Business Studies

Directions: Answer each question completely and in detail. If the question has a minimum word count, it is likely because it is a complex subject that cannot be fully addressed in fewer words. Cite your sources with in-text citations and references. Only you citations from websites. At least one in-text citation per question that is answered. Create a reference sheet at the bottom of the assignment in alphabetical order.

1. Research the Sarbanes-Oxley Act. Write a minimum of 250 words, cite your sources and completely address the following:

• What was the motivation for enacting this law? Specifically, provide some background on the economic conditions in the US that led to this law. • What arguments do critics have about the law? • Is this law good or bad for US companies? Both? Explain your answer. • What other names is this law know by?

2. Describe the differences and relationship between information security policies and an information security plan. What does each accomplish in an organization? Why are they important?

3. Define in your own words and remember to cite your source ALWAYS use a source but NO DICTIONARIES or online encyclopedias (1) authentication and authorization, (2) prevention and resistance, and (3) detection and response, as they pertain to IT and IIM.

4. Describe the relationships and differences between hackers and viruses.

Be sure to discuss the differences between white-hat hackers and black-hat hackers.
Describe how viruses are transmitted.
Name one major virus from the past 12 months that has been in the news and describe its impact on consumers and business.

ANSWER

IT Assignment

The Sarbanes-Oxley Act

The Sarbanes-Oxley Act, which is also known as SOX, was instituted in 2002 for all types of businesses. The SOX Act was put in place to protect investors in the world of business. The Act demands greater accuracy in all business financial reporting and accurate disclosures of financial information of companies (107th Congress, 2002). The Sarbanes-Oxley Act became necessary following the scandals involving companies such as WorldCom, Enron, Arthur Andersen, Tyco, and Global Crossing, all of which were entangled in scandals that resulted in corporate and investor losses totaling into billions of dollars (Sarbanes-Oxley 101, 2016). The effect of these scandals was the loss of investor trust in the nation’s companies, which affected the financial market and the economy at large.

Even though the Act was put in place for the good of investors and the financial market, it has received criticism and scrutiny from many players in the business world, its critics complaining about the huge cost on companies imposed by section 404 of the Act (Raphael, 2016). Publicly traded companies are required to keep improving their IT system to achieve compliance with the requirements for control and reporting mandated by the Act. Some people also speculate that overseas organizations that are publicly US-traded may reconsider doing any business with the country as a result of the compliance regulations mandated by the SOX Act (Raphael, 2016). Such an outcome could result in huge financial stress on the economy for both businesses and investors holding shares in foreign companies that are publicly US-traded the US.

SOX may also have a negative effect in that it may motivate companies to look for loopholes to use to evade having to comply with the Act or spending capital to meet its requirements. Searching for such loopholes increases unethical business dealings. Since the Act requires businesses to develop their way of showing responsibility, it could result in controversy on the reporting standards used by companies, as companies are only given guidelines and not specific rules to comply with. Nevertheless, the Sarbanes-Oxley Act has a positive side, holding companies responsible for their actions and ensuring that transparency to the public is ensured (Raphael, 2016). This way, investors get all the information that they need when making investment decisions. The Act has restored the faith of investors in companies and held company executives responsible for their actions.

Information Security Policies versus Information Security Plans

Information security policies are regulations or rules that are meant for users of the information to ensure the safety of information (Whitman & Mattord, 2011). They entail practices that are meant to keep information secure, such as changing passwords often, ensuring that one is logged off before switching off the computers and ensuring the secrecy of passwords. An information security plan details how an organization is going to implement its information security policies and how they are going to be adhered to (Baltzan, 2015). This plan assists a company in understanding how they are going to ensure that all information security policies are used and acted upon.

IT and IIM Definitions

Authentication and authorization relate to the people who are part of or who are involved in information security. Authentication refers to proving that an individual is who they say they are, while authorization refers to giving an individual permission to access or use something, such as some information (Baltzan, 2015).

Prevention means taking various actions to ensure that something unwanted does not happen, while resistance refers to going against something or countering something, such as an attack (Baltzan, 2015). Prevention and resistance keep unauthorized people from accessing information and systems. Examples of prevention and resistance measures used in organizations include firewalls and encryption systems.

Detection and response form the third step in information security. Detection refers to finding something, while response refers to the reaction to what is detected or found. Through detection, suspicious activity can be identified, such as hackers and other intruders (Baltzan, 2015). When an intrusion is detected by intrusion detection software, the people responsible for information security will be notified so that they can take action such as shutting down systems (response).

Hackers and Viruses

Hackers are organizations or individuals that have expert technical knowledge and knowledge on how to access information by bypassing all the information security measures put in place (Baltzan, 2015). Hackers may access private information for profit, in protest of company or organization actions, or as a challenge. White-hat hackers are hackers who are hired by organizations to hack into their systems to find problems and fix them to make their systems more secure, while black-hat hackers break into an organization’s or individual’s systems to look at their information or steal it for their benefit (Baltzan, 2015).

A hacker may just want to access and look at information or may wish to destroy it using a virus. A virus is a program that is designed to cause damage to information or a network, transmitted via the internet, intranet, or delivered using a drive (Baltzan, 2015). Some viruses cause repairable damage, but others destroy networks and data systems.

In March 2020, China’s Sina Weibo platform, the country’s substitute for Twitter, was hit by attackers, causing a data breach that resulted in the real names, site usernames, location, gender, and phone numbers being accessed and posted on the dark web markets (Hashim, 2020). The hackers were selling the information on the dark web. The social media company notified China’s Cyber Security Administration and said that investigations were undergoing.

References

107th Congress. (2002). Sarbanes-Oxley Act of 2002. https://www.sec.gov/about/laws/soa2002.pdf

Baltzan, P. (2015). Information systems. New York, NY. McGraw Hill Education.

Hashim, A. (2020, March 24). Sina Weibo Suffered Data Breach, 538 Million Records Now On Sale. https://latesthackingnews.com/2020/03/24/sina-weibo-suffered-data-breach-exposing-538-million-records-now-on-sale/.

Raphael, K. (2016). Increased criticism for Sarbanes-Oxley. https://www.translegal.com/feature-articles/increased-criticism-for-sarbanes-oxley

Sarbanes-Oxley 101. (2016). Sarbanes Oxley FAQ. http://www.sarbanes-oxley-101.com/sarbanes-oxley-faq.htm

Whitman, M. E., & Mattord, H. J. (2011). Principles of information security. Cengage Learning.