Mod 1 Case Assingment

The purpose of this qualitative study is to identify the IT leaders who have successfully implemented security policies and procedures. Using the quantitative methodology would not be appropriate because the collected data will not be in the form of numbers and/or statistical results, and the statistical findings will not generalize the real-world problem that needs to be resolved. (Creswell, 2014). Quantitative methods are used mainly to find out the who, what, when and where and the results numerical descriptions provide where the researcher needs more of a detailed narrative (Sutton, & Austin, 2015)

It becomes in reality the enterprise security architecture, and it is central to the success of a strategic program of information security management within the organization.

Providing a comprehensive framework for ensuring the effectiveness of information security controls that support federal operations and assets.

In the final chapter of CompTIA Security + Study Guide eBook, it covers some great topics, key elements of implementation, support, and managing the security efforts in a company or organization. It’s important for IT Professionals to understand their role in a company/ organization. It’s also extremely important for them to understand the boundaries of security within that company/organization. Adopting best security practices while adhering to company policies will ensure that both parties are happy. There are many fines lines with security management.

A robust information security system with an exemplary scope of coverage is the ultimate goal

To form an information security policy framework to protect important information, an organization has to ensure the enforcement of certain rules and controls. These rules are enforced using policies, standards, procedures and guidelines. This framework protects this information as well the systems that process and store this information.

Security is all regarding management of risk and carrying out powerful counteracting techniques. One of the most critical concepts in security is that effective security is a mixture of people, method and technology. Basic concepts in network security, including recognition of common accountability and threats, moderation strategies. Application

As Chief Information Officer (CIO) of a small but growing firm, the organization is outgrowing the current architectural centralized telecommunication structure along with the computer networks. The task at hand is to protect the valuable information, but remain flexible enough for employees to perform their daily duties. The enhancements need to address security aspects such as remote data access, enterprise mobility, and internal communications such as email. When accommodating a growing organization, a distributed architecture is more in line with the needs of the future. Sueur, Deneubourg, & Petit (2012) stated, “Any decision made by an individual is influenced by the relationships he or she has with people in different circumstances” (p. e32566). By analyzing the organization 's telecommunication structure and computer networking security measures, we can evaluate the strengths and weakness of the centralized and distributed architecture and determine which will be the best approach for the growing organization.

In today’s world everything relies on technology. Technology has aided in making day to day life simpler, as well as keep us all connected. Organizations today continue to grow using all the newest technological advancements. The use of technology can help mold the foundation for which a company is able to grow from, but it can also be the very cause of the same company’s demise. It is for that reason, that an organization should take appropriate actions to protect its Information Systems (IS) against any vulnerability. An information system is made up of many parts with each having their own areas of weakness. The best practice is to understand how each area is vulnerable, and adjust the protocols to limit the damages that could occur.

There are two types of management approach to the IT security function in the organization. The first is the bottom-up approach. The implementation of the IT security audit is from the grass-root level, whereby, the systems administrator and technical officers are the one making the decision on how to improve the security systems. This is advantageous because they possess technical expertise to enable them to execute these IT security functions. However, even with the best technical expertise, IT security within an organization would still be vulnerable due to lack of participation support from top management and the users of these IT systems. Another management approach is the top-down approach.

There has been a long need for IS governance within organizations. Information security governance is important to organizations because they have a real need to change their views on IT functions and not just consider them to be solely technical issues. There are four value streams in the IT value chain that the IS role supports. Those four steams are as follows: the strategy to portfolio, the requirement to deploy, the request to fulfill and detect to correct. These four value streams are at the center of the service model. They work together and play a vital role then it comes to the support or the supply chain.

The accentuation in on an upkeep of the framework security and having the ability to modify because of strikes are consistently changing so the framework dependably needs to encounter diverse updates and distinctive methods to be set up for an attack. The people who are in charge of the framework security ought to be canny and one phase before each other individual remembering the ultimate objective to be set up to shield against any ambushes. The organization of framework security is correspondingly as vital as anything since it offers legitimacy to the system and business that they are ensured to use.

Information Security deals with the Confidentiality, Integrity and Availability of organizational data to facilitate business decisions. Information Security breaches inflict significant monetary and reputational damage to organizations. Thus, ensuring business information security becomes a matter of great importance at the board level. Therefore organizations must view Information security from a governance perspective.

Some of our biggest challenges come with keeping information secure in the business world. Auburn University researchers teamed up with the International Information Systems Security Certificate Consortium to identify and rank the top information and security issues. Using a worldwide sample of 874 certified information system security specialists, they ranked a list of top 25 information security issues based on which ones were most critical facing organizations today. These 25 issues were: 1.) Top management support 2.) User awareness training and education 3.) Malware 4.) Patch management 5.) Vulnerability and risk management 6.) Policy related issues 7.) Organizational culture 8.) Access control and identity management 9.) Internal threats 10.) Business continuity and disaster preparation 11.) Low funding and inadequate budgets 12.) Protection of privileged information 13.) Network security architecture 14.) Security training for IT staff 15.) Justifying security expenditures 16.) Inherent insecurity of networks and information systems 17.) Governance 18.) Legal and regulatory issues 19.) External connectivity

Non conformance implies high vulnerability, high security risk on information security asset. To minimise security risk to an acceptable level effective Security mechanism, security standard, change management, management obligations, awareness, technical skills and training in addition to integration and enforcement of security and privacy legislation and adequate budget for security infrastructures are combined recipes of good information security assurance (Alfawaz el al., 2008).