Information Security Policy

Passwords should be designed to prevent them from being discovered by unauthorized persons. All passwords should have at least eight (8) characters. The user-IS should never be used as the password. Words in dictionary, derivates of user-IDs, and common character sequences such as “123456789” should not be employed.

An electronic system is usually password protected which ensures only specific staff can access the information.

* Review the results of a qualitative Business Impact Analysis (BIA) for a mock organization

When businesses provide computers for public use, several challenges are presented. In addition to allowing the general public this service, and ultimately growing their market share, a business must define the line between appropriate use and securing the network.

Company must also develop a clear structure for granting employees access to sensitive information. Not all employees need such data in order to fulfill their everyday job responsibilities. For those who need admission to sensitive information, a strong authentication mechanism must be developed, which cannot be bypassed. This will ensure that only authorized users are accessing compromising data.

The framework of security policy is defined to construct a structure by the help of which policy gaps can be identified in an easy manner. A system specific policy would assist to ensure that all employees and management comply with the policies. This is also used to maintain the confidentiality for user authentication would assist in the confidentiality aspect of security, maintain integrity (There are several limiting rules or constraints which are distinct in the relational data model and whose work is to maintain the data’s accuracy and maintain its integrity.), availability and authenticity of the system. Access controls are a collection of mechanisms that work together to create security architecture to protect the assets of an information system. One of the goals of access control is personal accountability, which is the mechanism that proves someone performed a computer activity at a specific point in time. So, the framework acts as the guideline

Physical security will involve the company securing its assets by devices such as alarm system for off hour use, and identification cards for employees. A process should be in place to make sure that guests are properly identified before gaining assess to the facility. Users cannot take computer home unless they are protected by encryption software. Downloading proprietary information onto floppies, CD, thumb/flash/memory drives and other portable media should be disallowed unless such transactions are pre-approved and proper security measures are taken.

In a business environment, controlling who has access to business information and at what level is critical for facilitating day-to-day business operations. There are three levels of information access: no access, read access, and read-write access. Use a business of your choice to answer the criteria for this assignment.

Restricting access to sensitive information plays a vital role in the success of any organization. Information is deemed sensitive when it needs protection from unauthorized access. Protecting this information is essential in safeguarding security and privacy of an organization. Thus, an organization such as Bank of America has taken measures geared towards protecting its sensitive information from unauthorized access. Just like other organizations, Bank of America has two types of sensitive information. The first type of sensitive information is personal information. This is data that may affect an individual if

Security risk analysis is performed periodically and when a change occurs in the practice or the technology.

There were a number of factors that contributed to the breach, which had they been addressed or had corresponding mitigation responses in place, would have reduced the likelihood that the breach would have taken place, or at a minimum reduce the impact of the attack. These items range from policy related issues, technology implementations, and security management and maintenance. Although I believe a number of these areas were in the process of being addressed, based on the information gathered regarding the details of the incident, it appears that it was still in many areas insufficient and would not have prevented an incident even if there had been more time available to perform the implementations.

Establishing an effective Information Technology Security Policy Framework is critical in the development of a comprehensive security program. The purpose of the Information Security Policy Framework is to insure your organization will be able to provide the minimum security level necessary to maintain confidentiality, integrity, and availability of the information it collects and uses.

In this case, Diane is facing an ethical dilemma in a professional setting where she can either follow the client’s request and sacrificing her professional judgment to get the contract from the client. On the other hand, she can follow what her professional judgment has told her and refuse to build the system at a lower security level. This dilemma is solely an ethical dilemma since Diane is choosing between monetary gain for herself and the security of the information of many people and critical data of the company. On the professional side, Diane has done proper assessment of the need of the company and the type of data that the system will hold. She has already deemed the information and data to be extremely sensitive and needs high security to protect it from being accessed by employees or attacked by hackers. She has also tried to explain to the CEO and the director of computing and director of personnel in the company about different options that correspond to the needs of the company and receive firm requests that the system should be built in a less secured structure than what she suggested. Another dilemma is that the company does not have the budget for the more highly secured option and has to opt for a less secure one. Taking all information into consideration. In order to make a decision, Diane should look into different decision making principle that particularly involves ethical decision making. In this case, we will evaluate

As the use of computers, databases, and technology in general, security has grown to be a powerful tool that has to be used. The threat of outside sources intruding and exploiting crucial information is a threat that is present on a daily basis. As a part of creating and implementing a security policy, a user must consider access control. Access Control is a security tool that is used to control who can use or gain access to the protected technology. Access control security includes two levels; logical and physical. Though database intrusions can happen at any moment, access control provides another security barrier that is needed.

The systems approach to problem solving is used to analyze and identify mediatory provisions, see figure 2, Appendix D, Systems Approach to Problem Solving. Loss suffered in the Societe Generale Bank security breach was substantial because the perpetrator knew where to look to acquire access to financial information and circumvent existing security measures. This defined fraudulent behavior and solidified criteria for productive countermeasures. Prevention and risk management must be addressed by establishing policies and procedures and enforced by management at all levels. In accordance with Societe Generale Bank security policy these recommendations are proposed