Explanation/Reference:
A company's implementation of IT will be less likely to succeed if senior management is not committed to strategic planning.

Section: Governance and Management of IT

Write access to production program libraries presents the greatest risk when granted to a new member of the system development staff. Production program libraries contain executable code that runs on live systems and supports critical business functions. Write access allows a user to modify or delete existing programs, or add new programs to the library. If a user were to make unauthorized or erroneous changes to production programs, it could cause serious disruptions, errors, or security breaches in the organization's operations.
Therefore, write access to production program libraries should be restricted to authorized personnel only, and subject to strict change management controls.

For an organization that has plans to implement web-based trading, it would be most important for an IS auditor to verify that the organization's information security plan includes security requirements for the new application. Security requirements are statements that define what security features and functions are needed to protect the confidentiality, integrity, and availability of the web-based trading application and its data.
Security requirements should be identified and documented during the planning phase of the application development life cycle, before any design or coding activities take place. Attributes for system passwords, security training prior to implementation, and firewall configuration for the web server are also important aspects of information security, but they are not as essential as security requirements for ensuring that the web- based trading application meets its security objectives.

Section: Protection of Information Assets
Explanation:
The SSL security protocol provides data encryption, server authentication, message integrity and optional
client authentication. Because SSL is built into all major browsers and web servers, simply installing a
digital certificate turns on the SSL capabilities. SSL encrypts the datum while it is being transmitted over the
internet. The encryption is done in the background, without any interaction from the user; consequently,
there is no password to remember. The other choices are incorrect. Since the communication between
client and server is encrypted, the confidentiality of information is not affected by wiretapping. Since SSL
does the client authentication, only the intended recipient will receive the decrypted data. All data sent over
an encrypted SSL connection are protected with a mechanism to detect tampering, i.e., automatically
determining whether data has been altered in transit.