Fluent Essays

Complete: a minimum of 1,500 words (total assignment) and 4 scholarly sources in perfect APA format.1.Why do Americans seem to be more concerned with terrorist hazards than natural hazards? How do our perceptions of risk affect the way we manage them? Do individuals have a greater personal responsibility to protect themselves from natural hazards than they do from other technological or terrorist hazards? What about organizational responsibility? Do organizations have a greater personal responsibility to protect themselves from natural hazards than they do from other technological or terrorist hazards? Why? 2.Explain how the Homeland Security Assessment process follows the Council on Competitiveness Business Model. Discuss the steps involved in developing a Homeland Security Plan and Budget after the Homeland Security Assessment of the organization has been completed. https___dftj9wb4gc6c5.cloudfront.net_bethel_courses_mcj_5900_unit_7_homelandsecurity_unit7read.pdf Unformatted Attachment Preview H1237 Fisher13_AppC.qxd 8/27/04 C 2:09 PM Page 197 COUNCIL ON COMPETITIVENESS C H A P Achieving Competitiveness and Security: Business Model Reprinted with permission from “Achieving M Competitiveness and Security: Creating a Business Case for Security” brochure A Council on Competitiveness 1500 K Street, N.W., Suite 850 N Washington, D.C. , Council on Competitiveness K The Council on Competitiveness is a nonpartisan, nonprofit organization whose members are corporate chief executives, university A presidents, and labor leaders dedicated to setting an action agenda to drive U.S. economic competitiveness and leadership in global markets. The R council helps shape the national debate on competitiveness by concentrating on a few critical I issues, including national and regional innovations, competitiveness and security, globalization, workforce development, and the benchmarking of U.S. economic performance against other S countries. S A 1 8 3 4 T S 197 H1237 Fisher13_AppC.qxd 8/27/04 2:09 PM Page 198 198 Appendix C The Business Case for Security (Council on Competitiveness Model) A prospective framework for integrated security management includes the following elements: Leadership Vision Articulated Goals Processes Integrated Security Management People Training Empowerment Performance Plans Continuity & Contingency C Planning Tools Technology Risk Assessment Simulations Partnerships Risk-Sharing Cost-Sharing Info-Sharing H A P M Financial Impact Assessment A Business Continuity Market Opportunities N Productivity Gains Competitive ,Advantage K • Visionary leadership and identified best A practices • Security embedded across global business processes, facilities, and supply chains R in the face of targeted attacks against companies • Strategic planning for business continuity and infrastructure I • Workforce engagement and training for embedded security S tools • Applied technology and risk management • Public-private partnerships to share S risk, cost, and information • Assessment of financial impacts and opportunities A 1 8 3 4 T S H1237 Fisher14_AppD.qxd 8/27/04 D 2:09 PM Page 199 Interviewing Hints and Tips C H A P Interviewing Hints and Tips M DO’S A • Be positive when asking questions. N • Allow participants time to formulate answers. • Make sure questions are understood., • • • • Reword questions to aid understanding. Encourage all participants to answer questions. K answers. Appear to be interested in all respondents’ Thank participants for their time. A R I Do not ask questions beyond what the criteria are asking. S is intended by the question. Never read more into the answer than Do not ask rhetorical questions. S Do not disagree with answers. A Never be repetitious when asking questions. DON’TS • • • • • • Do not make loaded statements when asking questions. • Do not allow one participant to monopolize all answers. 1 8 3 4 T S 199 H1237 Fisher14_AppD.qxd 8/27/04 2:09 PM Page 200 C H A P M A N , K A R I S S A 1 8 3 4 T S H1237 Fisher15_AppE.qxd 8/27/04 E 2:09 PM Page 201 Homeland Security Documentation List Document Description C H (List documents that were identified in the assessment.) A P Date Document Location Document Date Revision M A N , Document Owner K A R I S S A 1 8 3 4 T S Forms can be downloaded from the CD-ROM located inside the back cover of this book. 201 H1237 Fisher15_AppE.qxd 8/27/04 2:09 PM Page 202 C H A P M A N , K A R I S S A 1 8 3 4 T S H1237 Fisher16_GL.qxd 8/27/04 2:08 PM Page 203 Glossary C H A P 17 Baldrige Assessment Terms M administrative processes and support services—processes and services that may include activities and A operations such as finance and accounting, software services, marketing, public relations, information services, purchasing, personnel, legal services, N facilities management, research and development, secretarial, and other administrative services. , Baldrige assessment—an organizational evaluation based on the seven categories, 19 items, and 88 areas of the Malcolm Baldrige National Quality Award criteria. benchmarking—teams of employees review and visit best practice programs, services, and practices. K Benchmarking can include site visits to other organizations and telephone interviews. Benchmarking is an involved process that organizations Apursue when seeking to become “world-class” in processes that they have identified as needing improvement. R business and support services—includes units and operations involving finance and accounting, software services, sales, marketing, public relations, I information services, purchasing and personnel, and so forth. S business ethics—a published statement of values and business ethics that are promoted and practiced both internally and externally by the organization. S business plan—a statement of business plans and strategies that is published and shared throughout an A organization. Many organizations when beginning their quality improvement process have a separate business plan and quality plan. competitive comparisons—an organization’s comparison of its products/services against major competi1 tors and industry comparisons. 8 to determine if their work process is within prescribed control chart—a graph that is used by employees limits. 3 cross-functional teams—teams formed from different divisions or departments to solve or create new solutions to an organizational problem 4 or opportunity. customer—the end-user of all products and T services produced within an organization. Customers are both internal and external. S has direct interface with external customers, in person, via customer contact employee—an employee who telephone, or other means. customer relationship management—an organization’s interactions and relationships with its customers. cycle time—the amount of time it takes to complete a specified work process. data—the collection of facts, information, or statistics. data analysis—the breaking apart of data to help the organization gauge improvement. 203 H1237 Fisher16_GL.qxd 8/27/04 2:08 PM Page 204 204 Glossary documented improvement—a process improvement that has been supported against base-line data and documented at measured intervals. ergonomics—the evaluation of an organization’s facilities and equipment to ensure compatibility between workers and their work processes. employee involvement—involvement of employees across the organization at all levels. employee morale—the attitudes of employees in regard to their willingness to perform work tasks. empowerment—employees’ freedom to respond to customer demands and requests. flowchart—a graphic map of a work process used by employee teams to document the current condition of a process. goals and strategies—organizations develop goals and strategies for short-term (1 to 2 years) and longterm (2 years or more) desired results. Goals and strategies are usually written and distributed across the organization. improvement plan—a written plan that the organization has published to accomplish desired improvement results. C internal customer/supplier network—an organization’s employee network; referred to as inside cusH tomers and suppliers. key indicators—key measures of performance A (i.e., productivity, cycle time, cost, and other effectiveness measures). P that makes or processes raw materials into a finished prodmanufacturing organization—an organization uct. M measurement—the process of gauging an organization’s results against its customers’ requirements. A mission statement—many organizations have a published document that defines an organization’s reason for existing. The mission statement is shared N with employees, suppliers, and customers. performance data—results of improvements in product and service production and delivery processes. , process—a series of steps linked together to provide a product or service for an end-user. process control—a control device to detect and remove causes of variation to a defined process. process management—organization’s maintenance of defined processes to ensure that both quality and K performance are continuously improved. A productivity improvement—measured reduction in an organization’s key operational processes. Rto solve process problems (i.e., flowcharts, Pareto analysis, problem-solving tools—tools used by teams histograms, control charts, cause-and-effect diagrams, and matrix diagrams). I problem-solving teams—teams of employees selected and empowered by management to assess, analyze, S These teams may be cross-functional, work group, departand solve problems within an organization. mental, or project focused. S public responsibility—an organization’s impact and possible impact on society with its products, servA ethics, environment, education, health care, community ices, and operations. This includes business services, and safety as they relate to the public. Practices of trade or business associations are also considered part of an organization’s public responsibility. 1 quality plan—a written statement of an organization’s plan for maintaining and improving quality. An organization that has just begun the quality improvement process usually has this plan separate from 8 its business plan. The more mature organizations in quality usually integrate their quality plan with their business plan. 3 quality results—an organization’s achievement levels and improvement trends. 4 quality assessment—an assessment of an organization’s approach to and implementation of quality. T of safety on the worksite for employees. Many organisafe work practices—an organization’s promotion zations have documented guidelines for S employees to follow and they collect data on safe work practices. strategic plan—a detailed plan of action developed by an organization establishing and defining measurable goals to achieve continuous quality improvement within the organization. A strategic plan can be broken into short term (1 to 2 years) and long term (more than 2 years). survey process—the means by which an organization collects data from its customers and employees. These surveys help an organization focus on internal/external customer satisfaction issues. senior executive—refers to the organization’s highest ranking official and those reporting directly to that official. H1237 Fisher16_GL.qxd 8/27/04 2:08 PM Page 205 Glossary 205 service organization—nonmanufacturing organizations, such as utilities, schools, government, transportation, finance, real estate, restaurants, hotels, news media, business services, professional services, and repair services. small business—complete businesses with no more than 500 full-time employees. Business activities may include manufacturing and/or service. statistical process control (SPC)—technique for measuring and analyzing process variations. supplier—an individual or group, either internal to the organization or external, that provides input to a work group or customer. supplier certification program—a formal supplier program used by an organization to improve supplier quality. Many organizations partner with critical suppliers and establish a relationship of trust and measurable results. supplier partnership—a supplier process practiced by many service and manufacturing organizations. Organizations establish a preferred supplier program that is based on a trust relationship with measurable results. Supplier partnerships are usually a prelude to a more formalized supplier certification C program. system—a set of well-defined and well-designed H processes for meeting the organizations quality and performance requirements. A in their strategic planning process. targets—desired goals that organizations have third-party survey—a survey conducted by Pa resource outside the organization. total quality management (TQM)—a management philosophy that focuses on continuous quality M improvement throughout an organization. A to all levels of a workforce within an organization. A useruser-friendly—a process that is understandable friendly process can be understood because it is written in simpler, more understandable language. N values statement—a published document that describes an organization’s beliefs. This values statement is , customers, suppliers, and the community. usually shared with faculty, staff, students, vision statement—many organizations have a published document that defines their direction for the next 5 to 10 years. The vision statement is shared with both internal and external groups. world-class organization—an organizationK that produces excellent results in major areas with a sound quality management approach to homeland A security. This organization is totally integrated with a systematic prevention-based system that is continuously refined through evaluations and improvement R cycles. zero-based organization—an organization that I has no quality system in place for homeland security and is anecdotal in its implementation of a sound, systematic, effective, and quality management–based S integrated and implemented across the organization. approach to homeland security that is fully Homeland Security Assessment Terms18 S A acceptable risk—the level of Residual Risk that has been determined to be a reasonable level of potential loss/disruption for a specific IT system. 1 access—the right to enter or use a system and its resources; to read, write, modify, or delete data; or to use 8 software processes or network bandwidth. access control—limiting access to information 3 system resources to authorized users, programs, processes, or other systems only. 4 accountability—the explicit assignment of responsibilities for oversight of areas of control to executives, managers, staff, owners, providers, and usersT of minimum essential infrastructure (MEI) resource elements. agency—federal department, major organizational unit within a department, or independent agency. S aggregated data—data that an organization has gathered together into a mass or sum so as to constitute a whole. Aggregated data is collected and used to determine an organization’s achievement levels and improvement trends. alert—notice of specific attack directed at an organization’s IS resources. application—all application systems, internal and external, used in support of the core processes. areas of control—collectively, controls consist of the policies, procedures, practices, and organizational structures designed to provide reasonable assurance that business objectives will be achieved and that undesired events will be prevented or detected and corrected. H1237 Fisher16_GL.qxd 8/27/04 2:08 PM Page 206 206 Glossary areas of potential compromise—these broad topical areas represent categories where losses can occur that will impact both a department or agency and its ability to conduct core missions. assurance—grounds for confidence that a system design meets its requirements, satisfies specifications, or a specific property is satisfied. attack—a discreet malicious action of debilitating intent inflicted by one entity upon another. An opponent might attack a critical infrastructure to destroy or incapacitate it. audit—independent review and examination of records and activities to assess the adequacy of system controls, to ensure compliance with established security policies and procedures, and/or to recommend necessary changes in controls, policies, or procedures to meet security objectives. audit trail—chronological records of system activities or message routing that permits the reconstruction and examination of a sequence of events. authentication—Access privileges granted to a user, program, or process. availability—timely, reliable access to data and information services for authorized users. capability—the ability of a suitably organized, trained, and equipped entity to access, penetrate, or alter C government or privately owned information or communications systems and/or to disrupt, deny, or destroy all or part of a critical infrastructure. H chief information officer—agency official who provides advice and other assistance to the head of the A agency and other senior management personnel to ensure that information and technology is acquired and information resources are managed P in a manner that implements the policies and procedures of the Congress and the priorities established by the head of the agency. M civil liberties—those individual rights and freedoms protected by the Constitution, the Bill of Rights, and federal law and regulations. A code—in computer programming, a set of symbols used to represent characters and format commands and N instructions in a program. Source code refers to the set of commands and instructions making up a program. , code amber—significantly debilitate the ability of an agency to fulfill its mission, critical national security or national economic security functions, or to provide continuity of government services. K missions. code green—no appreciable impact on agency code red—prevent an agency from fulfilling Aits mission, critical national security or national economic security functions, or from providing continuity of core government services. From the perspective of R an attacker, this would constitute a “kill.” cold site—an alternate site with electrical and I communications connections and computer equipment, but no running system; it is maintained by an organization to facilitate prompt resumption of service after S a disaster. computer emergency response team—An organization chartered by an information system owner to coorS dinate and/or accomplish necessary actions in response to computer emergency incidents that Ainformation systems. threaten the availability or integrity of its computer network—a set of computers that are connected and able to exchange data. computer security—measures and controls that ensure confidentiality, integrity, and availability of IS assets, including hardware, software, firmware,1and information being processed, stored, and communicated. confidentiality—assurance that information8 is not disclosed to unauthorized persons, processes, or devices. consequence management—includes measures to protect public health and safety, restore essential gov3 ernment services, and provide emergency relief to governments, businesses, and individuals affected by the consequences of terrorism. The laws 4 of the United States assign primary authority to the states to respond to the consequences of terrorism; the federal government provides assistance as required. T crisis management—includes measures to identify, acquire, and plan the use of resources needed to anticipate, prevent, and/or resolve a threat or Sact of terrorism. critical infrastructures—those systems and assets—both physical and cyber—so vital to the Nation that their incapacity or destruction would have a debilitating impact on national security, national economic security, and/or national public health and safety. cyberattack—exploitation of the software vulnerabilities of information technology–based control components. data integrity—a condition existing when data is unchanged from its source and has not been accidentally or maliciously modified, altered, or destroyed. H1237 Fisher16_GL.qxd 8/27/04 2:08 PM Page 207 Glossary 207 debilitated—a condition of defense or economic security characterized by ineffectualness. defense—the confidence that Americans’ lives and personal safety, both at home and abroad, are protected and the United States’ sovereignty, political freedom, and independence, with its values, organizations, and territory intact are maintained. delete access—the ability t ... Purchase answer to see full attachment