Longinus from on the sublime Essay Example

Longinus: from on the sublime Essay Name: Course: Instructor: Date: We will write a custom essay sample on Longinus: from on the sublime specifically for you for only $16.38 $13.9/page Order now We will write a custom essay sample on Longinus: from on the sublime specifically for you FOR ONLY $16.38 $13.9/page Hire Writer We will write a custom essay sample on Longinus: from on the sublime specifically for you FOR ONLY $16.38 $13.9/page Hire Writer Longinus: from on the sublime Sublime theory is a style of writing or speaking that is used to expresses the content in a great way. Rhetoric is an art of persuading the minds of the listeners. Rhetoric is related to science since it through it that scientists try to demonstrate through different theory the existence of nature. In addition, it is through rhetoric relation that divine objects are explained. This greatness described by sublime is indescribable, limitless and immeasurable. According to Longinus, the term sublime, has never been clearly defined since it consists of many aspects such excellence, distinction, amazement and wonder, combined into one. I agree with Longinus for there are divine things in the nature whose, magnificent cannot be explainable. Therefore sublime which is the style used to express this magnificent is not definable. Longinus states that people pose some serious challenges to the theory of sublime. Some argue that sublimity is a natural art that is inborn hence; it cannot be taug ht nor acquired. However, Longinus disagrees with them and calls this perception a fault that people have towards sublimity. He adds that the other fault that people commit when it comes to sublimity is turgidity, which is a tendency to overdo sublime. This fault occurs when a writer goes overboard when describing the greatness of the content in the poem or speech. Another fault that Longinus describes is pseudo-bacchanalian that touches on application of unnecessary emotions in poetry or speech. He explains that emotions should go hand in hand with the content written rather than the writer imposing their own emotions where one is not needed. In my own opinion, I would say that the writers impose their own emotion that they feel regardless of the readers’ emotion since the writer is passionate about the subject. This faults that writers commit are what makes their work not to be considered sublime. Sublime in rhetoric theory is a product of the poet. According to Plato’s theory of knowledge, which defines knowledge as a belief of something that a person has when that belief is justified through, prove. Plato explains that having a belief alone is not the same as knowledge rather it is having a belief that is proven beyond doubt through sufficient evidence (Benson, 2000). This theory therefore exempts this theory of sublime since the theory does not provide proof beyond doubt on matters it expresses. Rhetoric theory therefore is not easily accepted in science and religion matters since in these two areas a measurable proof is needed to convince people of their existence. Therefore, in line with this theory Longinus reconciles that sublime writing is not something that is acquired easily but through experience. Longinus explains ways on how a writer can acquire knowledge on sublime writing through several ways that he proves by presenting examples of other writers. The fir st way he describes of attaining sublimity is through the greatness of thought. This greatness is achieved through the writer conceiving powerful ideas that the writer will successfully put in writing. The writer must put the idea into words, and it should reflect the same effect as the thought. The other way of attaining sublime in writing is the appropriate use of emotions that are both inspiring and strong in the poem or speech. The emotions should be genuine and in line with the content. I disagree with Longinus on choosing emotions; I believe that the writer should express the greatness of the subject according to how the writer feels since the idea is generated by the writer and the purpose is to persuade the readers. The other way is selecting and organizing the thoughts into writing using different writing features and combining them in a proper manner to attract and captivate the listeners. This is achieved through amplification, that is, putting more emphasis on all the details that are in that poet by strengthening the argument or situation behind it to give it more meaning. The other technique is visualizing the images of the ideas to create clarity to the audience or readers. This technique when blended well with the facts creates easy persuasion to the readers or listeners and makes them listen more closely. The other technique is figures that are used to create a deeper design or to deduce the situation. It works well in diverting the current situation at hand by providing relief to the listeners. Figures should be chosen and used depending on the occasion, place, purpose and the manner to be represented. Figures help in creating suspense to the listeners by masking the real design of the writing until later. Therefore, the critics who think that sublime is an art one is born with are incorrect. Though Longinus explains that it is not easy he clarifies that it is possible for a writer to attain sublime in rhetoric theory through learning, practicing and experience. Work cited Benson, Hugh H. Socratic Wisdom: The Model of Knowledge in Plato’s Early Dialogues. New York, NY: Oxford University Press, 2000. Print

Agnon Judaism through Metaphors

Agnon Judaism through Metaphors Introduction Shmuel Yosef was a writer and a key figure in contemporary Jewish fiction. His writings tackle â€Å"conflicts in traditional living in Judaism, language, and contemporary world† (Balaban 420). As he said, religious books, viz. Talmud and Torah, mostly swayed the works of Agnon.Advertising We will write a custom essay sample on Agnon: Judaism through Metaphors specifically for you for only $16.05 $11/page Learn More He acquired the name â€Å"Agnon† from one of his stories influenced by the Jewish term Agunah that represents a woman that is not capable of remarrying after being refused a divorce or being abandoned by her husband. Some argument has been raised as to what could have led to Agnon choosing this name with some claiming that it is metaphorical to the abandonment of Israel by deity (Balaban 419-420). The metaphor as illustrated in Torah concerns the moment that Israel had turned away from God and God abandoned them for th eir disobedience. In many stories, ordinary themes of Jewish traditions are portrayed through journeys. This paper discusses the stories of Agnon and the manner in which they metaphorically signify and characterize the customs and traditions of Judaism. Agunot At the start of the story â€Å"Agunot†, Agnon employs the styles of symbolism and metaphor that act as a foundation of the ensuing plot. In stating that â€Å"a thread of grace is spun and drawn out of the deeds† (Yefet 440) and that â€Å"Holy One, blessed be He, in His glory, sits and weaves† (Yefet 440), it is insinuated that God intertwines a shawl of prayers that is woven from substances consisting of deeds of the Jewish people. Like the midrashic starting ends, the deeds of the Jewish people are structured in accordance with love. Out of the deeds of accomplished and pure love, God intertwines with the help of the threads (mercy and grace). The aforementioned metaphor comes up at the opening of the story. From the â€Å"Agunot† story, the author acquired his name â€Å"Agnon†. In this story, the author has altered the term â€Å"Agunah† from a law in Judaism to psychological status of being. In Judaism, â€Å"Agunah† denotes a woman that is married but has lost his husband (perhaps in battle or indifferent settings where he could be believed to have passed on). When the whereabouts of the husband s not identified, the wife turns out to be lawfully â€Å"attached†. The word â€Å"Agunah† is obtained from a Hebrew name â€Å"Ogen† that signifies â€Å"attached†. Therefore, the wife cannot be married again before being issued with a divorce by her husband. In this regard, the wife is in an indefinite state, caught up in two worlds.Advertising Looking for essay on religion theology? Let's see if we can help you! Get your first paper with 15% OFF Learn More In the â€Å"Agunot†, the author chang es the lawful Agunah into a psychological Agunah, portraying multiple instances of personified souls destined to be terribly attached to their desire for things they cannot acquire. The real plot narrates the story of a rich person who arrives in Jerusalem to assist in the reconstruction of the city. The rich man by the name Sire had a daughter, whom he wanted to get married to Ezekiel. Being an intellectual, Ezekiel was offered a teaching job by the rich man (Yefet 439). For the function of constructing an impressive ark in the temple, Sire employed a famous artisan whose name was Ben-Uri. Ben-Uri was a dedicated craftsman, and he dedicates his entire efforts towards his inventive function of constructing the ark. During the construction of the ark, Ben-Uri starts to sing. At this point, Dina gets so much attracted to Ben-Uri. However, Ben-Uri pays no attention to Dina and dedicates all his concentration and zeal to his task of art until he is through with the construction of the a rk, placing it near a window. When Ben-Uri dozes off in a backyard when it is already dark, Dina gets interested in knowing why Ben-Uri has stopped singing. In her nightdress, Dina goes closer to where Ben-Uri had been working and finds the completed ark near a window. When she was admiring the complex and beautiful artistic work in which Ben-Uri had totally dedicated his time and efforts to, Dina is overcome by a swift satanic urge in the form of jealousy and she throws out the ark thru the window (Yefet 441). Ben-Uri is blamed of the act and is forced to leave Jerusalem, and instead of the ark he had made, a simple one was prepared. Overpowered by guilt prior to get married to Ezekiel, Dina opens up to the rabbi and disclosed that she damaged the ark that Ben-Uri had made. The rabbi termed it as an accident. Even if Dina got married to Ezekiel, their marriage was never consummated. Both Dina and Ezekiel sat in different corners in the bedroom reflecting on the different things tha t had earlier transpired. On the same night, Ezekiel decides to divorce Dina and flees from Jerusalem (Yefet 442). The story ends on a mystical instance with assumptions of where rabbi headed to after he also leaves Jerusalem. Some of the metaphors that ensue are in some names of the characters. Ben-Uri symbolizes the Bezalzel in the bible who constructed God’s Tabernacle. Ezekiel symbolizes the Ezekiel in the bible who was a prophet and Dina symbolized the Dina in the bible who is represented as a raped woman. He says, Our sages of blessed memory said that when a man puts his first wife away from him, the very altars weep, but here [with Ezekiel and Dina] the altars had dropped tears even as he took her to wife (Agnon 7)Advertising We will write a custom essay sample on Agnon: Judaism through Metaphors specifically for you for only $16.05 $11/page Learn More The Kerchief In the story of â€Å"The Kerchief†, there comes up a boy as he moves th rough an entrance, when he starts to learn to join his childlike notions with the accountabilities of living in the world. While he lies in the bed of his dad, the boy gets a dream of the Christ, a magical realism (Agnon 8). He integrates his supernatural practicality of his juvenile and relates it to the function of mitzvot. As the boy grows up, his voice is augmented as the sounds of his parents diminish. His parents are reprieved, shifting to the backdrop as his real individuality, his desires and thoughts shift to the forefront. During his father’s absence, the boy would spend the nights in his bed and think of the likelihood of the return of Messiah. The Messiah as the boy believed, having intermingled with beggars, was immediately set to be identified as the Redeemer and King. In accordance with the boy, in the times that the Messiah would come back, his family could not have any distance separating them. Instead of journeys to work or to school, they would live togethe r, matching together in the courts of deity (Balaban 424). The boy could keep a record of the times of the absence of his dad by attempting a fresh loop in his fringes, after waking up every morning. The section outlined when the boy’s dad could come back from the fair is impressively gorgeous. This part carries the dream of the boy concerning his family, the value of closeness, and reverence, which are a radiance of light that grips the kids of a given family from cohort to cohort. The presents that the head of the family would bring home were valued, but temporary thus vanishing and lost after a moment (Balaban 425). Past the contentment of his riches, the storyteller is somewhat taken by a kerchief that his dad gave to his mum. The boy’s mum wears the scarf on different occasions. Nevertheless, during the Bar Mitzvah (an initiation rite in Judaism indicating 13 years of age of a Jewish lad and representing the start of religious accountability) of the boy, the mothe r ties it perfectly around the neck of the boy as a symbol of reputation. On the day of the ceremony, a beggar finds his way to the urban dwelling and he is avoided by everyone who gets near him. As the boy was on his way home, he meets the beggar and hands the exceptional kerchief to the beggar who uses it to cover his sores (Balaban 421-422). When the boy gets home, his mum immediately assures him that instead of a punishment for handing the kerchief to the beggar, he is applauded in joy for his lovely deed. In this regard, the existence of his parents, his dream concerning splendor of loving and lasting affection of his family get strongly achieved.Advertising Looking for essay on religion theology? Let's see if we can help you! Get your first paper with 15% OFF Learn More The digit 13 is metaphoric of a custom in Judaism. It is a number that illustrates a given maturity, a signpost of the maturity of a child. This number also symbolizes the traits of God, as earlier comprehended from a biblical perspective. Additionally, in Judaism, there exist 13 standards of faith. In the story of â€Å"The kerchief† the boys appears to make his parents contented with his deeds, illustrating the lines delineated for him, which is just the same way as a person could complete a written Torah (Balaban 423). The kerchief acquires a key and changing position in the attentiveness of the boy. The kerchief acts as the connection between the dad and mum and when the boy offers it to the beggar on the day of his Bar Mitzvah, the boy symbolizes Elijah, accomplishing a kind-hearted deed that could lead to redemption in the future. In this regard, the boy embraces both the greatest ambitions of human lessons and every one of the Godly qualities, a principle that symboliz es the best of traditions in Judaism stranded by tight traditions and kind family. Torah satisfies the Talmud. Additionally, the Talmud satisfies the scientific investigation and finally, the whole story makes the traits of a well-built person. From Lodging to Lodging The importance of this story heightens with the remembrance that Agnon initially shifted to Palestine in 1908 at the time of the second occurrence of mass migration to Palestine that took place from around 1904 until the World War I started. The aforementioned occurrence encompassed countless believers of Judaism that turned up not for the fact that they were idealists or Jewish backers of Zionism, but since riots and dire lack compelled them to (migration to Palestine was economical as compared to migration to America). The story commences with the narration of both winter and summer. The motives of sickness against those of well-being discussed at the beginning keep coming up throughout the story. The lodgings rent o ut in Tel Aviv are very close to the main bus terminus (Vais 31). The noise at the terminus keeps the narrator awake during nighttime with the sleepiness making him weary throughout the day, in such a great way that he could not actually benefit from being near the sea. Escalating the sense of sickness, the reader learns that the landlord had a kid who after being abandoned by his mum, eats dirt and is in a very pitiful state. The child cries through out the night. Even if flies could crawl over the wounds of the narrator, he was very tired to chase them away. The friends of the child’s father speak to him the way people speak to the ailing individuals. Moreover, they persistently tell him to move from one lodging to another, especially because he seemed to hate being kept awake throughout the night in Tel Aviv (Hagbi 90-95). The narrator states that Talmud’s teachings point out that individuals must never keep moving from one quarter to another, but his pals ignored h im and one of them searches new lodgings for him. The lodgings are not just new, but as well ideal. In this regard, they symbolize the dreams of a restored, healthy Israel and healthy individuals. In this story, the small house is positioned on a grassy hill away from the rowdy residents of the city and in the vineyards grown by the landlord. The portrayal of the house as well as nurturing of the land around it creates the metaphor of the resurgence of the land adored by the youthful Jewish innovators. The images of sickness and well-being keep occurring as the child’s father longs for the unique relaxation that he will experience when he gets into the house (Hoffman 147-148). Meanwhile, prior to his doing so, he generates an illness of his eyes and he is cautioned against touching the eyes to prevent them from turning out to be worse. Nevertheless, when he goes back to the lodgings in Tel Aviv, the boy, who has sick eyes and unclean fingers, keep on touching the eyes of his father even after being stopped. The representation of the illness strongly differs with the speaker’s finding when walks to the roads: I passed through the land and I saw that we had several more villages. Places that had produced only thistles and thorns had become like a garden of God. And like the land, so too the people were happy in their labors and rejoicing in building their land, their sons and daughters healthy and wholesome. Their hands were not soiled, and their eyes were not diseased (Agnon 18). The fable of the goat This story tells of an old man who falls sick and the sickness makes him get a severe and bad cough. As his treatment, the physicians prescribe the milk from a goat. The old man thus obtains a goat that demonstrates a queer pattern of conduct. Each day, the goat would disappear for a short time and come back with its udders filled with very sweet milk that calmed the cough. Puzzled by this queer conduct, the son to the old man is determined to unders tand this occurrence (Hagbi 127). The son to the old man ties the goat with a very long rope and stealthily follows her. When he followed the goat by the rope, the goat directed him to a very lengthy cave. The journey through the cave landed them to the land of Israel. Turning his eyes about the land, the son saw an attractive land that looked like the Garden of Eden. With the notice that he had reached the â€Å"promised land†, the son wrote a note to his dad directing him on the way to come after the goat on its way to this land. He attached this note at the ear of the goat as it started its journey back home. On seeing the goat without the company of his son, the old man assumed that the goat had led to the death of his son (Hagbi 129). He thereby reacted with wrath and killed the goat, only to find the note when the goat is already dead. This story ends on a sad note of disconnection of the father from his son as the cave strangely vanished with the death of the goat. The father thus forever remains in exile. The position of exile is represented as a sickness. A characteristic theme of exile from Israel in the bible as well as in the Jewish scriptures is a curse and reprimand. The affirmation of coughing from his heart rather than from his lungs symbolizes that the old man was not sick physically but psychologically (Hoffman 149-150). The reality that the milk carried by the goat originates from Israel and calms the coughing of the old man symbolizes Israel as a treatment to the psychological sickness of exile. The journey to Israel through the cave is symbolic of a spiritual walk to the Promised Land. In Hebrew, the word cord used to represent the rope tied to the goat has a pronunciation of ‘Meshicha† that calculatedly is pronounced almost the same as the Hebrew term for Messiah. To accept to have a grip on the cord â€Å"then your journey will be secure, and you will enter the Land of Israel† (Agnon 23) represents a real messia nic acceptance. Conclusion Shmuel Yosef was an author and a significant contributor in contemporary Jewish creative writing. As Yosef said, religious scriptures, Talmud and Torah, habitually influenced his writings. The stories of Agnon metaphorically signify and characterize the customs and traditions of Judaism. At the beginning of the story â€Å"Agunot†, Agnon utilizes metaphor that acts as a basis of the subsequent plot. It is from this story that the author gained his name â€Å"Agnon†. The figure 13 in â€Å"Kerchief† is metaphoric of a tradition in Judaism. The lodgings in â€Å"From Lodging to Lodging† are not merely new, but as well perfect, symbolizing the dreams of a reinstated, healthy Israel and healthy persons. In â€Å"The fable of the goat†, the journey to Israel via the cave is symbolic of a divine walk to the Promised Land. As evident in this paper, the writings of Agnon embark upon conflicts in traditional living in Judaism, lan guage and modern-day world. Agnon, Shmuel Y. A book that was lost and other stories, California: Schoken, 1995. Print. Balaban, Avraham. â€Å"A different reading of S. Y. Agnon’s story, â€Å"The kerchief.† Journal of Modern Jewish Studies 11.3 (2012): 419-425.  Print. Hagbi, Yaniv. Language, Absence, Play: Judaism and Superstructuralism in the Poetics of SY Agnon, New York: Syracuse University Press, 2009. Print. Hoffman, Anne. Language, Absence, Play: Judaism and Superstructuralism in the Poetics of SY Agnon. European Journal of Jewish Studies 5.1 (2011): 147-150. Print. Vais, Hilel. Agnon and Germany: The Presence of the German World in the Writings of SY Agnon, Ramat Gan: Bar-Ilan University Press, 2010. Print. Yefet, Karin. Unchaining the Agunot: Enlisting the Israeli Constitutional in the Service of Womens Marital Freedom. Yale Journal of Law Feminism 20.1 (2008): 439-442. Print.

Strategic Marketing Plan for Pit Bull Pride of Delaware Term Paper

Strategic Marketing Plan for Pit Bull Pride of Delaware - Term Paper Example Further, the organization allows volunteers render their services in line with promoting positivity for pit bulls. Remarkably, the organization draws no profits from their operations hence explaining the reason as to why the organization relies on foster shelters to offer this service. In this regard, this essay will give a detailed strategic plan report on how Pit Bull pride of Delaware would become a better performing institution from the level that is in currently. Additionally, the planning process will include a marketing strategy to produce a customer centered strategic plan. Company operations Pit Bull Pride receives a substantial number of pit bulls through surrender by the owners and the other fraction from shelters with high-kill probability. As per their database, the organization rescued at least a hundred and ten dogs from within Delaware, New Jersey, Pennsylvania and also Maryland in the year 2013. The highest percentage of the rescued pit bulls came from high kill hold ing shelters hence assuring the company of the continued need to stay in operation. After rescuing, pit bulls receive temporary shelter at foster homes until a time when they would get permanent homes that would give love and care as intended. Therefore, this organization draws success from the relenting partnership that they have with foster shelters as they help them save more pit bulls. On the other hand, the organization also facilitates adoption of rescued pit bulls, but they subject possible candidates to thorough screening before qualifying to adopt the animals. The rigorous process includes a face to face interview, home inspection, personal veterinary reference, and lastly a written consent commitment to caring for a dog. However, the organization also performs a temperament check on the pit bulls before their enrollment into the core program. Further, the dogs also go through screening to ascertain their health status before adoption into an official member of their foreve r family. The medical procedures include up to date vaccinations, testing for heartworms, and dosage on fleas or ticks. The dosage acts as a preventive measure for these pest infestations to assure them of healthy lives during their stay at the shelter. Vision for the organization As earlier mentioned, Pit Bull pride Delaware principally relies on the services of foster shelters to provide animal holding facilities until they can give shelter to the rescued pit bulls. For them, this serves as a restriction to growth and stability as it restricts the number of pit bulls that the organization might save if they had their own shelters. In this regard, Pit Bull pride intends to create their own shelter possibly in 2014 as a way of increasing work output and impact. According to Pit Bull Pride founder, Lauren Verfaillie, the organization underwent successful official incorporation in April of 2012. After incorporation, the organization applied for the 501 (c) 3 tax exemption application to the IRS it sought recognition as a nonprofit entity (Herman & Associates, 2011). This will in turn facilitate the organization to make strides into being a large supporter of pit bulls. The labor force of Pit Bull Pride According to Lauren, the organization squarely depends on volunteers to help in the running of the operations

Response and Opinion Paper Essay Example | Topics and Well Written Essays - 500 words

Response and Opinion Paper - Essay Example Apology, the dialogue reveals the tension that persisted between citizens in society, who discovered the tyrannical government and its regressive tendencies. Religion was employed to pacify the masses to follow particular norms and traditions that defined morality, but Socrates in his defense criticizes its exploitation and misuse of authority. For instance, he mocks the jury when he requests free meals for the rest of his life to be his sentence, but is later sentenced to death. Socrates dislike and disregard for the political system is extended in his third dialogue Crito where he decides to remain after the jury sentences him to death when found guilty. Even though, his second text Apology neglects his accusers, the system almost reigns supreme when he complies with the unjust laws of Athens and waits for his execution. I believe Socrates did not loathe interplay between religion and politics, but despised the manner rulers wielded power and influence over the masses. Finally, his last dialogue, Meno takes a sudden twist when though Socrates appeared to have lost the battle of justice, his dislike for the political system is seen when he decided to self-administer his death. He remained unconvinced by the jury’s verdict and considered his fate not in their hands. The dialogue is full of debate between Immortality and soul and subtly implies the inevitability of the continued existence of the soul. It is apparent battles characterize the history of philosophy, especially between camps debating major issues about human existence. One major debate is the source of knowledge and this argument pits rationalists against empiricists. Even though, rationalists claim the starting point of human knowledge is reasoning, I believe the beginning of human knowledge is sense experience (Carrutheras 123). It is the human senses that provide us with the original data concerning events in the world. Without the raw data obtained through sense experience, then knowledge

Leading In the Affective Domain

Leading In the Affective Domain Describe the effect behaviors have on productivity. Contrast the cognitive and affective domains. Research What is the relationship between the domains and learning? Identify a cognitive skill and an affective skill? The concept for learning domains and educational taxonomies evolved from the 1948 American Psychological Association Convention (Menix, 1996). There are three domains involved in the process of learning which exist as separate yet interactive processes involved in the Human learning outcomes. The cognitive, affective, and psychomotor domains epitomize the different aspects and degrees of learning complexity (Menix, 1996). The cognitive domain is often described as what we know, but is more the interaction of knowledge, understanding, application, analysis, synthesis and evaluation (Jensen, 2003). This encompasses the psychological and intellectual functions that facilitate comprehension and subsequent formation of rational judgments and includes perception, memory, imagination, thought and language (Brà ¼hlmeier, 2010). An example of a Cognitive skill is comprehension-to successfully interpret the meaning in order to develop an understanding of what is required. The affective domain concerns empathy and behaviour by the interaction of receiving, responding, valuing, organization and characterization by a value or value complex (Gronlund, 1991, p. 34). Emotions stimulate our learning and determine whether we are confident in this learning. Only when we have strong feelings about it do we believe something and give significance to it (Gazibara, 2003). An example of an affective skill is Value- to attach values to concepts and express an opinion as to its worth. Between the domains which one has the greatest impact on productivity? I feel that affective domain has a more significant impact on productivity in that the cognitive domain imparts the knowledge of how to do the task and the psychotic domain gives us the manual dexterity however the intention to do the task is carried out by the affective domain-attitude and motivation. Koul et al (2004) suggested that students perceptions of biology and physics classroom learning environments and their biology and physics classroom anxiety are conditioned by their motivational goal orientations Contrast the tasks, obstacles and goals of the Bully versus the Charismatic Leader. The authoritarian leadership style is the historical model of leader, based on the power being held exclusively by an individual leader who dictates policies and procedures, determines goals and strategies and directs without input by the subordinates, possibly modelled on historical feudal leadership where the word of the leader is absolute. It is largely dismissed as a leadership style. Smither (1991) wrote that it is not advocated in any management textbook recommends it. Many people who have under an authoritarian leader, describe their experience as a nightmare. Authoritarian methods of operation are dysfunctional, causing breakdown in the organization, in work accomplishment, and in interpersonal relations (Fisher, 1978). It is not without advocates however, in certain situations. Smither (1991) wrote about cases where a team management approach has been ineffective, and that authoritarian leadership as a management style has seen some revival. Researchers have found that there are cases where teams respond well to this management approach. The article suggests essentially that some people like to be led, and do not want responsibility of decision-making concerning organisational operations. Many individuals favour the structure and order of an authoritarian workplace. Additionally he writes that changing ones leadership style to fit the situation -has been found ineffective by a great many managers. While it is important to remember that authoritarian management is not a synonym for oppressive or punitive management, there is no cause to assume that teamwork or quality circles in themselves will result in higher productivity (Smither, 1991). Clegg et al (2003) described three forms of authority-charismatic authority as authority denoted due to the attractiveness and power of the leader, in that the leader is effectively owed homage through personal magnetism, grace and bearing. Traditional authority where the authority is owed by birthright e.g. the clas s system. Rational-legal authority holds that authority is given due to the position held by the leader in that it is not the individual but the office that commands authority. Kuhn (2012) described a charismatic leader as a person who creates the belief that anything is possible, via the command of three elements-branding, articulation and affection of the team. Tuomo (2005) wrote that a charismatic leader is effective when the leader behaviours are motivated by altruism as opposed to ego. Raelin (2003) warned that though charismatics can charm employees with their rhetoric and can draw the big picture, they can display such traits as grandiosity and suspicion. This was further tempered with the lack of availability with born leaders, and the requirement to recruit the capable. Traits required included innate intelligence, a desire to learn and work with others, giving them the ability to become effective leaders. The key issue with an authoritarian leader is one of staffing retention and low morale. The key issue with the charismatic leader is to perform and produce the promises. Describe a memorable leader: How did they impact Stress, Control and Satisfaction? Greg Dyke amongst other achievements served for a short-lived tenure as the director general of the British Broadcasting Cooperation. This was terminated following a disagreement with the government of the time concerning an edition of the current affairs programme Today questioning the justification from the government for the role of the United Kingdom in the conflict. During his tenure, Greg Dyke achieved several significant victories overseeing the transition from analogue to digital television, the rise of the MTV phenomena. He significantly reduced costs by terminating consultancy and agency staffing which was a contributory factor to the cooperations lack of success, as was the extant management style at the time which was responsible for eroding the BBCs Creativity (Schlesinger, 2010). Overturning this and effectively empowering his staff helped to regain creativity within the cooperation which effectively defines his tenure. Additionally, he had a management style that one many allies within the cooperation in that he was an approachable individual who interacted with all levels of staff. Such was his popularity that when he was forced to resign the cooperation saw industrial action as workers went on strike in protest. His success as a leader was according to him, down to making sure staff who worked closely with him, broadcasted the right message to others. References Clegg. S., Kornberger. M., Pitsis. T. (2011) Managing Organisations An Introduction to Theory Practice. London: SAGE Publications Ltd. Fisher, J. (1978). The Authoritarian as Anti-Manager. Public Personnel Management. 7.1 (Jan./Feb. 1978): 33. Gazibara, S, (2003) Head, Heart and Hands Learning. A challenge for contemporary education. Journal of Education Culture and Society No. 1_2013 Gronlund, N. E. (1991). How to write and use instructional objectives (4th ed.). New York : Macmillan Publishing Company. Jensen, E. (2003). Super teaching: Over 1000 practical strategies. Zagreb: Educa. Koul, R, Roy, L, Lerdpornkulrat, T. (2012) Motivational goal orientation, perceptions of biology and physics classroom learning environments, and gender. Learning Environments Research; Dordrecht15.2(Jul 2012): 217-229. Kuhn, M Alexander. (2012) Charismatic Leaders. Leadership Excellence; Aurora29.7 (Jul 2012): 20. Menix, K,. (1996) Domains of Learning: Interdependent Components of Achievable Learning Outcomes. The Journal of Continuing Education in Nursing; Thorofare27.5 (Sep/Oct 1996): 200-208. Raelin, J (2003) The myth of charismatic leaders. Profile. T + D; Alexandria57.3 (Mar 2003): 46-54. Schlesinger, P. (2010) The most creative organization in the world? The BBC, creativity and managerial style. International Journal of Cultural Policy, 16(3), pp. 271-285. (doi:10.1080/10286630903302766) Smither, R. (1991). The Return of the Authoritarian Manager. Training. 28.11 (Nov 1991): 40. Tuomo, T (2005) Problems and Perspectives in Management, 3/2005 45 Charismatic Leadership and Power

The Bible References in Brothers Grimm Fairy Tales

The very first reference to a religious aspect is that they are twelve as the apostles of the Bible, and one of them, the youngest had the name of one bible character – Benjamin- who was too the 21st son of Jacob also, who had a daughter too.The next reference is the Golden Star on the girl's forehead, which is a compost symbol with two pieces, the first is gold, and it evokes what is illuminated, sacred and durable. The second is Star, it symbolize â€Å"the presence of divinity' (Cooper, 156). Like the brothers on this fairy tale, Jacob once had to flee from the wrath of his brother Seas. When the princess took off the flowers from earth she deflowered her brother she committed an incestuous act.The brothers turned into Ravens, which are in the Bible god singers and prophets, as a punishment to the Incestuous act and she was not punished too because of being a divinity and sacred being. The seven years of silence that she had to obey can be a reference to Mary of Sorrows, w hich symbol Is a heart pierced by seven swords, each sword meaning one of the sorrows that she had to face. The latter reference is the step-mother who persuades the King to send his beloved wife to the fire, acting like the Devil stacking his claim of the sinner princess.

Principles of Information Security, 4th Ed. – Michael E. Whitman Chap 01

Licensed to: CengageBrain User Licensed to: CengageBrain User Principles of Information Security, Fourth Edition Michael E. Whitman and Herbert J. Mattord Vice President Editorial, Career Education & Training Solutions: Dave Garza Director of Learning Solutions: Matthew Kane Executive Editor: Steve Helba Managing Editor: Marah Bellegarde Product Manager: Natalie Pashoukos Development Editor: Lynne Raughley Editorial Assistant: Jennifer Wheaton Vice President Marketing, Career Education & Training Solutions: Jennifer Ann Baker Marketing Director: Deborah S.Yarnell Senior Marketing Manager: Erin Coffin Associate Marketing Manager: Shanna Gibbs Production Manager: Andrew Crouth Content Project Manager: Brooke Greenhouse Senior Art Director: Jack Pendleton Manufacturing Coordinator: Amy Rogers Technical Edit/Quality Assurance: Green Pen Quality Assurance  © 2012 Course Technology, Cengage Learning For more information, contact or find us on the World Wide Web at: www. course. com ALL R IGHTS RESERVED.No part of this work covered by the copyright herein may be reproduced, transmitted, stored or used in any form or by any means graphic, electronic, or mechanical, including but not limited to photocopying, recording, scanning, digitizing, taping, Web distribution, information networks, or information storage and retrieval systems, except as permitted under Section 107 or 108 of the 1976 United States Copyright Act, without the prior written permission of the publisher.For product information and technology assistance, contact us at Cengage Learning Customer & Sales Support, 1-800-354-9706 For permission to use material from this text or product, submit all requests online at cengage. com/permissions Further permission questions can be emailed to [email  protected] comLibrary of Congress Control Number: 2010940654 ISBN-13: 978-1-111-13821-9 ISBN-10: 1-111-13821-4 Course Technology 20 Channel Center Boston, MA 02210 USA Cengage Learning is a leading provider of custo mized learning solutions with office locations around the globe, including Singapore, the United Kingdom, Australia, Mexico, Brazil, and Japan. Locate your local office at: international. cengage. com/region. Cengage Learning products are represented in Canada by Nelson Education, Ltd. For your lifelong learning solutions, visit course. cengage. com Purchase any of our products at your local college store or at our preferred online store www. engagebrain. com. Printed in the United States of America 1 2 3 4 5 6 7 8 9 14 13 12 11 10 Copyright 2011 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s). Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it . Licensed to: CengageBrain User hapter 1 Introduction to Information Security Do not figure on opponents not attacking; worry about your own lack of preparation. BOOK OF THE FIVE RINGS For Amy, the day began like any other at the Sequential Label and Supply Company (SLS) help desk. Taking calls and helping office workers with computer problems was not glamorous, but she enjoyed the work; it was challenging and paid well. Some of her friends in the industry worked at bigger companies, some at cutting-edge tech companies, but they all agreed that jobs in information technology were a good way to pay the bills.The phone rang, as it did on average about four times an hour and about 28 times a day. The first call of the day, from a worried user hoping Amy could help him out of a jam, seemed typical. The call display on her monitor gave some of the facts: the user’s name, his phone number, the department in which he worked, where his office was on the company campus, and a list of all the calls he’d made in the past. â€Å"Hi, Bob,† she said. â€Å"Did you get that document formatting problem squared away? † â€Å"Sure did, Amy. Hope we can figure out what’s going on this time. † â€Å"We’ll try, Bob. Tell me about it. † â€Å"Well, my PC is acting weird,† Bob said. When I go to the screen that has my e-mail program running, it doesn’t respond to the mouse or the keyboard. † â€Å"Did you try a reboot yet? † 1 Copyright 2011 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s). Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it. Licensed to: CengageB rain User Chapter 1 â€Å"Sure did. But the window wouldn’t close, and I had to turn it off. After it restarted, I opened the e-mail program, and it’s just like it was before—no response at all. The other stuff is working OK, but really, really slowly. Even my Internet browser is sluggish. † â€Å"OK, Bob. We’ve tried the usual stuff we can do over the phone. Let me open a case, and I’ll dispatch a tech over as soon as possible. † Amy looked up at the LED tally board on the wall at the end of the room. She saw that there were only two technicians dispatched to deskside support at the moment, and since it was the day shift, there were four available. Shouldn’t be long at all, Bob. † She hung up and typed her notes into ISIS, the company’s Information Status and Issues System. She assigned the newly generated case to the deskside dispatch queue, which would page the roving deskside team with the details in just a few minutes. A moment later, Amy looked up to see Charlie Moody, the senior manager of the server administration team, walking briskly down the hall. He was being trailed by three of his senior technicians as he made a beeline from his office to the door of the server room where the company servers were kept in a controlled environment. They all looked worried.Just then, Amy’s screen beeped to alert her of a new e-mail. She glanced down. It beeped again—and again. It started beeping constantly. She clicked on the envelope icon and, after a short delay, the mail window opened. She had 47 new e-mails in her inbox. She opened one from Davey Martinez, an acquaintance from the Accounting Department. The subject line said, â€Å"Wait till you see this. † The message body read, â€Å"Look what this has to say about our managers’ salaries†¦Ã¢â‚¬  Davey often sent her interesting and funny e-mails, and she failed to notice that the file attachment icon was unu sual before she clicked it.Her PC showed the hourglass pointer icon for a second and then the normal pointer reappeared. Nothing happened. She clicked the next e-mail message in the queue. Nothing happened. Her phone rang again. She clicked the ISIS icon on her computer desktop to activate the call management software and activated her headset. â€Å"Hello, Tech Support, how can I help you? † She couldn’t greet the caller by name because ISIS had not responded. â€Å"Hello, this is Erin Williams in receiving. † Amy glanced down at her screen. Still no ISIS.She glanced up to the tally board and was surprised to see the inbound-call-counter tallying up waiting calls like digits on a stopwatch. Amy had never seen so many calls come in at one time. â€Å"Hi, Erin,† Amy said. â€Å"What’s up? † â€Å"Nothing,† Erin answered. â€Å"That’s the problem. † The rest of the call was a replay of Bob’s, except that Amy had to jot notes down on a legal pad. She couldn’t dispatch the deskside support team either. She looked at the tally board. It had gone dark. No numbers at all. Then she saw Charlie running down the hall from the server room. He didn’t look worried anymore. He looked frantic. Amy picked up the phone again.She wanted to check with her supervisor about what to do now. There was no dial tone. Copyright 2011 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s). Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it. Licensed to: CengageBrain User Introduction to Information Security 3LEARNING OBJECTIVES: Upon completion of this material, you should be able to: †¢ †¢ †¢ †¢ †¢ Define information security Recount the history of computer security, and explain how it evolved into information security Define key terms and critical concepts of information security Enumerate the phases of the security systems development life cycle Describe the information security roles of professionals within an organization 1 Introduction James Anderson, executive consultant at Emagined Security, Inc. , believes information security in an enterprise is a â€Å"well-informed sense of assurance that the information risks and controls are in balance. He is not alone in his perspective. Many information security practitioners recognize that aligning information security needs with business objectives must be the top priority. This chapter’s opening scenario illustrates that the information risks and controls are not in balance at Sequential Label and Supply. Though Amy works in a technical support role and her job is to solve technical problems, it does not occur to her that a malicious software program, like a worm or virus, might be the agent of the company’s current ills.Management also shows signs of confusion and seems to have no idea how to contain this kind of incident. If you were in Amy’s place and were faced with a similar situation, what would you do? How would you react? Would it occur to you that something far more insidious than a technical malfunction was happening at your company? As you explore the chapters of this book and learn more about information security, you will become better able to answer these questions. But before you can begin studying the details of the discipline of information security, you must first know the history and evolution of the field.The History of Information Security The history of information security begins with computer security. The need for computer security—that is, the need to secure physical locations, hardware, and softwa re from threats— arose during World War II when the first mainframes, developed to aid computations for communication code breaking (see Figure 1-1), were put to use. Multiple levels of security were implemented to protect these mainframes and maintain the integrity of their data.Access to sensitive military locations, for example, was controlled by means of badges, keys, and the facial recognition of authorized personnel by security guards. The growing need to maintain national security eventually led to more complex and more technologically sophisticated computer security safeguards. During these early years, information security was a straightforward process composed predominantly of physical security and simple document classification schemes. The primary threats to security were physical theft of equipment, espionage against the products of the systems, and sabotage.One of the first documented security problems that fell outside these categories occurred in the early 196 0s, when a systems administrator was working on an MOTD Copyright 2011 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s). Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.Licensed to: CengageBrain User 4 Chapter 1 Earlier versions of the German code machine Enigma were ? rst broken by the Poles in the 1930s. The British and Americans managed to break later, more complex versions during World War II. The increasingly complex versions of the Enigma, especially the submarine or Unterseeboot version of the Enigma, caused considerable anguish to Allied forces before ? nally being cracked. The information gained from decrypted transmissions was used to anticipate the actions of German armed forces. Some ask why, if we were reading the Enigma, we did not win the war earlier. One might ask, instead, when, if ever, we would have won the war if we hadn’t read it. †1 Figure 1-1 The Enigma Source: Courtesy of National Security Agency (message of the day) file, and another administrator was editing the password file. A software glitch mixed the two files, and the entire password file was printed on every output file. 2 The 1960s During the Cold War, many more mainframes were brought online to accomplish more complex and sophisticated tasks.It became necessary to enable these mainframes to communicate via a less cumbersome process than mailing magnetic tapes between computer centers. In response to this need, the Department of Defense’s Advanced Research Project Agency (ARPA) began examining the feasibility of a redundant, networked communications system to support the military’s exchange of information. Larr y Roberts, known as the founder of the Internet, developed the project—which was called ARPANET—from its inception. ARPANET is the predecessor to the Internet (see Figure 1-2 for an excerpt from the ARPANET Program Plan).The 1970s and 80s During the next decade, ARPANET became popular and more widely used, and the potential for its misuse grew. In December of 1973, Robert M. â€Å"Bob† Metcalfe, who is credited Copyright 2011 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s). Editorial review has deemed that any suppressed content does not materially affect the overall learning experience.Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it. Licensed to: CengageBrain User Introduction to Information Security 5 1 Figure 1-2 Development of the ARPANET Program Plan3 Source: Courtesy of Dr. Lawrence Roberts with the development of Ethernet, one of the most popular networking protocols, identified fundamental problems with ARPANET security. Individual remote sites did not have sufficient controls and safeguards to protect data from unauthorized remote users.Other problems abounded: vulnerability of password structure and formats; lack of safety procedures for dial-up connections; and nonexistent user identification and authorization to the system. Phone numbers were widely distributed and openly publicized on the walls of phone booths, giving hackers easy access to ARPANET. Because of the range and frequency of computer security violations and the explosion in the numbers of hosts and users on ARPANET, network security was referred to as network insecurity. In 1978, a famous study entitled â€Å"Protection Analysis: Final Report† was published. It focused on a project undertaken by ARPA to discover the vulnerabilitie s of operating system security. For a timeline that includes this and other seminal studies of computer security, see Table 1-1. The movement toward security that went beyond protecting physical locations began with a single paper sponsored by the Department of Defense, the Rand Report R-609, which attempted to define the multiple controls and mechanisms necessary for the protection of a multilevel computer system.The document was classified for almost ten years, and is now considered to be the paper that started the study of computer security. The security—or lack thereof—of the systems sharing resources inside the Department of Defense was brought to the attention of researchers in the spring and summer of 1967. At that time, systems were being acquired at a rapid rate and securing them was a pressing concern for both the military and defense contractors. Copyright 2011 Cengage Learning. All Rights Reserved.May not be copied, scanned, or duplicated, in whole or in pa rt. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s). Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it. Licensed to: CengageBrain User 6 Chapter 1 Date 1968 1973 1975 1978 Documents Maurice Wilkes discusses password security in Time-Sharing Computer Systems.Schell, Downey, and Popek examine the need for additional security in military systems in â€Å"Preliminary Notes on the Design of Secure Military Computer Systems. †5 The Federal Information Processing Standards (FIPS) examines Digital Encryption Standard (DES) in the Federal Register. Bisbey and Hollingworth publish their study â€Å"Protection Analysis: Final Report,† discussing the Protection Analysis project created by ARPA to better understand the vulnerabilities of opera ting system security and examine the possibility of automated vulnerability detection techniques in existing system software. Morris and Thompson author â€Å"Password Security: A Case History,† published in the Communications of the Association for Computing Machinery (ACM). The paper examines the history of a design for a password security scheme on a remotely accessed, time-sharing system. Dennis Ritchie publishes â€Å"On the Security of UNIX† and â€Å"Protection of Data File Contents,† discussing secure user IDs and secure group IDs, and the problems inherent in the systems. Grampp and Morris write â€Å"UNIX Operating System Security. In this report, the authors examine four â€Å"important handles to computer security†: physical control of premises and computer facilities, management commitment to security objectives, education of employees, and administrative procedures aimed at increased security. 7 Reeds and Weinberger publish â€Å"File Secu rity and the UNIX System Crypt Command. † Their premise was: â€Å"No technique can be secure against wiretapping or its equivalent on the computer. Therefore no technique can be secure against the systems administrator or other privileged users †¦ the naive user has no chance. 8 1979 1979 1984 1984 Table 1-1 Key Dates for Seminal Works in Early Computer Security In June of 1967, the Advanced Research Projects Agency formed a task force to study the process of securing classified information systems. The Task Force was assembled in October of 1967 and met regularly to formulate recommendations, which ultimately became the contents of the Rand Report R-609. 9 The Rand Report R-609 was the first widely recognized published document to identify the role of management and policy issues in computer security.It noted that the wide utilization of networking components in information systems in the military introduced security risks that could not be mitigated by the routine pra ctices then used to secure these systems. 10 This paper signaled a pivotal moment in computer security history—when the scope of computer security expanded significantly from the safety of physical locations and hardware to include the following: Securing the data Limiting random and unauthorized access to that data Involving personnel from multiple levels of the organization in matters pertaining to information securityMULTICS Much of the early research on computer security centered on a system called Multiplexed Information and Computing Service (MULTICS). Although it is now obsolete, MULTICS is noteworthy because it was the first operating system to integrate security into Copyright 2011 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s). Editorial review has deemed that any suppressed content does not materially affect the overall learning experience.Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it. Licensed to: CengageBrain User Introduction to Information Security 7 its core functions. It was a mainframe, time-sharing operating system developed in the mid1960s by a consortium of General Electric (GE), Bell Labs, and the Massachusetts Institute of Technology (MIT). In mid-1969, not long after the restructuring of the MULTICS project, several of its developers (Ken Thompson, Dennis Ritchie, Rudd Canaday, and Doug McIlro) created a new operating system called UNIX.While the MULTICS system implemented multiple security levels and passwords, the UNIX system did not. Its primary function, text processing, did not require the same level of security as that of its predecessor. In fact, it was not until the early 1970s that even the simplest component of security, the password function, became a component of UNIX. In the late 1970s, the microprocessor brought the personal computer and a new age of computing. The PC became the workhorse of modern computing, thereby moving it out of the data center.This decentralization of data processing systems in the 1980s gave rise to networking—that is, the interconnecting of personal computers and mainframe computers, which enabled the entire computing community to make all their resources work together. 1 The 1990s At the close of the twentieth century, networks of computers became more common, as did the need to connect these networks to each other. This gave rise to the Internet, the first global network of networks. The Internet was made available to the general public in the 1990s, having previously been the domain of government, academia, and dedicated industry professionals.The Internet brought connectivity to virtually all computers that could reach a phone line or an Internet-connected local area network (LAN). After the Internet was commercialized, the tec hnology became pervasive, reaching almost every corner of the globe with an expanding array of uses. Since its inception as a tool for sharing Defense Department information, the Internet has become an interconnection of millions of networks. At first, these connections were based on de facto standards, because industry standards for interconnection of networks did not exist at that time.These de facto standards did little to ensure the security of information though as these precursor technologies were widely adopted and became industry standards, some degree of security was introduced. However, early Internet deployment treated security as a low priority. In fact, many of the problems that plague e-mail on the Internet today are the result of this early lack of security. At that time, when all Internet and e-mail users were (presumably trustworthy) computer scientists, mail server authentication and e-mail encryption did not seem necessary.Early computing approaches relied on secu rity that was built into the physical environment of the data center that housed the computers. As networked computers became the dominant style of computing, the ability to physically secure a networked computer was lost, and the stored information became more exposed to security threats. 2000 to Present Today, the Internet brings millions of unsecured computer networks into continuous communication with each other. The security of each computer’s stored information is now contingent on the level of security of every other computer to which it is connected.Recent years have seen a growing awareness of the need to improve information security, as well as a realization that information security is important to national defense. The growing threat of Copyright 2011 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s). Editorial review has deemed that any suppressed content does not materially affect the overall learning experience.Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it. Licensed to: CengageBrain User 8 Chapter 1 cyber attacks have made governments and companies more aware of the need to defend the computer-controlled control systems of utilities and other critical infrastructure. There is also growing concern about nation-states engaging in information warfare, and the possibility that business and personal information systems could become casualties if they are undefended.What Is Security? In general, security is â€Å"the quality or state of being secure—to be free from danger. †11 In other words, protection against adversaries—from those who would do harm, intentionally or otherwise—is the objective. National security, for example, is a multilayered system that protects the sovereignty of a st ate, its assets, its resources, and its people. Achieving the appropriate level of security for an organization also requires a multifaceted system.A successful organization should have the following multiple layers of security in place to protect its operations: Physical security, to protect physical items, objects, or areas from unauthorized access and misuse Personnel security, to protect the individual or group of individuals who are authorized to access the organization and its operations Operations security, to protect the details of a particular operation or series of activities Communications security, to protect communications media, technology, and content Network security, to protect networking components, connections, and contents Information security, to protect the confidentiality, integrity and availability of information assets, whether in storage, processing, or transmission. It is achieved via the application of policy, education, training and awareness, and techno logy.The Committee on National Security Systems (CNSS) defines information security as the protection of information and its critical elements, including the systems and hardware that use, store, and transmit that information. 12 Figure 1-3 shows that information security includes the broad areas of information security management, computer and data security, and network security. The CNSS model of information security evolved from a concept developed by the computer security industry called the C. I. A. triangle. The C. I. A. triangle has been the industry standard for computer security since the development of the mainframe. It is based on the three characteristics of information that give it value to organizations: confidentiality, integrity, and availability.The security of these three characteristics of information is as important today as it has always been, but the C. I. A. triangle model no longer adequately addresses the constantly changing environment. The threats to the c onfidentiality, integrity, and availability of information have evolved into a vast collection of events, including accidental or intentional damage, destruction, theft, unintended or unauthorized modification, or other misuse from human or nonhuman threats. This new environment of many constantly evolving threats has prompted the development of a more robust model that addresses the complexities of the current information security environment.The expanded model consists of a list of critical characteristics of information, which are described in the next Copyright 2011 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s). Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it. Licensed to: CengageBrain User Introduction to Information Security 9 1 Information security Figure 1-3 Components of Information SecuritySource: Course Technology/Cengage Learning section. C. I. A. triangle terminology is used in this chapter because of the breadth of material that is based on it. Key Information Security Concepts This book uses a number of terms and concepts that are essential to any discussion of information security. Some of these terms are illustrated in Figure 1-4; all are covered in greater detail in subsequent chapters. Access: A subject or object’s ability to use, manipulate, modify, or affect another subject or object. Authorized users have legal access to a system, whereas hackers have illegal access to a system. Access controls regulate this ability.Asset: The organizational resource that is being protected. An asset can be logical, such as a Web site, information, or data; or an asset can be physical, such as a person, c omputer system, or other tangible object. Assets, and particularly information assets, are the focus of security efforts; they are what those efforts are attempting to protect. Attack: An intentional or unintentional act that can cause damage to or otherwise compromise information and/or the systems that support it. Attacks can be active or passive, intentional or unintentional, and direct or indirect. Someone casually reading sensitive information not intended for his or her use is a passive attack.A hacker attempting to break into an information system is an intentional attack. A lightning strike that causes a fire in a building is an unintentional attack. A direct attack is a hacker using a personal computer to break into a system. An indirect attack is a hacker compromising a system and using it to attack other systems, for example, as part of a botnet (slang for robot network). This group of compromised computers, running software of the attacker’s choosing, can operate autonomously or under the attacker’s direct control to attack systems and steal user information or conduct distributed denial-of-service attacks. Direct attacks originate from the threat itself.Indirect attacks originate from a compromised system or resource that is malfunctioning or working under the control of a threat. Copyright 2011 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s). Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it. Licensed to: CengageBrain User 10 Chapter 1 Vulnerability: Buffer overflow in online database Web interfaceThreat: Theft Threat agent: Ima Hacker Exploit: Script from MadHackz Web site Attack: Ima Hacker downloads an exploit from MadHackz web site and then accesses buybay’s Web site. Ima then applies the script which runs and compromises buybay's security controls and steals customer data. These actions cause buybay to experience a loss. Asset: buybay’s customer database Figure 1-4 Information Security Terms Source: Course Technology/Cengage Learning Control, safeguard, or countermeasure: Security mechanisms, policies, or procedures that can successfully counter attacks, reduce risk, resolve vulnerabilities, and otherwise improve the security within an organization.The various levels and types of controls are discussed more fully in the following chapters. Exploit: A technique used to compromise a system. This term can be a verb or a noun. Threat agents may attempt to exploit a system or other information asset by using it illegally for their personal gain. Or, an exploit can be a documented process to take advantage of a vulnerability or exposure, usually in software, that is either inherent in the software or is created by the attacker. Exploits make use of existing software tools or custom-made software components. Exposure: A condition or state of being exposed. In information security, exposure exists when a vulnerability known to an attacker is present.Loss: A single instance of an information asset suffering damage or unintended or unauthorized modification or disclosure. When an organization’s information is stolen, it has suffered a loss. Protection profile or security posture: The entire set of controls and safeguards, including policy, education, training and awareness, and technology, that the Copyright 2011 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s). Editorial review has deemed that any suppressed content does not materially affect the overall learning experience.Cen gage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it. Licensed to: CengageBrain User Introduction to Information Security 11 organization implements (or fails to implement) to protect the asset. The terms are sometimes used interchangeably with the term security program, although the security program often comprises managerial aspects of security, including planning, personnel, and subordinate programs. Risk: The probability that something unwanted will happen. Organizations must minimize risk to match their risk appetite—the quantity and nature of risk the organization is willing to accept.Subjects and objects: A computer can be either the subject of an attack—an agent entity used to conduct the attack—or the object of an attack—the target entity, as shown in Figure 1-5. A computer can be both the subject and object of an attack, when, for example, it is compromised by an attack (object), and is then used to attack other systems (subject). Threat: A category of objects, persons, or other entities that presents a danger to an asset. Threats are always present and can be purposeful or undirected. For example, hackers purposefully threaten unprotected information systems, while severe storms incidentally threaten buildings and their contents. Threat agent: The specific instance or a component of a threat.For example, all hackers in the world present a collective threat, while Kevin Mitnick, who was convicted for hacking into phone systems, is a specific threat agent. Likewise, a lightning strike, hailstorm, or tornado is a threat agent that is part of the threat of severe storms. Vulnerability: A weaknesses or fault in a system or protection mechanism that opens it to attack or damage. Some examples of vulnerabilities are a flaw in a software package, an unprotected system port, and an unlocked door. Some well-known vulnerabilities have been examined, documented, and pu blished; others remain latent (or undiscovered). 1 Critical Characteristics of InformationThe value of information comes from the characteristics it possesses. When a characteristic of information changes, the value of that information either increases, or, more commonly, decreases. Some characteristics affect information’s value to users more than others do. This can depend on circumstances; for example, timeliness of information can be a critical factor, because information loses much or all of its value when it is delivered too late. Though information security professionals and end users share an understanding of the characteristics of subject object Figure 1-5 Computer as the Subject and Object of an Attack Source: Course Technology/Cengage LearningCopyright 2011 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s). Edit orial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it. Licensed to: CengageBrain User 12 Chapter 1 information, tensions can arise when the need to secure the information from threats conflicts with the end users’ need for unhindered access to the information.For instance, end users may perceive a tenth-of-a-second delay in the computation of data to be an unnecessary annoyance. Information security professionals, however, may perceive that tenth of a second as a minor delay that enables an important task, like data encryption. Each critical characteristic of information—that is, the expanded C. I. A. triangle—is defined in the sections below. Availability Availability enables authorized users—persons or computer systems—to access information without interference or obstr uction and to receive it in the required format. Consider, for example, research libraries that require identification before entrance.Librarians protect the contents of the library so that they are available only to authorized patrons. The librarian must accept a patron’s identification before that patron has free access to the book stacks. Once authorized patrons have access to the contents of the stacks, they expect to find the information they need available in a useable format and familiar language, which in this case typically means bound in a book and written in English. Accuracy Information has accuracy when it is free from mistakes or errors and it has the value that the end user expects. If information has been intentionally or unintentionally modified, it is no longer accurate. Consider, for example, a checking account.You assume that the information contained in your checking account is an accurate representation of your finances. Incorrect information in your che cking account can result from external or internal errors. If a bank teller, for instance, mistakenly adds or subtracts too much from your account, the value of the information is changed. Or, you may accidentally enter an incorrect amount into your account register. Either way, an inaccurate bank balance could cause you to make mistakes, such as bouncing a check. Authenticity Authenticity of information is the quality or state of being genuine or original, rather than a reproduction or fabrication.Information is authentic when it is in the same state in which it was created, placed, stored, or transferred. Consider for a moment some common assumptions about e-mail. When you receive e-mail, you assume that a specific individual or group created and transmitted the e-mail—you assume you know the origin of the e-mail. This is not always the case. E-mail spoofing, the act of sending an e-mail message with a modified field, is a problem for many people today, because often the mo dified field is the address of the originator. Spoofing the sender’s address can fool e-mail recipients into thinking that messages are legitimate traffic, thus inducing them to open e-mail they otherwise might not have.Spoofing can also alter data being transmitted across a network, as in the case of user data protocol (UDP) packet spoofing, which can enable the attacker to get access to data stored on computing systems. Another variation on spoofing is phishing, when an attacker attempts to obtain personal or financial information using fraudulent means, most often by posing as another individual or organization. Pretending to be someone you are not is sometimes called pretexting when it is undertaken by law enforcement agents or private investigators. When used in a phishing attack, e-mail spoofing lures victims to a Web server that does not represent the organization it purports to, in an attempt to steal their private data such as account numbers and passwords.The most c ommon variants include posing as a bank or brokerage company, e-commerce organization, or Internet service provider. Even when authorized, pretexting does not always lead to a satisfactory outcome. In 2006, the CEO of Hewlett-Packard Copyright 2011 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s). Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.Licensed to: CengageBrain User Introduction to Information Security 13 Corporation, Patricia Dunn, authorized contract investigators to use pretexting to â€Å"smokeout† a corporate director suspected of leaking confidential information. The resulting firestorm of negative publicity led to Ms. D unn’s eventual departure from the company. 13 1 Confidentiality Information has confidentiality when it is protected from disclosure or exposure to unauthorized individuals or systems. Confidentiality ensures that only those with the rights and privileges to access information are able to do so. When unauthorized individuals or systems can view information, confidentiality is breached.To protect the confidentiality of information, you can use a number of measures, including the following: Information classification Secure document storage Application of general security policies Education of information custodians and end users Confidentiality, like most of the characteristics of information, is interdependent with other characteristics and is most closely related to the characteristic known as privacy. The relationship between these two characteristics is covered in more detail in Chapter 3, â€Å"Legal and Ethical Issues in Security. † The value of confidentiality of information is especially high when it is personal information about employees, customers, or patients. Individuals who transact with an organization expect that their personal information will remain confidential, whether the organization is a federal agency, such as the Internal Revenue Service, or a business. Problems arise when companies disclose confidential information.Sometimes this disclosure is intentional, but there are times when disclosure of confidential information happens by mistake—for example, when confidential information is mistakenly e-mailed to someone outside the organization rather than to someone inside the organization. Several cases of privacy violation are outlined in Offline: Unintentional Disclosures. Other examples of confidentiality breaches are an employee throwing away a document containing critical information without shredding it, or a hacker who successfully breaks into an internal database of a Web-based organization and steals sensitive information about the clients, such as names, addresses, and credit card numbers.As a consumer, you give up pieces of confidential information in exchange for convenience or value almost daily. By using a â€Å"members only† card at a grocery store, you disclose some of your spending habits. When you fill out an online survey, you exchange pieces of your personal history for access to online privileges. The bits and pieces of your information that you disclose are copied, sold, replicated, distributed, and eventually coalesced into profiles and even complete dossiers of yourself and your life. A similar technique is used in a criminal enterprise called salami theft. A deli worker knows he or she cannot steal an entire salami, but a few slices here or there can be taken home without notice.Eventually the deli worker has stolen a whole salami. In information security, salami theft occurs when an employee steals a few pieces of information at a time, knowing that taking more wou ld be noticed—but eventually the employee gets something complete or useable. Integrity Information has integrity when it is whole, complete, and uncorrupted. The integrity of information is threatened when the information is exposed to corruption, Copyright 2011 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it. Licensed to: CengageBrain User 14 Chapter 1 Offline Unintentional Disclosures In February 2005, the data aggregation and brokerage firm ChoicePoint revealed that it had been duped into releasing personal information about 145,000 people to identity thieves during 2004. The perpetr ators used stolen identities to create obstensibly legitimate business entities, which then subscribed to ChoicePoint to acquire the data fraudulently.The company reported that the criminals opened many accounts and recorded personal information on individuals, including names, addresses, and identification numbers. They did so without using any network or computer-based attacks; it was simple fraud. 14 While the the amount of damage has yet to be compiled, the fraud is feared to have allowed the perpetrators to arrange many hundreds of instances of identity theft. The giant pharmaceutical organization Eli Lilly and Co. released the e-mail addresses of 600 patients to one another in 2001. The American Civil Liberties Union (ACLU) denounced this breach of privacy, and information technology industry analysts noted that it was likely to influence the public debate on privacy legislation.The company claimed that the mishap was caused by a programming error that occurred when patients w ho used a specific drug produced by the company signed up for an e-mail service to access support materials provided by the company. About 600 patient addresses were exposed in the mass e-mail. 15 In another incident, the intellectual property of Jerome Stevens Pharmaceuticals, a small prescription drug manufacturer from New York, was compromised when the FDA released documents the company had filed with the agency. It remains unclear whether this was a deliberate act by the FDA or a simple error; but either way, the company’s secrets were posted to a public Web site for several months before being removed. 16 damage, destruction, or other disruption of its authentic state. Corruption can occur while information is being stored or transmitted.Many computer viruses and worms are designed with the explicit purpose of corrupting data. For this reason, a key method for detecting a virus or worm is to look for changes in file integrity as shown by the size of the file. Another key method of assuring information integrity is file hashing, in which a file is read by a special algorithm that uses the value of the bits in the file to compute a single large number called a hash value. The hash value for any combination of bits is unique. If a computer system performs the same hashing algorithm on a file and obtains a different number than the recorded hash value for that file, the file has been compromised and the integrity of the information is lost.Information integrity is the cornerstone of information systems, because information is of no value or use if users cannot verify its integrity. Copyright 2011 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s). Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it. Licensed to: CengageBrain User Introduction to Information Security 15File corruption is not necessarily the result of external forces, such as hackers. Noise in the transmission media, for instance, can also cause data to lose its integrity. Transmitting data on a circuit with a low voltage level can alter and corrupt the data. Redundancy bits and check bits can compensate for internal and external threats to the integrity of information. During each transmission, algorithms, hash values, and the error-correcting codes ensure the integrity of the information. Data whose integrity has been compromised is retransmitted. 1 Utility The utility of information is the quality or state of having value for some purpose or end.Information has value when it can serve a purpose. If information is available, but is not in a format meaningful to the end user, it is not useful. For example, to a private citizen U. S. Census data can quickly become overwhelming and difficult to interpret; however, for a politician, U. S. Census data reveals information about the residents in a district, such as their race, gender, and age. This information can help form a politician’s next campaign strategy. Possession The possession of information is the quality or state of ownership or control. Information is said to be in one’s possession if one obtains it, independent of format or other characteristics.While a breach of confidentiality always results in a breach of possession, a breach of possession does not always result in a breach of confidentiality. For example, assume a company stores its critical customer data using an encrypted file system. An employee who has quit decides to take a copy of the tape backups to sell the customer records to the competition. The removal of the tapes from their secure environment is a breach of possession. But, because the data is encrypted, neither the e mployee nor anyone else can read it without the proper decryption methods; therefore, there is no breach of confidentiality. Today, people caught selling company secrets face increasingly stiff fines with the likelihood of jail time.Also, companies are growing more and more reluctant to hire individuals who have demonstrated dishonesty in their past. CNSS Security Model The definition of information security presented in this text is based in part on the CNSS document called the National Training Standard for Information Systems Security Professionals NSTISSI No. 4011. (See www. cnss. gov/Assets/pdf/nstissi_4011. pdf. Since this document was written, the NSTISSC was renamed the Committee on National Security Systems (CNSS)— see www. cnss. gov. The library of documents is being renamed as the documents are rewritten. ) This document presents a comprehensive information security model and has become a widely accepted evaluation standard for the security of information systems.T he model, created by John McCumber in 1991, provides a graphical representation of the architectural approach widely used in computer and information security; it is now known as the McCumber Cube. 17 The McCumber Cube in Figure 1-6, shows three dimensions. If extrapolated, the three dimensions of each axis become a 3 3 3 cube with 27 cells representing areas that must be addressed to secure today’s information systems. To ensure system security, each of the 27 areas must be properly addressed during the security process. For example, the intersection between technology, integrity, and storage requires a control or safeguard that addresses the need to use technology to protect the integrity of information while in storage.One such control might be a system for detecting host intrusion that protects the integrity of Copyright 2011 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party co ntent may be suppressed from the eBook and/or eChapter(s). Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it. Licensed to: CengageBrain User 16 Chapter 1 Figure 1-6 The McCumber Cube18 Source: Course Technology/Cengage Learning information by alerting the security administrators to the potential modification of a critical file.What is commonly left out of such a model is the need for guidelines and policies that provide direction for the practices and implementations of technologies. The need for policy is discussed in subsequent chapters of this book. Components of an Information System As shown in Figure 1-7, an information system (IS) is much more than computer hardware; it is the entire set of software, hardware, data, people, procedures, and networks that make possible the use of information r esources in the organization. These six critical components enable information to be input, processed, output, and stored. Each of these IS components has its own strengths and weaknesses, as well as its own characteristics and uses.Each component of the information system also has its own security requirements. Software The software component of the IS comprises applications, operating systems, and assorted command utilities. Software is perhaps the most difficult IS component to secure. The exploitation of errors in software programming accounts for a substantial portion of the attacks on information. The information technology industry is rife with reports warning of holes, bugs, weaknesses, or other fundamental problems in software. In fact, many facets of daily life are affected by buggy software, from smartphones that crash to flawed automotive control computers that lead to recalls.Software carries the lifeblood of information through an organization. Unfortunately, software programs are often created under the constraints of project management, which limit time, cost, and manpower. Information security is all too often implemented as an afterthought, rather than developed as an integral component from the beginning. In this way, software programs become an easy target of accidental or intentional attacks. Copyright 2011 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it. Licensed to: CengageBrain User Introduction to Information Security 17 1 Figure 1-7 Components of an Information System Source: Course Technology/Cengage Learning Hardware Hardware is the physical te chnology that houses and executes the software, stores and transports the data, and provides interfaces for the entry and removal of information from the system. Physical security policies deal with hardware as a physical asset and with the protection of physical assets from harm or theft.Applying the traditional tools of physical security, such as locks and keys, restricts access to and interaction with the hardware components of an information system. Securing the physical location of computers and the computers themselves is important because a breach of physical security can result in a loss of information. Unfortunately, most information systems are built on hardware platforms that cannot guarantee any level of information security if unrestricted access to the hardware is possible. Before September 11, 2001, laptop thefts in airports were common. A two-person team worked to steal a computer as its owner passed it through the conveyor scanning devices.The first perpetrator ente red the security area ahead of an unsuspecting target and quickly went through. Then, the second perpetrator waited behind the target until the target placed his/her computer on the baggage scanner. As the computer was whisked through, the second agent slipped ahead of the victim and entered the metal detector with a substantial collection of keys, coins, and the like, thereby slowing the detection process and allowing the first perpetrator to grab the computer and disappear in a crowded walkway. While the security response to September 11, 2001 did tighten the security process at airports, hardware can still be stolen in airports and other public places.Although laptops and notebook computers are worth a few thousand dollars, the information contained in them can be worth a great deal more to organizations and individuals. Data Data stored, processed, and transmitted by a computer system must be protected. Data is often the most valuable asset possessed by an organization and it is the main target of intentional attacks. Systems developed in recent years are likely to make use of database Copyright 2011 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it. Licensed to: CengageBrain User 18 Chapter 1 management systems. When done properly, this should improve the security of the data and the application. Unfortunately, many system development projects do not make full use of the database management system’s security capabilities, and in some cases the database is implemented in ways that are less secure than traditional file systems. People Though often overlooked in co mputer security considerations, people have always been a threat to information security.Legend has it that around 200 B. C. a great army threatened the security and stability of the Chinese empire. So ferocious were the invaders that the Chinese emperor commanded the construction of a great wall that would defend against the Hun invaders. Around 1275 A. D. , Kublai Khan finally achieved what the Huns had been trying for thousands of years. Initially, the Khan’s army tried to climb over, dig under, and break through the wall. In the end, the Khan simply bribed the gatekeeper—and the rest is history. Whether this event actually occurred or not, the moral of the story is that people can be the weakest link in an organization’s information security program.And unless policy, education and training, awareness, and technology are properly employed to prevent people from accidentally or intentionally damaging or losing information, they will remain the weakest link. S ocial engineering can prey on the tendency to cut corners and the commonplace nature of human error. It can be used to manipulate the actions of people to obtain access information about a system. This topic is discussed in more detail in Chapter 2, â€Å"The Need for Security. † Procedures Another frequently overlooked component of an IS is procedures. Procedures are written instructions for accomplishing a specific task. When an unauthorized user obtains an organization’s procedures, this poses a threat to the integrity of the information.For example, a consultant to a bank learned how to wire funds by using the computer center’s procedures, which were readily available. By taking advantage of a security weakness (lack of authentication), this bank consultant ordered millions of dollars to be transferred by wire to his own account. Lax security procedures caused the loss of over ten million dollars before the situation was corrected. Most organizations distrib ute procedures to their legitimate employees so they can access the information system, but many of these companies often fail to provide proper education on the protection of the procedures. Educating employees about safeguarding procedures is as important as physically securing the information system.After all, procedures are information in their own right. Therefore, knowledge of procedures, as with all critical information, should be disseminated among members of the organization only on a need-to-know basis. Networks The IS component that created much of the need for increased computer and information security is networking. When information systems are connected to each other to form local area networks (LANs), and these LANs are connected to other networks such as the Internet, new security challenges rapidly emerge. The physical technology that enables network functions is becoming more and more accessible to organizations of every size.Applying the traditional tools of phys ical security, such as locks and keys, to restrict access to and interaction with the hardware components of an information system are still important; but when computer systems are networked, this approach is no longer enough. Steps to provide network Copyright 2011 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s). Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it. Licensed to: CengageBrain User Introduction to Information Security 19 security are essential, as is the implementation of alarm and intrusion ystems to make system owners aware of ongoing compromises. 1 Balancing Information Security and Access Even with the best planning and imple mentation, it is impossible to obtain perfect information security. Recall James Anderson