SEC 402 Developing the Corporate Strategy for Information Security

Strayer SEC 402 Cyber Security, Assignment 1, Developing the Corporate Strategy for Information Security, 7 pages, 1511 words, Graded A. Cybersecurity: The essential body of knowledge
Imagine that you are working for a startup technology organization that has had overnight success. The organization’s immediate growth requires for it to formulate a corporate strategy for information security. You have been recruited to serve as part of a team that will develop this strategy.
As part of the Information Security Strategy development, you are required to define specific Information Technology Security roles that will optimize and secure the organization’s data assets.
Review the following Website titled, “Information Technology (IT) Security Essential Body of Knowledge (EBK): A Competency and Functional Frame-work for IT Security Workforce Development”, located at, for additional information necessary to complete this assignment.
Write a five to seven page paper in which you:
1. The Chief Information Security Officer (CISO) is responsible for several functions within an organization.
a. Examine three specific functions a CISO and provide examples of when a CISO would execute these functions within the organization.
b. Specify at least three competencies that the CISO could perform using the provided Website titled, “Information Technology (IT) Security Essential Body of Knowledge (EBK): A Competency and Functional Frame-work for IT Security Workforce Development.”
2. The Chief Information Officer (CIO) is responsible for several accountability functions within an organization:
a. Identify at least four functions of the CIO using the EBK as a guide. Provide examples of how the CIO would execute these functions within an organization.
b. Classify at least two security assurances that could be achieved by the CIO developing a formal security awareness, training, and educational program.
c. Suggest methods, processes, or technologies that can be used by the CIO to certify the security functions and data assets of an organization on a day-to-day basis.
3. Describe how the digital forensics function complements the overall security efforts of the organization.
4. Evaluate the operational duties of digital forensic personnel and how these help qualify the integrity of forensic investigations within the enterprise and industry.
5. List at least three technical resources available to the digital forensics professional to perform forensic audits and investigations.

Download Now
(sent via email)

Discussion 1

Imagine you are part of a security policy development team. Compose four policies that could prevent threats to the information assets of an organization. Select one policy you believe would be the best policy for strengthening data security and explain why. • Every IT organization has the critical responsibility of providing a certain level of service. Such services includes the following: 1. Data Access: Every IT organization has service level agreements that dictates how the organization will retain and manage user data. 2. Level of Service: IT organizations focus on high-level customer service. Every IT organization strives to provide high-level customer service. Functioning as the Agency ISP, the IT organization also sets a certain standard in regard to network uptime. In todays world, it is quite normal for most organizations to guarantee uptime of 99.99% or higher. This is critical to an agency operations. Although IT organizations have the responsibility of providing top-level service to the agency, it also has the responsibility to ensure security is the top priority. In order to provide service to internal and at times external customers, IT agencies have to follow policies. And in some cases, such policies require review. As an IT Specialist, I think these are four are very important to develop when it comes to protecting assets of an organization. 1. Develop a Physical Security Policy: A policy to control physical access to the facility and data center must be developed. Employees must go through a prover verification process and should only have access to areas where necessary. Important to also install security mechanisms for access, such as Security guards, badging systems, and biometric authentication mechanisms that will control physical access to the facility. 2. Network Access Policy: It’s critical that an agency define its network access policy. Although the IT organization has the responsibility to provide a service, its’ also important to set user expectation. A Network Access Policy is critical on defining what, who and how data will be made available, monitored, accessed and controlled. 3. Audit Policy: Policies must be followed. Auditing is critical on making sure that the agency and organizations are adhering to it. Auditing allows managers to verify and ensure that rules and policies are being followed. 4. Information Classification Security Policy: Government agencies and private sector corporations have employees. In order to hire, employees must go through the application and interview process. Information submitted by candidates during the application process must be available to HR. The IT department has the responsibility of ensuring the data is available and secure. In addition to that, access to this data must be only made available to authorized personnel. All data should have a certain level of classification (Confidential, Secret, etc.). Access to such data should be made available only to employees who undergo the proper verification. From the four listed policies, I think that the best policy for strengthening data security would be the Information Classification Security Policy. This policy would dictate the level of access someone would be granted and in addition to that it would also ensure that data is properly compartmentalized and access would only be available to people who been verified and actually need it. •Explain how you would factor risk management practices into the development of the policies you constructed above. Outline specific measures. processes. and activities in your answer. Before developing each policy, it’s critical to identify the risk associated with physical and data security. My first step on identifying risks would be to perform a risk assessment of the facility. Next I would perform a risk assessment of the personnel (employees). As part of employee risk mitigation, I would develop training programs to ensure employees are aware of policies and procedure in regards to data access and protection. Training would not only be require to the regular end-user, I would also ensure that IT Professionals have the necessary training.

Discussion 2

Distinguish the three most important factors that will protect and enhance the confidentiality and integrity aspects of data assets. Provide a rationale for your chosen factors. When it comes to security data within the enterprise, security administrators focus primary on the CIA (Confidentiality, Integrity and Availability) triad. Many security measures are designed primarily to protect one of more facets of the CIA triad. As requested in this discussion, I am going to primarily focus on Confidentiality and Integrity. What are three important factors that will protect and enhance the two? What can I do to ensure data remains confident and meets its set classification? Many organizations classify data based on certain level of “Confidentiality”. How can this data be protect from being disclosed or accessed by the wrong people? When it comes to Integrity, agencies have to ensure that data has not been tampered with. How can agencies ensure that data will not and has not been modified by unauthorized parties. Here are three factors that will enhance the two: Encryption: Encryption of data across the wire ensures that only the correct endpoint will be able to open/decrypt the document. One of the method used to encrypt data is Digital Certificates. Digital Certificates uses a Private and Public key process. Enforcing Permissions/Access Control: By enforcing permissions and setting a certain level of ACL controls, only the authorized users will be able to access the data. Cryptography I Hashing: Common method of cryptography to enhance integrity of data is hashing. By hashing the data, users have confirmation that the data was not modified or tampered with. Examples of hashing algorithms are MD4 and SHA. Government agencies do require that agencies meet such standards. The Federal Information Processing Standard (FIPS) is the standard framework used for accreditation.