Implementing Effective Policies For Governing The Network

To reduce malicious code, SMC will restrict staff from certain networking sites (Hawkins, 2013a). Additionally, SMC will govern policies that discourage downloading files from the Internet and using personal computer information. Another serious threat is the malicious insider. This can be a disgruntled employee or a recently fired employee who still has access to the network system. Prompt removal of privileges is necessary to avoid issues created by terminated malicious insiders. Separation of privileges is a common security tool that helps decrease vulnerability. If one person can alter pay rate and hours worked, another person must review and approve a report before the changes take

1. Using least privilege can help protect your data and intellectual property. This the concept of giving users the minimum permissions to perform a task. This can restrict access to certain applications. Sales would not have the same access as the technical services team. Only administrators will have unlimited privileges. Administrator level access should be limited to only 2 users (What Is Principle of Least Privilege (POLP)? Definition from WhatIs.com).

Formal user access control procedures must be documented, implemented and kept up to date for each application and information system to ensure authorised user access and to prevent unauthorised access. They must cover all stages of the lifecycle of user access, from the initial registration of new users to the final de-registration of users who no longer require access. These must be agreed by IDI. User access rights must be reviewed at regular intervals to ensure that the appropriate rights are still allocated. System administration accounts must only be provided to users that are required to perform system administration tasks.

Users can be the main risk to an organization. A disgruntled employee can access the server and open it up to all types of security issues or install malware or virus’. User access to the server should be limited to users that need admin level and closely monitored. Admin accounts should never be used for day-to-day activities as this could lead to username/passwords being stolen more easily providing access to others from the outside. When an employee leaves their admin and general use accounts should be turned off immediately. If an employee is to be terminated with cause, theses accounts should be disabled prior to the termination discussion. Users risk are medium impact and highly controllable with policy and procedures.

One should never run with administrator or root privileges regardless of the operating system platform. If a hacker manages to get in, he or she will still need to find ways to perform privilege escalation to cause more harm. Hopefully, this buys enough time for security professionals within the company to notice abnormal behavior and take action.

Individual users play an important role in any form of institution or organization but concerns are raised about the security. The network administrators clearly lay down a set of rules, regulations and protocols that an individual user has to agree accordingly upon which part of the resources and what class of service that the user can obtain.

There are no policies governing the TKU network except for one policy relating to printing reports and that policy is routinely ignored. Without policies to guide the users and administrators of the system it is impossible to discourage unwanted behaviors such as users routinely sharing network credentials. Additionally, the administrators have been inconsistently managing the network due to differences in knowledge, training, and requirements that can only be addressed with direct guidance in the form of policies.

Security shall be a high priority requirement. Since this system is intended for a wide range of users, it shall be user-friendly, requiring limited training and assistance.

This can save an administrator from the tedious job of defining permissions per user. Users are limited to the available resources their role allows.

The controls listed in this section are selected from the National Institute of Standards and Technology (NIST) Special Publication 800-53 revision 4. These four controls will be used to improve the security posture of TKU and will enhance the security requirements listed in prior

The framework of security policy is defined to construct a structure by the help of which policy gaps can be identified in an easy manner. A system specific policy would assist to ensure that all employees and management comply with the policies. This is also used to maintain the confidentiality for user authentication would assist in the confidentiality aspect of security, maintain integrity (There are several limiting rules or constraints which are distinct in the relational data model and whose work is to maintain the data’s accuracy and maintain its integrity.), availability and authenticity of the system. Access controls are a collection of mechanisms that work together to create security architecture to protect the assets of an information system. One of the goals of access control is personal accountability, which is the mechanism that proves someone performed a computer activity at a specific point in time. So, the framework acts as the guideline

This will be set up by the organisations themselves, this will set out the policies in which the staff must abide by in order to use the internet, most of the time, the policies will state that they must not use the company’s internet for personal use, and that they must use it wisely. Many measures such as passwords, authentication, firewalls and

Produce a report that justifies the need for network managers to undertake routine performance management activities. Please ensure that your justification for these activities relates to reasons of efficiency and how they affect the quality of the service provided.

Users accounts should be limited and not granted excessive authorizations especially ability to access to administrative functions such as read and/or write source code and source code trees.

Tk Video Services has been able to identify key areas that may propose some dangerous risk for the company. One of the risks has to do with the staff, they are in charge of the daily use of digital information. This information contains sensitive information and therefore it shall not be left out in the open for all to see at will. Some members of the staff have been using their personal unauthorized devices on the networks, this creates problems for the IT department due to the fact it the hardest problem to track; therefor the company has to find or create ways to stop the problems. One way to achieve the intended goals is to provide some basic training and review of the company values. Secondly there has to be some tough sanctions if there is a policy violation the employee must know and understand this risk is not acceptable and this behavior is going to change immediately. Another vulnerability the company faces has to do with the security training, the company should properly train the employees the old as well as the new and provide proper ways to secure the important information that is being used, this protocol must be implemented and carried out on a regularly basis, the training will cover the workforce do’s and don’ts of the office computer usages, it will cover the handling and storage of digital information, it will over the approved software that has or will be installed on all of the machines in the office. Then there will be discussions on why we are