An Effective Information Security Program

Ethics are of a special importance to practicing professionals. Professions such as lawyers, teachers, doctors and engineers have a bigger responsibility as to making sure there jobs are done right and ethically. Though in order to achieve this goal individuals must understand what ethics really means. Ethics is basically the rules of conduct which is recognized in respect to a particular group, culture, or class of human actions. The decision to behave ethically is a moral one.

Ethics are defined as “a set of moral principles and perceptions about right versus wrong and the resulting philosophy of conduct that is practiced by an individual, group, profession, or culture” (Barker, 2001, p. 159). In the field

An effective information security program should include, periodic assessments of risk, including the magnitude of harm that could result from the unauthorized access, use, disclosure, disruption, modification, or destruction of information and information systems that support the operations and assets of the organization. Policies and procedures should be based on risk assessments, cost effective reduced information security risk, and it should ensure that the information security is addressed throughout the entire life cycle of each and every organizational information system. Subordinate plans for providing sufficient information security for groups of the information system, facilities, networks, or information systems.

Ethics are the “standards of conduct that indicate how one should behave based on moral duties and virtues.”

American Psychological Association define ethics as the standards or code of conduct members of any particular profession must follow, and whoever steps out of such codes will be reprehended.

Ethics are guides of morals that dictates the wrongs and rights of someone. It ensures that one makes the right choices considering the way he is supposed to act in a situation is specified. The ethical behaviours apply to different professions on the way they are supposed to act and if they tend to go against the rules they face different consequences. The above task

Information Security education initiatives are vital for Information Security group’s effort to be a successful partner within the company culture. Establishing a formal program that articulates our strategy and approach with respect to security education as the Information Security Education Program (ISEP) will be the first step towards effectively providing and measuring successful behavior change metrics in our goal to create a culture of security here at company. This will allow us to better understand requirements, identify gaps, and focus on initiatives to be able to better plan resource allocation and needs, assemble our team, and utilize our branding (email templates,

When working in an organization, it is usually important to establish professional ethics while following consistent ethical principles. Professional ethics are personal and corporate standards of behavior that are set by businesses, associations, and organization. It creates an institution that reflects our own values and make us feel more confident about what is an acceptable behavior and what is not. This type of ethic could vary depending on the various types of situations, professions, and personal values. Many professionals that are trusted by the public like doctors, accountants, engineers and even an information technologist all have a Code of Ethics, which sets out expectations of the member’s behavior and how they operate internally and externally.

Participants reported that undergoing training and taking security seriously reduced unauthorized disclosures. Arachchilage and Love (2014) confirmed the need for information security training. The researchers suggested that personnel have an insufficient amount of both knowledge and training to mitigate threats related to information security. For instance, organizations attempt to counter information security threats by publishing organizational policies and conducting periodic information security-training that assist in the mitigation efforts to thwart threats such as fraud, viruses, malware, spyware, and social engineering attacks (Arachchilage & Love, 2014; Chen, Ramamurthy, & Wen, 2015; Singh et al., 2013).

Implementation of an information security project takes more time, effort and communication in security systems development life cycle (SecSDLC). In this phase, an information security blueprint is executed and accomplished by changing the configuration and operations of the organization. The change in procedures, people, hardware, software and data can provide more security. During implementation phase, the blueprint turns into project plan. The project plan implements the security controls and establish a setting to achieve those controls with desired outcomes. To develop the project plan, the management must communicate to the information security vision and objectives with the communities of interest involved to execute the project plan. The security visions states the goals of the information security and its objectives to built the project plan by guiding the changes, which are useful for the implementation phase.

Organizations can create awareness and perception of information technology in their employees through providing them security awareness training, implementation of policies regarding security issues. Organizations should create a security aware culture to make staff aware of the risk of security issue and what are their responsibilities in a sensible manner (Researchomatic.com, 2015).

What is Ethics? In Webster dictionary website define ethic is an area of study that deals with ideas about what is good and bad behavior: a branch of philosophy dealing with what is morally right or wrong. We have ethical training in the military to create a universal standard of behavior because morals are so variable and linked to religious belief. They cannot tell people what religious behaviors to have but they can create a universal ethical guidance. Many people might think of ethic is common sense and may not take it seriously. Sometimes we need the reinforcement like the ethic training to illustrate what is right and wrong look like, and hope people will do the right thing intuitively. I believe everyone has their own ethical

According to Harwell, Humphrey, Mohammed & Balloo (2016) the "term ethics is used in different ways. On a personal level, ethics is motivation based on ideas of right and wrong. From a wider perspective, ethics is the philosophical study of moral values and rules. In business, ethics is the rules and standards of conduct that govern the behavior of individuals or members of a particular profession. Furthermore, ethics deals with questions of rightness, fairness, or equity when considering the moral perspective of a situation, and it deals with duty and obligation of and to society. Lee (2002) defines ethics as "the explicit, philosophical reflection on moral beliefs and practices" (as cited in Hinman, 1998). Ethics is also sometimes known as moral philosophy. According to The Columbia Encyclopedia, ethics is "... the study and

Ethical is defined in a human perspective as a moral principle with the rule of individual or an organization recognized in respect of a particular class of human actions. Professionally it is seen as a principle, idea and attitude on “what is good or bad or right or wrong” that we need to control and practice in a professional approach. It does not only concern behaviour, but also what people think, the language they use, and their judgemental approach can influence the code of conduct in an institution or organization. In most cases, the choices people make divert their own well-being, and daily lives which may sound unethical.

Some of our biggest challenges come with keeping information secure in the business world. Auburn University researchers teamed up with the International Information Systems Security Certificate Consortium to identify and rank the top information and security issues. Using a worldwide sample of 874 certified information system security specialists, they ranked a list of top 25 information security issues based on which ones were most critical facing organizations today. These 25 issues were: 1.) Top management support 2.) User awareness training and education 3.) Malware 4.) Patch management 5.) Vulnerability and risk management 6.) Policy related issues 7.) Organizational culture 8.) Access control and identity management 9.) Internal threats 10.) Business continuity and disaster preparation 11.) Low funding and inadequate budgets 12.) Protection of privileged information 13.) Network security architecture 14.) Security training for IT staff 15.) Justifying security expenditures 16.) Inherent insecurity of networks and information systems 17.) Governance 18.) Legal and regulatory issues 19.) External connectivity