Annotated Bibliography: Internal Control for Information Security

In today’s IT world every organization has a responsibility to protect the information and sensitive data they have. Protecting data is not only responsibility of security and IT staff but every individual is involved in protecting the information. The risks to information security are not digital only, but it involves technology, people and process that an organization may have. These threats may represent the problems that are associated to complex and expensive solution, but doing nothing about these risks is not the solution.

Any enterprise has to pay special attention to computer security. Computer security is a field that is concerned with the control of risks related to computer use. A primary focus should be on the external threats to the computing environment. In enterprise with branches cross country, it is important to allow information from "trusted" external sources, and disallow intrusion from anonymous or non-trusted sources. In a secure system, the authorized users of that system are still

2. Which law requires all types of financial institutions to protect customers’ private financial information?

In 2010, Congress passed the Dodd-Frank Wall Street Reform and Consumer Protection Act. The Dodd-Frank Act is a bill that was put into place to protect Consumers, Investors, Businesses and many other business related sources from repeating another financial crisis. The main purpose of the Dodd-Frank Act is to highlight all the flaws from the previous financial crisis and put preventions into place to reframe from the loss of 8 million jobs to happen again. Throughout I will highlight important proposals within the Dodd- Frank Act to breakdown and explain the reasons behind the development. To explain more fully the basic motivation behind each of these proposals is quite simple actually, starting with Consumer Protections with Authority and Independence.

In shaping a new security policies, it is essential to have a full understanding of all aspects of the internal network and services to be protected from both internal and outside threats. An article by Solms & Solms (2004) outlines several criteria in developing information security. First, a governing body must be formed to ensure all sensitive data is secured and provide due

Information security enabled by technology must include the means of lowering the impact of intentional and unintentional errors entering the system and to prevent unauthorized internally or externally accessing the system  actions to reduce risk data validation, pre-numbered forms, and reviews for duplications. It is crucial that the mission plan include the provision of a disaster recovery and business continuity plan. On the other hand, there is much more intrusion activity today than ever before. Obviously, there is an increased concern for attacks through companies’ network in an effort to either commit malice or affect the integrity of an organization’s most valuable resource. Therefore, it is important that companies do not get complacent in their IT infrastructure security. The fact of the matter, there is no perfect system; however, it behooves organizations to protect their information by way of reducing threats and vulnerabilities. Moreover, Whitman and Mattord (2010) said it best, “because of businesses and technology have become more fluid, the concept of computer security has been replaced by the concept of information security. Companies

While all of these technologies have enabled exciting changes and opportunities for businesses, they have also created a unique set of challenges for business managers. Chief among all concerns about technology is the issue of information security. It seems to be almost a weekly occurrence to see a news article about yet another breach of security and loss of sensitive data. Many people will remember high profile data breaches from companies such as T.J Maxx, Boston Market, Sports Authority, and OfficeMax. In the case of T.J. Maxx, a data breach resulted in the loss of more than 45 million credit and debit card numbers. In many of these incidents, the root cause is a lack of adequate security practices within the company. The same technologies that enable managers can also be used against them. Because of this, businesses must take appropriate steps to ensure their data remains secure and their communications remain

The use of information technology in business presents major security challenges, poses serious ethical question, and affects society in significant ways. Especially, the computer crime is a growing threat to society and is caused by the criminal or irresponsible actions of individuals who are taking advantage of the widespread use and vulnerability of computers and the Internet and other networks. It presents a major challenge to the integrity, safety, and survival of most business systems.

Financial Institutions like Bank Solutions Inc. are required to meet the standards regulated by the government to avoid mismanagement of sensitive information. These regulations are solely purposed to mandate financial institutions to protect confidentiality, availability and integrity of individuals, information systems and processes. Some of the applicable regulations and standards are elaborated below:

Whitman, M. E., & Mattord, H. J. (2014). Management of information security (4th ed.). Boston, MA:

Information security is often still playing in companies only a minor role. Many companies neglect aspects such as system misuse, sabotage or even espionage. But by now the reality has caught up with them. Straight from abroad there are more hacker attacks and espionage by competitors. Therefore, the law requires different approaches before to ensure information security. Companies must for example ensure that their information-processing systems are protected and kept safe.

An Information security programs mission should be developed in a way that “aligns with organizational strategies by evaluating business requirements, applicable laws, regulations, standards, and best practices” (Module 2). More importantly businesses, governments, and other types of organizations need to incorporate cyber security to conduct business transactions, share information, and interact with customers and suppliers. Threats to the confidentiality, integrity and availability of cyberspace capabilities (e.g., hardware, software, and networks) are threats against the “economic activities and social interactions that depend upon cyberspace” (Module 2).These threats drive the need for cyber security, thus an information security

As we talk about security breaches, let’s look into what protects businesses from getting hacked. Network security is to help protected information, to create the possibilities that various information is not being breached or hacked by other users. The network security is to be concerned about employee information, visitors and customer information, as well as vouchers and data. The consequences of security being breached can be significant in

If the companies start considering employees as information security threat, the company will become more secure and efficient.

Safety of information is the most valuable asset in any organization particular those who provide financial service to others. Threats can come from a variety of sources such as human threats, natural disasters and technical threats. By identifying the potential threats to the network, security measure can be taken to combat these threats, eliminate them or reduce the likelihood and impact if they should occur.