Review Questions (1 to 2 paragraphs on each question)

1. Describe top-down strategic planning. How does it differ from bottom-up strategic planning? Which is usually more effective in implementing security in a large, diverse organization?
2. What is the primary objective of the SecSDLC? What are its major steps, and what are the major objectives of each step?
3. What questions might be asked to help identify and classify information assets? Which is the most useful question in the list
4. What are the three categories of information security controls? How is each used to reduce risk for the organization?

Exercises (1 to 2 paragraphs on each questions)

1. Using a Web search engine, find an article from a reputable source published within the past six months that reports on the relative risk that comes from inside the organization as opposed to risk that comes from external sources. If the article notes that this relative risk is changing, how is it changing and to what does the article attribute the change?
2. Search your institutions published documents, including its Web pages. Locate its mission statement, vision statement, and strategic goals. Identify any references to information security. Also look for any planning documents related to information security.
3. Using a Web browser, go to http://gocsi.com. Search for the link offering a free copy of the latest CSI/FBI study. Summarize the key points and bring your summary to class to discuss with your fellow students.

Please answer all of them if you can and know.I found some here,but i would like new ones. Thank you!