Security Awareness And Training Program
Order ID 53563633773 Type Essay Writer Level Masters Style APA Sources/References 4 Perfect Number of Pages to Order 5-10 Pages Description/Paper Instructions
Security Awareness And Training Program
Running Head: BUSINESS SECURITY PLAN 1
BUSINESS SECURITY PLAN 12
Business Security Plan
CSUSB
IST 415
3/7/18
Executive summary
Owing to the increased cases of cyber threats and malicious intrusion into the data warehouse of Wal-Mart Inc, it would be prudent to design an action plan to ensure that vulnerabilities and cyber threats are appraised and that informed steps regarding resiliency of cyber threats are taken. In this proposed security plan, vulnerabilities of the company regarding its IT infrastructure will be discussed and the most effective defense mechanism proposed to ensure that the increased sophistication of cyber intrusion that compromises the company’s operations through disruptions is mitigated. As hacking and cyber threat has become more advanced, the organization must take its league on security issues a notch higher to ensure that sensitive data, as well as critical IT infrastructure, is protected. An effective control policy structure can help mitigate the probability of breach, therefore, helping to enhance the detection of intrusion and help come up with a response mechanism as well as a recovery plan. Prevention controls ensure that incidents are barred from occurring and that unauthorized access is prevented. Measures of preventive control help to secure the perimeter through technology like remote and cloud access, the company must expand its control way beyond its traditional perimeter. Detective controls are measures that are designed to alert the organization of unauthorized and malicious activity. The focus of detective controls is infiltration, these controls can, however, be implemented at any phase of the attach cycle to ensure that data security I increased. Corrective controls are measures that help to limit the incident scope and prevent unauthorized activity. Corrective controls are viewed by many organizations as majorly technical though they can come in varied forms as procedural, physical, regulatory and physical.
Strategic Security Plan
Introduction
The wake of the global security threats compels companies to find out solutions through which they could secure their systems and information. Data security, secure communication lines and installation of firewalls in the IT infrastructure of an organization are some of the measures that are taken by companies to reduce the threats posed by cyber terrorists. The strategic security plan is often in line with the business objectives of an organization and should be flexible to address the emerging the threats. The IT infrastructure of the organization comprises of the computers on the workstations, LAN network, VoIP telephones and the server. Therefore, the primary role of the organization is to ensure that their communication and data storage are not compromised by a third party (Bernstein & Siegel, 1996).
Striking the appropriate balance between commercial demands and risk mitigation of the company is an essential skill which must be mastered and shaped according to the nature of the size and nature of the industry, the risk, and the culture as well as the proactive approach required for preventing the risk (Doherty& Fulford,2006). The regulatory, as well as the legal requirements, must be considered, the compliance cost, as well as the benefits of implementing any strategies, must be weighed against each other. Policies and procedures help to put in place the guidelines to business processes and behavior in accordance with the strategic objective of the organization, their main while typically developed to respond to regulatory and legal requirements should be to convey accumulated knowledge regarding how best to do things in an efficient, risk-free and compliant way.
Findings have suggested that the failure of the past security measures were as follows
-Lack of management scrutiny
-Inadequate communication
-Poorly structured policies
-Poor enforcement and implementation
Therefore, the following six steps are proposed to ensure that the proposed policies will be successful in bringing change
1.) Create and review the best guidelines to shape the best practices
2.) Distribute and communicate the policy guidelines
3.) Achieve consent
4.) Ensure that all relevant stakeholders have a better understanding of the guidelines
5.) Ensure that the policy is auditable
6.) Make a report about the compliance and the performance indicators
Privacy policy summary
The company should consider its customers to be number one at all times. Therefore, everything it does should be geared towards the provision of excellent customer services at prices considered affordable. Therefore, while collecting personal information from customers the company should keep it private and safe. So, the privacy policy of the company should cover why and how the organization collects, use and protects the private information of its customers (Doherty& Fulford,2006).
Thus, the policy of the organization should cover personal information –personal identity used to supplement records, detect fraud and personalizes services to individual customers.
The information collected should not be shared with third parties, customers should be given the ability to make choices reading the way their information is collected, shared or even used. This means that customers should be given an opportunity to access and update their personal information.
The administration should, therefore, put in place reasonable security measures like technical and administrative safeguards to protect the personal information of it users. The customers should also be made aware of privacy rights and an effective communication system should be put in place to ensure that any changes are communicated to them in good time.
To ensure that privacy policies are successful the organization should come up with administrative policies for the management of its IT infrastructure, this will be as follows.
Policy and Compliance for Wal-Mart
The policy rants the chief information officer with the responsibility of designing the cybersecurity of the organization. Additionally, he or she has the mandate of investigating and offering a recommendation for any security breach. The exclusive users of the information systems of the company are the employees. Additionally, the users have an obligation to adhere to password policy. Double authentication has to be incorporated as part of the organization’s systems to prevent likely cyber-attack. Additionally, the chief information officer has the mandate of leading the IT team (Doherty& Fulford,2006). The IT team is responsible for approving the use of all devices in the IT infrastructure of the organization. Some of the products that have to be approved include hubs, VoIP, virtual private network, routers, networking appliances, access points for the wireless networks and the switches. Finally, the policy seeks to ensure that traffic logs that include the IT address, physical interface, user account and both source and destination IP address. Such information has to be kept for a minimum of two years.
But since personal customer information is stored in databases major findings indicate that remote access and an end to end transfer of data through the global network if vulnerable to malicious intrusion and malware attack.
The system is also prone to spyware and ransom ware attack which has made it lose client information, weakened device security posture and high cases of virus infection.
All of the above threats combined have made the system to be vulnerable to data destruction and system lock by malicious intruders.
The way forward
To protect its information asset the organization will need to protect its database and its IT infrastructure. It has been confirmed that the most critical exposures are
1.) Excessive abuse of privileges
2.) Legitimate use of privileges
3.) Elevation of access privileges
4.) Vulnerabilities of database platforms
5.) SQL injection
6.) Weak user authenticity
7.) Exposure to data back up
All of the above threats can be summed up to be unauthorized data observation, data unavailability, and incorrect data modification. Therefore, the company needs to initiate a complete data solution that takes into consideration the confidentiality, availability, and integrity of data.
The organization should, therefore, consider installing up a data security and encryption system, in this case, the SSH Tectia solution would be relevant. The solution has prevention, detective and corrective measures whereby sensitive company information is secured in transit through a robust encryption that supports platforms for heterogeneous computing and multiple technologies for authentication alongside capabilities for secure file transfer protocols. The company should consider outsourcing the top management to help up with system administration, the manager should be an expert of Tectia IT ways to help manage the robust SSH Tectia solution. The goodness of this solution package is that it can be used on all platforms. By ensuring that the management of the SSH is centralized it will be easy to deploy quickly, maintain and simplify the aspects of configuration in the platforms.
By applying this solution there will be a return on investment since the company will restore its operations to normal by ensuring proper data functionality, availability and integrity (Rhodes,2013).
It has also been identified that the company is facing threats from internal and external sources. Internal threats include the employees of the organization who have access to the IT infrastructure for example system administrators, database and application developers and station managers. These employees carry data and use it around from one point to another, the external source is third-party groups who do not work in the organization but may be interested to access the sensitive data for malicious interests. To ensure that these two sources of threats are controlled only authorized personnel will be allowed to access the It infrastructure while strong security measures will be taken to bar malicious external intrusion, for instance, the solution package suggested ensures that there is strong encryption of data which keeps off external intrusion.
Encryption is the process of modifying information through algorithm into a form considered unreasonable so that it would be inaccessible to any person who does not have the special technique and devices to decrypt it. Data encoding through special algorithm makes it unreadable to any users who may have accessed it thereby finding it not useful. The solution package will employ end to end coding to protect the data (Rhodes, 2013).
Security Awareness & Training Program
Conducting of security awareness training to all the staff will serve to enlighten the staff on the measures that they ought to undertake to minimize the vulnerability of the system to external and internal threats. The training of such staff needs to take into consideration aspects such as phishing. All employees need to be trained on a regular basis on the type of emails that could compromise the organizational system and how they should discard such e-mails without opening them. The IT departments also have to conduct regular vulnerability tests of the system and propose the type of training that all the employees may need. Awareness should also be conducted to the staff on why they need to use the information systems of the organization for all the exclusive communication and data sharing activities (Hayden, 2010). The hiring of an IT consultant to take up the training programs would serve to ensure that all the employees are trained on a rotational basis without compromising the regular activities of the company.
Intrusion Detection and Prevention Tools and Techniques
The SSH Tectia solution package through its host-based intrusion detection system has the primary role of examining the data that gets into and out of the servers of the organization. The host-based intrusion systems also examine the hard drive and notify the IT team of any change in the logical content of the information stored y the organization. Additionally, the network-based intrusion detection system examines the presence of suspicious data that is within company’s network. The application-based intrusion system has the purpose of limiting the use of a given application by the company to its exclusive role. Applications are often the major points of access into an organization’s system that are preferred by the hackers. By detecting any malicious intrusion, the system will prompt appropriate action from which may be the stimulation of its security features to take effect and prevent such intrusion from occurring, for example, the firewall that comes with the solution package will ensure that such intrusion is prevented. If a malicious intrusion is detected management will be able to know where weaknesses are and what kind of improvements needs to be done to ensure that this is prevented from occurring in future.
Vulnerability Assessment and Penetration Testing Procedures
A vulnerability scan needs to be conducted regularly with the emphasis being at the time when a new device or application has to be installed into the system. The existent in-house IT staff members have the mandate of conducting the vulnerability scans. Some of the vulnerability assessment tools that are recommended for the organization include Open VAS and Nessus However, the penetration testing are to be done using the Pen Test technique. An external IT consultant has the mandate of doing the independent penetration testing procedure whose intent is to determine the exposure points that could be exploited by the hackers. Additionally, the Pentest could also enable the management of the company to determine the data and systems of the company that may have been compromised and offers the restitution measures.
Disaster Recovery Program
The installation of firewalls to prevent an intrusion into the system software of the organization is some notable measures that should be undertaken by the organization to prevent the loss of data. Additionally, the backup of data offsite and ensuring that there is a power back up to prevent any data loss are also some of the prevention measures whose intent is to prevent any likelihood of lost data. Additionally, the detective measures that could be put in place by the organization include training of the staff on how they would prevent cybercrime and the installation of smoke detectors in the server rooms. Network monitoring software and the installation of an antivirus that is up to data are some additional measures that could be used to enforce data security (Calder and Watkins,2010). All reports of IT disasters that have been recorded by an organization ought to be well recorded to facilitate insurance compensation to the organization. The organization can come up with an offsite database situated far ways from the primary location to ensure that the database is safe from malicious intrusion targeted to the primary server. The organization can also consider setting up an alternative site in a well-protected location far away from the primary site to ensure that there is an assurance of business continuity in case of an attack done on the primary site.
Defense in Depth principles
Having physical controls such as fencing of the location in which data is stored and having CCTV throughout the organization’s premises is crucial. The access to the IT systems would also be limited to the authorized staff only (Hayden, 2010). The encryption of some disks of the organization and the use of fingerprints to seek access to the systems are also additional control measures. The IT policy of the organization serves as the major administrative control to which all the employees must adhere and sign up to. The data handling policy should also integrate security requirements need to access data.
Conclusion
Cybercrime is often dynamic with the nature of attacks evolving. However, the most crucial aspects of the organization that are often sought by the hackers include user private information, financial information and critical management decisions that would grant the company a competitive advantage. Therefore, doing penetration testing is a valid move that would enhance the integrity of the company’s data. Additionally, there is need to have a rigorous hiring process for all the staff, with more emphasis being on the IT system. Having strong data security policy and IT impenetrable IT infrastructure cam only is valid where the staff also has the integrity not to engage in any activity that may lead to data loss. Some hackers may collude with the existent staff of the company to gain access to their crucial data. The company should also consider applying the suggested SSH Tectia IT package solution to ensure that its data is protected and kept safe from both internal and external threats. Some of the reasons why the security solutions that the company has applied before having failed to work include lack of visibility placed into dynamic environs of the IT infrastructure, the exposure due to shadow IT, the complexity of the IT surrounding and the constant barrage of security attacks –making the IT team and personnel of the organization to be strapped by resources. The proposed solution package has the ability to detect and deal with the latest kinds of malware and ransom ware while it has the most advanced technological advancements to match the expanded and dynamic attack surface (Calder and Watkins,2010).
References
Bernstein, T., Bhimani, A. B., & Siegel, C. (1996). Internet security for business (pp. 125-326). New York: Wiley.
Calder, A. and Watkins, S. (2010). Information security risk management for ISO27001/ISO27002. Cambridgeshire: IT Governance Pub.
Doherty, N. F., & Fulford, H. (2006). Aligning the information security policy with the strategic information systems plan. Computers & Security, 25(1), 55-63.
Hayden, L. (2010). IT Security Metrics: A Practical Framework for Measuring Security & Protecting Data. McGraw-Hill Education Group.
Rhodes-Ousley, M. (2013). Information security: the complete reference. McGraw Hill Education.
RUBRIC
QUALITY OF RESPONSE NO RESPONSE POOR / UNSATISFACTORY SATISFACTORY GOOD EXCELLENT Content (worth a maximum of 50% of the total points) Zero points: Student failed to submit the final paper. 20 points out of 50: The essay illustrates poor understanding of the relevant material by failing to address or incorrectly addressing the relevant content; failing to identify or inaccurately explaining/defining key concepts/ideas; ignoring or incorrectly explaining key points/claims and the reasoning behind them; and/or incorrectly or inappropriately using terminology; and elements of the response are lacking. 30 points out of 50: The essay illustrates a rudimentary understanding of the relevant material by mentioning but not full explaining the relevant content; identifying some of the key concepts/ideas though failing to fully or accurately explain many of them; using terminology, though sometimes inaccurately or inappropriately; and/or incorporating some key claims/points but failing to explain the reasoning behind them or doing so inaccurately. Elements of the required response may also be lacking. 40 points out of 50: The essay illustrates solid understanding of the relevant material by correctly addressing most of the relevant content; identifying and explaining most of the key concepts/ideas; using correct terminology; explaining the reasoning behind most of the key points/claims; and/or where necessary or useful, substantiating some points with accurate examples. The answer is complete. 50 points: The essay illustrates exemplary understanding of the relevant material by thoroughly and correctly addressing the relevant content; identifying and explaining all of the key concepts/ideas; using correct terminology explaining the reasoning behind key points/claims and substantiating, as necessary/useful, points with several accurate and illuminating examples. No aspects of the required answer are missing. Use of Sources (worth a maximum of 20% of the total points). Zero points: Student failed to include citations and/or references. Or the student failed to submit a final paper. 5 out 20 points: Sources are seldom cited to support statements and/or format of citations are not recognizable as APA 6th Edition format. There are major errors in the formation of the references and citations. And/or there is a major reliance on highly questionable. The Student fails to provide an adequate synthesis of research collected for the paper. 10 out 20 points: References to scholarly sources are occasionally given; many statements seem unsubstantiated. Frequent errors in APA 6th Edition format, leaving the reader confused about the source of the information. There are significant errors of the formation in the references and citations. And/or there is a significant use of highly questionable sources. 15 out 20 points: Credible Scholarly sources are used effectively support claims and are, for the most part, clear and fairly represented. APA 6th Edition is used with only a few minor errors. There are minor errors in reference and/or citations. And/or there is some use of questionable sources. 20 points: Credible scholarly sources are used to give compelling evidence to support claims and are clearly and fairly represented. APA 6th Edition format is used accurately and consistently. The student uses above the maximum required references in the development of the assignment. Grammar (worth maximum of 20% of total points) Zero points: Student failed to submit the final paper. 5 points out of 20: The paper does not communicate ideas/points clearly due to inappropriate use of terminology and vague language; thoughts and sentences are disjointed or incomprehensible; organization lacking; and/or numerous grammatical, spelling/punctuation errors 10 points out 20: The paper is often unclear and difficult to follow due to some inappropriate terminology and/or vague language; ideas may be fragmented, wandering and/or repetitive; poor organization; and/or some grammatical, spelling, punctuation errors 15 points out of 20: The paper is mostly clear as a result of appropriate use of terminology and minimal vagueness; no tangents and no repetition; fairly good organization; almost perfect grammar, spelling, punctuation, and word usage. 20 points: The paper is clear, concise, and a pleasure to read as a result of appropriate and precise use of terminology; total coherence of thoughts and presentation and logical organization; and the essay is error free. Structure of the Paper (worth 10% of total points) Zero points: Student failed to submit the final paper. 3 points out of 10: Student needs to develop better formatting skills. The paper omits significant structural elements required for and APA 6th edition paper. Formatting of the paper has major flaws. The paper does not conform to APA 6th edition requirements whatsoever. 5 points out of 10: Appearance of final paper demonstrates the student’s limited ability to format the paper. There are significant errors in formatting and/or the total omission of major components of an APA 6th edition paper. They can include the omission of the cover page, abstract, and page numbers. Additionally the page has major formatting issues with spacing or paragraph formation. Font size might not conform to size requirements. The student also significantly writes too large or too short of and paper 7 points out of 10: Research paper presents an above-average use of formatting skills. The paper has slight errors within the paper. This can include small errors or omissions with the cover page, abstract, page number, and headers. There could be also slight formatting issues with the document spacing or the font Additionally the paper might slightly exceed or undershoot the specific number of required written pages for the assignment. 10 points: Student provides a high-caliber, formatted paper. This includes an APA 6th edition cover page, abstract, page number, headers and is double spaced in 12’ Times Roman Font. Additionally, the paper conforms to the specific number of required written pages and neither goes over or under the specified length of the paper. GET THIS PROJECT NOW BY CLICKING ON THIS LINK TO PLACE THE ORDER
CLICK ON THE LINK HERE: https://www.perfectacademic.com/orders/ordernow
Also, you can place the order at www.collegepaper.us/orders/ordernow / www.phdwriters.us/orders/ordernow
Do You Have Any Other Essay/Assignment/Class Project/Homework Related to this? Click Here Now [CLICK ME]and Have It Done by Our PhD Qualified Writers!!