Recommending a COBIT-Based IT Security Framework for a Midsize Organization

* Align IT security policies throughout the 7 domains of a typical IT infrastructure as part of a layered security strategy

This policy provides a framework for the management of information security throughout Cañar Networking organization. It applies to:

Ideally however, a business monarchy would be established, clearly defined security policies would be put in place along with information security education, training and awareness to every employee in the organization and some investment would be made in the IT structure whereby the server might be accessible at the organization itself as well as in the Finance Commission’s offices. Lastly, another alternative would be to establish IT governance within the organization and give invest in education, training and awareness of information security to all employees involved with the organization whether directly or indirectly.

In order to properly secure the Information Technology (IT) infrastructure today, there are many different areas that need to be addressed. Each of these areas pose different vulnerabilities and challenges to properly securing an IT environment. By identifying these vulnerabilities, applying controls to address them, and designing a robust security plan the IT infrastructure at WD Enterprises will be more secure and provide better protection against these threats. This plan along with design and application of a code of ethics related to the IT profession, will ensure the staff is held accountable to the standards and objectives of the organization. To accomplish these goals, a review of the organization’s vulnerabilities will be performed followed by suggestions and discussions of the security models that can be used to overcome these risks. Following that, a security plan will be designed along with a code of ethics. These will become the blueprint for securing the IT infrastructure at WD Enterprises.

Information Security Policies are a very important part of a company’s protection; these policies are put in place to protect the company and well as the clients. It is important to maintain a constant watch over all security departments daily to ensure that everything is in working order. The policy below is a great way to keep track of the steps needed to protect your company and clients.

All organizations should have an effective IT security policy framework to creating a security program to meet the needs of the organization to protect information and their information systems. There are many security frameworks that can be used to design an IT security program such as NIST and COBIT being a few. It is very important to establishing compliance of IT security controls with U.S. laws and regulation. The organization can align the policies and controls with the regulations. There are seven domain in the framework and each have their own challenges. There are issues and challenges with implementing a security policy framework and ways to overcome these problems.

Every business needs a security policy that provides authentication, access control, secrecy, data integrity, and audit. (Schneider, 2009) Authentication will determine who is trying to access the information system. Access control determines who is allowed to log on and access information. Secrecy determines who is permitted to access certain information. Data integrity determines who is allowed to change data. And, audit determines who or what causes specific actions to occur and when.

The purpose of this policy is to define the measures that need to be in place when managing any risk related to a company’s information systems. In addition, this policy will identify the criteria under which

One way to develop a strong security policy is to hire a security analyst who is in charge of overseeing every aspect of the company’s security. The security analyst will help design, implement, and update security policies and procedures, as well as ensure that these policies and procedures are being followed. This is a crucial position as it is the first line of defense in protecting a business’s most important asset; its data. Any loss of data can be catastrophic leading to a ripple effect that will impact the business negatively.

Establishing an effective Information Technology Security Policy Framework is critical in the development of a comprehensive security program. The purpose of the Information Security Policy Framework is to insure your organization will be able to provide the minimum security level necessary to maintain confidentiality, integrity, and availability of the information it collects and uses.

In this paper, Berber et al discusses ways of formalizing information security requirements. They noted that risk analysis and the concentration on threats, vulnerability and assets are the most effective means of protecting all IT resources.

In order to effectively implement security governance, the Corporate Governance Task Force (CGTF) recommends that organizations follow an established framework, such as the IDEAL framework from the Carnegie Mellon University Software Engineering Institute. This framework, which is described in the document “Information Security Governance: Call to Action,” defines the responsibilities of (1) the board of directors or trustees, (2) the senior organizational executive (i.e., CEO), (3) executive team members, (4) senior managers, and (5) all employees and users. This important document can be found at the Information Systems Audit and Control Association (ISACA) Web site at www.isaca.org/ContentManagement/ContentDisplay.cfm?ContentID=34997.

The organisation needs to update their security policies as this is vital. The security features evolve with the IT technology that is used in the organisation. These policies should be reviewed regularly by the head of IT security. To get new security procedures, they can compare their procedure with other company’s and this might give them ideas of new procedures.

Both of this framework and plan clearly show how cyber security insurance can be considered as the method to help reduce and maintain the level of security attacks among IT practitioners. It is palpable that the decision plan of action in issuing insurance policies involves a systematic process of assessment and evaluation that can help in improving the quality of cyber security. Meanwhile, Bohme & Swartz

ISACA was established in 1967, by specific commercial ventures operating in the field of frameworks. At that point, in 1969 they were fused as Electronic Data Processing (EDP) Auditors Affiliation. Parts of ISACA cooperated to create and make best practices , and COBIT system is one of their wok. The primary adaptation of this framework was discharged in 1996 and was called "Control Objectives for Information and related Technology",covering the range of review [12]. The second version with upgrades on control evaluation was discharged in 1998 . The third release was discharged after two years, and as indicated by [12] "The huge change accompanied the distribution of COBIT Third Edition, with its business objective introduction. At this point, COBIT was termed as an IT administration skeleton. The third release recognized that an association needs IT for data handling, as well as to accomplish business destinations". In 2005 ISACA presented another , fourth form of COBIT with a reasonable concentrate on IT legislation [14]. A further form of this structure is COBIT 4.1 , discharged in 2007, tolerating the by and large utilized schemas, for example, "IT Infrastructure Library (ITIL)", "ISO 27000 arrangement" and "Ability Maturity Model® Integration (CMMI)" [5], [15]. The current rendition of the structure, COBIT 5, was discharged in 2012. It is based upon the past rendition of the schema and two integral skeletons from ISACA (Val IT and Risk IT); and