Establishing an information security program for organizational protection

IT Security Plan

The technological advances that have been witnessed in the past twenty to thirty years, has placed a tremendous emphasis on data and information. Computers have changed the world in many facets and the ability to communicate and perform work have been greatly assisted by the digital age. Along with these new found powers, there exists also new found threats. The ability to protect these investments and resources of an informational matter, has produced new sciences and approaches to accomplishing such a task.

The purpose of this essay is to discuss and analyze how to establish an information security program to protect organizational information. This essay will address the specific guidelines and elements that compose such a program and explore ways in which these methods can be exploited for the fullest possible benefit. Specific guidelines will be discussed however this is a general overview of a program and the details that are inherent within such a program will be omitted for simplicity sake. The main idea of this essay is to explain the fundamental concepts that are contained within an information security program and how these qualities affect the ability to produce and maintain a competitive advantage within any chosen industry or business realm.

Identifying Information Threats

Before identifying any reasonable steps to an information security program, it is wise and prudent to first single out what the major threats are to the particular business. Threats are unique and general depending on the situation so it is essential that both avenues of approach are covered and investigated to determine the most harmful and prescient threats that are currently being waged against the organization. Since computers and information are included in almost every single legitimate business organization, there appears to be a constant and persistent threat at all times that needs to be protected. Companies and organizations soon become dependent on these technologies and their usage increases. This dependence also creates security concerns due to the emphasis that is placed on such actions.

It appears that many companies and organizations are unaware of the ease in which their information and data can be compromised. Durbin (2013) explained how information is a critical resources that must be protected from the many and varying threats that exist in the world today. He wrote "as we move into 2014, attacks will continue to become more innovative and sophisticated. Unfortunately, while organizations are developing new security mechanisms, cyber criminals are cultivating new techniques to circumvent them. Businesses of all sizes must prepare for the unknown so they have the flexibility to withstand unexpected, high-impact security events."

The interconnectivity of the internet and wireless communication has allowed for clandestine and secret attempts to steal and propagate digital information. Many times businesses have no idea to the high levels of dangerous exposure they are submitting themselves to in many cases. The threats are often invisible and quiet, leaving little traces or clues to signify where and how they originated from. Threats are everywhere and must be constantly identified as the industry landscape and markets are always changing and evolving along with the possibilities of threats and danger.

Computer hacking crime syndicates are more prominent in this day and age due to these leaps in technology and communication. Grimes (2012) argued that these criminal outfits present the largest threat to computer and digital information in today's environment. He wrote "Many of the most successful organized cyber crime syndicates are businesses that lead large affiliate conglomerate groups, much in the vein of legal distributed marketing hierarchies. In fact, today's cyber criminal probably has more in common with an Avon or Mary Kay rep than either wants to admit. Small groups, with a few members, still hack, but more and more, IT security pros are up against large corporations dedicated to rogue behavior. Think full-time employees, HR departments, project management teams, and team leaders. And it's all criminal, no more funny messages printed to the screen or other teenage antics"

Components of an IT Security Plan

Simplicity and ease of use is the most pressing idea surrounding the issue of a competent and practical information technology security plan. Access becomes the most glaring component of any IT plan when approached in this manner. Access is important because this is where and how information can be approached and taken. This is the first step in comprising an IT plan that is both safe and secure. Hu (2006) suggested that "access control is concerned with determining the allowed activities of legitimate users, mediating every attempt by a user to access a resource in the system. In some systems, complete access is granted after successful authentication of the user, but most systems require more sophisticated and complex control." Using logon names and passwords is the simplest way to create a system of security regarding access. While this may be appropriate at many levels of the security plan, the more important and sensitive the information is, the more restrictions to access should be afforded within the information technology security plan.

There are many dangers and problems with this portion of the plan. Access is not a simple process and the complexities of the business organization will certainly dictate the complexities of the IT plan that is designed to protect it. When planning for access control it is important that certain standards are kept and that the strategic outlook is always prominent in the planning stages. Many times designers of such systems will overlook key portions of access control that may have damaging effects down the road. Technology can be a great assistance in avoiding such problems, and getting the most out of what is available will no doubt serve the project well. Bioscolo (2008) agreed with this argument when he wrote "Traditional security solutions, such as firewalls, anti-virus, anti-spyware, patch management, or VPNs are no longer sufficient to keep the threats off the network. While these play a vital role, companies are still dealing with devices connecting to the network with unpatched software, out-of-date anti-virus and improper security settings. Not keeping devices up-to-date is probably the largest hole in the security fight today."

IT security programs need more than just a good idea. Monitoring and supervising these factions is also an integral part of any security plan. Privacy enters the picture in this phase of the program and these issues should be reflective of the greater organizational strategy. In some businesses, such as medical and legal industries, require greater privacy than other types of retail or standard businesses. The monitoring and auditing of the IT components within any organization should be based upon the need for the employee privacy. There is no accepted standard, but experience and inductive experiment should help guide the planers to a safe and productive spot when balancing between monitoring and privacy issues.

Avoiding malware and computer viruses also falls under the responsibility of monitoring the IT program. The devastation and problems that these unfortunate incidents produce are very threatening to any organization who relies on digital communication to achieve profits. Besides viruses, the rampant practices of cybercrimes by hackers has also shifted the balance of power requiring greater and more sophisticated protective measures to fend off such malevolent attacks and inquiries. Kelly (2012) wrote " modern hackers use increasingly sophisticated methods to attack a variety of targets that occupy nearly every corner of our society, private persons, corporations, religious institutions, and governmental entities including local police units, industrial and utility systems and major federal agencies and legislative bodies, " (p.1673).

Once priorities are set and the proper allocation of resources and efforts have been adequately placed in the IT security program, the plan may be ready to be configured and installed. This is the last piece of the implementation portion of the plan and must be done according to standard and must be continuously aligned with the greater and more important overall organizational strategy. The IT security plan is nothing more than a tool to help create a competitive advantage within a business, or to increase efficiency and effectiveness within organizations of a non-profit model. Configuring requires physical and mental tasks that seeks to put all the pieces in place for the organization to begin using. A solid and helpful configuration will greatly assist in helping to ensure that the organization is aware of the issues at hand within the network. Assigning hardware and software responsibilities to the right people who know how to use it will also serve the program in a very positive and beneficial manner that will allow for growth and evolution.

Conclusions

Essentially every information technology security plan will be judged upon its ability to protect the organization who decided to implement it. The security plan itself must be aligned and attached to a larger and more important overall business strategy. The IT security plan is nothing more than an offshoot of this greater scheme. It is most important to understand the risks and benefits of implementing such a plan before designing and go forth with the idea. Leadership is ultimately responsible for deciding how and in what fashion IT should be protected and maximized for its greatest possible use. When these ideas are aligned and the proper attention is placed in the appropriate places, an organization can begin to work with this program and allow it to provide a safe and confident work space that can bring great benefit and reward when properly balanced.