In order to highlight to management, the importance of network security, the security manager should FIRST:
Click on the arrows to vote for the correct answer
A. B. C. D.D.
A risk assessment would be most helpful to management in understanding at a very high level the threats, probabilities and existing controls.
Developing a security architecture, installing a network intrusion detection system (NIDS) and preparing a list of attacks on the network and developing a network security policy would not be as effective in highlighting the importance to management and would follow only after performing a risk assessment.
The FIRST step for the security manager to highlight the importance of network security to management would be to develop a network security policy.
A network security policy outlines the rules and procedures for securing the organization's network, identifies potential threats, and establishes guidelines for protecting against them. By creating a network security policy, the security manager can help management understand the risks and potential impact of network security incidents, and the measures required to prevent them.
Developing a security architecture (option A) or installing a network intrusion detection system (option B) may be important steps to ensure network security, but they cannot be implemented without first establishing a network security policy. A security architecture outlines the overall security design for the organization's network, while a network intrusion detection system detects and alerts on network-based attacks. However, without a clear understanding of what the organization wants to achieve through network security, it would be difficult to develop a security architecture or choose the right security tools.
Conducting a risk assessment (option D) is an important step to identify potential vulnerabilities and threats to the organization's network. However, risk assessments are typically based on the organization's policies and procedures, making it important to establish a network security policy before conducting a risk assessment.
Therefore, the correct answer is C. Develop a network security policy.