7COM1066 Information Security Management And Compliance

Introduction

The report is based on identification and analyzing the risks which are associated in the existing security policies and set up of the University of Hertfordshire. While setting up of the existing system into the university, they are facing of various risks. The internal risks within the organization are caused because of insufficient security policies in the organization. The university is violated the policies when there is use of BYOD (bring your own device), access to non-verified websites from the server of the organization and open of spam emails from the system. These are the main reasons behind the security risks of the information system. Control measures are taken against the risks in the organization to prevent the significant impact on the organization.

As the control statement, firewall is implemented to provide system resistance against malicious files along with viruses. It is also analyzed that restriction over the server is helpful to restrict access in the internet in addition to prevent the students from accessing spam and unverified websites. The University is recruited of system security experts such that it develops the system security by use of firewall as well as antivirus software to connect central server of the university. Risk analysis policies are documented to conduct investigation and take of actions to analyze the risks. The risks are analyzed by the authority of the Chief Security Officer. It is analyzed that risk assessment helps to manage, eliminate in addition to reduce the external and internal risks within the university.

Task 1: CISO Memo

Date:

From: INSERT NAME

Chief Information Security Officer

University of Hertfordshire

To: IS Authorizing Official

School of Computer Science

University of Hertfordshire

Subject: CISO Memo (INSERT System Name)

Finding and Summary:

This memo report is mainly based on the identification and analysis of the risks associated with the existing security policies and set up at the University of Hertfordshire. From the analysis of the existing system, it has been found that there are several security risks associated with the system that cannot be solved or addressed if the present security policies are in place. These policies must be modified as well as several new steps must be taken to address all the associated risks.

Risk Statement:

In information systems, there are generally two types of risks – external and internal. No absolute control can be established for the external risks and the organization only has the option to reinforce information system security in order to prevent such risks for as long as possible. However, internal security risks can be controlled by the organization by implementing various rules and guidelines. Moreover, the organization can take suitable steps to ensure none of the security policies are broken by any individual involved with the organization. In this particular case, it has been found that there are several internal risks that are caused due to lack of sufficient security policies within the organization. Internal activities like BYOD (bring your own device), accessing non-verified websites from the organization server and opening spam emails from the system are the main reasons behind the system security risks.

Impact Statement:

The risks mentioned above will have significant impact on the organization if they are not addressed immediately. In order to reduce the overall operational costs, the university allows the students to use their own laptops during computer practical classes. As a result, the malwares or viruses can easily enter the university server from the students’ systems. Similarly, opening spam websites and links can also insert malicious files into the system. These malwares can steal information from the server and can also destroy the entire data and information stored inside the database.

Risk Level:

Low:_________ Moderate:_________ High:__Yes_______

Justification for Noncompliance or Deviation:

Till now, controls cannot be implemented for several reasons. If BYOD is scrapped, the university has to encounter excess costs to provide systems to each of the students. Moreover, the spam websites cannot be entirely blocked as most of them mask themselves with the domains of other verified sites.

Compensating Controls:

The university can consider alternative practical classes for students in order to scrap BYOD and allow students to work on the provided systems only. For instance, if there are 90 students, there can be alternate classes for 30 students at a time and hence, the university can use only 30 laptops instead of 90. Moreover, specific firewalls can be implemented in order to provide system resistance against malicious files and viruses. Server restriction will also help to restrict access in the internet and will be prevent the students from accessing spam and unverified websites.

Statement of Residual Risk:

Even if sufficient control is applied, there may be some residual risks in the system. The spam websites cannot be entirely blocked and some of them can comprise verified sites and can enter the system even if the user enters a verified website.

Risk Response Request:

As discussed in the previous headers, the identified risks are extremely serious and must be addressed immediately with urgent response. All the risks discussed are internal and hence, they can be controlled and minimized. It is evident that the university policies regarding the BYOD and open access to internet are the root causes behind the risks discussed and hence, these policies must be modified and changed in order to protect the overall information system. Furthermore, the university should also provide active response in raising awareness among the students regarding the use of the systems and accessing unverified websites while browsing through the internet. Finally, the university should recruit system security experts so that they can develop system security using firewalls and antivirus softwares in the systems that are connected to the central server of the university.

Task 2: Information Security Policy

Policy Document on Acceptable Use Policy (AUP)

1. Background towards developing the policy:

The policy document is the continuation of analysis and identification of the risks regarding the current security policies and set up. It is also found from the analysis of the current system that there have been various risks related to the system that are still needed to be addressed or solved. The policies were needed to be modified, and various new steps are taken to address the related risks.

The policy demonstrated the AUP or Acceptable Use Policy. It also includes the lines of the ISO27000 family. It also links the BYOD, or the “Bring Your Device Policy” to the AUP. The integrity, confidentiality and the availability of the challenges information assets are analyzed here.

2. Purpose:

The BYOD program involves the students and parents to bring their mobile devices supporting the learning and teaching tasks. For the program, the mobile device indicates the student-owned device like the laptop, iPod touch, suitable phone and tablet. It must be reminded that the personal gaming devices are not permitted in the program.

This risk analysis policy has documented the authority of University of Hertfordshire for conducting the investigations and taking actions as needed to analyze the risks in the university. It intends to mitigate the measures for reducing, eliminating and managing the risks. The document specifies when and how the risk analysis could be done and who have been behind those responsibilities. Further, the policy determines how the risks could be identified for remediating it. It is conducted keeping the authority of the Chief Security Officer.

3. Scope:

This policy applies to every data and systems on the organizational network operated or owned by the university. The policy is efficient since the date issues never expire till it gets superseded by any other policy. However various risks analysis is particular to the system, the entire risk to the organization is needed to be considered. Moreover, the general risk analysis of the university functions is evaluated periodically like the risks to the network.

4. Term Definitions:

Risk: The chance of an undesirable outcome along with the harm that could occur.

Risk assessment: This is the analysis of every possible risk with the implemented and non-implemented solutions for managing, eliminating and reducing the risks.

Threat: It could be accidental, deliberate or result from any nature.

5. Risk Assessment Participants and Skills:

The staff members must perform the risk analysis. They must be familiar with the security and technology. The leader here must be the security officer. The technical support staff and the business owners must supply the information of risk assessment.

6. The risk assessment method:

The method is defined by the process of risk assessment. The process must be upgraded as needed. This is because of the outcomes of incidents and audits.

7. The steps of risk analysis:

The management of the university should define the scopes of risk analysis and develop the risk analysis team to guide the process.

As the procedure is not defined, the team must determine them.

The system must be evaluated by determining if the system is critical to the business process of organization and recognizing the security needs and data classification.

The threats must be listed as the exploitation of the vulnerability.

The vulnerabilities must be identified.

Evaluate the security controls.

The identification of probabilities.

The impact of the quality damage.

The risk levels must be determined.

8. The BYOD Acceptable Use Policy (AUP) Summary:

In the effort to the parents, guardians and students to take part in the BYOD program, the responsibilities and conditions added must be accepted as stated in the BYOD linked to the AUP as shown below. They must first read, then sign and return from this document.

1. The students wishing to use the personally owned mobile phone must read and sign the AUP.
2. The guardian/parent must read a sign and submit the AUP to the tutor putting that in the student file.
3. The students should undertake the roles for the proper use of the personal device at any times.
4. They are also liable for the devices including the cost of repairs, breakages and replacement.
5. Further, the school has the right to reserve to monitor or inspect the student mobile devices during the school hours.
6. The violations of the school rules or policies including any student device might lead to a student not being permitted to use the device during the disciplinary action or school hours.
7. As the school hours are allowed to use the device to learn the related tasks only.
8. The students need to comply with the requests from the teachers about the using of devices while the classes are going on.
9. The mobile devices should be charged with bringing them to school to be usable during the school hours.
10. The devices must not be used to transmit or post or record the videos or photos.
11. Every user is responsible for their device and must use that appropriately and with responsibility. The University of Hertfordshire had taken no liability regarding the damaged, lost or stolen devices. This must also include the corrupted or lost data on the devices.
12. Further, University of Hertfordshire is also not liable for any possible device changes to the account which could be incurred during the approval of the school-related use.
13. Confidentiality: The privacy and the ability to control or restrict the access must be maintained by the individuals to view the sensitive data.
14. Integrity: To maintain this security testing is intended to reveal the flaws in the security mechanisms protecting the data and control the functionality as expected.  
15. Availability: An off-site location must be kept ready for restoring the services as anything occurs to the primary data centers.