Recommending and justifying security improvements

Name:

Date:

Class:

Quick Questions

Shade in the A or B circle for each question.

1. Which is a stronger security recommendation for a clinic whose staff share one login?

A Improve the clinic's security so it is better protected

B Give each staff member a unique login with MFA, because shared logins weaken accountability and confidentiality

2. A recommendation should be linked to a weakness found in the organisation's current strategy.

A False

B True

3. Which justification uses the CIA criteria?

A Encrypting the database protects confidentiality by making stolen data unreadable

B Encrypting the database is popular, so it is a good idea

4. A recommendation to store daily backups offsite supports which CIA criterion most directly?

A Availability

B Confidentiality

5. Which recommendation is justified by a legal obligation?

A Delete customer records no longer needed, because APP 11 requires reasonable steps to destroy or de-identify unneeded personal information

B Keep all customer records forever, because more data is always better

Match the Pairs

Draw a line connecting each item on the left to its match on the right.

Left column		Right column
1Recommendation: add MFA to staff email		AThe justification does not use CIA criteria, legal obligations or cost and practicality
2Weakness: shared admin password -> Fix: role-based access		BNames one specific improvement that a student can describe and action
3Justify a recommendation using the CIA criteria and legal obligations		CEncrypting backups protects confidentiality and helps meet APP 11 on securing personal information
4Consider the cost and practicality of a recommendation		DCost: $2,000 a year. Staff need 1 hour of training. Fits the current budget
5Recommendation: improve security and buy better software		ELinks the recommendation directly to a weakness found in the current strategy
6Recommendation: install a new firewall. Justification: firewalls are popular		FToo vague. It names no specific improvement and is not tied to any weakness found

Definitions

Security recommendation

Fill in the Blanks

Complete each line of code by filling in the missing parts.

Weakness: staff reuse weak passwords Recommendation: add ___ to all logins

Weakness: no audit trail of file access Recommendation: turn on access ____

Fix: encrypt laptops to protect data Justification: this improves _______________

Recommendation: encrypt data in transit Justification: meets legal ___________

Recommendation: train staff in phishing Practicality: low ____ and quick to roll out

Spot the Error

Shade in the letter of the line that contains an error.

Question 1

A Weakness: weak passwords

B Fix: require MFA for logins

C Criteria: confidentiality

D Law: APP 7 protects the data

E Cost: low, uses current app

Question 2

A Weakness: no offsite backups

B Fix: add daily cloud backups

C Criteria: confidentiality

D Cost: moderate monthly fee

Question 3

A Weakness: staff can edit logs

B Fix: make audit logs read-only

C Criteria: availability

D Cost: low, a settings change

Question 4

A Weakness: unencrypted laptops

B Fix: turn on disk encryption

C Legal: APP 3 requires it

D Cost: low, built into the OS

Question 5

A Weakness: staff click phishing

B Fix: buy a bigger hard drive

C Criteria: confidentiality

D Cost: low, one session a term

Answer Key

Recommending and justifying security improvements

Section A: Quick Questions

B — Give each staff member a unique login with MFA, because shared logins weaken accountability and confidentiality

B — True

A — Encrypting the database protects confidentiality by making stolen data unreadable

A — Availability

A — Delete customer records no longer needed, because APP 11 requires reasonable steps to destroy or de-identify unneeded personal information

Section B: Match the Pairs

Recommendation: add MFA to staff email → Names one specific improvement that a student can describe and action

Weakness: shared admin password -> Fix: role-based access → Links the recommendation directly to a weakness found in the current strategy

Justify a recommendation using the CIA criteria and legal obligations → Encrypting backups protects confidentiality and helps meet APP 11 on securing personal information

Consider the cost and practicality of a recommendation → Cost: $2,000 a year. Staff need 1 hour of training. Fits the current budget

Recommendation: improve security and buy better software → Too vague. It names no specific improvement and is not tied to any weakness found

Recommendation: install a new firewall. Justification: firewalls are popular → The justification does not use CIA criteria, legal obligations or cost and practicality

Section C: Definitions

Security recommendation — A specific improvement that is tied to a weakness found in the strategy and justified using the CIA criteria, legal obligations and its cost and practicality.

Section D: Fill in the Blanks

Weakness: staff reuse weak passwords
Recommendation: add MFA to all logins

Weakness: no audit trail of file access
Recommendation: turn on access logs

Fix: encrypt laptops to protect data
Justification: this improves confidentiality

Recommendation: encrypt data in transit
Justification: meets legal obligations

Recommendation: train staff in phishing
Practicality: low cost and quick to roll out

Section E: Spot the Error

D — APP 7 covers direct marketing. Protecting data from unauthorised access is APP 11 (security of personal information), so that is the law the recommendation should cite.

C — Offsite backups let the organisation restore data after a failure, so they are justified by availability, not confidentiality.

C — Read-only logs stop records being changed, so the recommendation protects integrity. Availability is the wrong criterion for this fix.

C — APP 3 is about collecting personal information. Taking reasonable steps to secure stored data, such as by encrypting it, falls under APP 11.

B — A recommendation must be tied to the weakness found. More storage does nothing about staff clicking phishing links. Staff training does.