Recent orders
Differences between Bilingual in Either Attention Focused or Less Focused Conditions
Differences between Bilingual in Either Attention Focused or Less Focused Conditions
Whether a bilingual’s brain process language in a different way from the brain of a monolingual or not is a question of concern. Initially, being a bilingual was seen as anomaly but in contrary to this perception, most people around the world are bilingual or even multilingual. Comparisons between bilinguals and monolinguals in terms of their way of absorbing language or recruiting classic language areas within their brains in response to tasks in language could provide a better idea of who between the two individuals in more advantaged. A significant portion of research conducted recently concerning the issue of bilingualism seems to establish that bilingual individuals are more advantageous than their monolingual counterparts in absorbing foreign languages. This is initiated by the fact that the human brain can function better or adequately with many language systems. The availability of many researches about the acquisition of a second language highly supports the idea better cognitive processing abilities among bilinguals as compared to the monolinguals.
Considering the case, which considers old English nouns, monolingual and bilinguals have various ways of learning the plural morphology of the nouns. In the experiment, students learned about the stems of the nouns first and later the plural of these nouns. The students in this case are able to learn about the plural of the words through the sensational context of modern English. It was found that most of the students seemed to learn the plural case best in silence. A GJ task was also given to the students in which the task involved sentences that were grammatically correcting and meaningful as well as sentences that were grammatically correct but anomalous. The results in this case the shows that bilingual group of students are more advantaged than their monolingual counterparts. This aspect is mainly exhibited in terms of the control sentence whereby the performance of the bilingual students happens to be far much better than that of monolinguals.
The case is reverse for the analysis sentence whereby the bilinguals perform better when in silence. Monolinguals however exhibit advantage in the control sentence. The experiment shows that bilingual are as good as the monolingual in most aspects of their common language especially if the language in question is their first language. The experiment was purposely initiated to ensure the manipulation of attention during learning. In this case, it came out that within a silent condition where monolinguals exhibit concentration, their performance on their second language is almost the same as the monolinguals in either condition. It comes out that although the bilingual individuals could have some seeable problems with their second language, they could do very well whenever they concentrate fully.
Furthermore, their second language may have nothing to do with creating problems to their first language. This aspect can be strengthened by a number of other similar experiments as well as theories concerned with language acquisition. In any case, it would always be held that learning of language within more attentionally focused conditions would all participants to perform better, especially in the language tasks, which require much attention. This has been shown in the experiment whereby both the monolingual participants and the bilinguals exhibit the same proficiency within silent conditions. It comes out that attention achievement in learning is critical in helping the tasks requiring control. From the experiment, it can be argued that bilinguals have a natural power to focus their attention on appropriate structural properties, especially when they are learning language. This makes them more advantageous than the monolinguals in the control sentence and equally advantageous in the structural sentence. Generally, bilinguals have advantage over the monolinguals. The same case could be supported by other experiments similar to the one discussed above. Even in previous studies, bilinguals are argued to show more advantage in their language than their monolingual counterparts.
A case of highly proficient adult English-Spanish bilinguals who are highly exposed to early foreign language acquisition provides a clarification for this argument. In this case, English monolinguals and Spanish-English bilinguals took part in planned competitions in a functional magnetic resonance imaging. In this competition, the participants had to complete a structured sentence judgment task (Caplan, 2001). In this experiment, the structured sentences exploited some significant difference between Spanish and English properties of linguistics. This aspect gave the researchers a good chance of exploring the similarities as well as the differences in both behavior and the neutral responses between monolinguals and bilinguals. The researchers could also get clarifications in terms of the two languages to the bilingual participants. It was established that whenever bilinguals’ neutral processing activity differ across the two languages, differential, behavioral, as well as neutral patterns would be observed in English and Spanish.
Behaviorally, both bilinguals and monolinguals have the same speed as well as accuracy when it comes to their first language, which in this case was English. Conversely, the bilingual participants showed that performance in a second language usually differ significantly. The differences shown in Spanish as a second language to the participant is principled as well as predictable, but these factors are based on the differences exhibited between the two languages in terms of their morphosyntactic differences. A significant difference is within the fact that bilinguals have a significantly higher increase in their blood oxygenation level dependent-signals whenever they are processing their first language as compared to the monolinguals. This happens due to the difference in the way of conceptualizing cognitive processes. In the experiment, it comes out that although the bilingual participants are conversant with both languages and more importantly that they can compete effectively of happen to be better in mastering their first language, they still have problems in accuracy and speed when it comes to Spanish, their second language.
Questions on whether bilinguals could ever acquire two language systems fully arise due to the many cases of inaccuracy in using a second language. The experiment on English-Spanish test was meant to show that acquiring a second language does not readily affect the fluency in the first language. Now, many debates exist on whether acquiring two or more languages promote or destruct the processing activity of the first language or even the two languages, or either of the two languages. While monolinguals are found to be perfect in their only language, this may not imply that a bilingual would lose some of his/her confidence of fluencies in using his/her first language. Typically, studies seem to suggest that the first language in any bilingual is hardly affected in a negative manner by a second language especially if the bilingual acquired the second language at an adult age.
This would be the case especially when the learner employs much attention focus, which could even better his or skills in the two languages during formal tasks. The big question among researchers has been whether bilinguals’ brains process linguistic information in exactly the same way the brain of a monolingual does. Again, researchers strive to find out whether early exposure to dual language modify one’s ability in language proficiency by modifying the neutral tissues in a classic way that makes the language processing processes among bilinguals completely different as compared to monolinguals. Based on such questions, neutral organization is said or thought to gain influence from environmental experiences. This implies that many experiences of childhood like sensory deprivation, learning how to read, learning music, as well as delays in the exposure to languages has great potential in yielding a very long impact on the respective individuals in terms of their behaviors and on their brain organization (Newman, Bavelier, Corina, Jezzard, & Neville, 2002).
Most of the previous research has hardly involved direct studies of language process within the human brain and more specifically on the brain of bilinguals. Most of the studies seemed to focus on monolinguals. According to Klein, Watkins, Zatorre, & Milner, (2006), most of the studies focused on language processing within bilinguals’ brains who had early or late exposure to language. These are individuals with high proficiency in both their two languages against those individuals having proficiency in only one of their two languages. In such as case, the studies aimed to compare the way in which the brains of bilingual individuals and those of monolingual individuals processed linguistic information. The experiments made use of a combination of functional magnetic and behavioral resonance techniques in order to understand if being purely bilingual modifies the neutral sites that are dedicated to classic language as well as the pathway, which underlies the processing of human language. It was also critical to find out whether there could be neutral signatories to being a bilingual. An instance case of this concern is whether being exposed to two languages at an early age could modify the way bilinguals recruit the brain tissue of classic language as compared to the respective brain tissue of monolinguals. Again, the resulting behavioral consequences, any possible improvement, or even deficits in one’s language process in the two languages or at least one of the two languages was worth considering.
What bilinguals understand about their languages and the way bilinguals organize the skills of the systems for the two languages has been a major area of focus by psycholinguistic literature. The question on whether bilinguals have a general language representational system or whether they have two distinct language representational systems has been a major concern in this case. For the case of neuroscience literature, the major concern has been whether the processing of bilingual language draws upon some common neutral systems, or two neutral systems that are completely distinct. The understanding of the way bilingual individuals process items has been advanced by decades of psycholinguistic research on adults. In this case, the understanding is extended to the way the processing of items by bilinguals is compares with that of monolinguals (Gollan & Kroll, 2001).
Moreover, strong evidence showing that bilinguals differ from monolinguals exists. Such differences are mainly seen in the case of dual lexicons existence, nature and existence of connections in their dual lexical representations that are differentiated, and in terms of the control required in using a lexical item in contrary to the other. Studies in this case have established that bilinguals translate concrete words in a way that is faster as compared to their ability to translate abstract words according to Hell & Groot, (1998). Again, it has been established that bilinguals are able to become semantically primed within a one of their languages to produce a corresponding word in their second language or even in the reverse way according to Kroll & Sunderman (2003). This aspect suggests that despite the fact that lexico-semantic representation along the two lexicons of a bilingual can portray facilitation, such representations involve distinct lexical stores.
It has also been suggested that there is an existence of only one lexico-semantic store that is combined and is similar to that of monolinguals. These aspects could further explain why the bilingual students proved to be better than the monolingual student in the Stimuli for experiment 3. Based on the same aspects, little has been provided about the differences existing between bilinguals and monolinguals in the way they process other critical aspects of language and more specifically in the structure of language such syntax and morphology. Syntax and morphology are two important aspects of language, which are very crucial in processing full sentences within a natural language. Focusing on these aspects could further show distinctive advantages of the bilinguals versus the monolinguals.
In the case of young bilinguals, psycholinguistic research shows that young bilinguals develop two linguistic systems that are entirely differentiated. The differentiation is mainly from early in their infancy stages according to Petitto & Kovelman (2003). From such an understanding a contrast can be established with regard to earlier claims that two language of young bilinguals are mainly fused within one language system in general specifically during their early life. The system hardly becomes differentiated into two different linguistic systems until these children attains the age of four year or five years old (Vihman, 1985). Contemporary developmental findings could be consistent with differentiated language presence and the associated representations among young bilinguals, but this claim hardly suggests that the two languages used by a bilingual hardly interact. There many evidences of influence from cross-linguistics in young children.
Cross-linguistic influence implies that some aspects of one language practiced by bilingual children generate some impact on the other language (Paradis & Navarro, 2003). The effect of cross-linguistic is extended to aspects like language competences, world information, sound perceptions, sentence structures, and word meanings according to Kohnert, Bates, and Hernandez (1999). Adults also depict some aspects of cross-linguistic influence. The effect in this case is however not generalized to all bilingual adults, but to some individuals in their late ages, especially the low-proficiency bilinguals. This happens when the processing of their second language is significantly influenced by their first language, which in this case is dominant according to Liu, Bates, & Li (1992).
Examination on the same aspect made by Hernandez (1994), suggests that the comprehension of a language entail a process in which various forms of linguistic sets compete with an effort of yielding a particular interpretation. In this case, it was suggested that adults who are bilingual predominantly make use of amalgamation strategies of forming combinations of morphosyntactic forms that are specifically taken from both of their languages. These individuals follow this strategy instead of using differentiated strategies in which language-specific forms are used for each of their two languages. Grosjean (2001) also suggested that bilinguals could have the capabilities of processing their two languages independently but in a parallel way thereby generating difficulties and complications to researchers in determining the instances of bilinguals’ language production, which provide examples of amalgamation, parallel processing, and dominance in the case of two linguistic systems that are fully differentiated. This could depict that adults are a bit different from children especially when their second language was acquired at a later age.
The proficiency of young children in using two languages seems to depend on various factors according to the existing research. Studies by classic neuropsychological researchers dealing with bilingual aphasics indicate that individuals could selectively lose one of the two languages, but not the other. This supports the view on language differentiation, which also affects the way some individuals especially children would perform language tasks very accurately, but react slowly according to Paradis (1977). On the other hand, neuroimaging studies that focus on ages of first exposure to bilingual and the level of proficiency in the two languages reflect the resulting effect or process to the organization of the bilingual brain and language processing. Typically, early exposure to bilingual language is strongly believed to result to practice of bilingual individuals including children to use exactly the same neural tissue in processing their two languages. In general, bilingual children grow up to be proficient in their two languages, but the proficiency could be affected by various factors as the individual grows. Previous studies and literatures have provides many reasons on why bilingual children perform some tasks with great accuracy, but they are slow in their reacting times.
Works Cited
Bates E, Devescovi A, D’Amico S. “Processing complex sentences: A cross-linguistic study.” Language Cognitive Processes. (1999):14:69–123. Print.
Caplan D, Alpert N, Waters G. “Effects of syntactic structure and propositional number on patterns of regional cerebral blood flow.” Journal of Cognitive Neuroscience.Vol. 10 (1998):541–552. Print
Grosjean F, editor. The bilingual’s language modes. Blackwell Publishing; Malden, MA: 2001. Print.
Kroll JF, Stewart E. “Category interference in translation and picture naming: Evidence for asymmetric connection between bilingual memory representations.” Journal of Memory and Language. Vol. 33 (1994):149–174. Print.
Liu H, Bates E, Li P. “Sentence interpretation in bilingual speakers of English and Chinese.” Applied Psycholinguistics.Vol. 13 (1992):451–484. Print.
Newman AJ, Bavelier D, Corina D, Jezzard P, Neville HJ. “A critical period for right hemisphere recruitment in American sign language processing.” National Journal of Neuroscience, Vol.5 (2002):76–80. Print.
Penfield, W and R. Lamar. Speech and brain-mechanisms. Princeton, NJ: Princeton University Press, 1959. Print.
Van Hell JG, De Groot AMB. “Disentangling context availability and concreteness in lexical decision and word translation.” The Quarterly Journal of Experimental Psychology: Series A, Human Experimental Psychology.Vol.51 (1998):41–63. Print.
Vihman MM. “Language differentiation by the bilingual infant.” Journal of Child Language Vol.12 (1985)12:297–324. Print.
Wartenburger, I, et al. “Early setting of grammatical processing in the bilingual brain .” Neuron, Vol. 37 (2003): 159–170. Print.
Step 2 Establish Key Organizational Facts (2)
PROJECT 2 STEP 2
Step 2: Establish Key Organizational Facts
To start, write a brief overview description creating an organizational fact sheet of your organization, including the following information:
when it was established and by whom
legal forms of organization and tax status
its current CEO
its industry or industries
its size
its general purpose
Typically, such overviews in a report of this size are no more than one page (approximately 250 to 300 words).
Remember to apply the perspective of an outside consultant to your analysis. Be as objective as possible. Also, consider the audience for this report: key stakeholders including, board members, new employees, and anyone else who would benefit from this overview.
creating an organizational fact sheet= Creating an Organizational Fact Sheet
Fact sheets vary depending upon the organization and intended audience. For the purposes of this project, your fact sheet should be a one-page overview of important information any new or prospective employee or board member would find helpful. You should adapt the fact sheet you create to fit your specific organization.
Organizations in the nonprofit sector use varyinglanguage and approaches to share similar important types of information. To see an example, you can look for the Facts section or About section on the website of the American Red Cross or United Way.
If you scan the Internet for organizational fact sheets, you will find many different templates and examples. You will also find that different types of organizations use different labels for the areas on their websites where they share information. Corporations sometimes use an About page to share information of general interest to all stakeholders and then create a one-page fact sheet targeted primarily at investors. To see examples, search the corporate website of companies like Exxon Mobil or IBM.
Those who work in large government departments may find many different fact sheets. For example , if you search the About section one the US State Department website, you will probably find yourself on a page intended as a starting place for people interested in a career. If you work for a small or new business that does not yet have a fact sheet, you might find the toolkit for small- and medium-size enterprises on the International Monetary Fund’s website helpful.
Fact sheets typically provide information that can be independently verified (i.e., facts), while About pages convey something about the organization’s intended purpose and areas of focus. In it’s simpliest form, a fact sheet focuses primarily on presenting key facts about the organization, but it might also link to the organization’s mission, vision, values, and strategy.
Below are examples of information you may wish to include in a one-page fact sheet:
name of organization
location
when organization was created
legal status
focus
purpose, products, or services
size (i.e., number of employees)
leadership (i.e., CEO and members of the executive leadership team)
mission and vision
other important facts appropriate for your organizational type
legal forms of organization = Legal Forms of Organization
An organization may operate in one of several sectors, which determines its legal form of organization. The following questions can help clarify what legal form of organization a company or initiative has.
Which sector is your organization operating in: private, public (i.e., government), or nonprofit?
If private, review Law in Business (Varner, 2007), located in the Resources section below, to determine which of the following best describes your organization:
proprietorship
partnership
corporation
If public (government), which of the following best describes your organization:
federal
state
local
If a nonprofit organization see A Nonprofit Organization (Dicke, 2011), located in the Resources section below. This article provides some general information about the sector and can help you determine its tax status. Many organizations will likely qualify as a 501(c)(3), which is the most common type of nonprofit. If you have an interest in learning more, you might want to explore some of the websites that provide useful information about this sector. One example is the Urban Institute’s National Center for Charitable Statistics (NCCS), which provides information and research about the sector. Another potentially useful resource is the Charity Navigator, which helps contributors understand the different types of 501(c) organizations and their status for tax purposes. Of course, another very useful source is the IRS website. If, for example, you work for a trade or professional association—a 501(c)(6)—you could search the IRS site for the term business leagues.
outside consultant = Developing a Consultant’s Perspective
When examining an organization you know well, one of the challenges is achieving sufficient distance to ensure you are being as objective as possible. It can be helpful to think about what you would expect of an outside consultant if one were hired by your organization. Then imagine yourself in that role, assuming those same responsibilities and needing to meet the same expectations. This is what is meant by developing a consultant’s perspective.
We expect consultants to have the expert knowledge required to address a particular project or task. We also expect and need consultants to be skilled at recognizing how their own experiences, beliefs, and values, as well as those of others, can influence thinking and decisions. When thinking about situations at work, it is typical for us to have ideas about why they are as they are and, sometimes, how they might be made better. When a consultant is brought in to look at the same situation he or she may have some good preliminary ideas thanks to expert knowledge, but will need to conduct a careful investigation before reaching any conclusions or recommendations. This is what you will want to do for this project. In other words, you will need to develop the required expertise and make every effort to ensure your approach, findings, conclusions, and recommendations are sound and supportable.
To achieve sufficient distance it can be helpful to imagine that you are a consultant for another organization that is similar to yours but that you do not know. In addition, actually write down your beginning assumptions, ideas, and possible biases, and then figure out what you can do to avoid being influenced by them. Depending upon the situation, you might imagine what would happen if the organization accepted your initial hunches, analysis, or recommendations and the situation was made worse. In other words, take the time to imagine the harm you might do if your initial ideas are wrong, and then take the necessary steps to limit this possible outcome. Discussing any issues or concerns with your professor is also important.
stakeholders=
Stakeholders
There are many individuals and groups who have a stake in what an organization does and in how well it does it. Stakeholder theory proposes that organizational performance relies on recognition and inclusion of key stakeholders in the organization’s major decisions. The need to manage stakeholders effectively is an important responsibility and potential challenge for leaders and managers (Fassin, 2012; Loi, 2016).
Read the article Stakeholder located in the resources section below for more about what a stakeholder is and why this is important to recognize all stakeholders.
References
Fassin, Y. (2012). Stakeholder management, reciprocity and stakeholder responsibility. Journal of Business Ethics, 109(1), 83–96. doi:10.1007/s10551-012-1381-8
Loi, T. H. (2016). Stakeholder management: A case of its related capability and performance. Management
Sample Cyber Security Profile
Project #3: Sample Cyber Security ProfileInsert Name
CSIA 412
The security controls introduced by the National Institute of Standards and Technology (NIST) (2014) provide a framework from which organizations can develop their information system security plans. While some organizations may struggle to implement all of the standards as outlined, many address the various controls through systems they already have in place. This paper seeks to analyze the implementation of security controls by the Department of Human and Health Services (HHS) and provide recommendations for improvements to the information security department as necessary. Specifically, this paper will explore the HHS’ implementation of risk assessment as it pertains to vulnerability scanning of privilege information and updating of tools, identification and authentication as it pertains to local access to privilege accounts and remote access, and incident response as it pertains to incident response training and incident handling.
Selected Controls
Management Control – Risk Assessment
This section of controls focuses mainly on minimizing the risk for the organization associated with computer security and is generally addressed by management through policy and documentation (Department of Health and Human Services, 2014a). The risk assessment control, specifically, addresses how a company chooses to develop a management policy that will work to address the policies required by executive orders, federal laws, and other computer security legislation (Stoneburner, Goguen, & Feringa, 2002). By identifying the risk that exists within the system, assessing the risk, and then taking the appropriate steps to address and reduce the risk, the organization is better able to protect the confidentiality, integrity, and availability of its systems. A comprehensive and solidified risk management policy secures the IT systems, provides justifications for budget expenditures, and provides confidence in IT systems based upon performance evaluations and risk management processes (Stoneburner, Goguen, & Feringa, 2002).
Technical Control – Identification and Authentication
Technical controls prevent unauthorized access to the organization’s networks and therefore provide automated protection of data, applications, and user content (Department of Human and Health Services, 2014a). Identification and authentication is designed to create policies that identify the roles and responsibilities of individuals within the organization as well as put into place procedures that ensure that only authorized parties are accessing restricted portions of the network and obtaining control over various systems and applications (Burr, Dodson, Newton, Perlner, Polk, Gupta & Nabbus, 2013). According to Burr et al (2013), there are four levels of assurance that incorporate various requirements to be met in order to decrease the likelihood of an error in authentication. The Office of Management and Budget (OMB) provides a five-step process to aid organizations in ensuring that their selected technology meets the required electronic authorization standards.
Operational Control – Incident Response
Operational controls focus on decreasing the amount of security risks and breaches that occur as a result of the errors made by people rather than by the operating systems (Department of Human and Health Services, 2014a). Operational controls put into place the systems and trainings that prevent human error through trainings, incident response, policies surrounding interactions with media, system integrity, and various other aspects. Attacks often compromise personal and organizational data and the benefit of a quality incident response policy is that it supports a systematic response to a security breach, allowing for the protection of more vulnerable systems (Cichonski, Millar, Grance, & Scarfone, 2012). A present and updated policy provides the guidance needed in order to ensure a swift, efficient, and organized approach as it pertains to a security breach and also addresses the internal steps that may need to take place in order to reestablish the security of the network.
Associated Family Identifiers
Risk Assessment
Vulnerability Scanning – Update Tool Capability
This family identified ensures that the organization not only has a vulnerability scanning system in place but that the system is able to provide updates to the information system after the scan is complete (NIST, 2014). HHS has employed the use of a system that not only scans for vulnerabilities but also updates the system as necessary (HHS, 2014a). In addition to updating the information system, the system used also tracks the changes made and produces a report which the Chief Internet Security Officer (CISO) then uses in order to adjust current trainings and implement new ones (HHS, 2014a). The vulnerability scanning system in place allows the HHS to stay current and ahead of potential threats by implementing proactive rather than reactionary methods.
Vulnerability Scanning- Privileged Access
This family identifier seeks to establish a policy that requires the definition of scanning activities that are allowed to access privileged information (NIST, 2014). The Department of Health and Human Services guarantees fulfillment of this standard by running a full security test and evaluation (ST&E), which is performed in conjunction with the security control assessment (SCA) (HHS, 2014a). This system runs a full evaluation and audit of the system network and produces a report revealing the weaknesses and vulnerabilities within the system. From here, the information security department assesses the vulnerabilities and either produces an authorization to operate (ATO) to the system that is requesting to store, process, or transmit department data or it produces a denial of ATO. Every system within the department is required to have a SCA and run a ST&E on a routine basis.
Identification and Authentication
Local Access to Privileged Accounts
This family identifier is designed to ensure that only those who have authorized to have access to privileged accounts within the building are able to access said accounts (NIST, 2014). This security control decreases the chances that an unauthorized user would gain access to privileged information by ensuring through multi-level authentication that the individual requesting access is indeed an authorized official. HHS has taken various steps in order to ensure that this standard is fulfilled. Through the use of ID badges, personal identification verification (PIV) cards and numbers, as well as unique passwords for each application (HHS, 2014b), HHS has a great starting point from which to work in ensuring that only authorized individuals are accessing privileged information. The HHS could improve its password verification system, however, by implementing a system-wide password time out where each password expires after a specified period of time. According to the security training documents, not all applications have an automated time frame in which passwords must be reset (HHS, 2014b). This lack of automated reset can provide for application vulnerabilities through user neglect to protect current passwords and/or the use of one password for all systems. The PIV card can mitigate the password issues as it must be plugged into the computer in order for various applications to work, however, an added level of security through the automatic reset is a good idea as well.
Remote Access
Remote access can cause issues due to the use of personal networks and technology devices to access privileged and confidential information. In order to meet the standard for this family identifier, the organization must ensure that a multi-level authentication process is used to ensure that the individual’s device has permission to access the network (NIST, 2014). To guarantee that the network nor any sensitive information is compromised while an employee is accessing the network remotely, all aspects of the employee’s role and the work they will be accessing must be taken into account before the ability to access the network remotely is granted (HHS, 2001). HHS has created a policy with solid definitions of what type of information is able to accessed remotely as well as the system that must be used and the level of encryption that must be in place in order for the operation to be carried out. The HHS dictates that all information that needs to be saved must be saved on a shared system server rather than a personal storage device to preserve the confidentiality and integrity of the data as well as ensure that it will be backed up on a daily basis (HHS, 2001). In addition to the requirements that are in place for the technology, there are standards that are also in place for the employee and the employee is required to sign a waiver indicating that they understand the consequences should any information or network be compromised as a result of an action they commit.
Incident Response
Incident Response Training
Incident response training is designed to decrease the amount of incidents that occur from user (human) error. Incident response training (IRT) is conducted under the belief that the better quality of training the staff receives and the more often they are provided with refresher courses, the less likely it is that an incident will happen due to negligence. HHS has ensured that its employees are properly trained in cyber security by appointing the Chief Information Security Officer (CISO) as the point person for facilitating information sharing across departments as well as for coordinating necessary trainings (HHS, 2010). To guarantee that employees of all departments are properly trained, the CISO holds annual and as needed overview trainings for the managers of each department at HHS that share the importance of information security, how HHS is to respond in case of an incident/breach, and the role that each individual plays in the implementation and maintenance of the information security program (HHS, 2014a). In addition, the CISO has implemented various security controls, such as deactivation sequences when an employee is fired, in order to ensure that the vulnerabilities that the organization is exposed to stay as low as possible.
Incident Handling
The Department of Health and Human Services (HHS) requires that any incident that involves the loss or destruction of data as it pertains to any information that deals with unique personal data or any information that can be linked to an individual (HHS, 2014a). Incident handling as defined by NIST (2014) requires that the organization be prepared to handle the incident, and have a system in place that works to detect and analyze, contain, eradicate, and recover from the security breach. After handling and recovering from the security breach, it is required that the organization incorporates training related to the incident into future trainings and education sessions. HHS has fully implemented all aspects of incident handling by having a solidified policy of what is to happen in the case of a security breach. According to the Breach Response Team’s (BRT) policy (2008), when a breach is identified as having occurred, the team is to come together to assess and analyze the depth and breadth of the threat. After the analysis, the team then moves to contain the threat by assigning specific duties to the responsible party to both contain and eradicate the threat. The final step in the HHS policy is to create a plan of actions that need to be taken after the threat has been contained and subsequently eradicated (HHS, 2014a). Within the HHS, as it pertains to this particular family identifier, each member of the team has a role and understands how their role functions within the whole group. There are members that communicate with others based upon the threat level of the breach, there are those that address the situation once it arises, and there are those that supervise depending upon clearance level and responsibilities assigned.
Conclusion
There are only two areas of concern that arise for this evaluator and that would be the lack of update in the remote access policy for over 14 years and the lack of automatic reset as it pertains to application and systems passwords. While the remote access policy may not require significant updates, it may be necessary to update small components as technology has advanced significantly over the past decade and a half and some portions of the policy may be outdated due to advancement. The lack of automated reset for passwords, as stated earlier, provides an area of vulnerability due to human error and negligence and while the PIV cards assist in strengthening security controls, implementing routine password changes adds and extra layer of protection. Overall, based upon the security controls assessed, the Department of Health and Human Services has created a fairly comprehensive and solid systems security plan, reassessing and addressing the two areas of concern can only create a more proactive and preventative plan.
References
Burr, W.E., Dodson, D.F., Newton, E.M., Perlner, R.A., Polk, W.T., Gupta, S., & Nabbus, E.A. (2013). Electronic authentication guidelines (NIST Special Publication 800-63-2). DOI: http://dx.doi.org/10.6028/NIST.SP.800-63-2
Cichonski, P., Millar, T., Grance, T., & Scarfone, K. (2012). Computer security incident handling guide (NIST Special Publication 800-61r2). DOI: http://dx.doi.oeg/10.6028/NIST.SP.800-61r2
Department of Human and Health Services. (2001). HHS IRM policy for IT security for remote access (HHS Document Number HHS-IRM-2000-0005). Retrieved from: http://www.hhs.gov/ocio/policy/
Department od Human and Health Services. (2008). Personally identifiable information (PII) breach response team (BRT) policy (HHS Document Number HHS-OCIO-2008-0001.003). Retrieved from: http://www.hhs.gov/ocio/policy/20080001.003.html
Department of Health and Human Services. (2010). Policy for information technology (IT) security and privacy incident reporting and response (Policy 2010-0004 – OCIO). Retrieved from: http://www.hhs.gov/ocio/policy/hhs_ocio_policy_2010_0004.html
Department of Health and Human Services. (2014a). The department of health and human services information security for managers [PowerPoint slides]. Retrieved from: http://www.hhs.gov/ocio/securityprivacy/awarenesstraining/infosecurity-managers.pdf
Department of Health and Human Services (2014b). The department of health and human services information systems security awareness training [PowerPoint slides]. Retrieved from: http://www.hhs.gov/ocio/securityprivacy/awarenesstraining/issa.pdf
National Institute of Standards and Technology. (2014). Assessing security and privacy controls in federal information systems and organizations (NIST Special Publication 800-53Ar4). DOI: hhtp://dx.doi.org/10.6028/NIST.SP.800-53Ar4
Stoneburner, G., Goguen, A., & Feringa, A. (2002). Risk management guide for information technology systems (NIST Special Publication 800-30). Retrieved from: http://csrc.nist.gov/publications/nistpubs/800-30/sp800-30.pdf