Unit 3 Assignment 1: Protecting Customer Information

During SDLC phase one, the initiation phase, “the need for a system is expressed and the purpose of the system is documented” (NIST, 2008). Some of the expected outcomes from this phase would be a project plan and schedule; system performance specifications outlining the operational requirements, system design documents, and a document that defines roles and responsibilities. The corresponding RMF step, security categorization, establishes the foundation for security standardization among information systems and provides a vital step towards integrating security into the information system (NIST, 2008). During this step, the type(s) of information processed by the information system are identified and the information system is categorized to determine the level of protection requirements to put in place. Some of the expected outputs of this step include a security project plan and schedule, documented system boundary, the system categorization, and the security roles and responsibilities. These two process steps are very similar except the focus of RMF is on information security related functions. In some cases, SDLC produces the expected outputs that RMF requires, and the security professionals only require a copy of the documentation for their records. For example, the system design document often depicts the system boundary. The reason this step is so critical is that it

Formal user access control procedures must be documented, implemented and kept up to date for each application and information system to ensure authorised user access and to prevent unauthorised access. They must cover all stages of the lifecycle of user access, from the initial registration of new users to the final de-registration of users who no longer require access. These must be agreed by IDI. User access rights must be reviewed at regular intervals to ensure that the appropriate rights are still allocated. System administration accounts must only be provided to users that are required to perform system administration tasks.

Security shall be a high priority requirement. Since this system is intended for a wide range of users, it shall be user-friendly, requiring limited training and assistance.

Sunica Music and Movies, a local multimedia chain with four locations would like to switch to a centralized network to handle accounting and inventory as well as starting an Internet-based commerce site. The security policy overview shows the new setup will utilize four types of security policies. These polices have set goals that must be meet in order to achieve and maintain a successful transition.

Without understanding the what to achieve, there is no way to provide a strong operational concept to produce the result. As for the security control part (RMF), the most critical part is to categorize the system information. Categorize what is important, set priority, and use security controls to measure each user, or system that should or should not be accessing. Overall, security engineers provide a framework that includes both SDLC and RMF to be together, otherwise, the system will fall

This area of the Security Policy articulation presented is a report that all in all make up the Security Policy that administers the activities of the Campbell Computer Consulting and Technology Company. The security strategy covers the accompanying:

An Information Security Policy provides directive and doctrine of a framework for best practice within an organization. This security policy includes inventory and management of all security assets both physically and virtually, enumerates clearly the roles and responsibility, accountability and governance. Moreover, the security policy also includes substantive enforcement methods as well as regular vulnerability and risk assessments, change and configuration management, traffic and event logging, periodic internal and annual external audit provisions. In the meantime stating detail operational security process and procedure for all to follow. Most importantly, the senior leadership of Secured Inc. made it achievable, enforceable, and minimizes risk; maximize security by endorsing this security policy.

In most small-to-mid sized organizations, the system administrator is the first level contact for end-users for computer & network support. In addition to monitoring the network & data security, System Administrators should assume the responsibility of educating their end-users on security best practices. After all, end-users

Many times, disaster recovery planning fails to consider how diverse regulations and compliance issues will impact an organization after a natural disaster strikes (Talon, 2006). For instance, organizations regulated by the Health Insurance Portability and Accountability Act of 1996 (HIPAA), will discover that disaster recovery planning can be a complex web of potential pitfalls.

Every business needs a security policy that provides authentication, access control, secrecy, data integrity, and audit. (Schneider, 2009) Authentication will determine who is trying to access the information system. Access control determines who is allowed to log on and access information. Secrecy determines who is permitted to access certain information. Data integrity determines who is allowed to change data. And, audit determines who or what causes specific actions to occur and when.

Access control obliges what a client can do straightforwardly, and in addition what projects executing for the clients are permitted to do. Thus get to control tries to anticipate action that could prompt a break of security. This article clarifies access control and its relationship to other security administrations, for example, validation, reviewing, and organization. It then audits the entrance framework demonstrate and portrays diverse ways to deal with actualizing the entrance network in functional frameworks, and takes after with a talk of access control arrangements regularly found in current frameworks, and a brief thought of access control organization.

The purpose of this policy is to define the measures that need to be in place when managing any risk related to a company’s information systems. In addition, this policy will identify the criteria under which

The critical factor of network development is security planning. Without doing a full hazard appraisal, it is unrealistic to get ready for security. This security arranging includes creating security policies and executing controls to keep PC dangers from getting to be reality.

What 's more, this guide gives data on the choice of savvy security controls. These controls can be utilized to alleviate risk for the better assurance of mission-basic data and the IT frameworks that procedure, store, and convey this data.

Logical safety includes the security of the systems an administrator is responsible for. This type of safety consideration includes well-defined access control policies, periodic review of access, and the secure configuration of workstations and servers. When a system administrator ensures these types of controls are in place, the safety and security of company systems has a reasonable level of assurance. In addition, there are actual physical safety measures that must be considered (Frisch, 1995).