Assignment 1: A List Of Key Security Controls

This starts with five crucial risk management practices: protection, detection, prevention, reaction and documentation. Along with the risk management practices, the company should also implement good physical security measures. They include firewalls, user authentications- like strong passwords and user names, software protections like security suites, backups, Intrusion detection and automated constant system integrity

Another step involves security checks upon implementation and describes agency-level threat to the business scenario or the mission. It similarly entails sanctioning the information system for processing and lastly constant monitoring of the security controls. FISMA and NIST's standards are aimed at offering the ways for agencies to achieve their identified missions with safety commensurate with the threat (United States Department of Agriculture, 2015). Together with guidelines from the Office of Management and Budget (OMB), FISMA and NIST create a framework for advancing and growing an information security scheme (SecureIT, 2008). Such framework includes control descriptions and evaluation, program development, and system certification and accreditation. The final objective involves conducting daily functioning of the agency and achieving the agency's articulated objectives with sufficient security commensurate with risk.

According to Whitman and Mattord (2010), The ISO 27000 series is one of the most widely referenced security models. Referencing ISO/IEC 27002 (17799:2005), the major process steps include: risk assessment and treatment, security policy, organization of information security, asset management, human resources security, physical and environmental security, communications and operations management, access control, information systems acquisition, development, and maintenance, information security incident management, business continuity management, and compliance

In order to diminish both security and privacy risks to organizations, measures need to be taken to combat risks throughout the various stages of the threat’s life cycle. Specific processes must be implemented to identify threats, procedures to follow when the attack occurs, and finally methods to recover from the attack (Houlding, 2011).

Within this security profile three controls and two family controls were selected to be enforced in order to explore the security awareness and the training being done that can be used as counter measures against any cyber security threats that may pose a problem to the network. The three controls that are being examined within management, technical, and operational families will be based on the needs of the VA and how best to implement them.

Before I plan for security, I will ensure that the suitable officials are assigned to security responsibilities, continue reviewing the security system controls in their information systems, and authorize the system processing before the operations. These management responsibilities are believed to have responsible agency officials that understand the risks and other factors that could affect the mission. Additionally, these officials must also understand the current status position of their security program and the security controls that protect their information and the information systems that makes investments that mitigate the risk to an acceptable level. The objective is to conduct a day-to-day operation and to accomplish missions with adequate security, including the increase of harm resulting from unauthorized access, modification, disruption, usage, or disclosure of information. The key element of FISMA Implementation Project, NIST developed a Risk Management Framework which will bring all of the FISMA related guidance and security standards to promote developmental comprehension and balance information security programs by different agencies.

12, 2014. Based on the EO, the Cybersecurity Framework must include a set of standards, methodologies, procedures, and processes that align policy, business, and technological approaches to address cyber risks. It must provide a prioritized, flexible, repeatable, performance-based, and cost-effective approach, including information security measures and controls, to help owners and operators of critical infrastructure identify, assess, and manage cyber risk. The EO will create processes which identify areas for improvement to be addressed through future collaboration with particular sectors and standards-developing organizations. Lastly, the EO must be consistent with voluntary international

Threat modeling is the process of optimizing an organizations’ security of their network by finding vulnerabilities in that system, and then deploying countermeasures to protect against those threats should they happen in the future. If a company wants to know what vulnerabilities they may have then threat modeling is an excellent way of determining these threats. An individual threat is when an event occurs that has a negative impact on an organization’s daily operations. (Rouse, 2006). These negative impacts can manifest themselves in many ways from damaging the reputation of that organization to interrupting the functions of that organization. These threats can be in the form of destruction or stealing sensitive data, cracking of weak passwords, malware, phishing, or other scams and frauds. The goal of this paper is to address how the organizations code of ethics and security policies apply, what specific security policies can be deployed, and to identify the impact of asset security standards and governance. I chose Northrop Grumman as the focus of my paper

The third phase of our risk analysis involves implementing the security controls. Security controls are essentially

This policy is guided by the ISO/IEC 27002:2013 Information technology - Security techniques -Code of practice for information security controls and sets out our requirements for effectively managing information security in a risk based manner.

Securing an IT environment properly can be broken down into three basic questions. The first question to address is what assets within the organization need protection? After these assets have been identified, it is important to ask in what are they threatened? Finally, the question of what needs to be done to counteract these threats (Stallings & Brown, 2012)? By answering these questions, it is

Conducting a risk analysis is an integral part of providing security management for an organisation,

Risk management is the term applied to a logical and systematic method of establishing the context, identifying, analyzing, evaluating, treating, monitoring and communicating risks associated with any activity, function or process in a way that will enable organizations to minimize losses and maximize opportunities. (Lecture notes)Risk Management is also described as 'all the things you need to do to make the future sufficiently certain'. (The NZ Society for Risk Management, 2001)

Good security management requires risk management to mitigate or reduce risk to an acceptable level within an organization. Security management’s objective is to protect the company and its assets. A proper risk analysis will identify the company’s major assets, threats that put those assets at risk, and estimate the possible damage and loss a company may endure if any of the threats were to become real. With a good risk analysis, management can determine the type of budget they want to set to mitigate threats. Risk analysis justifies the cost of the countermeasures against the threats and determines the benefit or worth of security

In order to effectively implement security governance, the Corporate Governance Task Force (CGTF) recommends that organizations follow an established framework, such as the IDEAL framework from the Carnegie Mellon University Software Engineering Institute. This framework, which is described in the document “Information Security Governance: Call to Action,” defines the responsibilities of (1) the board of directors or trustees, (2) the senior organizational executive (i.e., CEO), (3) executive team members, (4) senior managers, and (5) all employees and users. This important document can be found at the Information Systems Audit and Control Association (ISACA) Web site at www.isaca.org/ContentManagement/ContentDisplay.cfm?ContentID=34997.