Developing a comprehensive information security plan for organizational data protection

Information System Security Plan

The information security system is required to ensure the security of the business process and make the confidential data of the organization secure. The organization's management is required to analyze the appropriate system to be implemented and evaluate the service provided on the basis of their required needs. The implementation of the system requires the compliance of organizational policies with the service provider to ensure the maximum efficiency of the system. The continuous update and maintenance of the system is required to ensure the invulnerability of the system towards the potential internal and external threats.

Data Security Manager and Coordinator

Develop Plan

Implement Plan

Employees Training

Test Safeguards

Evaluate Service Providers

Internal Risks

Change Passwords Periodically

Restricted access to personal information

Safeguard paper records

Report unauthorized use of customer information

Terminated Employees 1

3. External Risks 1

3.1 Firewall Protection 1

3.2 Data Encryption 1

3.3 Secure user authentication profiles 1

3.4 Secure access control measures 1

4. External Threats 1

4.1 DOS Attacks 1

4.2 Adware/Spyware 1

5. Data Protection 1

5.1 Backups 1

5.2 Updated Software 1

5.3 Complex Passwords 1

5.4 Protect Equipment 1

5.5 Regular Maintenance 1

Conclusion 1

REFERENCES 1

Introduction

The unpredictable and fragile environment of corporate industry has caused the extreme requirement to equip the business mechanisms and processes to be secured with the use of information security systems. These systems are required to make the work and communication procedures efficient and secure for the businesses and their clients so that the latest advancements in information technology can be fully utilized.

The effective information security system can be equipped in the business processes with the condition in which these systems are planned carefully in order for successful implementation and desired outcomes. An effective security plan is required to be developed which will not only provide the businesses with the efficiency in business processes and business transactions but the competitive security advantage will be provided to the company in order to make their business and customer related information safe (Dhillon & Backhouse 2000).

The current study is aimed to provide a comprehensive security plan in order to construct safeguards with respect to technical, physical and administrative practices so that the confidential and personal information of clients and employees can be kept safe.

1. Data Security Manager and Coordinator

The data security coordinator in an organization is responsible to coordinate the importance of the security system and security measures to all the employees in the organization. The coordinator is also liable to monitor if the employees are taking suggestive measures and operating the security system effectively (Whitman & Mattord, 2011).

1.1 Develop Plan

The plan with respect to the information security should be developed by the information security executive or manager. According to Whitman and Mattord (2011), the security manager has to develop the systematic organizational goals and objectives that should be addressed by the proposed security plan and should be in compliance with the organizational processes. Furthermore, the plan should be developed with respect to the allocated budget by the organization for the system development. Moreover, the appropriate processes should be developed in order to monitor the employees' practices in order to do the proper utilization of the system and specific procedures should also be generated to observe the efficiency of the security system. The system security should be prioritized with respect to the importance of business procedures and the important procedures and data should be categorized as most confidential so that the data can be made accessible to the authorized users only.

1.2 Implement Plan

The implementation of the security system takes place when the service providers for the security system are analyzed. The objective data and metrics are developed in order to rate the service providers and the best service providers in terms of cost efficiency, the degree to which the proposed system is compliant with organizational processes and service quality is selected. The agreement between the service provider and organization takes place and implementation process takes place. The effective implementation of the plan takes place when the policies and guidelines are deployed at the organizational level so that employees should follow in a strict manner in order to ensure the security of the system that is proposed for the security plan. The security manager then identifies the gap with the help of his security management group in order to observe the extent at which the organization's employees lack in order to follow the proposed security system and identify the employees who should be provided with the adequate awareness.

1.3 Employees Training

The employees who lack the knowledge and operational practices about the security system should be provided with the adequate training about the security system. The employees who need training should be segmented on the basis of their knowledge and department so that the effective means of training can be adapted in order to ensure the maximum learning by the employees. The departments and employees of the organization should be segmented with respect to the employees' contribution and liability in the organization. The employees should be informed about the benefits of the security plan so that the employees show proactive behavior towards the learning and implementing of the program. Furthermore, the trainers are required to be hired or outsourced to provide the employees with the training related to the operationalization of the security system (Whitman & Mattord, 2011).

1.4 Test Safeguards

The extent to which the security system tends to be safe should be analyzed by keen observation and assessment with the help of conducting the internal audits. The vulnerability of the system is assessed in which the system configuration and system scan takes place in order to analyze the adherence of the system towards the misconfiguration and process weaknesses. Moreover, it should be observed that how the employees are using the suggested practices in order to gain the optimum benefits of the system and continuous internal and external audit should take place to analyze the potential threats that can create bugs in the implemented system. The quantitative analysis should be used in order to keep track of the number of times the security system creates glitches so that the system vulnerability can be identified (Jain et al., 2006).

2. Internal Risks

The security system that is being implemented should be able to address the internal risks that may threaten the confidential information of the organization and can cause the misuse of client and business data. The potential internal risks are discussed below:

2.1 Change Passwords Periodically

The employees often change their passwords which threaten the confidentiality of the organizational information. Moreover, when employees use complex passwords then they need to memorize those passwords every time they change it. It becomes difficult for employees to create complex passwords periodically and remember them. They cannot use the previous password alternatively because if any of those passwords are encrypted then unauthorized user will get unlimited access (Tipton & Krause, 2003).

2.2 Restricted access to personal information

The personal information related to clients and the exchange of data and information from clients to the organization should be restricted from the certain level of employees and the accessibility of that data should be refrained from the internal employees and users with the help of making secured VPN and it should be ensured that only specific users can access that data. The access to such data can be limited by making Layer-3 firewall to help control the client traffic in order to deny and restrict the access. Moreover, the information should be encrypted in such that only authorized people can utilize it (Kaufman et al.,2002).

2.3 Safeguard paper records

The paper records that mainly consist of transactions, agreements and policies should be encrypted properly in order to encode the papers in such way so that only authorized personnel can read it.

2.4 Report unauthorized use of customer information

The policy guidelines of the organization should provide the proper reporting with respect to the reporting of unauthorized use. Kaufman et al.,(2002) implies that direct guidelines should be made that tells employees whom to report immediately if they find that the customer information is being used by someone who is not authorized. The report should immediately be forwarded to the IT manager so that the system access report can be analyzed and the necessary steps can be taken.

2.5 Terminated Employees

The organization should implement the policy with respect to the IT department in which the username and accessibility of the employees who are being terminated from the organization should immediately be removed. The data that employees were able to access from their personalized gadgets and homes should be immediately removed. Kaufman et al.,(2002) suggests that the encrypted data that the employee used to access during his employed should be re-encrypted so that the potential threat of this information to be reutilized by the employee can be reduced. Moreover, the organization should pledge the terminated employees with the written agreement that no previous information related to the encryption will be shared with any other party.

3. External Risks

The confidential information of the company is also threatened by the external sources that may access the confidential data and can misuse it. The potential external risks are addressed below:

3.1 Firewall Protection

The external risk that threatens the organization's confidential information can be safeguarded with the application of firewall system. Stoneburner et al., (2002) infers that firewall system consists of a collection of components that are constituted in such manner that helps to manage and control the flow of data based on the described trusted level. The organization has to ensure that the data is not made accessible to the external parties thus, firewall protection systems by means of introducing the DMZ are installed in order to separate the organization's internal network and external network so that the information that flow inter-organization cannot be threatened by the potential use of malware or outgoing traffic.

3.2 Data Encryption

The transmission of data from the FTP system, web or inter-organization should be executed at the trusted medium to ensure the confidentiality of the transmitted data. Dlamini et al., (2009) suggests with respect to the encryption of confidential data that the data should be encrypted with the complex cryptography to ensure the secure transmission of data. The data encryption should be used to prevent external access to the organization's network sources and the encryption passwords should contain complex pattern so that the risk of encryption cracking can be reduced. Moreover, the disk encryption system should be practiced in the company so that not only the organization's confidential data can be safeguarded but also the daily business process with low priority can be provided with security in order to maintain the integrity of the security system.

3.3 Secure user authentication profiles

The user or client authentication profile should be provided with the strong and secured system in which complex passwords should be used in order to minimize the risk of unauthorized use. Tipton and Krause (2003) suggest that the user-profiles should be saved in the disk which is followed by the strong cryptography so that the external or unauthorized access can be reduced. Moreover, the system should provide strong protection against the modification of the data in order to reduce any potential loss to the company. The user accounts that are used for administrative purpose should be refrained to use the same account for the functional or processing function so that the track of authorize use can be kept safe and reduce the unauthorized uses.

3.4 Secure access control measures

According to Mellado (2007), the mechanisms of access control mainly comprise of the threats that may violate the security policy of the organization and allow users to access the data on the basis of data-traffic analysis. Therefore, intrusion-detection-system or IDS is installed in the organization in order to observe the recent activities performed by the user and analyze the indications if the intrusion of the information is attempted so that preventive measure can be acted upon immediately. The IDS is installed in such manner in which traffic from the external parties is accessible so that the system will keep the log of the times the intrusion has been attempted.

4. External Threats

The external threats can cause the organizational procedures to be malfunctioned and create glitches in the system processes which also threatens the confidentiality of the organizational information are addressed bellow:

4.1 DOS Attacks

The denial-of-service or DOS attack causes the system-based services provided to the users to be clogged and the malfunction of the device due to DOS attack which refrain the end users to access the system procedures and carry out the business activities. These attacks are generated by the internal systems' malfunction or external parties to interrupt the services that are being carried out by the organization. The security system should be equipped with the potential ability to prevent the DOS attacks. Stoneburner et al., (2002)suggests that the organizational system should also contain the Emergency Operating Procedures (EOP) so that in case of system interruption and malfunction, the business processes continue without effecting the organization's business.

4.2 Adware/Spyware

The adware or spyware come with the purchases made by the organization and sometimes the external download from the web causes the adware to give access to the personal computer. These adware are downloaded or saved in the storage device without any prior notice to the user and malfunction the system. These adware also adhere to be installed in the system and cause the potential access of third parties and steal the information that is being saved in the system and often corrupts the system files. Therefore, the users should not be given access to the suspicious web links in the organization and the security system of the organization should be adept at the resistance towards the possible adware download (Mellado et al., 2007).

5. Data Protection

The preventive measures with respect to ensure the maximum confidentiality and vulnerability of the data can be strengthened with the proper utilization of effective data protection practices. These practices are addressed bellow so that the continuous practice of these measures can provide optimum results.

5.1 Backups

Stoneburner et al., (2002) suggests that the organization should implement the backup system in so that the compromised or lost data by means of hardware failure or by any accidental incident can be restored. The security system should contain guidelines for employees to keep and manage the backup data so that the potential damage of data can be restored in case of emergency. The data-backup practice should extensively contain the daily based assembly of data-backup. Moreover, it should be ensured that the backup data is made accessible to some authorized personnel only so that the safety of backup data can be ensured. The system should provide the automated report about the successful backup and the backup files should be reviewed monthly or quarterly to avoid any glitches in the backed up files. The maintenance of the backup storage should be practiced continuously and periodically so that the identified problems and threats with respect to the storage devices can be addressed accordingly.

5.2 Updated Software

The configuration of system and processes should be prompted with the updated software and the periodic update of the software should be practiced from the respected service provider of the system. According to Whitman (2011), the updated software will result in the more invulnerability of the security system and the system will be functioned at its optimum level. The continuous scan and scheduled update of system should be reviewed in order to identify the extent at which the system is available to preclude the potential threats.

5.3 Complex Passwords

The complex passwords should be used for the user ids, system procedures and information accessibility to ensure the maximum security of the business practices. Peltier (2005) infers that the passwords should be renewed periodically however, the users may find the complex passwords difficult to remember and create. The users should be provided with the systematic guidelines about the creation and remembrance of passwords in which they can use some words with mixed characters and numbers. The by-default passwords should be changed immediately and the number of characters in password, usage of special characters and password length should be prompted by the system for the creation of effective passwords.

5.4 Protect Equipment

According to Baskerville (2002), the storage devices, work procedures and systems are required to be adequately configured with the antivirus software in order to avoid potential bugs and user-traffic related threats. The software provider should be providing a competitive antivirus with the continuous upgrade of new virus definition in order to know and prevent the potential virus threats. The daily scan of the system should be practiced with respect to the updated virus definitions and the software should not be configured to fix the infectious files automatically without the administrative concern so that the risk of potential loss of data can be reduced.

5.5 Regular Maintenance

The security system is required to be evaluated with the daily logs with respect to the imposed threats, potential intrusion and system status in order to find out the potential risks that adhere towards the vulnerability of the system. Knapp (2006) suggests that the daily log report should be analyzed by the IT administrative in order to observe the threat and intrusion patterns and take appropriate steps to make the system more efficient and responsive towards the outside threats. Moreover, the maintenance with respect to the organizational policy, development of new business procedures and upgrade of business processes needs to be aligned with the security system to assure the system to be compliant and useful in the business practices.

Conclusion

The information security system is an important practice to be installed in the organization so that the potential internal and external threats can be eradicated in order to provide the organization with the secured edge and platform to continue its business processes while ensuring the security of the confidential business and customer data. However, the information security system should be generated with the exact requirement of the organization and the service provider of the system should be in compliance with the organizational policies. The security service administration or IT department of the organization is required to make sure that the service is compliant with the organizational requirement and user or employees' knowledge. The proper training of the employees is required to ensure the maximum functionality of the security system. Moreover, the continuous maintenance and up-gradation of the system is required to ensure that the security system is able to stand against the new security threats rising in the external and internal environment. Therefore, the efficient security system will provide the organization with the maximum secured path to transfer and access the location and will protect the business processes from the possible intrusions.