SEC 402 Term Paper: The Rookie Chief Information Security Officer

Strayer SEC 402 Cyber Security, Term Paper, The Rookie Chief Information Security Officer, 15 pages, 3234 words, Graded A. Cybersecurity: The essential body of knowledge
Exclusive and Original document Available only on Course Answer
This assignment consists of five parts


Download Now
(sent via email)



Part 1: Organization Chart
Part 2: Request for Proposal (RFP) Plan
Part 3: Physical Security Plan
Part 4: Enterprise Information Security Compliance Program
Part 5: Risk Management Plan
Imagine that you have been recently promoted to serve as Chief Information Security Officer (CISO) for a Fortune 500 organization. This organization has known brand products across the world and expects top-secret methods for safeguarding proprietary information on its recipes and product lines. The Board of Directors request that their information security strategy be upgraded to allow greater opportunities of secure cloud collaboration between suppliers and resellers of their products. Another concern they have is the recent number of hacktivist attacks that have caused the network to fail across the enterprise. Their concern extends to making sure that they have controlled methods for accessing secured physical areas within their various regional facilities.
For your new position, you will be responsible for developing standards, methods, roles, and recommendations that will set the new IT security path for the organization. The existing organization has limited experience in supporting an enhanced level of IT security; therefore, you may need to outsource certain security services.
Additionally, you may create and / or assume all necessary assumptions needed for the completion of this assignment.
Write an eight to twelve (8-12) page paper in which you provide the following deliverables:
Part 1: Organization Chart
1. Use Visio or an Open Source alternative, such as Dia, to:
a. Create an organization chart in which you:
i. Illustrate the roles that will be required to ensure design, evaluation, implementation, and management of security programs for the organization.
ii. Within your organizational chart, clearly identify the reporting structure for roles such as IT Security Compliance Officer, Security Manager, CIO, CISO, IT Security Engineer, Privacy Security Professional, and IT Procurement Specialist.
iii. List the types of resources required to fulfill the each forensic duty of the organization below each of the roles you identified.
iv. Align your organization chart to reflect the Department of Homeland Security (DHS) Essential Body of Knowledge’s three (3) areas of information security: physical security professional, privacy professional, and procurement professional. Provide comments and comparisons on how your organizational chart fosters these three (3) values.
Part 2: Request for Proposal (RFP) Plan
2. Develop a Request for Proposal (RFP) plan to solicit qualified vendors that could partner with your internal team to deliver optimum IT service delivery. The RFP Plan should contain qualifying criteria of potential vendors and the responsibilities of the vendor once the contract is awarded. As part of the plan, you must:
a. Describe at least two (2) perspectives that need to be closely monitored within the contract.
b. Give your perspective on at least two (2) methods that could be used to evaluate and develop a qualified trusted supplier list.
Part 3: Physical Security Plan
3. Recommend a physical security plan that could be used to protect sensitive areas such as telecom rooms, employee only areas, and manufacturing facilities in which you:
a. Include at least three (3) specific methods.
Part 4: Enterprise Information Security Compliance Program
4. Establish an enterprise information security compliance program that addresses the concerns of the board of directors of the organization in which you:
a. Describe specific plans and control objectives that could be adopted to address the known issues.
b. Suggest at least three (3) information security policies that could be developed and practiced within the organization for data security assurance.
c. Outline the steps you would take to define the security needs of the organization in terms of duties, staffing, training, and processes.
Part 5: Risk Management Plan
5. Develop a risk management plan in which you:
a. Describe at least three (3) possible risk management efforts that could be used to assess threats and unknown issues.
b. Determine why defining priorities is an important part of the process when enumerating and having efficient risk control measures.
c. Suggest specific technical and management controls that could be enacted in order to monitor risks accurately.



Discussion 1

Propose three ways to ensure that cooperation occurs across security functions when developing a strategic plan. Select what you believe is the most effective way to promote collaboration and explain why. The frrst thing that comes to mind when I think of cooperation across security functions are the three (3) main security control types, i.e., administrative, technical and physical. Obviously, there are more but, these particular control types essentially have the common goal and mission of protecting a company and its assets. Not only that they interact in such a way to achieve the goals in which they were created to protect which is confidentially, integrity and availability. With this understanding when developing a strategic plan, each plan must be tailored in such a way to include each of the controls and more if need be. I believe three (3) ways to best accomplish this is to: 1. Information Security- Identify common denominators that are addressed in the other two (2) when considering strategic plans. {COOP, DRP, IRP)-Inside/Outside Cyber Threats a. Administrative = training, awareness, policies, procedures b. Technical = training, awareness, policies, procedures c. Physical = training, awareness, policies, procedures, exercise scenarios 2. Technical Security- Identify common denominators that are addressed in the other two (2). Identify common denominators that are addressed in the other two {2) when considering strategic plans. (COOP, DRP, IRP)-Inside/Outside Cyber Threats a. Administrative = training, awareness, policies, procedures b. Technical = training, awareness, policies, procedures c. Physical = training, awareness, policies, procedures, exercise scenarios 3. Physical Security -Identify common denominators that are addressed in the other two (2). -Identify common denominators that are addressed in the other two (2) when considering strategic plans. (COOP, DRP, IRP, Active Shooter) a. Administrative = training, awareness, policies, procedures b. Technical= training, awareness, policies, procedures c. Physical = training, awareness, policies, procedures, exercise scenarios I believe the most effective way to promote collaboration among all programs are going to be by way of communication and constant auditing; with leadership buy-in and management tracking (Quarterly and Annually) will certainly sustain a successful program for each of these platforms. Explain what may happen if working cultures are overlooked when developing a strategy. Recommend one way to prevent working cultures from being overlooked. When working cultures are overlooked or not included in the process or taken into consideration it is much like the concept; “Well, it doesn’t work so it’s obviously broken” this is not necessarily the case. Which is the very reason why standardization and uniformity needs to be taken into account. Take for example, the military; for a number of years they had for each installation their own network they were responsible for i.e., (patching, security (logical/technical/physical, boundary protection etc.) It was costly, chaotic and not standardized … and when individuals moved from one (1) installation to another, what worked efficiently for one (1) base may not have been implemented or worked for another because the platforms was different. Not to mention the personnel were only educated or trained to understand that platform. Since that debacle the military got smarter and opted for more of a unified/standardized platform along with protocols for policies and procedures. When you allow organizations/installations to go rouge then uniformity and standardization doesn’t work. By having management buy-in and putting in place protocols that everyone is to follow then the need to work harder not smart concept is preventable … and not overlooked.

Discussion 2

the application and system security process is defined by policies and passes through a lifecycle of five standard stages. the five lifecycle stages are: 1. Soecification of requirements. provides the definition of the product. The outcome is always indepth. documented understandings of the functions the software will require to oerform.That understanding should include both the functional requirements for security as well as the security properties that the applications and systems should possess. 2. design of the software or system. the product’s actual plans are drawn up and the organization decides how to build it. The purpose of this phase is to conceptualize and communicate the precise structure of the product. It is in the design stage that the actual security functionality and properties are realized in some tangible form. 3. coding of the software 4. testing of the software. where cyber security professionals are involved in software assurance. 5. acceptance and use of the software underlined are three examples that demostrate how security can be instilled within the Systems Development life Cycle (SDLC) If software products are release with minimum security planning there are chances of security defects such as installation of back doors and trojans, as well as human error, or malicious intent. three ways that the application security can be monitored and evaluated for effectiveness are 1. software Assurance 2. Audits 3. Integration reviews Walkthroughs or inspections or combinations of both are employed to verify deliverables from the five phases, contract, process, requirements, design,and documentation. these methods would identify any violations, missing requirements, breach of standards, and any detecable faults or unspecified difficulties.