You’ve been asked to develop a risk management model for a moderately sized auto insurance company. The CEO explains that the organization needs to continue functioning smoothly “no matter what happens”. Located near a larger metro area, the car insurance company needs to support the daily work of insurance agents and also handles calls for roadside assistance. The call center often receives calls from upset customers in potentially dangerous situations. The director explains that all aspects of the business should, “be 100% secure and work all the time”.

1. Create two tables, one for qualitative risk and one for quantitative risks in the scenario from question.

2. Describe three considerations you would take into account in backup strategy for the company in question 1.

3. The CEO and director from question 1 like your risk assessment approach and believe it will fulfill their stated goals. Explain the limitations of risk management and your backup strategy to the CEO.

4. The CFO from question 1 believes your plan is too expensive; describe why your plan is fiscally important.

5. The network at your organization has been attacked and you are tasked with implementing IDS. Briefly describe the two main categories of IDS systems and list two advantages and two disadvantages to each one.

6. You suspect a man in the middle attack using PKI replacement. Describe what this attack means and how you can prevent it. Your answer should be specific to the type of attack.

7. You need obtain a secure certificate for your organization. Describe the advantages of using a public certificate authority.

8. Despite your arguments from question 8, your boss is determined to use an in-house CA. Explain why you think this could be a good or bad idea (you decide). Describe the third alternatives of an outsourced authority as well.