Reference no: EM132313961

Goal - To design and write the security policies for a small to medium enterprise

Introduction

The task is to produce a printed consultancy report that is for establishing the security provisions for an organization described in a case study. The case study will be created by the team and will be submitted several weeks prior to the remainder of the report to enable the team to receive feedback on its suitability for the assignment. The report itself will contain multiple parts, some created by the whole team, while some will be largely undertaken individually, but with input from the rest of the team.

As this assignment contains a sizable amount of team work, there will be a peer assessment perspective of the assignment. This will involve each team member providing some feedback and information to the tutor about how the group functioned as a team, and how much work was completed by each member.

Case Study

The first component of the assignment, due in week 10, is the case study.

You are going invent a company based in the IoT (Internet of Things) area and write a 500-700 word document describing the company your team has invented.

IoT encompasses everything connected to the Internet, but it is increasingly being used to define devices or elements that connect together through the Internet - from simple sensors, cameras to smartphones and wearable devices. IoT is being used in many forms in the agriculture, construction, industrial, medical, transport and social sectors. IoT devices provide real-time data gathering/monitoring and, as data is gathered over time, it can provide detailed business insights and lead to improvement in efficiency.

The company can be in any industry in IoT that the team chooses. For example, some ideas are:

• Agricultural/Environmental - Temperature, Humidity, Water purity, Energy usage
• Transport & Logistics
• Health
• Smart homes

It is suggested that you try to model the company off of an existing company and then make changes to create your own company. This will enable you to get a more detailed picture in your minds of what the company is like, its context, and its security needs.

It is suggested that the team invents a name for the company, and indeed names for key employees at the company. It is a good idea to describe the purpose of the company, the number of employees, geographical location, its ICT infrastructure and any specific industry-related risks to the company.

IoT Infrastructure - This is provided as a basic guide only and is by no means exhaustive. Your team doesn't need to limit your design to the basic infrastructure (you can use any other structure). The basic elements to be considered for your business are shown below:

• Cloud Based Infrastructure will be accessed by both Corporate and Customers. It provides a flexible, scalable platform for your customers to connect to and receive reports. Corporate users build customer Web portals and manage the customer devices
• Corporate Infrastructure provides the environment for the company servers, finance and administration.
Your task is a creative process requiring everything to be imagined to achieve a realistic view of the company to understand its needs and threat profile.

Consultancy Report

The report will have two sections: the first will contain information common to the entire report, such as the threat and risk analysis, while the second section will address specific security issues facing the company.

The first section of the report should contain:

• an executive summary (~400 words)
• an introduction including a description of the assumptions made and extra context for the case study (2-3 pages max)
• a threat and a brief risk analysis (2-3 pages)
• a definition of the main security goals for the case study's organisation and an accompanying set of high-level security policies (2-3 pages).

Include any extra material at the end of the report as appendices.

• The appendix should contain a copy of the case study, updated with any changes made since the first submission in week 10.

The second section of the report should contain the following subsections, each written by a different group member:

• Physical Security
• Logical Security
• Data and System Security
• Network Security
• User Education and Compliance (only if the group has 5 members)

The content should provide an overview of how you will achieve the security goals stated in the first section of your document in the area that you are tackling. Each recommendation should refer explicitly to a numbered security goal from the first section of your report. You need to explain why you are making the recommendations and mention any obvious competing solutions and why your suggestion is more appropriate.

Each of these subsections should be ~4 pages (no more than 5) in length.

Attachment:- Data Network Security.rar