M.B.A. (Semester IV) (CBCS) Examination, 2018
Paper IV System Management Security and Control
Information System
(Group
Day and Date Tuesday, 4-12-2018 Max. Marks 70
Time 10.30 a.m. to 1.00 p.m.
Instructions Question No. 1 is compulsory.
Solve any two questions from 4 and any two from
6 and 7.
All questions carry equal marks indicated in the right side of
each question.
1. Analyze the following case study, identify problems, suggest alternatives and
choose the best solution. 14
In 2004, Gartner, Inc. (Gartner) issued the first warning to organizations about
the threats they faced from the portable devices carried by the employees.
Data theft, one of the major security issues facing the companies, could
lead to heavy financial and economic loss to the organizations, according to
experts. Apart from the more prevalent forms of data theft like online hacking
of the organization's networks and stealing of hard copies of the files of the
organization, the companies were now waking up to yet another 'physical' way
of data theft with innocent looking IT gadgets like iPods, digital cameras, MP3
players and smart phones. The expenses incurred on preventing the theft of
data were slowly taking a major part of the IT budget for many organizations.
Employees could easily use their advantage of access to the internal resources
of the company to steal vital data. The main motives for stealing the data were
monetary gain, malicious intent and curiosity. Corporate data was profitable in
many ways; patented formulae, tender details, plans for future expansion were
some bits of information which could be very useful to competitors and fetch a
good sum of money in the market. Dishonest employees could steal data and
sell it to their competitors.
P.T.O.
Seat
No. Set P
Set P
SLR-CL 75 *SLRCL75*
Corporate insiders could easily evade the ring of security. Statistics showed
that internal security breaches were growing faster than the external security
breaches; and it constituted almost half of the total security breaches in the
organization.
However, there were some who argued that it was more of hype than a real
threat. Though there was every possibility of the data getting stolen and
used for malicious purposes, some experts opined that the threat had been
over-publicized in the media.
At a time when all the companies (mostly banks and governments) were
encouraging the customers to transact online, a considerable amount of
confidential customer data was stored in the company's database; and there
could not be any question of complacency on the part of the organizations in
safeguarding this data.
2. Write short notes on any two of the following 14
Security Policy.
Secret Key encryption.
Virus Threats and Protection.
3. Answer any two of the following 14
Discuss the need for security and control in information systems.
Discuss in detail Access Control and types of access control.
Discuss meaning of malicious software and its threat to information system.
4. Answer any two of the following 14
Explain Logical Security in detail.
Discuss the applications of Message Digests.
Explain meaning of Authentication and discuss types of authentication in
e-security.
5. Discuss in detail Security Audit along with security policy. Also discuss assurance
and evaluation of a secure information system. 14
6. Discuss the concept of Security of information resources along with different
types of security risks. 14
7. Discuss in detail cryptography and different types of cryptographic techniques. 14