ࡱ> M Fbjbj== :KWWqlFFFFDDD8DD0EBGG:GGGID?KlK8$ JEKI"IKKoMFFGGoMoMoMK.F8GGoMKoMoMR~ōGF RҸ @DLQ:ō0B:\/M@\ōoMFFFFUnderstand the need for a corporate information system security policy and the rle it would fill within an organisation. Factors could include prevention of misuse, detection, investigation, procedures, staff responsibilities, disciplinary procedures. Describe the content of a corporate information technology security policy. (Chapter 46) Describe methods of improving awareness of security policy within an organisation. cross referencing to training and standards. (Chapter 47) Audit requirements (Chapter 45) Understand that many information technology applications are subject to audit. Understand the impact of audit on data and information control. Describe the need for audit and the role of audit management/software tools software. Understand the function of audit trails and describe applications of their use; e.g. ordering systems, student tracking, police vehicle enquiries. Disaster recovery management (Chapter 46) Be able to describe The various potential threats to Information systems. Factors could include physical securitydocument securitypersonnel securityhardware securitycommunications securitysoftware securityUnderstand the concept of risk analysis Understand the commercial need to ensure that an information system is protected from threat Describe a range of contingency plans to recover from disasters and relate these to identified threats Describe the criteria used to select a contingency plan appropriate to the scale of an organisation and installation Legislation (Chapter 47) Understand that the impact that the implementation of legislation will have on the procedures within an organisation Describe the methods of enforcing and controlling data protection legislation within an organisation Describe the methods of enforcing and controlling software misuse legislation within an organisation Describe the methods of enforcing and controlling health and safety legislation within an organisation Discuss the implications of the various types of legislation The commercial need is to ensure that an IS is protected from threat. This is emphasised by the following statistic:- Seventy percent of companies that suffer a major hit do not survive the next year. Insurance may replace most of the money but, if you do not know where you spend it, your company does not survive. 6.1 THE CORPORATE IT SECURITY POLICY This is part of an organisations' strategic management. It is important to get right because Costs are involved as measures are needed to reduce the danger from deliberate or accidental damage User confidence in computer systems - no business wishes their system to contain errors or break down or be open for hackers, fraudsters, thieves and the malicious to tamper with. IT security policies seek to secure systems against loss of availability, integrity or confidentiality. They seek to: - 1 Prevent misuse i.e. Protect data from accidental or deliberate disclosure to unauthorised individuals or groups Preserve data integrity i.e. protect data from accidental or deliberate corruption or modification. Prevent data loss caused by software or procedural errors, or by physical hazards Preserve data privacy protect the rights of individuals and organisations to restrict access to information which relates to them and is of a private nature, to those entitled or authorised to receive it. 2 Detect it if it does happen 3 Investigate and establish the cause of the event and the responsibility for it 4 Set up procedures to deal with security 5 Set out Staff responsibilities to prevent and report if detected 6 Set out Disciplinary procedures 7 Limit the damage to the organisation of an untoward event 8 Recover fully from any untoward event  HYPERLINK "http://ted.see.plym.ac.uk/ishtar/tutorial/intro3/sld001.htm" http://ted.see.plym.ac.uk/ishtar/tutorial/intro3/sld001.htmHTML slideshow and notes covering security management in healthcare.  A Good Summary of processes involvedFirst Line of DefencePREVENTIONPrevents threats occurring or succeeding e.g. no smokingSecond Line of DefenceDETECTIONDetects loss of security despite first line of defence e.g. smoke detectorThird Line of DefenceRECOVERYRecovers from loss of security with minimal loss e.g. off-site back-ups. 6.2 RISK ANALYSIS p.248 This involves investigating the following questions What are the sources of potential threats? Which assets are vulnerable? Where are these assets? Identifying risks. The most common threats to systems are: AccidentalPhysical LogicalHardware failure, network or power failuresHuman Error - made by users inputting data, programmers writing software, operators in mounting wrong media Acts of God such as Lightening, Fire, Flood etc.Software bugs - use of untested softwareConfiguration faultsDeliberatePhysicalLogicalTheft or physical damage to equipmentFraud - perpetrated by users through abuse of system functionality, by programmers in manipulating softwareSabotageViruses - self-replicating programs which can damage data or other programs. Viruses are largely a PC phenomenon and are best guarded against by always checking incoming diskettes for existence of known virusesHackers - individuals who gain unauthorised access to systems and telecommunication lines. Hackers can frequently be kept at bay by excellent access controlsPiracy Performing the Risk Analysis Once threats have been identified their potential impact must be analysed i.e. the probability of the risk happening and the severity of its consequences e.g. loss of customer goodwill, effects on staff morale. Risks can be approximated using actuary tables, historical evidence and reasoned estimates. Probabilities can then be accorded a % and a very high, high, medium etc. rating.  A further calculation can be made whereby the annual loss exposure = cost x frequency and figures can be produced e.g. power reduction has 100 of consequent loss every time it occurs. Faulty cabling occurs once a day throughout the building with an annual cost of 30000 Other risks that can be insured against include Hardware replacement which will reflect the replacement cost Data and information loss which is perhaps the most serious but hardest to quantify Software loss is difficult to assess the time taken to develop The loss of key staff through head-hunting Consequences of risks may include - Interruption of processing in the long or short termCorruption of data recordsDestruction of storage mediaRunning of unauthorised software - clogging up the networkDisclosure of sensitive informationTheft of hardware/softwareLoss of accounting recordsLost productionDelayed deliveriesCash Flow problemsLoss of customer goodwillInaccurate accounting and tax statementsMeaningless and inaccurate or untimely management informationPenalties from breach of statutory obligationsInability to continue system functionLoss of competitive positionInability to continue business  HYPERLINK "http://www.drj.com/new2dr/w3_030.htm" http://www.drj.com/new2dr/w3_030.htm Brief notes on disaster recovery management, risk analysis and contingency planning HYPERLINK "http://secinf.net/info/policy/hk_polic.html" http://secinf.net/info/policy/hk_polic.html HYPERLINK "http://www.webopedia.com/TERM/a/audit_trail.html" http://www.webopedia.com/TERM/a/audit_trail.htmlAudit trails HYPERLINK "http://www.disastercenter.com/abrintro.htm" \t "main" http://www.disastercenter.com/abrintro.htm Disaster recovery plans HYPERLINK "http://www.cnn.com/TECH/computing/9908/25/disaster.ent.idg/" \t "main" http://www.cnn.com/TECH/computing/9908/25/disaster.ent.idg/  HYPERLINK "http://www.utoronto.ca/security/drp.htm" \t "main" http://www.utoronto.ca/security/drp.htm Disaster recovery plans - University of Toronto HYPERLINK "http://www.utoronto.ca/security/drp.htm" \t "main"   HYPERLINK "http://www.grsoftware.net/backup_strategies.html" \t "main" http://www.grsoftware.net/backup_strategies.htmlBack up strategies 6.3 Handling Risks i.e. avoidance and reduction p.249 Tightening up Operating Standards Rationalise practices to aid communication and simplify education and training Compatibility of software, hardware, data, staff and communication channels All data is input to the system (by the right people) at the proper time; All software used to process the data has been properly tested and authorised Changes made to data and/or software are only made by appropriate people; All output from the system is delivered on time to the right people in a form appropriate for the use to which it is to be put. Developing clear plans to fully recover all systems, over a period of time, in an organisation in the event of a failure from whatever cause; be it a bomb which blew up the building, a failure of a chip or disk in a computer, a software 'bug', etc. These procedures are described as 'disaster recovery plans' Detection of any corruption of data or software in the system; Correction of data and software; Ensuring that if a recovery of the system is necessary then the recovery procedures have resulted in a complete recovery. Segregation of responsibilities Users of systems to be identified; The functions which the user is entitled to use to be identified - Think of Jurassic Park where responsibilities were not segregated Provision in the software to prohibit the users from functionality which they are not allowed to use Network Security Identifying elements of the system that are vulnerable Designing the system to limit the vulnerability. This may include providing duplicate processing facilities, alternate communication routings etc. Access to network restricted and protected - handshaking, dial-back Physical access controls - locks on computer rooms, filing cabinets Network users carefully classified and assigned a level of security appropriate to their jobs. Users who need system data to perform their jobs should have fairly easy access, while users who do not need such data should have little or no access. Controls to ensure recruitment of personnel who are honest and competent Segregation of duties between different types of job ( to minimise the chance of unauthorised tampering with data) Passwords Access control measures are employed to identify users and the facilities they can use. Once identified a user may Be prohibited from access Be allowed to read data Be allowed to change data Be allowed to execute programs Be allowed to change programs Or any combination of the above. Data Encryption Anti-Virus Restriction of third party software in case of virus infection Fire detection and prevention Contingency planning against disasters Contingency planning is the process of learning how to survive the disaster and the longer-term processes of being able to recover from the disaster from the inevitable security breakdowns. It is like taking out an insurance policy. (Hope for the best, and prepare for the worst). It must be documented, tested, and ready for immediate use Lloyds have a mandatory list which must be complied with before they are prepared to underwrite any insurance First line physical defences and detectors Off-site back-up for data, software and documentation Standby hardware if appropriate Thorough and reliable maintenance contracts Rules for software development and acceptance Good personnel procedures Objectives of a contingency plan are to: Limit financial losses and hardships by identifying, prioritising and safeguarding those assets that the need the most protection Minimise the extent of interruption. Without a plan, the lost motion, mistakes, guesswork, and other fumbling will make the recovery plan several times longer and often impossible. Define service alternatives for accomplishing critical applications Ensure controlled emergency recovery by defining remote locations where backup files, software, documentation, etc. are stored. In addition, the plan will identify outside support that will be utilised if needed and specify the steps necessary to relocate to an alternative site if required Regain total processing capability Provide trained personnel to handle emergency conditions and recovery operations and assures adequacy and proficiency of personnel and plans through regular training, testing and maintenance. Disaster Recovery Plan Chapter 46 Will minimise the loss suffered by a catastrophic disruption in service. FIRST STAGE  To cope with the disaster by ensuring safety, minimising damage and enabling a return to workSECOND STAGE  To minimise the consequent effects of the disasterA key component is therefore backing up and restoring data for critical applications. Plans should be sensitive to how much data flows through minicomputers and telecommunication links and how much reside in mainframes. Firms use either internal or external disaster recovery facilities. The Disaster Recovery Plan must include: - (P.255) A step-by-step documentation i.e. a course of action for implementing the plan, the procedures for restoring parts of the network and the telephone numbers of key technical experts Knowing what hardware and software, files and human resources are required to resume processing of critical applications Training personnel to follow the recovery plan correctly Providing redundant file servers or disk drives The people involved in security All organisations will assign security tasks to appropriate people, who will be involved in Setting policy, Creating and maintaining a business recovery plan, Implementing access controls software, Investigating incidents Many large consultancies offer services in IS security to supplement resources in organisations. For example: Advice on IS security policy and strategy provided by experienced management or IS consultants; Carrying out security risk analyses; Reviewing information systems designs and testing implemented systems to ensure security requirements are met; Preparation of business recovery plans. Software engineers are employed to design and develop security products available in the marketplace-to perform independent security evaluations of systems and products. Such evaluations require highly skilled software engineers able to plan, perform and draw conclusions from rigorous evaluations using mathematical and other techniques. Academic and applied research in IS security and related fields is carried out in many universities and private institutions often sponsored by the IS industry. References As security affects most of IS the various standards covering telecommunications, operating systems, electronic data interchange messages etc. include security requirements. In addition specific security standards exist such as ITSEC: the EU standards for Information Technology Security Evaluation Criteria and the US "Orange Book". The British Computer Society has published Security Guidelines in Information Technology for the professional Practitioner (available from the Society). A British Standard (No. BS7799) for Information Security management was issued in February 1995 based on the Department of Trade and Industry (DTI) code of practice for Information Security Management (available from the British Standards Institution (BSI)). 6. 4 Legislation Chapter 47 THE BIG FOUR ISSUES Confidentiality and Privacy Copyright and Software Protection Health and Safety ICT and crime Confidentiality and privacy Privacy is the individuals' right to determine for themselves what about them is communicated to others - limited rights through a number of laws - contract, confidence, defamation, trespass, copyright Confidentiality is an organisations right to determine what will be communicated about commercially held information that is not about people e.g. sales data, R&D findings etc. Increasing importance - CCTV, smart cards, PNC, document image processing Data Protection Act 1998 Be able to cite the Eight principles Be able to cite Offences and Exemptions Costs to an organisation Management need to provide staff training in order to educate its staff - individual as well as corporate liability Siting of terminals in department store - personal data in full view of other customers Data management housekeeping - shredding redundant details Public liability insurance to cover any possible civil action Cost of registration Systems and procedures audits Consumer Credit Act 1974 - all data subjects to have access to all credit reference data held Copyright and software protection P.258 In effect the protection of intellectual property Patent Law protects hardware only The Copyright, Designs and Patents Act 1988 confirms that software is a 'literary' work for the purpose of copyright. Adaption is a restricted act - including compiling code. Source code is copyright. A software licence is permission to do something normally forbidden by copyright. Software Piracy - The best known UK group is FAST (Federation against Software Theft). The extent of software piracy is difficult to gauge but an estimate of 300 to 400 million in lost sales per year in the UK is not far off the mark. Work written by an internal employee in the normal course of their employment , ownership is held by the employer Consultants normally owns their own Health and Safety P.260 Health and Safety (Display Screen Equipment) Regulations 1992 Costs Immediately assess all workstations Reduce risks Meet minimum ergonomic standards Plan display screen work Offer eye tests Provide information and training Information systems and crime Be familiar with offences under Computer Misuse Act 1990 Code Establish and publish strong house rules on computer use that forbids employees loading personal software onto machines. This must be backed by a willingness to proceed to disciplinary action if illegal or offensive material is found Conduct routine and random checks of systems. Print directories and question non-registered ones Monitor access to public networks, call-barring Institute a confidential contact point. Readings will provide up to the minute accounts e.g. Barclaycard users on unusual spending sprees may find themselves being interrogated by store detectives because the credit card company has a knowledge based system Fraud 2000 that warns stores about apparently out-of-character purchases. Police and Emergency services are ones to look for. 6.5 Audit Requirements Chapter 45 What is a Computer Software / Hardware Audit? An audit is a survey, by competent persons in the Information Technology field, who are seeking to verify data on computer products (all items of software, also hardware and its components), using manual or automated means (i.e. auditing software) with the records held centrally by I.T. Services. This includes products bought, on loan or provided by others. What is the Purpose of such an Audit? To trap errors To monitor the efficiency of systems A legal requirement It serves to: Bring the use of software within licence agreements, as agreed with a licence provider. An audit would ensure that software is being used legally, and would highlight any software that falls outside the scope of currently held licences. Reconcile records for products that have been obtained with existing records. Whilst most software and hardware purchases are carefully recorded, there is nonetheless a need to determine where the records may be inaccurate. This may be because products have been moved between computers, original descriptions / serial numbers were inaccurate, new products have been added which have not been recorded centrally, or items have been removed / replaced (with authority or otherwise). Allows for better capacity planning. Determining what computer system items are installed will provide a picture of what items are in use, disk capacities used, types of application, linking these to hardware requirements (e.g. RAM requirements). Standardise, by determining most used or possessed products; Assess value for insurance purposes, and replacement planning. Provides Information to those supporting software / hardware by knowing what computer items are installed and under what configuration, standard set-ups can be agreed which make supporting users easier, and make the user more aware of the machines setting when contacting support personnel, e.g. in I.T. Services. The task of Computer Auditors is to See that all transactions are entered Ensure there are no duplicate entries Check that arithmetic is correct (manual and computerised) That proper documents exist for all recorded transactions Internal auditing Is performed under the direction of the business itself (not a legal requirement but many companies use specialist auditors) To minimise the incidence of accidental or fraudulent errors in financial accounting systems To monitor non-financial operations e.g. production control for operational efficiency Data controls check entries as they occur (see validation and verification) internal auditing makes additional, physical checks after entries have been made External auditing An examination of accounting records only, by an independent party - usually a professional auditor Not concerned with the efficiency of the system, only the completeness and accuracy of its operation A legal requirement to ensure that a business's accounting statements provide a true picture of its financial operations Audit management/software techniques There are two main techniques - Use of test data Use of audit enquiry programs Use of test data Runs the target application with test data, expected results are already known e.g. payroll figures can be tested in a variety of circumstances. Can be used to test source document design for input purposes Test batch preparation procedures Test input verification and validation techniques - i.e. how are normal and exceptional data handled. Test an applications computational and logical processes Live Data Testing  Auditor selects examples of live data. Results are calculated manually and checked against computer output. Disadvantage auditor may not have at hand data examples that cover all possible exceptions.Historical Data Testing  Sampling of transactions that have already passed through the system. Original transactions documents are made available for inspection, validity, authorisation and consistency with results checked.Dummy Data Testing  Auditor constructs fictitious data which contains the conditions to be tested, used with dummy customer files since you do not want these figures entering the systemProblems Can be time-consuming e.g. setting up dummy files Provides only a snapshot at the time of the audit System has to be made available to auditor - not available for operational use. Use of audit enquiry programs Examine contents of computer files Retrieve data from computer files Compare the contents of files e.g. two versions of the same file are compared to ensure structure has not been altered e.g. by inserting an extra field Produce formatted reports according to the auditors requirements Note that there are circumstances where updating overwrites the master file. But provided that source documents are retained or the transactions are logged onto a separate file, the auditor can still reconcile their expected effect on the master file with the actual values held there. Audit trail .251 A record of the file updating that takes place during a specific transaction. It enables policy within an organisation cross-referencing to training and standards Allows the trailing of a transactions history as it progresses from input to output. Computerised systems provide particular difficulties in that the trail disappears as it enters the computer system Auditor may ignore the computer system and pick up the trail at the output stage (auditing around the computer) Although audit enquiry programs allow the auditor to examine the contents of the files not every transaction effect is permanently on computer file Audit trails need to be designed into the system such that intermediate stages of a transaction progress are recorded for audit purposes A record of the file updating that takes place during a specific transaction. It enables a trace to be kept of all operations on files. An automatic record made (in journal file) of any transaction carried out by a computer system, such as updates to files. May be required for legal reasons (so auditors can confirm the accuracy of the company accounts) for security reasons ( so that data maliciously or accidentally deleted can be recovered) or simply to monitor the performance of the system. EXAMINATION QUESTIONS 1996 Many accounts packages have an audit trail facility. Explain why such a facility is necessary, what data is logged and how this information can be used. Necessary to meet formal audit requirements and ensure protection of the system from fraud or the use of the system from the accusation of fraud (2). An audit trail is the software functionality to produce a selective record of what has been happening on the system; who has been using it, when, how long for and what this person did with the data (2). There must be several ways of analysing the record relating to different levels of task (2). 1996 A particular college use a computer network for storing details of its staff and students and for managing its finances. Network stations are provided for the Principal, Vice-Principal, Finance Officer, clerical staff and teaching staff. Only certain designated staff have authority to change data or to authorise payments. (a) What are the legal implications of storing personal data on the computer system? (4) (b)What measures should be taken to ensure that the staff understand the legal implications?(3) ANSWER (a) Any from: The college must apply for registration under the Data Protection Act. Adequate protection should be applied to the system and data. The registration will specify the data use and data can be held. Only authorised users should have access to the data as specified under the registration. The college must supply details of the data held to the data subject on request. amplifications or equivalents accepted (b)Any from: There should be an in-house policy to inform staff of the college terms of registration. This may include a list of good and bad practice points for staff. Appropriate examples may include: handling data and discs, access levels, password changes, file security measures, log-on/off procedures, physical security measures etc.Back up copies kept off site roll back of failed transactionsThis may include any contractual matters of disciplinary measures for staff who fail to comply. 1996 Some software packages can be set up to monitor and record their use, this is often stored in an access log. Name four items you would expect to be stored in such a log. (4) Time and date of accessTerminal IDPerson IDPerson PasswordFiles accessedActivity e.g. menu routeLog off time 1997 A company uses a computer network for storing details of its staff and for managing its finances. The network manager is concerned that some members of staff may install unauthorised software onto the network. (a) Give reasons why it is necessary for some software to be designated as unauthorised. (2) (b) What guidelines should the network manager issue to prevent the installation of unauthorised software onto the network? (2) (c) What procedures might be available to the company to enforce the guidelines? (2) (a) The company has not purchased a license. The company has purchased a fixed number of licenses however the particular user has not been allocated access rights (or had loaded onto local disc). The software is share-ware but not authorised by the network manager. Authorised source code has been modified without authorisation. Personally owned software has been installed Software may introduce non-standardisation Software may facilitate unauthorised data changes e.g. by-pass audit log Software may compromise network security=causes a virus=prevent data corruption Distracts from work (1) (b) A written IT policy or Security Policy (1) stating the responsibilities of staff as defined in the Computer Misuse Act (1). explicitly forbidding the installation of any software except by authorised staff (1) OR reverse equivalent e.g. it must be authorised by Network Manager specifying how to request new software (1) specifying how to request changes in access rights (1) ACCEPT code of conduct (1)=signed booklet(1)=in written contract (1) NOT audit log software, training, log-on screens etc (c) formal written warning suspension or termination of contract legal action under the terms of Computer Misuse Act restrict file creation rights (perhaps to withhold executable status) automatic logging of executables and reporting of changes must have the bolded disciplinary procedure (0) instant dismissal (1) NOT contact FAST 1998.9 (20 marks) Information systems are mission critical, the consequences of failure could prove disastrous. Discuss this statement, including in your discussion: the potential threats to the system the concept of risk analysis the corporate consequences of system failure the factors which should be considered when designing the contingency plan to enable a recovery from disaster. Mark allocation: approximately 4 for points made on threats, approximately 4 for the concept of risk analysis, approximately 4 for the corporate consequences of system failure, approximately 4 the factors which should be considered when designing the contingency plan to enable recovery from disaster, approximately 4 for the coherence of argument and quality of language. Ceiling of 4 on each. Ceiling for content is 17 the potential threats to the system (max 4) e.g. fire, virus, hacker, bugs (4), [millennium bug (1)] (1) for main aspect then a further (1) for expansion to a max of 4 cannot gain 4 for a list...max for any list =2 (a) physical..fire, flood, power failure, cables, coffee (b) hardware failure...processor failure, disc crash (c) telecommunications failure...cable faults, data corruption, gateway down (d) data control failure...data inaccurate e.g. rounding, incorrect codes (e) software failure...bugs, unsuitable to task (f) invalid data...user errors, undiscovered corruption e.g. upgrade, processing cycle fault (g) computer crime/abuse...hacking (1) viruses (1) (h) system design failure...failure to build into the design the appropriate measures the concept of risk analysis mark as (1) for each aspect if explained to a max of 4 (a) determine risks and design countermeasures to appropriate level e.g. estimate impact, limited (1 day), severe (1 week), major (1 month), critical (!) (b) risks change from system to system (c) risks change from data to data and time to time (d) risks change from time to time e.g. pc system in open office storing local stock records at greater risk than multi-national mainframe system storing latest car design but the latter is more likely to be a target {this answer would obtain approx 2} (e) in order to determine risk a review of threat must be undertaken review may be: (f) on a quantitative basis e.g. Expected annual loss = probability of fire over 10 years (=0.02) * cost of fire ( =1000,000) i.e 20K per annum. Repeat this for each potential risk area. (g) on a subjective basis e.g. consult all staff, consider nature of business, operation, competition, likelihood of problems and work-arounds (h) using a checklist e.g. a software package to compare to all recognised dangers for this type of installation/activity. The package attaches weights to risks and provides an index rating of risk. 1989.1 (3 marks) Some IT applications use software which maintains an audit trail. Name one such application and state why this facility is necessary. Application: any acceptable e.g. police vehicle enquiries, ordering systems, student tracking. accounting (NOT in bank) Why necessary: to meet formal or legal (1) audit requirements, to ensure protection of the system from fraud (1) or the accusation of fraud (1). Track & check for mistakes (1) Network Software (1) Log of network access (1) Monitor network abuse (1) Log of internet access (1) to track sites visited (1) to track source of virus if one downloaded (1) or monitor net. abuse (1) Supermarket (0) Transaction log (0) What an audit trail does (0) June 2000.2 (10 marks) An insurance company is reviewing its disaster recovery management policy At a strategic level, state six potential threats to an information system. (6) Explain the concept of risk analysis. (4) 2 (a) Possible strategic level threats: Mark a 6 @ 1 per point max 6 Physical security=natural disaster, electrical spikes,access to building Document security Personnel security=human error inputting data, disgruntled employee Hardware security=failure=hardware theft Communications security=hacker=virus=firewall Software security=failure=passwords, access levels Data security=data loss, theft, backup strategy Computer crime (1) but includes many of the above Computer failure=0 (b) Risk analysis mark as (1) for each aspect to a max of 4 for single issue OR 2 @ 2 if explained determine risks and design countermeasures to appropriate level e.g. estimate impact, limited (1 day), severe (1 week), major (1 month), critical (!) risks change from system to system, data to data and time to time on a quantitative basis e.g. Expected annual lost=probability of fire over 10 years (=0.02) cost of fire ( =1000,000) i.e 20K per annum. Repeat this for each potential risk area. on a subjective basis e.g. consult all staff, consider nature of business, operation, competition, likelihood of problems and  work-arounds"! e.g. pc system in  open office"! storing local stock records at greater risk than multi-national mainframe system storing latest car design but the latter is more likely to be a target {this answer would obtain approx 2} June 2002.4 A Medical Practice has installed a new information system that links patient records and prescriptions to the financial systems of the practice. The financial records must be secure against fraud as they are used to claim money from the Health Authority. a. Describe four factors that should be included in an IT security policy for the practice. (8 marks) b. Describe one measure the practice could take to show that their records were accurate. (2 marks) c. Describe three criteria that could be used to select a disaster contingency plan to recover from a breakdown of this system. (6 marks) a. 1 for factor (F), 1 for description/example (E) - max. 4 x (2, 1, 0) prevention of misuse/protection against misuse/prevent unauthorised access (F); allow any sensible prevention example e.g. physical, anti- hacking etc (NOT vetting of staff) detection of misuse; e.g. finding an anomaly/discrepancy by regular checking investigation of misuse; e.g. by using monitoring software, audit trail etc procedures for keeping data safe e.g. data backup, file passwords etc staff responsibilities e.g. network manager monitors,' responsibilities for backup procedure disciplinary procedures b. By using an audit trail (1) to show what was amended and by whom/when (1) c. 1 for name, 1 for description/expansion/example - max. 3 x (2,1,0) Generic answers/example accepted, therefore context not important, but do not allow examples using contexts that are definitely not medical centre related Scale/size of organisation Timing e.g. how quickly to recover system and be up and running, how important for the company Costs of implementation/contingency site/external contract (make sure costs are of the plan, NOT costs if no disaster recovery plan or as a result of a disaster) Likelihood of disaster NOT volume of data any of the contents of the plan January 2003.8 A growing organisation has realised that so far they have been lucky in that their information systems have not failed. Before they expand their business operational reliance on ICT, they have been advised by their insurer to carry out a risk analysis and then plan what to do next. a. Explain what is meant by risk analysis. (3 marks) b. State three different potential threats to an information system, and describe a counter-measure for each one. (9 marks) c. Describe three of the criteria that could be used to select a disaster contingency plan. (6 marks) a. (Any 3x1) To identify each element of a successful information system (1) place a value - to the business - on that element (1) identify any potential threats to that element (1) the likelihood of the threat occurring (1) b. 1 for threat(T), 1 for counter-measure(C), 1 for description of why/how it would counteract the threat(E). Any 3 x (3,2,1,0) Physical - e.g. theft/terrorists - use locks etc - prevent easy entry Personnel - e.g. accidental overwrite - have procedures - trained staff less likely to make mistakes Hardware - e.g. disk crash - have duplicate system - so that system can be up and running asap Communications breach - e.g. hacking in - firewalls, encryption, passwords -to lessen ability to see/steal/tamper with data Virus - e.g. Trojan - anti-virus software - to stop files getting infected Natural disaster causing hardware/software/data loss - e.g. Fire/flood/earthquake - backup kept off-site - so that a safe copy is held and system can be reloaded Electrical surge/power loss - e.g. caused by weather - UPS/ off-site duplication/RAID/Mirror - as above Data errors, inaccurate data in system - verification and validation - pick up data errors before they get into the system c. 1 for criterion(C), 1 for description(E), Any 3 X (2,l ,0) Scale of the organisation and its ICT systems Nature of the operation (e-business, on-line, batch)/Timing of recovery - how long until the system would be operating, and if this is important to the business Costs of recovery options relative to value of systems Perceived likelihood of disaster happening, based on risk analysis NOT: Volume of data Size of the system Any of the contents of the recovery plan (e.g. how to set up, reciprocal site, who does what or anything to do with back-ups) 6 marks January 2003.9 (20 marks) Puregreens, a retailer of organic vegetables, has recently launched a marketing website. The e-mail response from the contact us button has been overwhelming, so they are thinking of expanding into selling on-line. Discuss the implications of this, paying particular attention to the following: methods of data capture that will be available for on-line or offline payment; the control and audit issues associated with this method of selling; the information needs of the management of this system; the additional information that might be generated. The Quality of Written Communication will be assessed in your answer. Continuous prose is expected for this answer. Discuss is the question, so each point made must be full, not just a single word/phrase. Mark as M, C and I or A for four bullets - no more than the given marks awarded in each section Methods (M) - max 4 - could be filling in credit/debit card details on-line and submitting the payment printing a form for off-line filling in, either by word processor or by hand or .pdf; submitting by e-mail, or by non-electronic means (i.e. post with a cheque) Control and audit (C) - max 6 - ask for pre-shopping registration - e-mail back access codes confirm order to e-mail address (insist e-mail address provided, check exists) use of credit checking agencies use of electronic payment, normally specialist applications/services - get authorisation before dispatching goods basic cross-field validation - e.g. checking address is correct for postcode; restricting values in fields keeping customer details secure and protected during communication (SSL or equivalent) holding previous orders and/or payment details, making easy to reorder same (like Tesco) adherence to Data Protection Legislation e.g. not passing data on unless the customer has given permission Information needs (I) - max 4 - different levels of information (Strategic, tactical and operational) source frequency (gathering) customer info, demographics, spending habits/patterns and so on Information generated (A) - max 5 - targeted market research/opinion, also targeted advertising/special offers to generate more sales food, seasonal, supply and demand issues (no point stocking up on certain items out of season if no/little demand - esp. as most is produce with short shelf life importance of having up-to-date information of use for 16 marks may for content June 2000.10 (20 Marks) IT managers have to be aware of certain legislation that will impact on the procedures within both their department and the rest of their organisation. Discuss this statement. Particular attention should be given to: . methods of enforcing and controlling the protection of data within the organisation, . methods of enforcing and controlling the use of software within the organisation, . the role of the IT department in developing and implementing suitable strategies to assist in these tasks. Quality of language will be assessed in this nnsww Mark allocation: approximately 6 in total for methods of enforcing (both bullet points, i.e. no repetition) approximately 6 for methods of controlling the protection of data approximately 6 for methods of controlling the use of software approximately 6 the role of the IT department in developing and implementing suitable strategies Up to 4 for the quality of language Ceiling for content is 16 NOT Health & Safety, Copyright, Data Protection Act approximately 6 in total for methods of enforcing (both bullet points, i.e. no repetition) Concept of implementation of appropriate legalisation (NOT 1 mark for mention of DP Act) (0/1/2/3) e.g. need to register (1) Concept of internal policies & procedures to implement legislative framework (0/1/2/3) e.g. appoint a DP Co-ordinator (1) e.g. sign an agreement when join company (1) Concept of monitoring and reporting procedures within the organisation (0/1/2/3) e.g. audit trail (1), reminders to staff (1) e.g. need to sign a contract (1) or may get sacked (no 2 nd mark) approximately 6 for methods of controlling the protection of data (note this is IT04we are looking for broader concepts rather than single words) Concept of environmental & physical controls.eg locked doors (1/2) Concept of access controls e.g. logon/password/terminal/times (1/2/3) MUST BE Hierarchy Concept of application controls e.g. document/report/storage/ (1/2) Accept any 2 aspects of DP Act control e.g. how do they keep data accurate OR facilitate requests for access to personal data (2) approximately 6 for methods of controlling the use of software Concept of systematic identification of software needs e.g. audit (1/2/3) Concept of installation control & licensing e.g. formal requests via software manager (1/2) Concept of monitoring controls e.g., monitoring software, collection of notebooks (1/2) e.g. well described use of audit software (2) approximately 6 the role of the IT department in developing and implementing suitable strategies Strategies should be contained within an IT Security Policy Formulation of IT Security Policy: stages: - Analysis of risks measurement of past occurrences adequacy of current safeguards likelihood of future failure potential disruptive impact Definition of IT Security Objectives cross reference to organisational strategic objectives management objectives operational objectives Preparation of IT Security Policy: review of institution needs application of Standards e.g. FAST IS facilities in place Personnel procedures Legal and audit requirements Formal procedures Implementation of IT Security Policy Monitoring of IT Security Policy Number & duration of incidents Cost recurrent and capital Other factors e.g. insurance, recovery Formal reporting of above to management It is highly unlikely that candidates will use this approach. Marking should be @1 mark per concept listed above. Examples lock away master copies of software (1) firewall (1) encryption (1) force change in passwords regularly (1) dongle (1) call back routines (1)"! separation of duties (1) plus another if explained escort from building procedures June 2003.7 Organisations that operate TCT systems have to comply with the relevant legislation. Most have procedures to ensure that this happens. (a) Describe three methods of enforcing and controlling data protection legislation within an organisation. (6 marks) (b) Describe three methods of enforcing and controlling software misuse legislation within an organisation. (6 marks) (c) Describe three methods of enforcing and controlling health and safety legislation within an organisation. (6 marks) June 2003.9 The expansion of e-business using the Internet in the past few years has led to more businesses including this medium for their operations. In the absence of 'a regulatory body to police the Internet, the 1CT and computing industry must regulate itself. Using specific examples, discuss this statement. Include in your discussion: why regulation might be required; the issues in devising regulation across a world-wide medium; the potential problems in enforcing regulation. A2 Module 4 (ICT4) 13.6 Legal Aspects  HYPERLINK "http://www.nchadderton.zen.co.uk/front.htm" http://www.nchadderton.zen.co.uk/front.htm Page  PAGE 1 of  NUMPAGES 22  EMBED Word.Picture.8  z ( w    9 m u   7 ? i  C d 36<v _u17OZǽǽǽǽǽǽǽǽ󶥶5B*CJph!jB*CJUmHnHphu B*CJph56B*CJph6B*CJphB*CJmH phsH B*CJmH phsH 6B*CJmH phsH 6B*CJmH phsH =VR{ffff' & F $d%d&d'dNOPQ#$d%d&d'dNOPQ' & F $d%d&d'dNOPQ' & F$d%d&d'dNOPQ q'E+($$d%d&d'dIfNOPQ' & F$d%d&d'dNOPQ#$d%d&d'dNOPQ+,?Qee($$d%d&d'dIfNOPQq$$Ifl0U"{F t0"4 laQRj|} j hhAAA' & F$d%d&d'dNOPQ($$d%d&d'dIfNOPQo$$Ifl0U"{F t0"4 laj m 7 T U   j#$d !%d !&d !'d !N !O !P !Q !#$d%d&d'dNOPQ#$d%d&d'dNOPQ' & F$d%d&d'dNOPQ  C { 4K _.$If & Fh^h#$d !%d !&d !'d !N !O !P !Q ! ./M .kd$If[$$Ifl!`   t04 la -04mtcdeg kt k ,Tu/hյզ埚jeB*CJUphCJPJ CJOJQJB*CJOJQJmH phsH 0JB*CJOJQJph$jB*CJOJQJUphjB*CJOJQJUphB*CJOJQJph B*CJph5B*CJph3deg/lY$$Ifl4,""064 la $$Ifa$k$$Ifl0U,"LL064 la TUktuuus~$$IflF ,"   06    4 la$If$If  7Tlm $$Ifa$#$d%d&d'dNOPQ#$d !%d !&d !'d !N !O !P !Q ! L1ll$$Ifl0 D t04 la$If[$$Ifl4 J! t04 la_abt\0$Ifl$$Ifl0 D t04 la$If H1Ll$$Ifl0 D t04 la$If[$$Ifl4 J! t04 lacde  ,t$l$$Ifl0 D t04 la$If ,/Hc$If+ & Fh$d%d&d'dNOPQ^h#$d%d&d'dNOPQ cd()<OPjd$Ifl$$Ifl09  t04 la(EFefgh {{$& #$/Ifb$l$$Ifl09  t04 la$If hi   S T U !!!H!I!ḯḔqfVqVjB*CJOJQJUphB*CJmH phsH B*CJOJQJmH phsH 'j.5B*CJOJQJUph B*CJph'j 5B*CJOJQJUphB*CJPJphB*CJOJQJph0J5CJOJQJ'j5B*CJOJQJUph5B*CJOJQJph!j5B*CJOJQJUph  !!v!!!""#|#||||(||||@|$& #$/Ifb$t$$Ifl0," 6 064 lae4I!s!t!u!v!!!!!!" "!"""a"b""""""""""##I#J#z#{#####'(&)9)A,L,h----- .C.W...e//000 1|1152Ͼ޳ޟ޳޳ޟ޳޳ޟ޳޳ޟ޳5B*CJph0JB*CJOJQJph B*CJphB*CJOJQJph 5B*CJOJQJmH phsH B*CJOJQJmH phsH jB*CJOJQJUph!0JB*CJOJQJmH phsH ;|#######|zVzT#$d !%d !&d !'d !N !O !P !Q !t$$Ifl0," 6 064 lae4$& #$/Ifb$#:$$$%i%%'^''''(=((')()9)q)*H***+++ & Fh$d%d&d'dNOPQ^h+A,B,L,,,, -*-H-i-y----- . .d/e//#$d%d&d'dNOPQ+ & Fh$d%d&d'dNOPQ^h//40T000000|152}23344444 5$If#$d%d&d'dNOPQ+ & Fh$d%d&d'dNOPQ^h52P2}2233344444 5l5x555888899);;;}<<=+=>>l>w>~>>,?2?@5@8@L@@@@@AABBBCDDDEDEOEkEEFFH HII>IXI]IYLLLLNN*B*CJph B*CJph5B*CJphW 5k5l5z555667 jhh#$d%d&d'dNOPQk$$Ifl0 ,"y064 la$If7738l88889+9^999 :m::;);}<= =+=#$d%d&d'dNOPQ+ & Fh$d%d&d'dNOPQ^h+==z>?@@6@8@L@i@@@@@@AGBBBB & F#$d !%d !&d !'d !N !O !P !Q !+ & Fh$d%d&d'dNOPQ^hBBBCCCDWDlDDDDEDEEEgEE1FFqG+ & Fh$d%d&d'dNOPQ^h#$d%d&d'dNOPQ & Fh^hqGGHH H^HdHHHHHHIIIXI]I#$d%d&d'dNOPQ#$d%d&d'dNOPQ+ & Fh$d%d&d'dNOPQ^h]IHJJJK8K'L[L]LLLLMNN?NNN#$d !%d !&d !'d !N !O !P !Q !#$d%d&d'dNOPQ+ & Fh$d%d&d'dNOPQ^hNNsNNNOOdQQ[RRRTT8T^TTTTTUU#$d%d&d'dNOPQ+ & Fh$d%d&d'dNOPQ^hUUAVVVVWWW5X6X[X{XXXXXNYYYZ & F#$d%d&d'dNOPQ+ & Fh$d%d&d'dNOPQ^hZMZNZaZ,[-[F[\\$\\__l$$Ifl04   t04 la$If+ & Fh$d%d&d'dNOPQ^h LZMZNZ_Z-[D[\"\\\]]___deeeeedgfgjgjikiqiik(kkkm m$mmmmmLnMnRnXprrtt}uuuuuuuu vwwwwww1xAxxxx,yWyyy!|>|ҀՀԻ6@B*CJph56B*CJph6CJ6B*CJph B*CJph5B*CJph5>*B*CJph>*B*CJphJ\\\]9]]]]]]^ZZZ+ & Fh$d%d&d'dNOPQ^h & Fh^hl$$Ifl04   t04 la ^^___`daahbbdddeee:fgdg$If#$d%d&d'dNOPQ+ & Fh$d%d&d'dNOPQ^hdgegfgh ijikiriiijFjjjk$If^X$$Ifl,""04 lakkk(kkk\#$d%d&d'dNOPQ#$d%d&d'dNOPQX$$Ifl""04 laklll'l@lAlYlylzllllmmmmi$$Ifl0,"LL04 la($$d%d&d'dIfNOPQ lmm mmmmmm}}}}ww$IfX$$Ifl4,""04 la($$d%d&d'dIfNOPQmmnnn#npq^ (^(``#$d%d&d'dNOPQ)$d%d&d'd1$7$8$H$NOPQpqҸӸԸ !#$%'(?@ABEF׸ jUj ; CJUVmHnHu jU55CJmHnHsH uj5CJUmH sH 5CJmH sH 0JCJmH sH jgCJUmH sH  CJmH sH jCJUmH sH 5B*CJph B*CJph5CJCJ#q%&'CDEF$a$&$$d !%d !&d !'d !N !O !P !Q !a$ 0 / =!"#$%`! Y$3˧Y-s{kP|zxڕW]hU>O6R>)vi6VXYX7[iqI5@'mȃ/itAKⓊmT0V[eJ%$B} "Jl2i{{wJ"-z?Vn.uEՄw\K1ϵ*7XED#zVX L'ݓYhU>r現@8g{ջE <24nVքg5e8oXtax8iX9q*jlYp4u nizCp^5]+PFL5x#oʼn.}J^ZT cz| W#ܒ z<钠_. YqXJ꒠KUoI%Q,%'Ng›+ts2?OM3`̜[RO-Ty;٪*E՞Uk- &!zQ +??ɖd "̀AaNM3tg3\^>[Mz=k'w[7[?]"S~_l^. FTūKŌ4Ju4gcDbOϊVgc!2Vv+yk_<{ΊY0B( |M/j6uw3Z]!/"nϗvLa5f|׳5nƯřy)ٲ!?M v3/hu7`./pCD#%ϝܕڝv*:|cwT/vqw)f܁֮V?,K*c?=i~]܅ټqh.B@NZ?w{^p>kr5~\iϾ` v#bt;p6(yN|J@5f:67LT:zY|5@yC\˓款bvUV-++{CG҈j1RNѤn{3+˯T6հ ș~VՏ;~)tFbwz٠Poz'CQmnP_HO"%?jn(̯J_m9]z&9ԡjWK8@ >D&ĩBU2L[@Z%84;n[D1PiPKy+ERC却D1QH> `RM}(*b0jD:{v.%s;{?x ⏟K{ug 1z40#,)v U t0 $Hǧ N"YI k$ٶfǝ5QLV{h"XH Ͳdqywܱi,//^n]Yw($ b %GxA(c92<6Wfric"y V,yoo[-|` "Jwx'Yo}5WZ^]4w52Vދu0UbafAժPvE)vA{#s!^䀼S9ٟr(=ozqJz؜hRsw^/BQ$>Y!0Bdy,jt$[z^ր;˫YI<1Gy5_FkMe99r^:_2*UF3YL,qY" `0X~^Lz,өVy,pV1ۊ')RZ2YfdyO4[HuF2b+E4sªHFqTӳը=2E!̡ ^(̱ީmXэ/Y .Wev5ngL^nOмVojePΉ<ʀ{W6怗1Tpױ$9f:GUľ ֣4'9y590z+P9='8nUa Z_q~+G-QvHV#kqZ}v#ƺ*c9+E4_ _x-VMԢM-#M1]x_B{C&Rg&auT*gIlf]WP9m\bN皗P[7Nz*TkSD^7UKItʕ>&=uvU^yVQ5j|ָK.5R'{x vbj;yHi*f9R#Zo8ӊ6>-7X5.wK_:y%?CX}}^ʷ//}ї^oD||$])̵U =+]AIc{޽=T /P>c.ٰ^tY2YDg x.сh@9%ta bPO^Kih礧y gab>w=ND3ЄhFH#щ]d'V㐓g,"ae L pmт8VMۈ؀%J;{b5gk'v@ykF4!8'AxO5g L y1X8vyzqKOƳ"E ΰ klZ|^(x|Svg祧yZ#2αEF[hX#JzDk͈&GN"Ȕhܚ-ŽdGeDyK <http://ted.see.plym.ac.uk/ishtar/tutorial/intro3/sld001.htmyK xhttp://ted.see.plym.ac.uk/ishtar/tutorial/intro3/sld001.htmDdT0  # ABw5|[dvƱ5 Tw5|[dvƱ5F\MD xmRAKA}5^*&Ѣ"il!`87jn9k)Ǽ}3vf{[~ 4O`b@,8V`j Ylx'bmVy> y./3$g TJ]Œ{|bDHr{V89|*&&?H fof TG=)v5L9j를c^_)LKTo˻볾rƱV<@(<)nft<#w_g#ʶ8>)пls˛[^ 5HኸWe5_h zͩםϽa˷%NA\ֲ}7۽Op3ThTOpnދk5?M DyK %http://www.drj.com/new2dr/w3_030.htmyK Jhttp://www.drj.com/new2dr/w3_030.htm%DyK ,http://secinf.net/info/policy/hk_polic.htmlyK Xhttp://secinf.net/info/policy/hk_polic.html9DyK 1http://www.webopedia.com/TERM/a/audit_trail.htmlyK bhttp://www.webopedia.com/TERM/a/audit_trail.html!DyK +http://www.nchadderton.zen.co.uk/front.htmyK Vhttp://www.nchadderton.zen.co.uk/front.htm> Ddl | B  S A? B?;b7e T|?;b7eDkP|Jx}WlW>^ c=(m& ~ v%6Z}+Ulln F͢qbX2Č05W ll9[^s;W6}L? Z ³0-"-vPP5j.,Q;0+޻'̂B=V߉WCe~̃:UiCuGkeTT˧Ӹr"\7?)*(]Yu\?)ڍ.w 5HfŸdX U]φOd|n^At2~ψOFObs>٤v GKTnk6YV(IaaDa8zQk./( v_T\u5$Y\A|-R5Ke@ǖ2+'? U42 çCfu.4tm֞n[48ӡ_ޖWjW龼/dfN 3yd޿H6[me\OKmN)6en# [:jYн8ZuizYKg.ÓĽMY[?qq%<ς ?ISp9xaxS%=d7Zޯ#`h|Y5CV:}b z z=*'&\BЧ'>e8rtI˽jt}p߳tе5QDE'8~l ~Ϧe@˦_ ^i\6}L::yk VNN/>KԴjUͽEr[q[祇 G_ŐTsKanm-R3Vw&8JGuC#f ]OWLNRab Xaֱ9m,S/#| t~ ZoT3~pvm %cL=hT1qUrُ>K%.:moIvy8wA{]Yai'E 5[) K].E%ꢮJ7JwW\FYF-[!hLrXIݽD7zw J}D<׍<[ fa->_@?fЙmc zmR5d&+?.|$rHl'=]D>ϿK5hc #sc)=h褊I%>̱kU)S0v3XF8OJ{%=#A  !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~-Root Entry  F>UҸ@ Data WordDocument :KObjectPoolRҸ>UҸ_990637714 FRҸRҸ1TableHCompObjXObjInfo i4@4NormalCJOJPJQJmH @ Heading 1T$<$d%d&d'd@&NOPQ5;B*KHOJQJphD`D Heading 2$@&5B*CJPJmH ph<A@<Default Paragraph Font3FVe{     3FVe{  @V l,B$waDB!x@A,@P ( H>`0 r  6 r  6 r  6 r  6 r  6 r  6 r   6 r   6  r   6    r   6    r   6    r  6    r  6   r  6 r  6 <B @ # !/<B  # !/<B  # !/<B  # !/<B  # !/<B @ # !/B S  ? irtl t  ttm hn tkt h  t=  t P  t3 h/t 3 t 3 0t 3 Q Lt 3 ht /t/0t/Lt/ht/ztLtht@T` @GTimes New Roman5Symbol3 Arial3Times"hUvFUvF!20\North ChaddertonNorth Chadderton  !"#$%&( FMicrosoft Word PictureNB6WWord.Picture.8Oh+'0p   , 8 DPX`h ssIT DepartmentoT D13.6 Legal.dot D626MicrObjectPool RҸRҸWordDocument*SummaryInformation( DocumentSummaryInformation83 jbjb^^ *h<h<lzzzz eee, je zeeezz ezzzzze u uHH 6.4 THE LEGAL REQUIREMENTS 6.1 SECURITY POLICY 6.2 RISK ANALYSIS Identify Risks Risk Analysis Insure against Risks 6.3 HANDLING RISKS Contingency Plans which Include Disaster Recovery Plans 6.5 AUDIT Are systems working? $%4GHIJZ[\jlyz{  5B*PJmH phB*CJPJmH phB*PJmH phCJ5B*CJPJmH ph CJOJQJ 5B*CJOJPJQJmH phCJ5B*CJPJmH ph jUmH)%&34HI[\klz{%&34HI[\klz{    (N N!*"*#!$!%  Oh+'0h  $ 0 <HPX`'ososNorth ChaddertonrdortNormalhNorth Chaddertonrd2rtMicrosoft Word 9.0d@@l/@/ ՜.+,0 hp  'Schooll  Titleom ڦ$$&S3ܣqݕ6]d-+ف?ꢜ8߆sgbg/mjkoUsDӀCzZq^?sjsnb%\77o4aewz#}g3V3ā>z1F6sg䗸J8~{(ӕv@@8_R\~?c#܁|oЇO"Vix\MRC*||S`TÃXb+l|Ъ-FD]~D k/~mO Y|>0NF8x%TU9B2݈^pH>}3'~v*Fir;Y^l~/֐ 7IJV?;/踉 U_V7f-~8al0Ev"U61Table\SummaryInformation(DocumentSummaryInformation8 0CompObj'josoft Word 9.0@F#@n{]9@3ʸ@3ʸ"՜.+,D՜.+,0 hp  School9K  Title 8@ _PID_HLINKSA<c1http://www.grsoftware.net/backup_strategies.htmlgt(http://www.utoronto.ca/security/drp.htmgt(http://www.utoronto.ca/security/drp.htm07<http://www.cnn.com/TECH/computing/9908/25/disaster.ent.idg/f9 +http://www.disastercenter.com/abrintro.htm\- 1http://www.webopedia.com/TERM/a/audit_trail.htmlMq,http://secinf.net/info/policy/hk_polic.html(O%http://www.drj.com/new2dr/w3_030.htm$(<http://ted.see.plym.ac.uk/ishtar/tutorial/intro3/sld001.htm=|+http://www.nchadderton.zen.co.uk/front.htm  FMicrosoft Word Document MSWo      !"#$%&'()*+, i@@@ Normal CJOJQJ_HkH'mH sH tH <@< Heading 1$@&5B*CJph8@8 Heading 2$<@&5B@B Heading 3$$@&a$5B*CJph@ Heading 4L$$d%d&d'd@&NOPQ5B*CJphJJ Heading 6$r1$@&^r` 5tH u<A@< Default Paragraph Font,@, Header  9r , @, Footer  9r &)@& Page Number*B@"* Body TextB*(U@1( Hyperlink>*B*8P@B8 Body Text 2 B*CJph~Q@R~ Body Text 3F$d%d&d'dNOPQ6B*CJphF^@bF Normal (Web)dd[$\$ OJPJQJ8V@q8 FollowedHyperlink>*B* F F>VR{+,?QRj|}jm7TU  C {  4 K _ . / M .kdeg TUkt 7Tlm_abcde  ,/Hcd()<OPj(EFefghv|: !i!!#^####$=$$'%(%9%q%&H&&&''A(B(L(((( )*)H)i)y))))) * *d+e+++4,T,,,,,,|-5.}.//00000 1k1l1z111223334l44445+5^555 6m667)7}89 9+99z:;<<6<8<L<i<<<<<<=G>>>>>>???@W@l@@@@ADAEAgAA1BBqCCDD D^DdDDDDDDEEEXE]EHFFFG8G'H[H]HHHHIJJ?JNJsJJJKKdMM[NNNPP8P^PPPPPQQQARRRRWSS5T6T[T{TTTTTNUUUVMVNVaV,W-WFWXX$XXXXY9YYYYYYZZ[[[\d]]h^^```aaa:bcdcecfcd ejekereeefFfffggg(ggghhh'h@hAhYhyhzhhhhii iiiiiiijjj#jpq%G   00 0   { {{{{{{{{{{ { { { {      00    00000000000000000                   ! " # $ % & ' ( ) * + , - . / 0 1800000000000 20 30 40 50000 60 70 80 900 :0 ;0 <0 =00000 >0 ?0 @0 A00000 0 0 0 000 B0 C0 D00 E> F>> G> H> I> J> K> L>>>>>>> M> N> O> P> Q> R>>>>> S> T> U> V> W> X>>>> YXE ZXE [XE \XEXEXEXEXEXEXEXEXEXEXEXE ]XE ^XE _XEXE `XE aXE bXE cXE dXE eXE fXE gXEXEXE hXE iXE jXE kXEXEXEXE lXE mXE nXEXEXEXE oXE pXEXEXEXE XE XEXEXE qXE rXE sXE tXE uXEXEXEXEXEXEXEXEXEXEXEXE vXE wXE xXEXE yY zY {Y |Y }YYYY ~Y Y Y Y YYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYY Y Y Y YYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYY Y Y