1. Read the situation:

Annual security audit in Google Corporation. Auditors check what kind of information on Google users is available and if there are any security breaches.

2. Choose your role:

Role 1. The Head of the Corporation.

Roles 2, 3, 4. Auditors.

Roles 5, 6. The Head of the Corporation Security Department and his Deputy.

3. Study your role and get ready to present it:

Role 1. You are the Head of the Corporation. Help the auditors to find answers to their questions. Invite the Head of the Corporation Security Department and his Deputy and representative of the IT Department to the meeting. Explain to them that answering the auditors’ questions honestly and rigorously, the organization can realistically assess how secure its vital information is.

In the end, ask the auditors about the problems that need immediate correction.

Roles 2, 3, 4. You are auditors. You should remember that computer security auditors perform their work through personal interviews, vulnerability scans, examination of operating system settings, analyses of network shares, and historical data. They are concerned primarily with how security policies - the foundation of any effective organizational security strategy - are actually used. There are a number of key questions that security audits should attempt to answer:

• What kind of information on Google users is available?

• Are passwords difficult to crack?

• Are there access control lists (ACLs) in place on network devices to control who has access to shared data?

• Are there audit logs to record who accesses data?

• Are the audit logs reviewed?

• How is backup media stored? Who has access to it? Is it up-to-date?

• Is there a disaster recovery plan? Have the participants and stakeholders ever rehearsed the disaster recovery plan?

• Have custom-built applications been written with security in mind?

• How have these custom applications been tested for security flaws?

• How are configuration and code changes documented at every level? How are these records reviewed and who conducts the review?

After the audit is complete, conduct an outgoing briefing, ensuring that management is aware of any problems that need immediate correction. Questions from management are answered in a general manner so as not to create a false impression of the audit's outcome. It should be stressed that the auditors may not be in a position to provide definitive answers at this point in time. Any final answers will be provided following the final analysis of the audit results.

Roles 5, 6. You are the Head of the Corporation Security Department and his Deputy. You have been called by the Head of the Corporation to the meeting. Answer the auditors’ questions. The following information can help:

• The most important part of your approach to security is your people. Google employs some of the best and brightest security engineers in the world. Many of your engineers came from very high-profile security environments, such as banks, credit card companies, and high-volume retail organizations, and a large number of them hold PhDs and patents in security and software engineering.

• You take appropriate security measures to protect against unauthorised access to or unauthorised alteration, disclosure or destruction of data. These include internal reviews of your data collection, storage and processing practices and security measures, as well as physical and technical security measures to guard against unauthorised access to systems where you store personal data.

Unit 10. Food Production and Consumption

Role play “Granting a License to GMF Growing” Exercise 15, page 82.