BINS 4331 Fall 2022 Exam 1
Answer 3 Questions
One From Section 1, and Two From Section 2
Read each question carefully and write a short essay for each question.
In each essay address the key points listed in the question.
(DONOT COPY & PASTE FROM TEXTBOOK OR INTERNET)
************************************
SECTION 1
************************************
Select one question from section 1. Each question in section 1 is worth 40 points
Question 1(40 points)
The Verizon Data Breach Report identified data breaches across various industries. In your
opinion, using the information in the report and your critical evaluation of the report identify
industries that are more prone to data breaches. Based on your assessment, write a short essay on
how Enterprise Governance and IT governance can help firms in the industry you identified
minimize the risk of data breaches. In your short essay address the following key points
?
Which sectors of the economy are more prone to security breaches?
?
What is Enterprise governance
?
What is IT governance
?
What is the difference between enterprise governance and IT governance and what is the
link?
?
Based on your responses above, how can the COBIT governance framework help the
sector you identified address future security risks?
?
Using the COBIT framework on governance, make recommendation on how the sector
can minimize the risk of data breaches in the future
Question 2 (40 points)
Last year hackers attacked and demanded ransom after shutting down the network at Colonial
Pipeline Co. Colonial Pipeline Company provides 45 percent of the East Coast’s gasoline, diesel
and jet fuel.
Read the article, Colonial_PipeLine_Paid.pdf, in the supplemental folder and in the Week 4
folder
1
Craft a short letter to the BOD of Colonial Pipeline Co. on IT governance and Enterprise
Governance and how governance can help minimize the risk of future security breaches. In your
letter address the following key points
?
How can Colonial Pipeline Co use enterprise governance and IT governance to minimize
the occurrence of security breaches in the future
?
Many businesses rely on the services provided by Colonial Pipeline Co. What will these
businesses, as stakeholders, want from Colonial Pipeline Co. Briefly describe how
stakeholder needs can shape the direction of organizational governance and trickle down
to IT governance
?
Explain each of the concepts in the AAA security principle. (The AAA services include
Identification, Authentication, Authorization, Accounting, and Auditing). Use the AAA
security principles to explain how Colonial Pipeline Co can minimize security breaches.
?
Identify 2 processes that you think can be implemented to support the AAA security
principle. Explain how the process support the AAA principle
***********************************
SECTION 2
***********************************
Select two questions from section 2. Each question in section 2 is worth 30 points
Question 1 (30 Points)
Audit is a very detail-oriented process that requires due diligence and care. In the CISA text, the
Audit Process identify 10 stages. The stages are illustrated in the image below
Select any 2 adjacent stage and write a short essay on the two stages. In your essay address the
following key points
?
Identify two adjacent step/sequential stages. Explain the activities that take place in each
of the stages you selected.
2
?
Explain the outcome of each stage that you selected. When the stage is completed what
is the outcome
?
What are the inputs to each of the stages? i.e., what is needed to complete activities in
this stage of the audit process.
?
How do the outputs you identified feed into the next stage of the process?
?
If you are auditing enterprise governance, what types of activities and task should be
accomplished in the stages that you selected, and what are the outcomes in those two
stages.
Question 2 (30 Points)
The Nursing program in a community college is incorporating experiential learning, thus as part
of the practical /internship component of the Nursing Degree Program , the Nursing Department
will provide primary healthcare services to patients in the community.
Due to the growth in enrollment and popularity of the program, the College is receiving a
significant grant from the federal government
The board of trustees hired your compliance and regulation consulting firm, BINS4331 Inc. to
assist the college institute process and procedures to comply with FERPA and HIPAA/HITECH
Craft a short report to the Board of Trustee explaining why the college must comply with these
regulations. In your brief report address the following key points
?
Explain why the college must comply with FERPA and make recommendations on how
the college can implement FERPA
?
Explain why the college must comply with HIPAA and make recommendations on how
the college can implement HIPAA
?
Explain how the AAA or the CIA principle can guide the college to implementing
HIPAA or /HITECH or FERPA. Explain each of the concepts in the principle that you
select. For example, if you AAA services, you must explain, Identification,
Authentication, Authorization, Accountability, and Auditing. If you select CIA, you must
explain, Confidentiality, Integrity and Availability and apply these concepts to the
implementation
Question 3 (30 points)
The Security Rule is an integral part of HIPAA. The Security Rule establishes national standards
to protect electronic personal health information. The Security Rule requires appropriate controls
to ensure the confidentiality, integrity, and availability of electronic protected health information
(e-PHI).
3
The Security Rule defines “confidentiality” to mean that e-PHI is not available or disclosed to
unauthorized persons and prohibitions against improper uses and disclosures of PHI. “Integrity”
means that e-PHI is not altered or destroyed in an unauthorized manner. “Availability” means
that e-PHI is accessible and usable on demand by an authorized person.
You have been tasked to train new interns on how your company will use AAA services
(Identification, Authentication, Authorization, Accounting, and Auditing) to implement controls
and procedures to comply with the HIPAA security rule.
Write short essay on what your training will cover. In your essay address the following key
points
?
Explain the elements of AAA services, (Identification, Authentication and Authorization,
Accounting and Auditing)
?
Explain how these AAA services processes and procedures can support the Security Rule
of HIPAA
?
One of the main elements of the AAA principle is Accounting/Auditing. Explain the role
of Accounting/Auditing in the AAA principles and explain how it can ensure the integrity
of e-PHI
?