Answer To: 1 | 5 COIT20263 Information Security Management (HT2, 2019) Assessment Item 3 - Written Assessment...
Kuldeep answered on Oct 06 2021
Information Security
Information Security
Topic: Information Security Risk Management
Student Name:
University name:
Unit Name:
Date:
Executive Summary
The main purpose of this report is to support in the growth of the well-designed safety procedures for Norwood System. In the procedure of raising a security plan, this report discusses the several roles of Norwood Systems and the duties of security personnel. The report focuses on improving the organization's existing safety structure to make it better. The report outlines several threats that can also affect the safety of organization's information, such as DoS and spoofing. It identifies the training requirements required to properly implement a security program. The report also provides recommendations for a security model that Norwood Systems can implement to effectively implement information security.
Contents
Introduction 4
Discussion 5
Guidelines for information security risk management 5
Guidelines for information security certification and accreditation 9
Conclusion 12
References 15
Introduction
Data is the very significant asset of association. In this period of communication and information technologies, safety risks moreover risks have become the main focus of the organization (Andress 2014). Information security involves protecting the integrity, availability and confidentiality of a company's valuable and sensitive information (Bergström, Lundgren and Ericson, 2019). FuturePlusis also known for provide telecommunications services to businesses, customers and operators around the world. This report also discusses the safety procedures that Norwood Systems can use to improve its present security architecture. It identifies safety threats as well as risk assessment plan or procedures that can apply. The report provides a training programs, appropriate ISO standards, and requirements for the FuturePlus security model. In order to manage the organization's operations, they have recruited full-time and temporary employees (Chang et al., 2017). The full-time staff includes an operations manager, accountant, planning officers, two case officers’ also three support employees. A total of three temporary employees provide extra support to case officer, including qualification checks and visits to candidate students, as well as up-to-date information on students who receive assistance from FuturePlus. However, the organization plans to increase the number of employees and the number of students they support in the next few years. FuturePlus operates in the Sydney CBD and occupies a high-rise building. They have designed and deployed the network by FuturePlus Company; all servers are located inside and hired FuturePlus’s business to provide them with ongoing network supports. Their office network sites connect to the Internet through 5th Generation cellular technology. They require their websites and database servers to run 24/7 (Fenz et al., 2014). FuturePlus provides temporary equipment for temporary employees to record on-site case records when they conduct on-site visits furthermore send them to office by the use of safe communications. Because they store sensitive data about the donors, donated students, and compensation details for example bank accounts and credit card data, it's critical that their communications and servers over Internet are secure completely.
Discussion
Information security involves protecting systems and information to prevent some kind of illegal or unauthorized access, destruction, modification, and disclosure. The primary goal of IS system is to retain the integrity, confidentiality and availability of information. Confidentiality is to protect or protect valuable data from a few unauthorized or unethical accesses. Confidentiality ensures that only official users can access the correct data based on their requirements (Humphreys, 2007). Integrity is designed to protect valuable data from several unauthorized modification and destruction. Integrity ensures that the data is accurate and complete. Availability is designed to provide the right data in a timely approach without causing any interference or hindrance. Information systems consist of people, hardware, software, data, networks, and programs. All of these parts are susceptible to a variety of threats and risks. Information security system is a significant necessity for each association. Numerous strategies can also be use to protect information from any form of attack. Risks can be mitigated and avoided to promote safe business environment. Losing valuable data can damage multiple users as well as affect the reputation of company (Jirasek, 2012). As time goes by, information security is becoming more and more important. A variety of information security model can be incorporated into an organization's business processes depend on certain requirements and needs.
Guidelines for information security risk management
Security Models
The security model can be considered as a standard that can use for comparison or comparison reference. The NIST control model access is used to identify access stages at all levels in Norwood System. The Management accesses information and data associated to strategic plan. The management stage controls operational information, furthermore technical stage accesses the everyday information necessary for business continuity. Safety models also help to secure data in FuturePlus. Norwood Systems provides enterprise solutions through a cloud service called Corona Cloud (Kang, 2014). The NIST security model will be tremendously helpful to the business. NIST files are available free of charge and have also been update by government. It provides guidance on risk assessment, privacy control and safety planning. Norwood systems require to implementing the strong safety policies to protect the cloud from some type of threat.
Development of Security Program
Norwood Systems is the medium-sized business with hierarchical organization. Codes of conduct prevail in the organizational culture. Workers should act very honestly moreover protect company assets. Employees can post confidential information under company licenses. If it violates the behavior, the company will take serious action. There is a need to develop robust security procedures to protect companies from security risks and threats. Fail to protect the valuable data will damage the reputation of company. The key parts of the safety program that require to be developing are follows as:
Hire a DSO or Designated Security Officer: DSO is necessary for coordinating and monitoring the safety policies of association.
Risk Assessment: Companies must determine the type of information they store and the value of the information (Kim and Shon, 2015). There is a need to identify threats and risks related with different categories of data. Risks and Threats should be ranked based on their impact and exposure.
Access Control: The refuge officer should determine which data should be provided to whom. Workers should be authoritative to access kind of data they need to run their company, depending on their role and level in the managerial structure.
Personal accounts: All workers should have separate account so they can be properly monitored as well as can also help to investigate a few data loss as well as manipulation.
Develop a strategy: An IS strategy should be in place so that the whole organizations know safety expectations (Meily, 2014). The significance of data should be mention in policy. These policies should be reviewed and updated annually. Workers should sign an agreement to comply with policies and rules.
Effective governance: Security officials must ensure that policy is followed in useful manners. The responsibilities and roles of workers ought to be clear defined in the order to manage effectively.
Install a firewall: A firewall can be implementing to...