Project

IT Security System Audits PSCS 3111

Project: Addressing a New Business’s Compliance Responsibilities Purpose This project provides an opportunity for you to apply principles related to auditing to ensure information systems are in compliance with pertinent laws and regulations, as well as industry requirements.

Required Source Information and Tools

Web References: Links to Web references are subject to change without prior notice. These links were last verified on July 1, 2015.

To complete the project, you will need the following: 1. Course textbook 2. Access to the Internet to perform research for the project

· PCI Security Standards Council: https://www.pcisecuritystandards.org

· COSO Internal Control—Integrated Framework Executive Summary (2013): http://www.coso.org/documents/990025P_Executive_Summary_final_may20_e.pdf

· COSO Internal Control—Integrated Framework PowerPoint (2013): http://www.coso.org/documents/COSOOutreachDeckMay2013.pptx

· COSO Internal Control—Integrated Framework (2013) whitepaper: http://www.kpmg.com/Ca/en/External%20Documents/Final-New-COSO-2013Framework-WHITEPAPER-web.pdf

Learning Objectives and Outcomes

You will be able to:

· Explain the purpose of PCI DSS

· Analyze business factors that influence PCI DSS compliance

· Describe potential consequences of failing to demonstrate PCI DSS compliance

· Apply standards and frameworks to the development of information security internal control systems Analyze the use of information security controls within IT infrastructure domains

 

 

 

 

Introduction Public and private sector companies are expected to comply with many laws and regulations as well as industry requirements to promote information security. Assessments and audits of the information technology (IT) environment help to ensure a company is in compliance. A successful information security professional must be able to assess a business’s needs, evaluate various standards and frameworks, and develop a customized, integrated internal control system that addresses the company’s compliance responsibilities. Furthermore, the professional must be able to communicate with various people—both inside and outside the organization—to facilitate awareness of how control activities mitigate weaknesses or potential losses that could compromise the company’s information security.

 

Deliverables The project is divided into three parts. Details for each deliverable can be found in this document. Refer to the course syllabus for submission dates.

· Project Part 1: PCI DSS Compliance Requirements

· Project Part 2: Design of an Integrated Internal Control System

· Project Part 3: Compliance within IT Infrastructure Domains

 

 

Project Part 1: PCI DSS Compliance Requirements

Scenario S&H Aquariums is a new online retailer that is about to begin selling aquariums and other items for aquarium hobbyists. In recent months, many companies have been featured in the news because of information security breaches that have exposed customers’ credit card data. S&H Aquariums’ management team is worried about the negative impact a potential breach could have on the company’s reputation and business standing. S&H Aquariums has hired you, an information systems security expert, to ensure that the company is prepared to accept credit card payments for purchases made through the company’s Web site. To kick off the planning phase, the board of directors would like you to write a report explaining what the company will need to do to minimize risks to sensitive data and comply with applicable laws and regulations, as well as industry standards. In preparation, you sit down with the company’s president and discuss the following details:

· Per the company’s strategic plan, the company expects to have between 20,000 and 1,000,000 credit card transactions during the first year of operations. However, the board would like to know what differences to anticipate as the volume of credit card transactions grows in the coming years.

· The company will initially accept payments made with MasterCard and Visa only, but it may decide to accept other credit cards in the future.

· The board of directors is discussing the possibility of opening a bricks-and-mortar store in the future, and the board would like to consider any compliance-related issues prior to making that decision.

· The board consists of professionals from a variety of fields. It is unlikely that any of the board members are familiar with complex information security concepts or with PCI DSS, the set of requirements that prescribes operational and technical controls to protect cardholder data.

 

Tasks

· Review the information related to PCI DSS compliance provided in the course textbook and in the Internet resources listed for this project. Consider how this information relates to the description of S&H Aquariums provided in the scenario above.

· Write a report for S&H Aquariums’ board of directors. Include the following:

· Introduction

· PCI DSS Overview

· Include a discussion of the six principles, twelve primary requirements, and the sub-requirements of PCI DSS.

· Rationale

· Explain why the company needs to address the PCI DSS requirements and describe potential consequences if the company is not able to demonstrate compliance.

· Immediate Considerations for PCI DSS Compliance

· Analyze factors (including those introduced in the scenario above) that will influence S&H Aquariums’ immediate plans for PCI DSS compliance. Discuss payment brands (credit card companies), transaction volumes, merchant levels (i.e., 1 through 4), and types of reporting required in relation to S&H Aquariums’ business projections.

· Future Considerations for PCI DSS Compliance

· Analyze contingencies that may influence PCI DSS compliance in the future. Address potential questions from the board, including but not limited to:

· What would be expected of the company if credit card volume increases past 1,000,000 transactions in future years?

· What should S&H Aquariums do to demonstrate PCI DSS compliance if it begins to accept American Express or Discover?

· How would opening a bricks-and-mortar store affect the company’s responsibilities for PCI DSS compliance?

· Conclusion

As a reminder, you may use the textbook for this course and the Internet to conduct research. You are encouraged to respond creatively, but you must cite credible sources to support your work.

Submission Requirements

· Format: Microsoft Word

· Font: Arial, 12-point, double-space

· Citation Style: APA

· Length: 2–3 pages

Self-Assessment Checklist

· I have created a report that uses a professional tone and includes correct terminology.

· In my report, I have described PCI DSS, provided a sound rationale for addressing PCI DSS compliance, and analyzed immediate and future considerations for PCI DSS compliance.

· I have conducted adequate independent research for this part of the project.

 

 

 

Project Part 2: Design of an Integrated Internal Control System

Scenario S&H Aquariums’ board of directors reviewed the report you submitted on PCI DSS compliance (in Project Part 1), and they were grateful for the background and analysis you provided. After discussing the information, they realized that PCI DSS compliance is but one aspect of the overarching information security system needed to launch and sustain the new business. The board would like to understand the bigger picture of how you will develop the control system needed to protect credit card data and document compliance with the PCI DSS requirements. You know this will be a rather complex process. You are planning to use a combination of frameworks and standards to guide the development of the control system. Furthermore, you are making it a priority to design an integrated system so the company can efficiently prepare for multiple types of audits, not just those related to PCI DSS compliance. After explaining to the board that, realistically, you and your team will need much more time to research, discuss, plan, and implement the company’s control system, you agree to write a report that highlights some of the key principles and procedures involved in this undertaking. Tasks

· Review information about the following frameworks or standards introduced in the textbook: COSO, COBIT, SOC, ISO, and NIST. Consider how you may use some or all of these frameworks/standards to guide the creation of an internal control system at S&H Aquariums. Note the similarities or overlaps among each set of frameworks/standards, as well as the differences.

· Using the Internet resources listed for this project, examine the specifics of the COSO framework, which outlines five components of internal control and 17 principles.

· Create a table or other visual aid to map the 17 principles of COSO to the 12 primary PCI DSS requirements. Use your table or visual aid to assess how specific elements of COSO and PCI DSS correspond with one another, as this will inform forthcoming decisions about which controls S&H Aquariums should implement.

· Write a report for the board of directors. Include the following:

· Introduction

· Plan for Developing an Integrated Internal Control System

· Explain how and why you will use multiple frameworks and standards to guide your development of this control system.

· Explain how you will ensure the control system can be used to demonstrate PCI DSS and other forms of compliance.

· Table (or Visual Aid) Showing COSO – PCI DSS Alignment

· In addition, explain how creating this table/visual aid—as well as other, more complex tables with multiple standards/frameworks—would be useful for designing an integrated internal control system.

· Conclusion

 

As a reminder, you may use the textbook for this course and the Internet to conduct research. You are encouraged to respond creatively, but you must cite credible sources to support your work.

Submission Requirements

· Format: Microsoft Word

· Font: Arial, 12-point, double-space

· Citation Style: APA

· Length: 2-3 pages

Self-Assessment Checklist

· I have created a report that uses a professional tone and includes correct terminology.

· In my report, I have explained how and why I would use a combination of standards/frameworks to guide the development of an integrated internal control system, and explained how I would ensure the control system could be used to demonstrate multiple forms of compliance.

· In my report, I have included a table or visual aid that shows alignment of COSO and PCI DSS, and I have explained how this would be useful for designing an integrated internal control system.

· I have conducted adequate independent research for this part of the project.

 

Project Part 3: Compliance Within IT Infrastructure Domains

Scenario S&H Aquariums’ board of directors has been receptive to your plan for building an internal control system. They are eager to move forward and expand the company’s IT infrastructure so they can begin processing credit card transactions through their Web site. The company has recently hired a new team member, Marcus, who will work with you to address some of the company’s information technology needs. Marcus brings a good deal of expertise in IT, but he needs some additional training and development on information security and compliance issues. To bring Marcus up to date on the company’s plans, you ask him to read the two reports you prepared for the board of directors (in Project Parts 1 and 2). Next, you will meet with him to discuss the integrated internal control system and explain how such a system can be used to proactively prepare for audits. Clearly, there is a lot to consider! You decide to create a presentation that is structured around the seven domains of a typical IT infrastructure. You will provide examples of controls that you think S&H Aquariums should implement, and explain how these controls relate to COSO and PCI DSS. You will also explain how this will, ultimately, help the company demonstrate compliance.

· Tasks Consider the seven domains of a typical IT infrastructure, as well as controls that are often associated with each of those domains.

· Based on your earlier analysis of S&H Aquariums and its compliance requirements (in Project Parts 1 and 2), which controls do you think S&H Aquariums should implement as part of the integrated internal control system? You may create a table, map, or other visual aid to help you evaluate control options for each domain. Note: For this part of the project, consider how prospective controls align with COSO and PCI DSS. In an actual organization, the controls you implement would most likely align with additional frameworks/standards, but you are not required to research and document that for this project.

· Create a presentation that includes:

· Title, date, and your name and contact information

· A brief introduction

· A section for each of the seven domains in a typical IT infrastructure In each domain section:

· Explain what the domain is and why it is significant for compliance.

· Describe at least two controls related to this domain that you would recommend S&H Aquariums implement as part of its integrated internal control system.

· Provide your rationale for selecting each control; explain how the control relates to one or more principles of COSO and one or more PCI DSS requirements.

· Implications for Compliance

· Explain how use of the controls you have presented will support the company’s efforts to demonstrate compliance.

· Conclusion

· References

As a reminder, you may use the textbook for this course and the Internet to conduct research. You are encouraged to respond creatively, but you must cite credible sources to support your work.

Submission Requirements

· Format: Microsoft PowerPoint

· Font: Arial; 36-point headings, 20- to 32-point body text

· Citation Style: APA

· Length: 12 to 16 slides

Self-Assessment Checklist

· I have created a presentation that uses a professional tone and includes correct terminology.

· In my presentation, I have described the seven domains of a typical IT infrastructure. For each domain, I have recommended at least two controls and provided my rationale for the selections. I have also discussed implications of implementing these controls for demonstrating compliance.

· I have conducted adequate independent research for this part of the project.

Page 1

 
Do you need a similar assignment done for you from scratch? Order now!
Use Discount Code "Newclient" for a 15% Discount!

For The Units 6-7 Assignment You Will Be Required To Build And Train A Neural Network To Recognize Letters Of The Alphabet And Numbers Based Upon Their Design Using A Seven Segment Display Where Each Segment Of The Display Is One Input Into The Neural Net

For the units 6-7 assignment you will be required to build and train a neural network to recognize letters of the alphabet and numbers based upon their design using a seven segment display where each segment of the display is one input into the neural network.

CS4407Unit6WAImg01.PNG

Using the numbering for the segments in the previous figure as the inputs into your neural network.  You are welcome to use any network design that will accurately solve the problem.   In this case your network must be able to identify the letter or number based upon the pattern of segments.   For example if the segments 1,2,3,4, and 7 are lighted then the pattern would represent the number 3.  The number three must be represented as a binary number that is the output of the neural network.

Not all of the letters of the alphabet can be accurately recognized.  The following chart represents the numbers and letters that your network must be able to recognize with the exception of letters S and Z which cannot be distinguished from the numbers 2 and 5.

CS4407Unit6WAImg02.PNG

The output of your network will be the ASCII code of the letter or number defined in the following list and represented as binary.  Since the largest number is 72 you will require 7 outputs to represent any of the 7 segment numerals.

Character       ASCII       Neural Network Output (Binary)

 

0                  48                0110000

1                  49                0110001

2                  50                0110010

3                  51                0110011

4                  52                0110100

5                  53                0110101

6                  54                0110110

7                  55                0110111

8                  56                0111000

9                  57                0111001

A                 65                1000001

B                 66                1000010

C                 67                1000011

D                 68                1000100

E                 69                1000101

F                 70                1000110

H                 72                1001000

We are using a 7 segment display to recognize letters and numbers, however it is important to know that we could use the same approach to recognize virtually anything.   We are using a 7 segment display because our simulated neural network only has the capacity to accommodate 10 input values.  However if we had more input values we could recognize any handwritten letter or number.  Consider the following examples example.  Assume that we had a matrix that was 16 x 16 (total of 256 point) and each of the points were an input into our neural network.  Further assume that we could overlay a hand written letter or number onto this matrix.  Every pixel that was colored by the letter would have a value of 1 and any pixel that was not colored would have a value of 0.

CS4407Unit6WAImg03.PNG

Using this as input we could easily train a neural network to ‘recognize’ various hand written letters.  As the amount of training increases the accuracy of the network to detect similar letters that might not have the exact same shape (but a similar one) would increase.

Let’s consider another example.   Assume that we had a neural network and instead of the inputs being 1 or 0, we had the ability to determine a value between 0 and 1 as input where 0 was the color white and 1 the color black and shades of grey as values in between 0 and 1.

CS4407Unit6WAImg04.PNG

Using this approach we could train the neural network to recognize faces, people, and objects … such as Albert Einstein here.  In practice, facial recognition software will typically limit the amount of ‘features’ that are used as input to the neural network to areas that have the greatest predictive power such as the position of the eyes, nose, mouth, and perhaps chin, but the principle remains the same as the network that we will build to recognize the letters in the 7 segment display.

To complete this assignment, you will need to download and install the Basic Prop neural network simulator.  Basic Prop is distributed as an executable Java Jar file.  You can either execute the file on your local computer or you can access the simulator in the Virtual Computing Lab.   To run the simulator on your local computer you will need to have the Java JRE (java runtime environment) version 1.5 or greater installed on your computer.

The simulator can be downloaded from the basic prop website at the following URL: http://basicprop.wordpress.com/2011/12/21/introducing-basic-prop-a-simple-neural-networ/

As part of the assignment you will need to create a pattern file for the 7 segment display input data.  You can see an example of a pattern file on the basic prop website.

I have provided an example of a pattern file below.  In this case I have set up the pattern file to teach the neural network to add two binary numbers.  Notice that the first set of digits is the input value in binary.  The second set of digits is the output value of the network.  Notice how in the first set of digits I have 0 0 0 0 1 0 0 0 0 0 1 as input.  In this example which adds two numbers together, I have defined the input as two binary numbers each 5 digits in length (in the first example the two numbers are 1 in binary).  The second set of digits are the output of the network in the example it would be 2 in binary (0 0 0 1 0) ….1 plus 1 is 2.

The network is then ‘taught’ to add the two numbers together.

Number of patterns = 3

Number of inputs = 10

Number of outputs = 5

[Patterns]

0 0 0 0 1 0 0 0 0 1    0 0 0 1 0

0 0 0 1 0 0 0 0 0 1    0 0 0 1 1

0 0 0 1 1 0 0 0 1 0    0 0 1 0 1

Another example is using the neural network to process logic patterns such as AND, OR, and the XOR. You can download the pattern file for AND logic and use the same file format for a network that can solve the 7 segment display problem (you could also cut and paste my add numbers pattern file from above).   When you have created the pattern file (the pattern file defines the number of inputs and the outputs in the problem and the number of test cases you can use it to train and test your neural network.

Using the simulator you will need to design a network, load the pattern file, and then train the network.  You should experiment with your network design to make sure that your network and solve all of the test cases.  If your network is not solving all of the cases, then you should alter the design of the network and train the network again.When you have workable network design that solves all of the cases:

  • You should save your network, capture a screen shot of your simulator with the completed solution, and save your pattern file.
  • You must report on the results of testing your network after it has been trained.
  • You must include the average per pattern error metric as part of your testing results.
  • Your error should be under 5% in order for the network to be acceptable.
  • You must report the number of training steps that your network required.
  • You should report the metrics chosen in basic prop for training your network report the defaults if you do not change them.
  • You should report these metrics for EACH network that you test identifying the network that you selected as the solution for your assignment.
  • You should also use the feature in basic prop to save your weights to a file.
  • All of these items should be submitted as part of your assignment.
  • You should also write a short paper explaining the process that you went through to develop your network including any network designs that were unable to accurately determine what each input character was and the reasons that you discovered the network design was not successful.

NOTE: You will have 2 weeks to compete this assignment; it will be due at the end of Week/Unit 7.

 
Do you need a similar assignment done for you from scratch? Order now!
Use Discount Code "Newclient" for a 15% Discount!

Excel

Grader – Instructions Excel 2019 Project

Excel_2F_Commercial_Compensation

 

Project Description:

In the following project, you will edit a worksheet that summarizes the compensation for the commercial salespersons who qualified for bonuses in two regions.

 

Steps to Perform:

Step Instructions Points Possible
1 Open the Excel workbook Student_Excel_2F_Commercial_Compensation.xlsx downloaded with this project. 0
2 Rename Sheet1 as Arizona and rename Sheet2 as Washington. 4
3 Click the Arizona sheet tab to make it the active sheet, and then group the worksheets. In cell A1, type Marisol Desserts and Spices and then Merge & Center the text across the range A1:F1. Apply the Title cell style. Merge & Center the text in cell A2 across the range A2:F2, and then apply the Heading 3 cell style. 10
4 The bonus rates for each salesperson are determined by sales amounts using the following scale: Sales greater than $35,000 earn a bonus rate of 5%, sales greater than $25,000 earn a bonus rate of 4%. All other sales (any amount greater than 0) earn a bonus rate of 2%. With the sheets still grouped, in cell C5 use an IFS function to determine the commission rate for the first salesperson whose sales are in cell B5. Fill the formula down through cell C8. 6
5 In cell D5, calculate Bonus for Moreland by multiplying the Sales times the Bonus Rate. Copy the formula down through cell D8. 4
6 In cell F5, calculate Total Compensation by summing the Bonus and Base Salary for Moreland. Copy the formula down through the cell F8. 8
7 In row 9, sum the columns for Sales, Bonus, Base Salary, and Total Compensation. Apply the Accounting Number Format with two decimal places to the appropriate cells in row 5 and row 9 (do not include the percentages). 4
8 Apply the Comma Style with two decimal places to the appropriate cells in rows 6:8 (do not include the percentages). Apply the Total cell style to B9 and D9:F9. 4
9 Ungroup the sheets, and then insert a new worksheet. Change the sheet name to Summary and then widen column A to 210 pixels and columns B:E to 155 pixels 4
10 Move the Summary sheet so that it is the first sheet in the workbook. In cell A1 of the Summary sheet, type Marisol Desserts and Spices and then Merge & Center the title across the range A1:E1. Apply the Title cell style. In cell A2, type November Commercial Salesperson Bonus Summary and then Merge & Center the text across the range A2:E2. Apply the Heading 1 cell style. 11
11 In the range A5:A7, type the following row titles and then apply the Heading 4 cell style: Bonus Base Salary Total Compensation 4
12 In the range B4:E4, type the following column titles, and then Center and apply the Heading 3 cell style: Arizona/Washington Arizona Washington Total 6
13 In cell C5, enter a formula that references cell D9 in the Arizona worksheet so that the total bonus amount for the Arizona region displays in cell C5. Create a similar formula to enter the total Base Salary for the Arizona region in cell C6. Using the same technique, enter formulas in the range D5:D6 so that the Washington totals display. 8
14 Sum the Bonus and Base Salary rows, and then calculate Total Compensation for the Arizona, Washington, and Total columns. 7
15 In cell B5, insert a Column Sparkline for the range C5:D5. In cells B6 and B7, insert Column sparklines for the appropriate ranges to compare Arizona totals with Washington totals. 10
16 To the sparkline in cell B6, in the first row, apply the second sparkline style. To the sparkline in cell B7, in the first row, apply the third sparkline style. 4
17 Group the three worksheets, and then center the worksheets Horizontally on the page and insert a Custom Footer in the left section with the file name. Change the Orientation to Landscape and fit the columns to 1 page. 6
18 Save and close the file, and then submit for grading. 0
Total Points 100

 

Created On: 10/03/2019 1 GO19_XL_CH02_GRADER_2F_AS – Commercial Compensation 1.1

 
Do you need a similar assignment done for you from scratch? Order now!
Use Discount Code "Newclient" for a 15% Discount!

Battleship Program C++ NEED HELP

For many of us old school gamers, we started out playing good old fashioned board games. Many of us learned strategy from games like Risk and Battleship. For your project, you will be developing a simple battleship type game to test your knowledge of the concepts we have learned in Object Oriented Programming.

 

The purpose of this project is to have you design of a fairly complicated project using concepts we have learned and then implement the solution using some of the code that we wrote in the previous projects along with new code, and then test your game.

 

You need to first start with the design of the project. The design documentation, due as shown on the syllabus, will be worth one homework grade and when corrected and submitted will be 20% of your final project grade. If your design is carefully thought through, the coding of the game should be relatively straightforward since many of the classes and concepts closely match previous assignments. You will need to first read these requirements and make a design document (ensuring that all the requirements are met in the design). A sample design document is posted in Canvas and should be used as your design TEMPLATE (example). Create a design document complete with the class diagram and activity (flow) diagram, as well as any decisions you made on the best use of classes, inheritance, polymorphism, and exception handling.

 

After you have completed your design, then you will be ready to implement the game and test. I cannot stress enough that a good design document and understanding of the requirements will make the actual coding of the game much faster and more simple.

 

Please don’t leave things until the last two weeks. Get started now, and please ask your instructor for help BEFORE you get too lost. Get the big picture done first. Worry about the structure and implementation of the major functionality. Then if you have time, work on the little details, and minor error checking.

 

So now onto the requirements. You sunk my battleship!….

 

For your CSCI 2312 Project, you will develop a simple battleship game. Battleship is a guessing game for two players. It is played on four grids. Two grids (one for each player) are used to mark each players’ fleets of ships (including battleships). The locations of the fleet (these first two grids) are concealed from the other player so that they do not know the locations of the opponent’s ships. Players alternate turns by ‘firing torpedoes’ at the other player’s ships. The objective of the game is to destroy the opposing player’s entire fleet. In our game, ‘firing a torpedo’ will be allowing the player to take a guess at where on the grid their opponent may have placed a ship.

 

In the requirements, we will set forth other simplifying rules to limit the scope of this project.

 

Requirements

 

Given the requirements as a rough specification, you are to design the classes and implement the game. In our imaginary game company, the requirements below were developed by the Product Development Team and your instructor is the Product Owner. You are in full control of the choice of classes (please use classes appropriately or points will be deducted), data structures, algorithms, internal file format, detailed user interface scheme, or any other pertinent design decisions you need to make. As the Product owner, I care that it compiles and runs like it is supposed to, meets all the functionality and requirements I have set forth, and is easy to play and understand.

 

The Battleship game you are designing and implementing is a simplified version of the electronic Battleship game played in one player mode.

 

The game is played on four grids, two for each player. The grids are typically square and in our case will be 10 by 10. The individual squares in the grid are identified by the x coordinate (indicated by a letter) followed by the y coordinate (indicated by a number). The following is an example of a 5 by 4 grid with an X in the position B3.

 

A B C D E

         
         
   

X

     
         

 

1

 

2

 

3

 

4

 

 

 

Each player uses two grids. Each player uses one of their grids to arrange their ships and record the torpedoes fired by the opponent. On the other grid, the player records their own shots and whether they hit or missed.

 

Before play begins, each player secretly arranges their ships on their primary grid. Each ship occupies a certain number of consecutive squares on the grid (sizes of ships are in the following table), arranged either horizontally or vertically. The number of squares for each ship is determined by the type of the ship. The ships cannot overlap so only one ship can occupy any given square in the grid. The types and numbers of ships allowed are the same for each player.

 

Ship Type Number of Grid Squares
Carrier 5
Battleship 4
Cruiser 3
Submarine 3
Detroyer 2

 

 

The game is played in rounds. In each round, each player takes a turn to fire a torpedo at a target square in the opponent’s grid. The opponent then indicates whether the shot was a hit (a ship occupied the square) or a miss (there was not ship in the square). If the shot is a “miss”, the player marks their primary grid with a white peg (X in our game); if a “hit” they mark this on their own primary grid with a red peg (O in our game). The attacking player then indicates the hit or miss on their own “tracking” grid with the appropriate color peg (red (0) for “hit”, white (X) for “miss”) so that they can understand where the opponent’s ship might be.

 

In the board game, once all of the coordinates of a ship have been hit, the ship is sunk, and the ship’s owner announces “You sunk my battleship! (Or whatever the particular ship that was destroyed). For our purposes, we will consider a battleship sunk if the opponent has a single hit. When all of one player’s ships are sunk, the other player wins the game.

 

For your game, you will create a one-person version of the game where ‘the computer’ will play for the second player.

 

At the beginning of the game, you will read a file called ship_placement.csv which contains the type of ship, the first grid square for the ship placement, and whether the ship is placed vertically or horizontally (V or H in the field). The file will be in csv format (comma separated values). This is a common format and is comma separated (instead of being on separate lines). There will be commas between the values. Blank values will just have a comma noting to go to the next field (the game input should not have blank fields so you should handle the case where a field is blank). If you want to view the file, often this will be opened by a spreadsheet unless you specifically open it with a text editor. Do not open it with Microsoft Word, as this may change the format. The first line of a CSV file notes the data descriptions as follows:

TypeOfShip,Location,HorizOrVert

 

I have provided several sample files which contain good scenarios and scenarios with placement issues that you will need to handle using exception handling. Your game should run with any of these files, but should also be able to run with any valid file in the correct format. You will need to check whether all ships were included in the input file (and appropriate action to take if not), whether all ships have been placed, whether they fit on the board in the configuration given, and whether more than one ship occupies a space (which is not allowed) when you read the input file from the user and how to recover if an error occurs.

 

You will then need to randomly position the computer’s ships on the grid taking into consideration the same factors as you did for the player’s input.

 

You will need to prompt for and allow for the user to input their next guess in the form of a letter (A through J) and a number (1 – 10) indicating where they are targeting for their torpedo and you should error check the input. In our simplified game, you will determine if the torpedo shot was a hit or a miss. If the shot was a hit, consider the ship to be sunk. You should display a hit or miss, whether the ship was sunk and which one, and display their tracking grid so they know what they have guessed and where they have made hits. The entire ship which was hit will display as sunk.

 

After the user takes their turn, you must have the computer randomly select a shot that they have not previously taken. Then you must display to the user what the computer guessed, whether it hit any of the player’s ships, whether a ship was sunk, and then display the player’s placement grid showing where ships are located and what has been hit.

 

You should continue this until someone wins or quits the game – meaning you should allow the player to gracefully quit at any turn.

 

At the end of the game, you should indicate the game is over and who the winner was. You should also allow the user to quit the game by entering a Q when prompted for their next guess. If a player decides to quit the game, the grid with all of their guesses and the locations of the computer’s ships should be displayed.

Overall System Design

1. You must have two different classes in your design.

2. You must use inheritance in one of the classes.

3. When reading from a data file, your program should test the input file to ensure that data is of valid format (basic error detection) using Exception Handling.

4. You should consider using the Grids from Assignment 2 to make this easier. You do not need to have 4 grids for this but if you decide to use only two grids, you need to make sure you do not show the player the computer’s ship location when you display the grid after each turn.

5. Each component of the overall program should be modular.

1. Program should be fairly fault tolerant of user input and the appropriate user prompts and on-screen directions should be displayed

1. Split the program into multiple files based on the roughly categorized functionality or classes.

Extra Challenge / Extra Credit

Some of you may want an extra challenge to boost your abilities and have some interesting resume material. If you have completed all of the requirements above and want an additional challenge, you can incorporate fully sinking the ships and additional logic to be used by the computer when it makes a hit. After determining whether the shot was a hit or miss, you will then need to determine if the ship was sunk. In the simplified version of the game above, one torpedo hit sunk the ship. For the extra credit, you will need to accurately track all hits on a ship to determine if it was sunk. If it was sunk, you will need to tell the player, “you sunk my XXXship” where XXX indicates which type of ship and then displays the information as described in the simplified version above. Additionally, you will need to add logic to the random selection of torpedo shots for the computer. When the computer takes a random shot that hits a ship, the next series of shots will need to be logically selected until the hit ship is sunk.

 

If you do the extra credit, please note this in your documentation and make it clear in the running of the program, so we can give you up to 15% extra credit. (meaning you could get 115% on the project). Note: Since this is extra credit, it needs to meet a higher standard for full extra credit).

 

 

 

 

 

1

 
Do you need a similar assignment done for you from scratch? Order now!
Use Discount Code "Newclient" for a 15% Discount!

ND Wk8

Network Defense and

Countermeasures

by Chuck Easttom

Chapter 14: Physical Security and Disaster Recovery

 

 

© 2014 by Pearson Education, Inc. Chapter 14 Physical Security and Disaster

Recovery 2

Objectives

 Understand Physical Security

 Implement Physical Security

 Understand Disaster Recovery

 Understand Business Continuity

 

 

Definition: Physical Security

 The physical measures and their associated

procedures to safeguard and protect against:

 Damage

 Loss

 Theft

© 2014 by Pearson Education, Inc. Chapter 14 Physical Security and Disaster

Recovery 3

 

 

Required Physical Controls

 Perimeter and Building Grounds

 Building Entry Points

 Inside the Building – Building Floors / Offices

 Data Centers or Server Room Security

 Computer Equipment Protection

© 2014 by Pearson Education, Inc. Chapter 14 Physical Security and Disaster

Recovery 4

 

 

Examples of Threats

 Emergencies

 Fire and Smoke Contaminants

 Building Collapse or Explosion

 Utility Loss (Power, AC, Heat)

 Water Damage (Broken Pipes)

© 2014 by Pearson Education, Inc. Chapter 14 Physical Security and Disaster

Recovery 5

 

 

Fire Prevention

 Use Fire Resistant Materials for Walls, Doors, Furnishings, etc.

 Reduce the Amount of Combustible Papers Around Electrical Equipment

 Provide Fire Prevention Training to Employees  REMEMBER: Life Safety is the Most Important

Issue!

 Conduct Fire Drills on All Shifts So that Personnel Know How to Exit A Building

© 2014 by Pearson Education, Inc. Chapter 14 Physical Security and Disaster

Recovery 6

 

 

Fire Detection

 Automatic Dial-Up Fire Alarm

 System Dials the Local Fire or Police Department and

Plays a Prerecorded Message When a Fire is

Detected

 Usually Used in Conjunction with One of the Other

Type of Fire Detectors

 This Type of System Can Be Easily/Intentionally

Subverted

 Combinations are Usually Used for The Best

Effectiveness in Detecting a Fire

© 2014 by Pearson Education, Inc. Chapter 14 Physical Security and Disaster

Recovery 7

 

 

Fire Suppression

 Carbon Dioxide (CO2), Foam, Inert Gas and

Dry Power Extinguishers DISPLACE Oxygen

to Suppress a Fire

 CO2 Is a Risk to Humans (Because of

Oxygen Displacement)

 Water Suppresses the Temperature

Required to Sustain a Fire

© 2014 by Pearson Education, Inc. Chapter 14 Physical Security and Disaster

Recovery 8

 

 

Fire Suppression – Halon

 Halon Banned for New Systems Under 1987

Montreal Protocol on Substances that Deplete

the Ozone Layer

 Began Implementation of Ban in 1992

 Any New Installations of Fire Suppression systems

Must Use Alternate Options

 EU Requires Removal of Halon for Most Applications

 Halon Replacements:

 FM200,

© 2014 by Pearson Education, Inc. Chapter 14 Physical Security and Disaster

Recovery 9

 

 

Safety Fire Extinguishers

 Class A – Ordinary combustibles such as

wood or paper.

 Class B – Flammable liquids such as grease,

oil, or gasoline.

 Class C – Electrical Equipment

 Class D – Flammable Metals

© 2014 by Pearson Education, Inc. Chapter 14 Physical Security and Disaster

Recovery 10

 

 

Fire Suppression – Water

 Wet Pipe  Always Contains Water

 Most Popular and Reliable

 165° Fuse Melts  Can Freeze in Winter

 Pipe Breaks Can Cause Floods

 Dry Pipe  No Water in Pipe

 Preferred for Computer Installations

 Water Held Back by Clapper

 Air Blows Out of Pipe, Water Flows

© 2014 by Pearson Education, Inc. Chapter 14 Physical Security and Disaster

Recovery 11

 

 

Fire Suppression – Water

 Deluge

 Type of Dry Pipe

 Water Discharge is Large

 Not Recommended for Computer Installations

 Preaction

 Most Recommended for Computer Room

 Combines Both Dry and Wet Pipes

 Water Released into Pipe First Then After Fuse Melts in Nozzle the Water is Dispersed

© 2014 by Pearson Education, Inc. Chapter 14 Physical Security and Disaster

Recovery 12

 

 

What Is a Disaster

 Any natural or man-made event that disrupts

the operations of a business

in such a significant way that a considerable

and coordinated effort is required to achieve

a recovery.

© 2014 by Pearson Education, Inc. Chapter 14 Physical Security and Disaster

Recovery 13

 

 

How BCP and DRP

Support Security  BCP (Business Continuity Planning) and

DRP (Disaster Recovery Planning)

 Security pillars: C-I-A

 Confidentiality

 Integrity

 Availability

 BCP and DRP directly support availability

© 2014 by Pearson Education, Inc. Chapter 14 Physical Security and Disaster

Recovery 14

 

 

BCP and DRP Differences

and Similarities  BCP

 Activities required to ensure the continuation of

critical business processes in an organization

 Alternate personnel, equipment, and facilities

 Often includes non-IT aspects of business

 DRP

 Assessment, salvage, repair, and eventual

restoration of damaged facilities and systems

 Often focuses on IT systems

© 2014 by Pearson Education, Inc. Chapter 14 Physical Security and Disaster

Recovery 15

 

 

The Role of Prevention

 Not prevention of the disaster itself

 Prevention of surprise and disorganized response

 Reduction in impact of a disaster

 Better equipment bracing

 Better fire detection and suppression

 Contingency plans that provide [near] continuous

operation of critical business processes

 Prevention of extended periods of downtime

© 2014 by Pearson Education, Inc. Chapter 14 Physical Security and Disaster

Recovery 16

 

 

Running a BCP / DRP Project

 Main phases

 Pre-project activities

 Perform a Business Impact Assessment (BIA)

 Develop business continuity and recovery

plans

 Test resumption and recovery plans

© 2014 by Pearson Education, Inc. Chapter 14 Physical Security and Disaster

Recovery 17

 

 

Performing a Business

Impact Analysis  Asset Analysis

 Purchase cost, development cost, administrative

cost, maintenance cost.

 Survey critical processes

 Perform risk analyses and threat assessment

 Determine Maximum Tolerable Downtime

(MTD)

 Establish key recovery targets

© 2014 by Pearson Education, Inc. Chapter 14 Physical Security and Disaster

Recovery 18

 

 

RAID

 RAID 0 (striped disks) distributes data across multiple disks in a way that gives improved speed at

any given instant. NO fault tolerance

 RAID 1 mirrors the contents of the disks, making a form of 1:1 ratio realtime backup. Also called

mirroring

 RAID 3 or 4 (striped disks with dedicated parity) combines three or more disks in a way that protects

data against loss of any one disk. Fault tolerance is achieved by adding an extra disk to the array and

dedicating it to storing parity information. The storage capacity of the array is reduced by one disk

 RAID 5 (striped disks with distributed parity) combines three or more disks in a way that protects data

against the loss of any one disk. It is similar to RAID 3 but the parity is not stored on one dedicated

drive, instead parity information is interspersed across the drive array. The storage capacity of the

array is a function of the number of drives minus the space needed to store parity

 RAID 6 (striped disks with dual parity) combines four or more disks in a way that protects data against

loss of any two disks.

 RAID 1+0 (or 10) is a mirrored data set (RAID 1) which is then striped (RAID 0), hence the “1+0”

name. A RAID 1+0 array requires a minimum of four drives: two mirrored drives to hold half of the

striped data, plus another two mirrored for the other half of the data.

© 2014 by Pearson Education, Inc. Chapter 14 Physical Security and Disaster

Recovery 19

 

 

Backups

 Full – all changes

 Differential – all changes since last full backup

 Incremental – all changes since last backup of

any type

© 2014 by Pearson Education, Inc. Chapter 14 Physical Security and Disaster

Recovery 20

 

 

Summary

 Physical security involves lighting, locks,

fences, and physical access control.

 Fire suppression systems are an important

part of physical security.

 A Business Impact Analysis must be done

before disaster recovery.

 RAID is a fundamental part of fault tolerance.

© 2014 by Pearson Education, Inc. Chapter 14 Physical Security and Disaster

Recovery 21

 

 

Summary cont.

 Disaster Recovery Plans are aimed at

restoring full normal operations.

 Business Continuity Plans are designed to

maintain some level of operations until full

recovery can be achieved.

 Data backups are a significant part of fault

tolerance and disaster recovery.

© 2014 by Pearson Education, Inc. Chapter 14 Physical Security and Disaster

Recovery 22

 
Do you need a similar assignment done for you from scratch? Order now!
Use Discount Code "Newclient" for a 15% Discount!

Excel Test

QUESTION 1

  1. The ways that HLOOKUP formula works is searching down instead of across data. True
    False

0.9 points  

QUESTION 2

  1. The AND formula takes a list of Booleans and returns TRUE if all of them are true, and FALSE otherwise. True
    False

0.9 points  

QUESTION 3

  1. How would Excel evaluate the following formula? =OR(7<5, A2=6,NOT(“zebra”<=”tree”))? Assume that the formula is in cell D4, the workbook contains no circular references, and outside of cell D4 the workbook contains no errors.TRUEFALSEIt would return an errorThere is insufficient information to answer this question

1.4 points  

QUESTION 4

  1. One of the benefits of using the Table feature is that you’ll be able to see the column titles at every moment. True
    False

0.9 points  

QUESTION 5

  1. Use the brewery.xlsx file to answer the following question: How many total transactions took place at Beerland Amherst?3527425844258542194315939

0.9 points  

QUESTION 6

  1. Use the file Code_Enforcement_-_Building_and_Property_Violations.xlsx for this question.
    What is the total dollar amount of penalties for closed cases in Charlestown due to residents’ improper storage of trash (improper storage trash:res)?

1.4 points  

QUESTION 7

  1. Use the Brewery.xlsx file to answer the following question: What s the name of the beer with the highest Alcohol by Volume (ABV)?Half LordGear ShiftSheep MojoRed Salty HoserGnu Breath

0.9 points  

QUESTION 8

  1. The PivotTable functionality is located in the Data tab. True
    False

0.9 points  

QUESTION 9

  1. Use the Brewery.xlsx file to answer the following question: How many beers product names have order quantities between 3000 and 12000?75689

1.4 points  

QUESTION 10

  1. Which of the following functions returns a range of cells?OFFSETCOUNTAMATCHREDEFINENone of the given choices

0.9 points  

QUESTION 11

  1. A named range can be usedwhen creating chartsin formulasin functionsnone of the given choicesall of the given choices

0.9 points  

QUESTION 12

  1. Which of the following statements is correct if new data will be attached as a new row to the existing table?OFFSET( base cell, 0, 0, 1, COUNTA (larger range in row where potential data may appear) )OFFSET( base cell, 0, 0, COUNTA (larger range in row where potential data may appear),1)OFFSET( base cell, COUNTA (larger range in row where potential data may appear), 0, 0,1)OFFSET( base cell, 0, COUNTA (larger range in row where potential data may appear), 0,1)None of the given choices

1.4 points  

QUESTION 13

  1. One of the primarily characteristics of Solver is the mathematical relationship between the objective, the constraints, and the decision variables. True
    False

0.9 points  

QUESTION 14

  1. The Solver and Analysis Toolpak Add-ins are not built in to Excel. True
    False

0.9 points  

QUESTION 15

  1. Use solver to answer the following question: A manufacturing concern wishes to minimize its shipping costs between its 4 factories and 3 warehouses. Factory 1 supplies 1000 units per week and costs $5, $3, and $4 to ship each unit to Warehouses 1, 2, and 3 respectively. Factory 2 supplies 1200 units each week and costs $4, $3, and $3 to ship to Warehouses 1, 2, and 3. Factory 3 supplies 1500 units and costs $6, $2, and $5 to ship to the three warehouses. Factory 4 supplies 1800 units and costs $6, $2, and $4.
    If Warehouse 1 requires 3000 units per week, Warehouse 2 demands 1000, and Warehouse 3 demands 1500, what is the minimum it would cost them in shipping to fulfill each warehouse’s demand?
 
Do you need a similar assignment done for you from scratch? Order now!
Use Discount Code "Newclient" for a 15% Discount!

Visio Networking Diagrams

I need three network diagrams made from Visio.  I have attached the base of the network diagram that was turned in for the first assignment.  Here is the information about the company that I am creating the networking diagram for:

 

ABOUT US

Bit Consulting Services is a small computer consulting company with 15 employees that consult computer solutions with a variety of small to medium sized companies. Bit Consulting specializes in Cloud services and mobile technologies for companies wanting to be at the forefront of technology for their customer solutions. Contact us and we will show you why Bit Consulting Services is the best in business!

 

This first diagram has to add:

Update your corporate network diagram to include branch offices and remote sites.  If your company only has one site, you must assume that at least one executive insists on operating a home office. Also, assume that any manufacturing operations are located in a separate building/site.
Update your network infrastructure using Cisco Packet Tracer to reflect VPN technologies.
Update your network diagram to reflect VPN technologies.

The second diagram has to add:

Update your network diagram to include separate subnets for all major departments in your corporation. You will need to subnet appropriately to account for all workstations, printers, and servers for each network and subnet.

Ensure that all manufacturing systems are appropriately airgapped by including a separate router and VLAN for those departments.

 

The third diagram has to add:

Update your network diagram to include IPv6 network addresses and subnets.

 

 
Do you need a similar assignment done for you from scratch? Order now!
Use Discount Code "Newclient" for a 15% Discount!

Homework Of Computer Networking

CSE422 Section 002 – Computer Networking Fall 2018

Homework 2 – 50 points Sockets (10 points)

1. For a client-server application over TCP, why must the server program be executed before the client program?

2. For a client-server application over UDP, why may the client program be executed before the server program?

3. The UDP server shown in the course slides needed only one socket, whereas the TCP server needed two sockets. Why?

4. If the TCP server were to support N simultaneous connections, each from a different client host, how may sockets would the TCP server need?

5. You are creating an event logging service that will be handling event messages from multiple remote clients. This service can suffer delays in message delivery and even the loss of some event messages. Would you implement this using TCP or UDP? Why?

The HTTP GET message (10 Points) Consider the figure below, where a client is sending an HTTP GET message to a web server, gaia.cs.umass.edu.

Suppose the client-to-server HTTP GET message is the following:

GET /kurose_ross/interactive/quotation1.htm HTTP/1.1

Host: gaia.cs.umass.edu

Accept: text/plain, text/html, image/gif, image/jpeg, audio/basic,

audio/vnf.wave, video/mp4, video/wmv, application/*, */*

Accept-Language: en-us, en-gb;q=0.5, en;q=0.1, fr, fr-ch, zh, cs

If-Modified-Since: Wed, 10 Jan 2018 13:13:03 -0800

User Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.11 (KHTML,

like Gecko) Chrome/17.0.963.56 Safari/535.11

Answer the following questions:

1. What is the name of the file that is being retrieved in this GET message?

2. What version of HTTP is the client running?

 

 

CSE422 Section 002 – Computer Networking Fall 2018

3. What formats of text, images, audio, and video does the client browser prefer to receive? [Note: for this and the following questions on browser media and language preferences, you will need to do a bit of additional reading on the Web. Here is a good place to start.]

4. What do the strings “application/*” and “*/*” signify in the Accept: header?

5. What languages is the browser indicating that it is willing to accept? [Note: you can look at your own browser preferences to get a listing of language codes.]

6. What is the meaning of the “relative quality factor,” q, associated with the various version of English? [Note: Here is a good place to start. See also [RFC 2616].]

7. What is the client’s preferred version of English? What is the browser’s least preferred version of English?

8. Does the browser sending the HTTP message prefer Swiss French over traditional French? Explain.

9. Does the client already have a (possibly out-of-date) copy of the requested file? Explain. If so, approximately how long ago did the client receive the file, assuming the GET request has just been issued?

10. What is the type of client browser and the client’s operating system? [Note: To answer this, you’ll need to understand the User Agent: header field. Here is a good place to start.]

The HTTP RESPONSE message (10 Points) Consider the figure below, where the server is sending a HTTP RESPONSE message back the client.

 

Suppose the server-to-client HTTP RESPONSE message is the following:

HTTP/1.1 200 OK

Date: Wed, 10 Jan 2018 21:23:35 +0000

Server: Apache/2.2.3 (CentOS)

Last-Modified: Wed, 10 Jan 2018 21:35:35 +0000

ETag:17dc6-a5c-bf716880.

Content-Length: 77385

Keep-Alive: timeout=41, max=92

Connection: Keep-alive

Content-type: image/html

Answer the following questions:

 

 

CSE422 Section 002 – Computer Networking Fall 2018

1. Is the response message using HTTP 1.0 or HTTP 1.1? Explain.

2. Was the server able to send the document successfully? Explain

3. At what date and time was this response sent?

4. When was the file last modified on the server?

5. How many bytes are there in the document being returned by the server?

6. What is the default mode of connection for HTTP protocol? Is the connection in the reply persistent or non-persistent? Explain.

7. What is the type of file being sent by the server in response?

8. Does the response message use separate keep-alive messages?

9. What is the name of the server and its version? List the advantages of the server used.

10. What is the timeout value for the response message?

DNS and HTTP delays (10 points) Before doing this question, you might want to review sections 2.2.1 and 2.2.2 on HTTP (in particular the text surrounding Figure 2.7) and the operation of the DNS (in particular the text surrounding Figure 2.19).

Suppose within your Web browser you click on a link to obtain a Web page. The IP address for the associated URL is not cached in your local host, so a DNS lookup is necessary to obtain the IP address. Suppose that four DNS servers are visited before your host receives the IP address from DNS. The first DNS server visited is the local DNS cache, with an RTT delay of RTT0 = 1 msecs. The second, third and fourth DNS servers contacted have RTTs of 31, 47, and 25 msecs, respectively. Initially, let’s suppose that the Web page associated with the link contains exactly one object, consisting of a small amount of HTML text. Suppose the RTT between the local host and the Web server containing the object is RTTHTTP = 14 msecs.

1. Assuming zero transmission time for the HTML object, how much time elapses from when the

client clicks on the link until the client receives the object?

 

 

CSE422 Section 002 – Computer Networking Fall 2018

2. Now suppose the HTML object references 7 very small objects on the same web server. Neglecting transmission times, how much time elapses from when the client clicks on the link until the base object and all 7 additional objects are received from web server at the client, assuming non-persistent HTTP and no parallel TCP connections?

3. Repeat 2. above but assume that the client is configured to support a maximum of 5 parallel TCP connections, with non-persistent HTTP.

4. Repeat 2. above but assume that the client is configured to support a maximum of 5 parallel TCP connections, with persistent HTTP.

5. What do you notice about the overall delays (taking into account both DNS and HTTP delays) that you computed in cases 2., 3. and 4. above?

Question: Reliable UDP data transfer (5 points) Is it possible for an application to enjoy reliable data transfer even when the applications run over UDP? If so, how?

Question: NAK-only vs ACK-only (5 points) Consider a reliable data transfer protocol that uses only negative acknowledgments. Suppose the sender sends data only infrequently. Would a NAK-only protocol be preferable to a protocol that uses ACKs? Why? Now suppose the sender has a lot of data to send and the end-to-end connection experiences few losses. In this case, would a NAK-only protocol be preferable to a protocol that uses ACKs? Why?

 
Do you need a similar assignment done for you from scratch? Order now!
Use Discount Code "Newclient" for a 15% Discount!

1. How Many Different Estimating Techniques Were Discussed In The Case? 2. If Each Estimate Is Different, How Does A Project Manager Decide That One Estimate Is Better Than Another? 3. If You Were The Project Manager, Which Estimate Would You Use?

APA FORMATE

ADD REFERENCES      AT END

Barbara just received the good news: She was assigned as the project manager for a project that her company won as part of competitive bidding. Whenever a request for proposal (RFP) comes into Barbara’s company, a committee composed mainly of senior managers reviews the RFP. If the decision is made to bid on the job, the RFP is turned over to the Proposal Department. Part of the Proposal Department is an estimating group that is responsible for estimating all work. If the estimating group has no previous history concerning some of the deliverables or work packages and is unsure about the time and cost for the work, the estimating team will then ask the functional managers for assistance with estimating.

Project managers like Barbara do not often participate in the bidding process. Usually, their first knowledge about the project comes after the contract is awarded to their company and they are assigned as the project manager. Some project managers are highly optimistic and trust the estimates that were submitted in the bid implicitly unless, of course, a significant span of time has elapsed between the date of submittal of the proposal and the final contract award date. Barbara, however, is somewhat pessimistic. She believes that accepting the estimates as they were submitted in the proposal is like playing Russian roulette. As such, Barbara prefers to review the estimates.

One of the most critical work packages in the project was estimated at twelve weeks using one grade 7 employee full time. Barbara had performed this task on previous projects and it required one person full time for fourteen weeks. Barbara asked the estimating group how they arrived at this estimate. The estimating group responded that they used the three-point estimate where the optimistic time was four weeks, the most likely time was thirteen weeks, and the pes- simistic time was sixteen weeks.

Barbara believed that the three-point estimate was way off of the mark. The only way that this work package could ever be completed in four weeks would be for a very small project nowhere near the complexity of Barbara’s project. Therefore, the estimating group was not con- sidering any complexity factors when using the three-point estimate. Had the estimating group used the triangular distribution where each of the three estimates had an equal likelihood of occurrence, the final estimate would have been thirteen weeks. This was closer to the fourteen weeks that Barbara thought the work package would take. While a difference of 1 week seems small, it could have a serious impact on Barbara’s project and incur penalties for late delivery.

 

1. ©2010 by Harold Kerzner. Reproduced by permission. All rights reserved.

 

Case Study 735 

 

Barbara was now still confused and decided to talk to Peter, the employee that was assigned to do this task. Barbara had worked with Peter on previous projects. Peter was a grade 9 employee and considered to be an expert in this work package. As part of the discussions with Barbara, Peter made the following comments:

I have seen estimating data bases that include this type of work package and they all esti- mate the work package at about 14 weeks. I do not understand why our estimating group prefers to use the three point estimate.

“Does the typical data base account for project complexity when considering the esti- mates?” asked Barbara. Peter responded:

Some data bases have techniques for considering complexity, but mostly they just assume an average complexity level. When complexity is important, as it is in our project, analogy estimating would be better. Using analogy estimating and comparing the complexity of the work package on this project to the similar works packages I have completed, I would say that 16–17 weeks is closer to reality, and let’s hope I do not get removed from the project to put out a fire somewhere else in the company. That would be terrible. It is impossible for me to get it done in 12 weeks. And adding more people to this work package will not shorten the schedule. It may even make it worse.

Barbara then asked Peter one more question:

Peter, you are a grade 9 and considered as the subject matter expert. If a grade 7 had been assigned, as the estimating group had said, how long would it have taken the grade 7 to do the job?

 
Do you need a similar assignment done for you from scratch? Order now!
Use Discount Code "Newclient" for a 15% Discount!

Module 6 Discussion

 

Module 6 Discussion Forum

Include at least 250 words in your posting and at least 250 words in your reply.  Indicate at least one source or reference in your original post. Please see syllabus for details on submission requirements.

Module 6 Discussion Question

Search “scholar.google.com” or your textbook. Include at least 250 words in your reply.  Indicate at least one source or reference in your original post.  Discuss ways organizations have built a CSIRT. What are the components to building an effective and successful CSIRT team?

Reply-1(Vindhya)

 

In the building, an effective and successful CSIRT the steps involved are as follows:

1. Buy-In and support of management are obtained: the creation of an effective incident response team becomes problematic and difficult without the support of the management. The support includes time, funding, and provision of resources to the team (D. Penedo, 2006). The important responsibility and function of the CSIRTs are obtaining managements perceptions and expectations.

2. The strategic plan of CSIRT development is determined: by dealing with the administrative issues and addressing the project management issues the development of CSIRT is to be managed.

3. Relevant information is gathered: the service needs of the organization and to determine the incident response the information is gathered. In gathering the information the resources available are inventories of assets and critical system, for enterprise the organization charts and functions of specific business, networks, and systems organizational topologies, plans of business-continuity or existing disaster recovery, the physical security breach of organization is notified by existing guidelines, existing plans of incident-management, regulations of institution or parental, and existing security policies and procedures.

4. CSIRT vision is designed: The key components of the CSIRT are identified by bringing the gathered information to incident response constituency needs. For creating, CSIRT vision the points to be followed are (Z. Yunos, 2016): Constituency identification, the goals, objectives, and mission of CSIRT are defined, CSIRT services are selected and provided to the constituency, the organizational model is determined, required resources are identified, and CSIRT funding is determined.

5. The vision of CSIRT is communicated: the operational plan and vision are communicated to constituency, management, and others involved in the operation and feedbacks are obtained. Communicating vision before implementation helps in identification of problems.

6. CSIRT implementation begins: the steps involved in implementation are the CSIRT staff is hired and trained, in supporting team the necessary infrastructure is built and equipment are bought, the initial set of CSIRT procedures and policies are developed, the specifications of incident-tracking system are defined and the forms and guidelines of incident-reporting are developed for a constituency.

7. CSIRT announcement: broadly announce to constituency when CSIRT is operational also include the operation hours and contact information.

8. The effectiveness of CSIRT is evaluated: information on effectiveness is gathered by including against other CSIRTs the benchmark, with constituency representatives the general discussions involved, on a periodic basis the surveys of evaluation are distributed to members of the constituency, and in evaluating the team the quality parameters or set of criteria created by an audit.

References:

D. Penedo (2006), Optimal Policy for Software Vulnerability Disclosure. Good practice guide for CERTs in the area of Industrial Control Systems – Computer Emergency Response Capabilities considerations for ICS.

Z. Yunos (2016), Creating and Managing Computer Security Incident Handling Teams (CSIRTs), CERT Training and Education Networked Systems Survivability Software Engineering Institute Carnegie Mellon University.

Reply-2 ( Glad)

 

CSIRT (Computer Security Incident Response Team) is a team within an organization which responds to threats or incidents as they occur within the organization. Their responsibilities include,

–          Maintaining and creating an incident response plan

–          Identifying, troubleshoot and remediation of any incidents

–          Communication methods for incident responses

–          Combing the organization and proactively identifying and physical or network security threats.

–          Recommending technologies, policy updates, governance updates based off the past threats

Keeping in mind the roles and responsibilities of this team, to build a team to perform these activities and own the responsibilities, the first step towards creating this team would be to buy management support to ensure they are in agreement with the creation of such a team and are on board to sign off on the resource allocation and budget as well as procedural aspects of building a CSIRT team.

The next step would be to create a strategic development plan on the various facets the team should possess and within which time frame team should be formed. The plan should be feasible and the timelines realistic and also care has to be taken to ensure the plan aligns with overall objectives of the organization.

After the strategic plan is developed, information should be gathered to ensure all aspects of the CSIRT team is covered based on the types of policies formulated, types of threats assessed and the services that are to be offered. The team will have to be picked based on the information at this stage.

Once the team is aligned and the vision is set, the vision of this team and its operations will have to be communicated within the organization to bring about an awareness on what this team could do.

Post the organizational wide announcement and policy implementation, the team goes live into operations and implements all the guidelines and procedures thereby serving the organization.

References:

Fuertes, W., Reyes, F., Valladares, P., Tapia, F., Toulkeridis, T., & Pérez, E. (2017). An Integral Model to Provide Reactive and Proactive Services in an Academic CSIRT Based on Business Intelligence. Systems5(4), 52. doi: 10.3390/systems5040052

Möller, K. (2007). Setting up a Grid‐CERT: experiences of an academic CSIRT. Campus-Wide Information Systems24(4), 260-270. doi: 10.1108/10650740710834644

 
Do you need a similar assignment done for you from scratch? Order now!
Use Discount Code "Newclient" for a 15% Discount!