Infrastructure Protection Memo

* Set up training program for all employees on network security policies and any new changes to network security.

The departments of a company that are holding personal information are required to have adequate security measures in place. Those include technical measures (such as firewalls) and organisational measures (such as staff training).

Company must also develop a clear structure for granting employees access to sensitive information. Not all employees need such data in order to fulfill their everyday job responsibilities. For those who need admission to sensitive information, a strong authentication mechanism must be developed, which cannot be bypassed. This will ensure that only authorized users are accessing compromising data.

Among one of the missions of The U.S. Department of Homeland Security is to protect and preserve the security of the Cyberspace in the country. The principal objective of this Security Plan is to give instructions and direction for the Department’s workers and help the Homeland Security to create best practices and strategies in the IT security system.

As such, our company’s people resources pose the greatest risk for security breach. Our way to help mitigate risk in this area is to keep communication lines open in this area and to continually mandate security knowledge training, with mandatory updates on a regular basis. When the employees are informed of company policy when facing a security matter, they are better equipped to act in the best or right way. In this way knowledge is power – or at least empowerment to act in the best interest of the company’s information security.

This Enterprise Security Plan (ESP) for Riordan Manufacturing employees the levels of security required to protect the network and resources utilized to communicate. It is intended purpose is to formulate a means to counterattack against security risk from potential threat. The ESP servers as a way to identify risks and to ensure a contingency plan is in place to protect the availability, integrity, and confidentiality of the Riordan organization's information technology (IT) system. The ESP benefits all employees however it is most beneficial to information resource managers, computer security officials, and administrators as it is a good tool to use for establishing

12, 2014. Based on the EO, the Cybersecurity Framework must include a set of standards, methodologies, procedures, and processes that align policy, business, and technological approaches to address cyber risks. It must provide a prioritized, flexible, repeatable, performance-based, and cost-effective approach, including information security measures and controls, to help owners and operators of critical infrastructure identify, assess, and manage cyber risk. The EO will create processes which identify areas for improvement to be addressed through future collaboration with particular sectors and standards-developing organizations. Lastly, the EO must be consistent with voluntary international

The following Multi-Layered Security Plan outline I am submitting for approval and implementation for Richman Investments, will provide a sound security plan for the firms most important mission critical assets, identifying and reducing vulnerabilities, Risks and threats to the firms confidential proprietary intelligence, sensitive customer data and other important assets within each of the Seven Domains that

Provision of services can be disrupted in the event of systems failure, compromised security or other advanced technologies. However, the result in downtime and resources can be minimized following a disaster recovery plan (DRP), effective immediately. To achieve this, policies and procedures must be formally established and reviewed periodically, beginning with the current ‘binder(s)’. The recent compromise, exposed the company to great risk, and furthermore, exploited existing vulnerabilities. Nevertheless, it is recommended, all current documentation be given an update of “no less than once every three years” (GFOA 2010, p. 1). A team or committee should be assembled in the case of emergency. In this manner, iPremier will be able to effectively engage in response to unforeseen circumstances. It is clear no formal communications were established much less responsibility were properly assigned while an attack was underway. The GFOA (2010) suggests as a minimum requirement, a (DRP) should outline the responsibilities of team members who are current and in contact. Ross (2010) agrees with this practice, suggesting the existence of (DRP)’s have proper trained staff with specified roles for emergencies.

Ideally however, a business monarchy would be established, clearly defined security policies would be put in place along with information security education, training and awareness to every employee in the organization and some investment would be made in the IT structure whereby the server might be accessible at the organization itself as well as in the Finance Commission’s offices. Lastly, another alternative would be to establish IT governance within the organization and give invest in education, training and awareness of information security to all employees involved with the organization whether directly or indirectly.

The risks that face an organization are going to always be present. However, an incident response plan outlines procedures for handling security incidents that occur within the organization and for correcting and documenting the security issue in a timely manner. The incident response team is trained to effectively implement the incident response plan. By containing an attack, and limiting the amount of time that an attack is allowed to continue, further risks to the organization can be mitigated.

When taking a look deep into an organization’s different departmental operation, it becomes clear how to plan to protect the most data and also which areas is more operation critical. While preventing interruption is the most important aspect of this plan, no one can predict the weather or any other attack. As part of the steps to implement the business continuity plan, Sunshine Machine Works will need to document a risk management plan, business impact analysis, incident response plan, plan activation, incident response team, communications, contact list and recovery plan section. Once all has been documented, the organization will need to test, evaluate and update schedule.

Tk Video Services has been able to identify key areas that may propose some dangerous risk for the company. One of the risks has to do with the staff, they are in charge of the daily use of digital information. This information contains sensitive information and therefore it shall not be left out in the open for all to see at will. Some members of the staff have been using their personal unauthorized devices on the networks, this creates problems for the IT department due to the fact it the hardest problem to track; therefor the company has to find or create ways to stop the problems. One way to achieve the intended goals is to provide some basic training and review of the company values. Secondly there has to be some tough sanctions if there is a policy violation the employee must know and understand this risk is not acceptable and this behavior is going to change immediately. Another vulnerability the company faces has to do with the security training, the company should properly train the employees the old as well as the new and provide proper ways to secure the important information that is being used, this protocol must be implemented and carried out on a regularly basis, the training will cover the workforce do’s and don’ts of the office computer usages, it will cover the handling and storage of digital information, it will over the approved software that has or will be installed on all of the machines in the office. Then there will be discussions on why we are

Designing a working plan for securing the organization s information assets begins by creating or validating an existing security blueprint for the implementation of needed security controls to protect the information assets.  A framework is the outline from which a more detailed blueprint evolves.  The blueprint is the basis for the design, selection, and implementation of all subsequent security policies, education and training programs, and technologies.  The blueprint provides scaleable, upgradeable, and comprehensive security for the coming years.  The blueprint is used to plan the tasks to be accomplished and the order in which

In today’s information technology age, many organizations are facing the security attacks. These kinds of attacks occur to two different forms which can be classified as external attacks and internal attacks. Organizations can mitigate the external attacks of implementing firewall, anti-virus and other defense perimeters but internal attacks are even hard to identify. Internal attacks take place in terms of employees negligence in their work performance, theft and stealing the organizational assets and selling to competitors, script kiddies, eaves dropping and spying other employees, etc. Even latest technologies are not being able to identify and detect those types of attacks. Therefore organizations have to implement security education, awareness and training program to educate the internal employees to minimize the risk of insider attacks. This paper further discuss about how security education, training and awareness program helps to mitigate the insider attacks and why it is important to organization.