The Role of Information Security Policy Essay

As we all know people are where we see the biggest problems in security breaches and problems on any computer or network system. People need to understand what they are allowed and not allowed to do, this is where policies, procedures, and training come in to play.

Policies are documents within the work place put together, influenced by law, by the manager. The policy will be designed around an area of practice that needs to be evidenced as being in line with law. The document gives a list of procedures for carrying out the task required,

| The security controls for the information system should be documented in the security plan. The security controls implementation must align with the corporate objectives and information security architecture. The security architecture provides a resource to allocate security controls. The selected security controls for the IS must be defined and

When a security policy is developed, it should be well defined and the information in it should be clear and plainly understand and the objectives should be well defined so that there will be no confusion. Conversely, a data system with security policies is probably going to have an assortment of countermeasures that address a range of threats. Policies, standards, guidelines, and coaching materials that are known to be obsolete and not enforced could be dangerous to a corporation due to the data being outdated. As a result, management is basically drawn into thinking that security policies do exist within the organization when actually that is not the case. Counter measures which are outdated does not do an organization any good because without the appropriate patches in place, the organization’s network could have holes which would leave them extremely vulnerable. All organizations need to be compelled to actively

This policy establishes the guidelines that the organization follows. This would include an acceptable use policy, an authentication policy, and an incident response policy (“The IT Security Policy Guide”, n.d., pg. 6). This policy will reflect the entire organizations security posture, not just the IT department ideas. A strong policy will help employees understand what is expected of them, and explain to customers how their information is protected.

The purpose of this qualitative study is to identify the IT leaders who have successfully implemented security policies and procedures. Using the quantitative methodology would not be appropriate because the collected data will not be in the form of numbers and/or statistical results, and the statistical findings will not generalize the real-world problem that needs to be resolved. (Creswell, 2014). Quantitative methods are used mainly to find out the who, what, when and where and the results numerical descriptions provide where the researcher needs more of a detailed narrative (Sutton, & Austin, 2015)

Management defines information security policies to describe how the organization wants to protect its information assets. After policies are outlined, standards are defined to set the mandatory rules that will be used to implement the policies. Some policies can have multiple guidelines, which are recommendations as to how the policies can be implemented. Finally, information security management, administrators, and engineers create procedures from the standards and guidelines that follow the policies.

The organisation promotes effective confidentiality and security practice to its staff through policies, procedures and training.

The Department of Homeland IT security policy must be uniform, stable, consistent, efficient, effective and compatible with best practices Information Security in the Department. It is the purpose of this security policy to create and implement the best security plans, strategies, and practices throughout the Department. Also, it is the intention of this policy to create safe and secure Cyberspace.

Policies are important in the work place because they help make sure that all of the organisation’s information is held securely, along with other things. Policies are only internal and don’t effect anything outside of the organisation, however some policies may coincide with some laws or other general rules from outside of the organisation. In this case, policies are used to control the maintenance of computer systems. Policies are used to protect things such as sensitive information which could be used for things other than its intended purpose. Organisations usually make their employees sign an agreement to make sure that they abide by their policies. This helps protect the

To understand the role(s) of a Security Manager, a person must know what security is and what it means to an organization. According to Ortmeier, “security may be defined as a public or private service-related activity that provides personnel, equipment, and creates policies and procedures designed to prevent or reduce losses. These losses, caused by criminal action as well as by noncriminal events resulting from human error, emergencies, man-made and natural disasters, and business intelligence collection by competitors”. (2009).

The procedures can be established for the security program in general and for particular information systems, if needed. The organizational risk management strategy is a key factor in establishing policy and procedures.

This will be set up by the organisations themselves, this will set out the policies in which the staff must abide by in order to use the internet, most of the time, the policies will state that they must not use the company’s internet for personal use, and that they must use it wisely. Many measures such as passwords, authentication, firewalls and

The first challenge is in the user domain. We must train our employees to ensure they are aware of the security policies. Employees need to understand the policies and how it aligns with business goals and mission statement. Another challenge in this area is handling of sensitive information and non-public customer identifying information. In order to be compliant we must have a training program in place that is in line with the regulations.

A threat agent is the facilitator of an attack however; a threat is a constant danger to an asset.