Security Plan Assignment: Designing a Plan to Protect Information Holdings of an Organization

Objectives of Security Plan Assignment

The Security Plan assignment, involves the design of a security plan based on a given case study.

The learning objectives of the Security Plan Assignment are for you to recognize the threats that exist in your current or future work place.  The complacent and lackadaisical approach many organizations have towards the security of their information holdings is common.  You have, through your research, the opportunity to identify the threats, outline security guidelines and develop a robust and pragmatic training programme.

You should develop a plan that you would regard as helpful to you, the information user, as well as protecting your organization’s information environment. Use your imagination in combination with a wide-range of material you glean from your research.

You are required to complete and submit a security plan based on the following scenario:

You are the recently appointed head of a security team responsible for protecting the information holdings of a business organization of some 600 staff.  The organization is housed in a detached, multistoried building located in the central business district of Kuala Lumpur city.

The security team is responsible for overseeing the security of information from deliberate and accidental threats.  A recent audit of the information security management system found it to be deficient in some key areas, notably incident response, disaster recovery and business continuity, social engineering exploitation of personnel, an apparent lack of personnel awareness of the various threats to information, and poor password security.  These issues were identified as needing urgent remedy.

Technical systems were found to be reasonably effective in maintaining database and document management security, and were well serviced by the IT team.

Management has directed you to undertake some security analysis and planning to improve the organization’s security of information.  You are tasked to:

1. Identify and describe the organization’s physical, human, and electronic threats information holdings that may be at risk.

2. Design a security plan that describes counter-measures that will manage the threats that put the organization’s information holdings at risk

3. Develop a comprehensive information security education and awareness programme for use by management, staff members and contractors).

Use the marking sheet as a possible template to prepare your security plan.