Identify the threats the important items are subject to

Assignment Help Computer Engineering

Reference no: EM133613684

Assignment: Create a Security Policy

Purpose

To help solidify and reinforce the concepts you studied in the unit involving the development of a computer network security policy.

Instructions

Part I: Devise a Security Policy

Think about a business you are familiar with that uses networks and computers to support business functions. Create a list of 10 important, specific IT/information assets. The list might contain items such as the following:

1. Components: Servers, computers, mobile devices, IoT devices, other equipment, etc.
2. Information: Sales data, client data, financial data, etc.
3. Network configuration

Identify the threats these important items are subject to. Devise a security policy to mitigate that threat. Document your analysis process used to develop this policy. Note that this information will be useful moving forward in the course, so develop it fully at this time.

Example: A company laptop is a portable device which is a trackable asset. A possible threat against this asset is theft or loss. A mitigation for this threat is to require encryption on the device to secure data in the event the device leaves control of an authorized party.

Part II: Security Policy Assessment

Read the following mini-security policy. Assess this security policy in the following four major areas. What is missing, incomplete, inaccurate, or ill-advised? Provide a rationale for your concerns.

R&D Financial Services, LLC Security Policy

Each document should have a footer or header identifying the level of sensitivity. Suggested sensitivity levels are unrestricted and client sensitive.

Email clients should enable SSL encryption for ActiveSync, POP3 and SMTP. SSL should also be used for web-based email. That way, regardless of where people work, their email traffic will not expose any data to network eavesdropping techniques. If client confidential data must be emailed amongst any third-party firms and/or consultants, the file should be encrypted, perhaps using a cross-platform product such as PGP or S/MIME, so that data cannot be read from email servers along the way.

File servers with shared folders should have access controls enabled to only members of the authorized group. Shared folders should also be encrypted so that physical theft of the server, its hard drives, or the backups will not compromise data confidentiality.

Periodic backups will be made of server hard drives and stored offsite in a secure location such as a safety deposit box. Access to the backups will be shared.

Only a select few consultants under contract with R&D Financial Services, LLC will be given the file server Administrator account password. Laptop computers will not automatically login the administrator and each account will be password protected. Local folders containing client sensitive data should be encrypted so that theft of the laptop or its hard drive will not compromise data confidentiality.

Portable storage devices, such as USB and thumb drives, may be used to store client sensitive documents if they are stored in encrypted folders or drive images.

Laptop computers will have screen savers enabled with password protection. Users will switch on their screen saver to lock the computer when they walk away from it.

Passwords should be chosen wisely, i.e., common dictionary words would not be used.

Reference no: EM133613684

Questions Cloud

Based on analysis of cadbury strategy : Based on your analysis of Cadbury's strategy and of the proposed acquisition, determine if you support the acquisition

Social security retirement benefit : Social Security Retirement benefit was intended to be one leg of a "three-legged stool."

Discuss a change initiative that you are familiar with : Discuss a change initiative that you are familiar with, using the force-field analysis model. Create headings for topics and sub-topics.

What research methodology is appropriate : You are asked to interview people to ask them about their experience during the COVID-19 pandemic. What research methodology is appropriate.

Identify the threats the important items are subject to : IT 540- Identify the threats these important items are subject to. Devise a security policy to mitigate that threat.

German automotive industry : Can you provide background information on the German automotive industry? Specifically as it relates to their history and present state.

Determine internal strengths and weaknesses of businesses : Determine the internal strengths and weaknesses of specific businesses and explain their interrelationship with external macro factors.

Standardized financial contracts as risk management tool : Which of the following is an advantage (or are advantages) of using standardized financial contracts as a risk management tool?

Implement systems on fpga design state machines : EE3621 Embedded Systems, Brunel University London - Design systems using VHDL using a suitable design interface.

User Account

All Pages