1. Refer to the following scenario for the next 4 questions. A global company benchmarks against similar companies that have recently faced costly and embarrassing cybersecurity breaches resulting in the loss of customer confidence. In response, the CEO assigns tasks to three departments: The IT department is charged with enhancing data accuracy, security, and privacy. Risk management is charged with implementing improved governance, compliance, and enforcement. HR is charged with strengthening procedures around acquisition of staff, policy creation, the code of ethics, and communication. Internally, the company must protect proprietary information and determine what limits to place on data retention and acquisition. Externally, they must also acquire competitive data and follow the law in all jurisdictions of their operations. Challenges with social media, web browsing, instant messaging, and high levels of employees traveling with their electronic devices create additional burdens. Currently, the company provides devices for all eligible employees. The three departments agree that employees must possess a work ethic, motivation, and integrity. The head of IT believes that there are three sources for recruitment, selection, and staffing: the military, college graduates with degrees in information technology, and professional hackers—skilled computer experts who use their technical knowledge to overcome a problem. IT plans to hire a professional hacker as an independent contractor to conduct ongoing IT vulnerability assessments to improve security, review the possibilities of penetration, and make recommendations to protect the system. Which protective measures should HR recommend?

A) A. Conduct a background check and create an independent contractor agreement that sets terms to prohibit any access not specifically authorized.
B) B. Give the person administrative passwords and see whether they are secure enough or should be changed.
C) C. Require that the independent contractor sign an invention agreement and honor code statement.
D) D. During the interview process, ask candidates to access the company's system and provide evidence of their ability to locate weaknesses.



2. In order to determine the full scope of enterprise risk that exists, which areas should HR review in an IT audit?

A) A. Compensation structure
B) B. Links between business and information strategy and business continuity
C) C. Ways to reduce the amount of sensitive data that must be protected
D) D. Reasons for the lack of outsourcing to third parties with deeper IT experience



3. Which technology policies should the HR manager recommend that the company implement? D is incorrect. A company may stipulate that a company-provided device be used only for business and may expressly prohibit use while driving.

A) A. The company must approve all personal devices the employee uses at home.
B) B. The company can review all charges and information on a company-provided device.
C) C. All employees must use their own electronic devices for work.
D) D. Employees may use devices at any time.



4. Where should the HR manager look to find potential employees with skills in cybersecurity?

A) A. Consider individuals who have recent criminal records related to Internet security and offer them state-of-the-art equipment.
B) B. Search for individuals with any computer-related degree.
C) C. Look on 'dark' websites that attract cybercriminals and promise them large hiring bonuses.
D) D. Recruit former military Internet workers who are attracted by a higher level of pay and flexibility.



5. Codes of Conduct An employee is faced with an ethical dilemma dealing with a supplier. How should the code of ethics support the employee?

A) By guiding decision making and behavior
B) By managing risks to the organization's public image
C) By reflecting the legal traditions of the home country
D) By accommodating the norms of the countries in which the organization operates