Reference no: EM132630326

COMP 0400 Information Security management - Middle East College

Learning Outcome 1: Develop information security baseline(s).
Learning Outcome 2: Manage reviews to identify events and corrective actions

Part 1 :

Submit a work proposal for this assignment or before 30/08/2020 (23:59) which must include:

• Understanding of deliverables - a detail description of deliverables.
• General overview of proposed plan - initial understanding of solution to task2.
• Timeline for completion of the given tasks.
• references
The work proposal must be submitted in a word file through the link available in Moodle.

Part 2:

SALT (Smart And Living Technologies) is a medium sized Software Development company in South Australia which was established in 2004. It is present in two premises, both of which have their offices. Additionally, they have hosted their information systems in a hosted data center facility with a service provider. That is the only instance of their IT infrastructure. SALT is providing software solutions and consulting services to clients all over the world, who fall under small to medium sized businesses. The departmental heads are mostly the people who were there since first day of the business, except the CISO that is a new role introduced recently. This explains why heads of department in SALT have a good knowledge about their business processes but did not make much effort towards formal documentation. Alex Smith is the CEO of SALT. He started the company in partnership with a friend Brett. Brett is an investor in the company but has a dormant role as far as the business operations are concerned. Mr. Smith is an engineer but he has no modern technical understanding of IT security issues. Alex has had no problems with IT Security until very recently when the Company's network was subject to a series of attacks. In the period of 3 days, the company's website was defaced, a serious virus infected the company e-mail and large quantities of data were corrupted. Smith is worried about cyberterrorism and is concerned about becoming a victim of e-crime. After discussing with the Executive committee, he appoints you as a Chief Information Security Officer (CISO). As a first step, you will review the current threats analyse the impacts, and create necessary management plans. The CEO has shared a recent audit report to start with and the shocking results are listed below:

a. General
Improper operating procedures used by employees. Lack of security awareness and general security laziness. Nil acceptance of security responsibility.
In-adequate standard operating procedures. Unattended machines.
Failure to take care of media. Printing sensitive material.
Failure to turn off computers at the end of the working day. Failure to backup information.

b. Hardware problems
Failure to adequately secure the hardware (eg laptops unsecured). Effects from the physical environment causing damage.
c. Software concerns
some application software is of inferior quality and untested in the field and therefore not able to be trusted in the office environment.
Nil audit logs.
Lack of adequate access control.
Lack of secure identification and authentication techniques. Limited antivirus software.
Lack of restrictions to specific files when certain applications are operating. Lack of security awareness and general security laziness.

1. Discuss the information security impacts of the current situation in SALT with appropriate examples. (20 marks)
(Hint: Give a minimum of two appropriate examples)

2. Using literature, recommend and discuss one cyber security incident response standard that would help SALT to manage the security incidents Smith is worried about.
(Hint: your discussion should be defended by literature)

3. Develop a baseline to protect SALT from being attacked again.
(Hint: your baseline should include at least 10 technical/ non-technical requirements with appropriate explanation.)

4. Most of cyber security crimes could be avoided by enhancing the users' security awareness. With appropriate security guidelines, design an appropriate cyber security awareness campaign to help SALT limit the impact of cybercrimes.

Part 3: Proper referencing, literature review, conclusion and report format
Rules & Regulations:
• All resources should be cited using CU Harvard style.
• The final assignment must have a Title page, Table of Contents, References/ bibliography using CU Harvard Style and page numbers.
• Title Page must have Assignment Name, Module name, Session, your name, ID, and the name of the faculty.
• The assignment answer is expected to be in total of 1500 - 2000 word.

Attachment:- Information Security management.rar