Am I needlessly overwhelmed?

[Morrigainz]

So here is this assignment that I talked about in the ARGH thread. It's supposed to be 3 pages double-spaced. I just...don't even know where to begin. It seems like SO MUCH. Probably it will be ok once I get started on it, but I'm just...I don't know. I want to give up already. What do you guys think? Do I need sympathy or a swift kick in the rear? You decide...

Instructions:

Assignment 2 is to develop an information security plan to enhance the security of our campus information environment. The plan should cover both managerial and technical issues, include but not limited to the following:

Describing the information environment of our campus. “Information environment†is a general term, which addresses information security questions such as what data/information are important, who create these data/information, who use these data/information, who have access to the data/information, what systems are associated with the data/information, what procedures are required to process the data/information, the connection between the campus and the external “untrusted†environment (e.g., the Internet), and so on. You may use the framework of information asset identification, classification and prioritization (see page 122-135 of our textbook).

Note: physical security can be included in your discussion here.

Discussing the potential threats to our information environment and proposing solutions. Here, you may apply the framework of risk management, i.e., risk identification, risk assessment, and risk control (Chapter 4 of our textbook).

Designing a set of security policies, including the Enterprise Information Security Policy (EISP) (this should be a general policy for our campus), Issue-Specific Security Policy (ISSP) (e.g., how to use email), and Systems-Specific Policy (SysSP) (e.g., how to use the Blackboard course website system). These policies are discussed in Chapter 5 of our textbook.

Discussing how to implement the security policies from a technical perspective (you may consider anti-virus software, firewall, and intrusion detection and prevention systems).

Discussing how to implement the security policies from a managerial perspective (e.g., forming a special committee, getting support from the campus administration).

Discussing how to implement the security policies from a behavioral perspective (e.g., training and education).

Note: in this assignment, you may assume that you were a CISO (chief information security official) of UM-Dearborn and planned for a new security program. Some disparity between your analysis and the real environment of our campus is acceptable.

P.S. sorry it's so long...

[CalvinHobbes]

Well, how long do you have to complete it?

I have to write >20 pages this week, so I'm VERY overwhelmed...but it was assigned months ago and I procrastinated :/

[Morrigainz]

It's due the 9th...so I have time...but considering how I did on the first assignment (84%) I really need to go more in-depth on this one. Which I don't know how to do in 3 pages since there's so much that goes into it. I mean...it took us all semester to cover this stuff...now I'm supposed to cover it in 3 pages?

I probably just need a kick in the ass.

Ugggghhh that sucks. 20 pages! Ugh. :/

[CalvinHobbes]

No I totally understand! I had to write a ridiculous paper that should have been like, 10 pages and was only 3. So much information--you end up writing one line about something that could have been a page on its own. Very frustrating. But, we can kick each others' asses if you want.

[Morrigainz]

OK. Good. This will help.

Luckily I have nothing planned for today so I can work on this for a while. Just have to stop procrastinating! Argh it's almost noon.

[Swthrtsuzy]

This is a pretty overwhelming assignment, I will give you that. BUT! Just start small. Pick an aspect and do some research into it, and put that down on paper. For instance, start with your campus' Blackboard implementation and run with it. Then switch to internet network security and run with it. What might help is to contact someone in your campus' OIT department that might be willing to answer some questions for you. I think you'll surprise yourself at how much data you come up with, then you can just pick and choose the most important to add into the paper. You can do this.

Incidentally, this assignment made me giggle because I'm a huge geek about stuff like this...actually enrolled in grad school so I can turn my accounting background into IS/AIS/IA. My hope is that I'll be able to do internal systems auditing and get my CISSP cert AND my CPA. Yay for computer security!

[The_Lonestar]

I actually did something similar when I was the Webmaster/Security Administrator for the Headquarters of the Nebraska Wing of the Civil Air Patrol. The trick is to boil every item into a three or four sentence paragraph, and don't neglect your summary sections.

Think like a manager: I want the info, I want it fast, but I don't want to slog through a bunch of words on a page.

Think of this as an exercise in Feng Shui: doing a lot with a little.

[Morrigainz]

That's awesome!

This stuff is interesting, but the teacher taught the class in a way that made it UNinteresting, if that makes sense.

I'm starting with our information environment - what data is important? Student data, faculty/staff data, and course data Hopefully I can pack it into like a paragraph.

[The_Lonestar]

You'll do well. Remember that.

[Rosie]

Err wow good luck with that! I don't know what advice I can give apart from when I have to type the minutes for committees I'm the secretary of. They like them to be concise so I have to slim down 20 minutes of them rambling on into just the main points. How I'll usually do it is brain dump everything into a word document and just keep going back, re,typing and cutting out the waffle until I've got something that is short and sweet.

Hope that helps! Now stop procrastinating and get back to work!

[Morrigainz]

All my hair might be grey by the end of it though

[Swthrtsuzy]

All my hair might be grey by the end of it though

That'll make it easier to dye whatever color you want. Pink? Blue? Green? Silver lining!

[aj_rock]

I think that if you know the material, just start writing. It sounds like one of those classes where you could get away with a lot of BS anyways...

[So Late So Soon]

I'm writing a research paper on genetic defects and there link to obesity that has to be 15 pages long, but with everything I have to cover it should be like 25 if not 30. the papers where you have to write less are always more difficult I think. You'll figure it out just try to think about what the most important things that HAVE to be in the paper then go from there.

[KillerGriller]

~ break it down into sections

~ fill the sections with point form ideas (brainstorm on this one)

~ whittle down the points to the important ones

~ create Intro/summary for each section

~ connect the points with the appropriate grammar/sentence structures

[The_Lonestar]

Stay alert.

Trust no one.

Always keep your laser handy.

...oh, wait. That was for something else.

Focus your intent and shine!

[LRB]

Security policies, and information security policies in particular, are popping up all over. Do an online search to see if you can find some other 3-ish page versions -- not to copy or even to mimic, but just to get an idea of what level of detail goes into one.

https://security.berkeley.edu/IT.sec.policy.html?destination=node/47

http://www.csuci.edu/it/Systemwide_Info_Security_Policy_v1_Draft.pdf

http://infosec.wfu.edu/WFU%20Information%20Security%20Policy%20DV2-1%202008-08-06.pdf

Interestingly - the policy doesn't have to be all that long; it's the procedures that tend to add pages.

[wildross]

Impossible to do in 3 pages, but very necessary to do in 3 pages ;-)

It's like Reagan's 1 page memo rule. If you can't condense it to 1 page, you really don't understand it.

[Lachy]

Assignments are like going to the gym (when it's not habit), the hardest part is getting started, then it just flows.

Forget the page requirement, just spill your brain on to the page, then edit, cut and structure. You'll be done before you know it. And then you can go workout!