Module 1 Case: Information Security System Risk Management

Information Security System Risk Management
Name:
Instructor:
Institution:
Date:
Introduction
Among the most vital components of any organization, information is critical towards the progress and performance of them. The nature, confidentiality, and validity of data and information are what will give one organization an upper hand against another. Organizations often face some threats to their information from any direction. These can be in the form of hackers, viruses, or denial of service (DoS) issues. It is, therefore, imperative that information is protected, so as to safeguard its integrity. However, the security of information only through the technical measures is not foolproof enough, since it leaves numerous vulnerabilities for the same said information. Towards this end, there is a host of things that can be done so as to come up with the most relevant strategies or measures. The most evident and inevitable first step is to come up with procedures as well as policies that would adequately safeguard information. This paper provides a systematic breakdown of the steps involved in coming up with information security and processes.
Policies
Policies hinging on security constitute the most fundamental aspect of organizational cybersecurity. For a given policy to be considered effective enough, it must have adequate documentation on what has to be done to safeguard not only the information but also the people in the organization. As a result, such a policy also has to contain guidelines on how the members of staff operate their respective computer systems while at the workplace (Landess, 2003). As the first line of action, all the personnel in charge of the system and information security in the organization, such as database administrators, need to acknowledge the fact that there exist potential threats to their information. The same should be the case for the other stakeholders as well. User participation, according to Spears & Barki (2010), is also essential.
Once they acknowledge this fact, then they should come up with ways to handle the same, either as a diagnostic measure, or a preventive one. Setting up of a security policy will depend on three critical factors; the level and type of threat in question, the size of the organization, and the available resources that the organization has at its disposal, to deal with the threat. Resources, in this case, will essentially be financial. It will then call for the coordination and participation of all the employees of the organization to identify and implement the necessary measures. This last aspect is as important as Krause (2008) notes that establishing the program is just one part, the crucial part is embedding the program’s principles into the ‘DNA’ of the entity.
Identification
The identification process involves earmarking the critical assets of the organization as well as the identification of the threats and weaknesses in the organization's systems. Identifying the organization’s assets includes compiling a list of all the physical aspects of the organization’s information system. These include routers, type of information moving through its networks, its servers and locations of its servers, as well as the...