data Protection Bill	(10 M)