Nt2580 Week 2 Information Security Research Paper

     On September 24, 2010, a laptop was stolen from an unlocked Urology office at the Henry Ford Health Systems hospital. The laptop did contain password protection software; however, it may not have been enough to permit access if the thief had advanced knowledge in computers. Additionally, the information stored on the laptop did not include social security or health insurance information, but instead held “patient names, medical record numbers, dates of birth, telephone numbers, e-mail addresses, and treatment and doctor visits” (Moscaritolo, 2010, p. 1). It is unknown how many records were contained on the laptop, but all records were related to prostate services that were provided during an eleven year span.

Information security is the protection of information against accidental or malicious disclosure, modification or destruction. Information is an important, valuable asset of IDI which must be managed with care. All information has a value to IDI. However, not all of this information has an equal value or requires the same level of protection. Access controls are put in place to protect information by controlling who has the rights to use different information resources and by guarding against unauthorised use. Formal procedures must control how access to information is granted and how such access is changed. This policy also mandates a standard for the creation of strong passwords, their protection and frequency of change.

I am currently on an Information Security Project. I was not allow to make ref to it until permission is grant by VP. The ABC hospital is a local hospital situated in Texas State. ABC hospital patient currently accesses their heath records over public network. However, ABC hospital believed network application should be strongly encrypted with guaranteed confidentiality, authentication and integrity. The ABC hospital plan is to have a networked application built securely and provide high availability as well as protecting information. If the network application is securely build as plan, the hospital will be able identify the authoritative source of data indicating where the data is coming from and knowing to what extent the hospital can

As organizations increase their reliance on, possibly distributed, information systems for daily business, they become more vulnerable to security breaches even as they gain productivity and efficiency advantages. Though a number of techniques, such as encryption and electronic signatures, are currently available to protect data when transmitted across sites, a truly comprehensive approach for data protection must also include mechanisms for enforcing access control policies based on data contents, subject qualifications and characteristics, and other relevant contextual information, such as time. It is well understood today that the semantics of data must be taken into account in order to specify effective access control

The definition of Information Security can be put in simple and understandable words; it is a system or a process that people may use in order to ensure the safety of their information or many other properties. Specialized measures, for example, passwords, biometrics, and firewalls alone are not sufficient in relieving dangers to data. A mixture of measures is obliged to secure frameworks and ensure data against mischief. Confidentiality, integrity and availability are every now and then referred to as the CIA Triangle of information security.

Abstract— Data security is one important issue that everyone anticipates these days. Whether it is an individual or an organization securing the data in the database is very important. As the technology is enhancing day by day the data is more vulnerable to the security breaches.A really exhaustive approach for information assurance should likewise incorporate instruments for implementing access control approaches focused around information substance, subject capabilities and qualities, and other pertinent relevant data, for example, time. Strategies for information trustworthiness what 's more accessibility particularly customized to database frameworks must be embraced. We concentrate on access control frameworks, on which a huge

In information security, computer security and network security an Asset is any data, device, or other component of the environment that supports information-related activities. Assets generally include hardware (servers and switches), software (e.g. mission critical applications and support systems) and confidential information. Assets should be protected from illicit access, use, disclosure, alteration, destruction, and/or theft, resulting in loss to the organization. Security assets are quite helpful for large or small companies and have many different ways of protecting one’s information.

The main focus of this research paper is to identify and examine different types of information system security plan that will eventually helps an organization to run smoothly. The policy and analysis guidelines are needed to represent the relationship between organization policy as well as selected policy. Every organization should have a system security plan (SSP) which will apply to major as well as minor information systems. The better implementation of security policy will preserve as well as protect organizational classified data. System security plan should be configured in a way that the information should be confidential, reliable, and available whenever needed. The information system security plans need to be reviewed in order to mitigate flaws or loopholes in the information system.

Authentication: Network security process starts with authentication concept, where user ID and password provided to authenticate a user. Specific authentication should be required for different areas of network i.e., servers, LAN, remote access, wireless communication etc. Because when user has only one username and password, it can be easily detected by hackers and having separate authentication credentials can decrease the threats. Organization has to follow appropriate authentication mechanisms, which includes tokens and cryptographic techniques when accessing the host applications, services and data through external connections .Network manager has to take responsibility of providing authorization to users.

Databases are used to store different types of information, from data on an e-mail account to important data of government agencies. The security of the database inherits the same difficulties of security facing the information, which is to ensure the integrity, availability and confidentiality. Database management system must provide mechanisms that will assist in this task. SQL databases implement mechanisms that restrict or enable access to data according to profiles or roles provided by the administrator. (Mittal, 2009). The “GRANT” command grants specific privileges to an object (table, view, sequence, database, function, procedural, schema, or table space language) for one or more users or groups of users. The concern with the creation and maintenance of secure environments is one of the main concerns of the network administrator, operating systems and databases. Research shows that most of the attacks, theft of information and access non - authorized are carried out by people belonging to the organization. For this reason, these professionals strive to both create and use tools in order to eliminate unauthorized access or reduce the opportunities of success of attempts to attack either internal or external. Information systems access controls must certify that all the shortcuts to the system happen exclusively according to modalities and pre-scheduled rules observed by protection directives/policies (Ben Natan, 205). Generally, security

The objective of this assignment is to develop security policy for information resources of the ABCD University with major emphasis on compliance with the current laws and regulations, integrity and confidentiality of information, and reduced risks to potential threats.

In innovation world, the software is being utilizing expanding and updating and producing for the propelled gimmicks. At the same time of the software has been assembled and has been released with a set of deformities. The deformities originates from execution and the configuration blemishes. The engineers have been for the most part concentrating on discovering execution bugs while about the recognizing defects they are not concentrating on that distinguishing imperfections generally. They are have engage for the most part on usage bugs instead of distinguishing the configuration defects. The IEEE computer security, the main relationship for registering experts had been dispatched a digital security which is activity

Access control limit access to sensitive data based on organisation policies by determining who and how data can be accessed based on a “need to know” of an entity like an employee’s name, position or something you are like fingerprints (Goodrich and Tamassia 2011, Kizza 2010). Additionally identity depends on other characteristics such as something you are acquainted with like password and something you have like secret encryption key. Access control is based on the assumption that only the authorized entity has possession of what they are, know or have (Shabtai, Yuval and Rokach 2012).

The essay seeks to explain and discuss an information security plan. The security plan will ensure protection from loss of confidentiality, integrity, and availability of data (CIA) which are the back bone of any organization’s information security. To provide an outline of the security requirements of the system and describe the controls in place or planned responsibilities and expected behavior of all individuals who access the system. The discussion will also review the guidelines for developing the security plans for information systems.

In this Assignment, I will be writing down the policy for using and allowing of personal devices to connect to the company network for business use while keeping the company data and infrastructure secure.