Pricinples of Information Security, Chapter 5 Review Questions

| The security controls for the information system should be documented in the security plan. The security controls implementation must align with the corporate objectives and information security architecture. The security architecture provides a resource to allocate security controls. The selected security controls for the IS must be defined and

Sadly, there is no way to alleviate the numerous amounts of threats that haunt networks and computers worldwide. The foundation and framework for choosing and implementing countermeasures against them are very important. A written policy is vital in helping to insure that everyone within the organization understands and behaves in an appropriate manner with regards to the fact that sensitive data and the security of software should be kept safe.

internal and external users to whom access to the organization’s network, data or other sensitive

* Recommend other IT security policies that can help mitigate all known risks, threats, and

Another step involves security checks upon implementation and describes agency-level threat to the business scenario or the mission. It similarly entails sanctioning the information system for processing and lastly constant monitoring of the security controls. FISMA and NIST's standards are aimed at offering the ways for agencies to achieve their identified missions with safety commensurate with the threat (United States Department of Agriculture, 2015). Together with guidelines from the Office of Management and Budget (OMB), FISMA and NIST create a framework for advancing and growing an information security scheme (SecureIT, 2008). Such framework includes control descriptions and evaluation, program development, and system certification and accreditation. The final objective involves conducting daily functioning of the agency and achieving the agency's articulated objectives with sufficient security commensurate with risk.

Other security elements are in reference to data recovery, database administration, handling a breach in security and administrative security policies such as access procedure, employee transfer and excessive user access. As I assume the role of the chief security officer, database designer, database administrator, and chief applications designer this project is very important to the armed services and the Virgin Islands National Guard as we strive to provide global security.

A sound information security policy begins with an understanding of what is the current climate, which can consist of policies, regulations, and laws. It is imperative to understand what legislation your line of business must comply with as well any applicable governance requirements. Beginning with defining what is a policy, a guideline and a standard: a policy provides specific requirements or rules to abide by, which can be either at the governmental level, meaning a statute and/or organization-specific directive; also known as administrative law. According to the SANS Institute (n/d), a leading cooperative research and education organization, a standard can be an amalgam of requirements that is applicable to the user body; and a guideline can be considered akin to a recommendation for a best practice (SANS Institute, n/d). Current government policies can be issued by federal, state, local and/or tribal

According to Whitman and Mattord (2010), The ISO 27000 series is one of the most widely referenced security models. Referencing ISO/IEC 27002 (17799:2005), the major process steps include: risk assessment and treatment, security policy, organization of information security, asset management, human resources security, physical and environmental security, communications and operations management, access control, information systems acquisition, development, and maintenance, information security incident management, business continuity management, and compliance

In this paper I will be discussing some of the benefits of having frameworks for information security management. What each of the frameworks of information security are, their pros and their cons. Which major perspectives to consider in information security management and framework choice. What organizational factors should be considered in framework choice? I will also attempt to come up with a better framework for information security.

Are overall responsibility for a comprehensive security program that includes information security policies, compliance, and management. They also develop long-term security strategies and ensure that the company meets all mandated security standards and client needs. He or she will provide security-related vision, leadership, and strategy required for the company’s continued market place presence and success. They also assist in the responsible of developing and implementing a corporate culture of compliance and information security. They will maintain and reinforce this culture throughout the organization via employee training and motivation, so that the culture underpins all business decisions and choices made on a daily basis. The SCO reports to the Security Manager.

Faults are a precise interaction of hardware and software that can be fixed given enough time.

3. How is infrastructure protection (assuring the security of utility services) related to information security?

Arrangement : The security outline may have a real effect on the frameworks sending environment for the sample you may require security situated equipment or programming or you may need to change at one time expected organization game plans keeping in mind the end goal to address security dangers

Working with security policies at any level of business and industry can be incredibly complex. Here, the research suggests that "developing an IT policy framework from scratch can be very daunting challenge for even the most experienced audit professionals" (ISACA, 2012). A mid sized firm simply does not have the resources or the time to build a network from scratch and have it work seamlessly. Building such networks is extremely costly and requires a great amount of effort, which an insurance agency may not be able to provide. As such, the most effective manner for reestablishing IT policy framework is to utilize something already in place and adjusted in order to fit the unique needs of a particular organization. Drawing from proven designs can help save time and effort in the trial and error process. Looking to external sources, successful strategies for framework can be drawn from the literature.

Top down has strong upper management support, dedicated funding, clear planning and the opportunity to influence organizations culture, whereas Bottom up lacks a number of critical features such as participant support and organizational staying power.