Information Security And Security Policies

Passwords should be designed to prevent them from being discovered by unauthorized persons. All passwords should have at least eight (8) characters. The user-IS should never be used as the password. Words in dictionary, derivates of user-IDs, and common character sequences such as “123456789” should not be employed.

| “Security controls are the management, operational, and technical safeguards or countermeasures employed within an organizational information system to protect the confidentiality, integrity, and availability of the system and its information” (NIST SP 800, 2009). The control allows the organization to efficiently mitigate the risk coming from the use of information System (IS) to conduct business operations and processes.

When a security policy is developed, it should be well defined and the information in it should be clear and plainly understand and the objectives should be well defined so that there will be no confusion. Conversely, a data system with security policies is probably going to have an assortment of countermeasures that address a range of threats. Policies, standards, guidelines, and coaching materials that are known to be obsolete and not enforced could be dangerous to a corporation due to the data being outdated. As a result, management is basically drawn into thinking that security policies do exist within the organization when actually that is not the case. Counter measures which are outdated does not do an organization any good because without the appropriate patches in place, the organization’s network could have holes which would leave them extremely vulnerable. All organizations need to be compelled to actively

internal and external users to whom access to the organization’s network, data or other sensitive

Due to policy changes, personnel changes, systems changes, and audits it is often necessary to review and revise information security policies. Information security professionals are responsible for ensuring that policies are in line with current industry standards.

* Review the results of a qualitative Business Impact Analysis (BIA) for a mock organization

This policy establishes the guidelines that the organization follows. This would include an acceptable use policy, an authentication policy, and an incident response policy (“The IT Security Policy Guide”, n.d., pg. 6). This policy will reflect the entire organizations security posture, not just the IT department ideas. A strong policy will help employees understand what is expected of them, and explain to customers how their information is protected.

The organisation maintains policies for the effective and secure management of its information assets and resources.

The Department of Homeland IT security policy must be uniform, stable, consistent, efficient, effective and compatible with best practices Information Security in the Department. It is the purpose of this security policy to create and implement the best security plans, strategies, and practices throughout the Department. Also, it is the intention of this policy to create safe and secure Cyberspace.

Policies are important in the work place because they help make sure that all of the organisation’s information is held securely, along with other things. Policies are only internal and don’t effect anything outside of the organisation, however some policies may coincide with some laws or other general rules from outside of the organisation. In this case, policies are used to control the maintenance of computer systems. Policies are used to protect things such as sensitive information which could be used for things other than its intended purpose. Organisations usually make their employees sign an agreement to make sure that they abide by their policies. This helps protect the

This policy provides a framework for the management of information security throughout Cañar Networking organization. It applies to:

For example a clerk will only be able to access a limited amount of information, such as inventory at each store. The limitations will be different for an accountant or the mangers. All information will be protected with several different layers of security. The first layers will be simple hardware protection for access to the network; from there the security will increase with password protection and restrictions to users. (Merkow & Breithaupt 2006)

There were a number of factors that contributed to the breach, which had they been addressed or had corresponding mitigation responses in place, would have reduced the likelihood that the breach would have taken place, or at a minimum reduce the impact of the attack. These items range from policy related issues, technology implementations, and security management and maintenance. Although I believe a number of these areas were in the process of being addressed, based on the information gathered regarding the details of the incident, it appears that it was still in many areas insufficient and would not have prevented an incident even if there had been more time available to perform the implementations.

Moreover, a reorganization and distribution of company policies and regulations can be distributed that outlines and explains new security procedures and implementations that will be monitored. It will also explain the penalties and sanctions if the policies and regulations are not adhered to. This is done as a deterrent with the cost of the crime outweighing the benefits.

Establishing an effective Information Technology Security Policy Framework is critical in the development of a comprehensive security program. The purpose of the Information Security Policy Framework is to insure your organization will be able to provide the minimum security level necessary to maintain confidentiality, integrity, and availability of the information it collects and uses.