Information Assurance Is Means Of Defending And Protecting Information Systems

In order to ensure that all information manipulated through an IT system is safe and reliable we use some type of information guarantee. Information Assurance manages the risks that can be posed during the transfer and storage of data. It protects the legitimacy and privacy of all data within the IT system. It seems as though information assurance plays with that fine line between security and constancy trying to find a balance of both.

An effective information security program should include, periodic assessments of risk, including the magnitude of harm that could result from the unauthorized access, use, disclosure, disruption, modification, or destruction of information and information systems that support the operations and assets of the organization. Policies and procedures should be based on risk assessments, cost effective reduced information security risk, and it should ensure that the information security is addressed throughout the entire life cycle of each and every organizational information system. Subordinate plans for providing sufficient information security for groups of the information system, facilities, networks, or information systems.

Information assurance seeks to secure this information from unauthorized access or use. With our ever advancing technological environment, business are struggling to protect themselves and the information that customers have entrusted to them with occasional mis-steps serving as reminders that one can never be too careful.

Limitations of Research: Considering all the studies this paper also has limitations. Since Information security management is prominently growing area, the guidelines maybe unstable and quick changes can happen. However the loss can be overcome if the organization maintains its security policies in clear and update them timely.

After the information system is installed, the IS security controls must be monitored and assessed on a continuous basis. Continuous monitoring ensures the security controls in place are effective. In this step, there are five tasks. The first task requires managers to determine the security impact based on the threat environment. The second task is conducting assessments on certain security controls as outlined in their Continuous Monitoring Strategy. The third task is correcting discrepancies found in the assessment. The fourth task requires updating the Security Authorization package based on the previous results. The fifth task requires the appropriate officials to make a risk determination and acceptance by reviewing the reported security

As an information security professional my goal is to ease fears of the unknown and provide assurance that confidentiality, integrity, and availability lessens risks that counter continuity. With insight and confidence I will serve as a guide for the speediest acceptable recovery from disasters when they occur. This is my purpose for pursuing the Master of Science in Information Assurance at Davenport University. As is evident with the College of Technology Faculty, my mission is one of achieving expertise and continually questing for knowledge in the complex and evolving world that is informatics security.

At this time the measures available to ensure information security include organizational controls such as limiting access to data, firewalls, antivirus systems, encryption, and application controls. When the security of the business fails and the private information of individuals is compromised the company faces many legal actions that can

All compromises or potential compromises must be immediately reported to the Information Technology department. Network administrators are responsible for acting as local information systems security coordinators. These individuals are responsible for establishing appropriate access privileges, monitoring access control logs, and performing similar security actions for the systems they administer. They also are responsible for reporting all suspicious computer and network-security-related activities to the Manager of IT Networks and Support. Network administrators also implement the requirements of this and other information systems security policies, standards, guidelines, and

Initially we should start with identifying and defining the four security components to ensure we have a clear understanding of what they are and how to implement them. The components of information security are Confidentiality, Integrity, and availability also known as the CIA triad. Confidentiality in Information Security is defined as the protection of information from disclosure to unauthorized parties (Chia, 2012). Integrity in Information Security is defined as protecting data from being modified by those not authorized to do so. Authentication is defined as proof that the individual requesting access is who they say they are. Non-repudiation is an assurance that someone cannot deny something, in information security this might be completed

Information security involves the protection of information regardless of whether it is in digital form, being stored on computers, or in transit over a network. It is a set of strategies for managing the processes, tools, and policies necessary to prevent and detect threats to

Defense-in-depth is a commonly cited best practices strategy for achieving Information Assurance. It is an approach to security that layers controls thus increasing security for the system as a whole (United States National Security Agency, n.d.). Security controls derive from three primary categories: Administrative, Technical/Logical, and Physical/Environmental (Harris & Kumar, 2013, p. 28). To help mature and improve information security as a process and business enabler, it is critical that organizations adapt their understanding and cogency of administrative controls. The information security market is flooded with technical solutions that fit into technical/logical control categories. As more businesses move to the Cloud, physical and environmental controls are relegated to third-parties. To achieve true Defense-in-Depth, businesses must further develop their Administrative controls and efforts. This enables the business to understand the value of security, and enables security to align with business strategy (Cano M., Ph.D, CFE, 2014, p. 51-55). This paper will examine the importance of administrative information security controls and the role they play in Defense-in-Depth strategies by discussing the maturity of security programs, discovery of security program foundations, frameworks, and process, enterprise security architecture, and the governance of information security strategies.

There are some procedures that Organization should follow to protect and maintain the security and integrity of its information systems which include infrastructure and software design, information processing, storage, transmission, retrieval and disposal.

The ISM guides departments in how to ensure their information is secure. The ISM states that “Information is a continual process, one that extends beyond ensuring that s system is secure at the time of deployment (Department of Defence- Intelligence and Security, 2015).” It includes managing, detecting and reporting cyber security threats and well as information on other types of security relevant to the organisation. In relation to physical security it states best practise, this includes “limiting access to facilities, servers, network devices, ICT equipment and media to authorised personnel only by applying appropriate physical security controls (Department of Defence- Intelligence and Security, 2015).”

Technology has grown tremendously over the past few decades. Everyday businesses, governments, and everyday people rely on technology for things from banking to communicating with loved ones and business associates. Disrupting this technology can cause major losses monetarily and in the sense of information. According to Information Security Curriculum Creation: A Case Study, “A survey of undergraduate degree programs in Computer Science, Information Technology, Management Information Science, and others show a lack of emphasis on security issues in their curriculum.” There is a strong need to secure and protect information for many, many reasons and as such it is important that an undergraduate curriculum provides a comprehensive approach to teaching information security concepts to its students.

Designing a working plan for securing the organization s information assets begins by creating or validating an existing security blueprint for the implementation of needed security controls to protect the information assets.  A framework is the outline from which a more detailed blueprint evolves.  The blueprint is the basis for the design, selection, and implementation of all subsequent security policies, education and training programs, and technologies.  The blueprint provides scaleable, upgradeable, and comprehensive security for the coming years.  The blueprint is used to plan the tasks to be accomplished and the order in which