Answer To: 1 | 5 COIT20263 Information Security Management (HT2, 2019) Assessment Item 3 - Written Assessment...
Kuldeep answered on Oct 04 2021
Information Security
IS
Information System
Student Name:
University Name:
Unit Name:
Date:
Executive Summary
Information Security means protecting data and information system from unofficial access, utilize, disclosure, destruction, destruction or modification. IS management is the process of defining safety controls to protecting a data assets. The implementation of IS in the organization includes six main activities: policy growth, understanding responsibilities and roles, appropriate IS design, usual monitoring, safety awareness, education and training. Now, in the order to attain reliable data security, basic control factors within the associations are needed. Security controls also include non-technical and technical controls. This report covers IS risk management standards or guidelines moreover information safety certification and accreditation guidelines.
Contents
Introduction 4
Discussion 5
Guidelines for information security risk management 5
Guidelines for information security certification and accreditation 8
Information Security Procedures, Policies and Strategies 12
Conclusion 13
References ` 14
Introduction
FuturePlus is a newly formed independent charity designed to help disadvantaged Australian students continue their education and give them the opportunity to move towards an opportunity-rich future. First, support includes paying tuition and educational supplies moreover student accommodation. However, the organization plans to expand and provide more programs to help disadvantaged students, such as early intervention as well as mentoring programs. Fees are paid throughout the public donations. FuturePlus collect one-time and monthly donations through a website with a safe payment system. They also advertised the event twice a year through national television, advertising on their website, and sent it to the list of donors from the donor database via SMS and email to manage the organization’s operations, twice a year. The full-time staff includes operations executives, an accountant, a plan officer, and two case managers and three support staff. A total of three temporary staff members provide additional support to the case officer, including qualification checks furthermore visits to candidate students, as well as up-to-date information on students who receive assistance from FuturePlus. However, the organization plans to increase the number of employees and the number of students they support in the next few years. Future Plus operates in the Sydney CBD and occupies a high-rise building. They have designed and deployed the network by FuturePlus Company; all servers are located inside and hired FuturePlus to provide them with ongoing network support. Their office network sites connect to the Internet via 5G wireless technology. They require their database servers as well as websites to run 24/7. FuturePlus provides temporary equipment for temporary employees to record on-site case records when they conduct on-site visits and send them to the office via secure communications. Because they store delicate data about employees and their salary details for example bank accounts and credit card information, it's critical that their communications and servers over Internet are safe. FuturePlus has asked companies to provide services to design appropriate information security procedures for their organizations.
Discussion
Guidelines for information security risk management
FuturePlus ISRM Guide
ISRM is a process of managing the risks associated with the use of IT.
In other words, the organization needs to:
1. Identify security risks, including the type of computer security risk.
2. Identify the “system owner” of the key asset business.
3. Assess the company's acceptable risks and risk tolerance.
4. Develop a network security incident response planning.
ISO / IEC 27005 is an important standard, although approximately two-thirds of the content consists of attachments with examples and other information. No criteria are specified and it is recommended not to specify a detailed risk management method. However, it does mean a continuous process consisting of a series of structured activities, some of which iterative:
1. Establish a risk management environment (like compliance obligations, scope, methods to be used, and related policies and standards, for example organization's risk tolerance and appetite);
2. Quantitative or qualitative assessment (that is identification, analysis and assessment) of relevant information issues or risks, consider information assets, existing controls threats, as well as vulnerabilities to identify the likelihood of an event or event scenario and expected business consequences (in case occurred) , determine the "risk level";
3. Use risk levels to properly handle risks;
4. Let stakeholders understand the situation throughout the complete process; and
5. Continuously monitor as well as review risks, risks management, obligations and standards, identify and respond appropriately to major changes.
A number of appendices provide more information, mainly examples, to illustrate the recommended move toward. Third edition of ISO/IEC 27005 was released in 2018. This is “minor revision” and is a temporary interim measure that has undergone extremely limited changes primarily through reference to ISO/IEC 27001. The project to modify/rewrite the standard is not progressing enough, has been canceled, and then restarted. The fourth edition of "27005" is being developed. It is hoped that the 4th edition of ISO/IEC 27005 will be released at same time as the next edition of ISO/IEC 27001 to support updated ISMS specification, but it is not guaranteed. Many comments indicate that the project once again embarked on the difficult road of Kan Rock in the winter. When it comes to opportunities, rewriting 27005 provides a once-in-a-lifetime opportunity to reorganize SC 27 and reorganize it into IS risk management standards, where and “information risk” can be defined by “information-related risks”. "This will remove, among other things, "information security risks" that are curious about "standard information security." Therefore, organizations will determine information security goals based on information security policies to achieve specific results." Therefore, the combination of the two as a result, information security risks is defined as “uncertainty”. Re-established information risk management standards can form the basis of ISO/IEC 27001. The whole ISO27k approach is consistent with risk, identifying, assessing, and processing information issues and risks is an essential element, so information risk management standards are critical.
Five steps to building a successful ISRM process:
Business awareness: FuturePlus have to know the whole business status of the organization, for example budget consideration, complexity of the people and business process (Mpaata, Basemera and Rulangaranga, 2016). FuturePlus need to believe the association risk profile and describe in detail each of the risks it faces moreover its threats tolerance the stage of risk that is prepare to be accepted to attain its goals (Awdah, Jasmeen and Alexander, 2017).
Guidelines for company: FuturePlus needs to...