Assignmenty 1

CSIA 300: Cybersecurity for Leaders and Managers

1

Copyright ©2020 by University of Maryland Global Campus. All Rights Reserved

Why do Businesses Need Security?

There are many different types of businesses. Each one needs security in some form. In this reading, we will explore the reasons why a business needs to have someone or some group within the business that is responsible for security.

Types of Businesses

A sole proprietorship is a simple form of business in which the owner is personally responsible for the business’s activities (including debts) (Entrepreneur Staff, 2017b). The business may have a trade name but it does not have a legal identity separate from its owner. In this form of business, the owner’s personal knowledge of cybersecurity issues and solutions will be very important.

A partnership is a form of business in which two or more individuals own the business (Entrepreneur Staff, 2017a). Partners contribute resources to the business (“investments”) and then share any resulting profits or losses. Partnership agreements state how those profits or losses will be distributed among the owner. Such agreements also provide for management and authority over the day-to-day operations of the business. A partnership will also need some form of governance structure to guide decision making about how the business will be operated (strategies, goals, policies, etc.). At least one of the partners involved in daily operations will need to have cybersecurity knowledge.

A corporation (Investopedia, 2017) is a legally recognized entity (owned or controlled by a group of people) that enjoys many of the rights, responsibilities, and duties as are granted under the law to a person. The corporation’s rights, responsibilities, and duties exist separately from those of the corporation’s owners. The documents of incorporation provide structure to the company’s governance by outlining key roles and responsibilities. The members of the Board of Directors and the senior leaders / managers of the company all need to have some familiarity with cybersecurity related principles, practices, threats and risks.

Reasons Why Businesses Need Security

Asset Protection (Traditional & Digital Assets)

Businesses exist to make a profit. They do this by creating and selling products and services. Business assets are resources used by the organization to produce the goods and services it will sell or to provide supporting services required to operate the business (Kovacich & Halibozek, 2003).

An asset is a possession (item or object) that has value. This value must be protected against harm or loss.

Digital assets are information assets that exist only in digital form (electronically stored information). These assets are stored on digital media and are accessed / used via digital

CSIA 300: Cybersecurity for Leaders and Managers

2

Copyright ©2020 by University of Maryland Global Campus. All Rights Reserved

devices. The term is used to refer to files, software, and firmware. Digital assets may also be physical assets (when they exist in stored form) or they may be classified as intangible assets.

Physical assets include buildings, land, property, etc. Computer hardware and infrastructures are physical assets.

Intangible assets include such things as intellectual property, trade secrets, brand recognition, reputation and good will.

Thus, we have our first reason that businesses need security – to protect business assets. Asset security consists of those measures taken by the business to protect its assets from harm or loss. This harm or loss may be caused by insiders (e.g. employees), outsiders (criminals, competitors), and extraordinary events (force majeure) or acts of God. Business assets that must be protected against loss or harm include:

• buildings and facilities, equipment and furnishings • business processes • computer systems • financial instruments and cash (money) • information (databases, documents, and files) • inventory (completed products, parts, and supplies) • networks and infrastructures • personnel (skilled workforce) • intellectual property (e.g., patents, trade secrets, plans, and strategies) • reputation

Information and information systems are assets. Information is an asset because the organization must spend money to obtain it so that the information can be used to produce goods and services. Examples of valuable information assets include recipes or formulas, customer and vendor lists, sales plans, and marketing strategies. An information system is an asset because each component of the system costs money to purchase or replace. Note: Businesses may also be holders or custodians of information belonging to others. This information must also be protected from harm or loss.

The security measures required to protect business assets are determined by identifying the assets that require protection and then assessing the specific threats and vulnerabilities (for each asset or type of asset) that are present in the organization’s operating environment.

Legal and Regulatory Compliance

Businesses must comply with laws and regulations set forth by certain governments and government agencies (Reynolds, 2010). Sometimes, it can be difficult to determine which laws or regulations apply

CSIA 300: Cybersecurity for Leaders and Managers

3

Copyright ©2020 by University of Maryland Global Campus. All Rights Reserved

and in what circumstances they apply. Businesses need the advice and services of attorneys or corporate counselors to provide guidance in making such determinations. It is important to have competent legal counsel for areas where the business is at risk or may face penalties for non compliance. Cybersecurity requirements imposed by laws or regulations are an area where specialized legal counsel may be required.

Key concepts from law that affect business operations are due diligence and duty of care (Reynolds, 2010). Due diligence is the obligation to be conscientious in performing your duties. In some uses, this term refers specifically to functions related to contracts and acquisitions. Duty of care is the obligation to be attentive and to avoid causing harm. Leaders and managers need to understand cybersecurity principles, practices, threats, and risks in order to meet their obligations under both due diligence and duty of care.

Integrating Security with Business Operations

Businesses can be described as systems of people, processes, policies, and technologies and the interconnections / relationships between these components (ISACA, 2009). These components can also be viewed as assets, which have value to the organization. Each component, each relationship between components requires some level of protection from harm or loss. Thus, the need for security throughout the system is pervasive and should be approached in a holistic manner.

Figure 1. Systems View of an Organization

Working with the entire system at once can be a daunting task especially when greater levels of detail are required. Breaking the system down into smaller chunks is an obvious solution but, how should those chunks be defined? One organizing strategy, used by business analysts, is to divide the organization into functional areas. Within each functional area, we can identify the components of the system that operate within the functional area and those components which are cross-cutting (apply to multiple functional areas at the same time. Dividing the business into functional areas will also allow us to analyze and assess security needs within each area. After the needs in each area are considered, we

CSIA 300: Cybersecurity for Leaders and Managers

4

Copyright ©2020 by University of Maryland Global Campus. All Rights Reserved

can identify cross-cutting or system-wide security requirements and gaps. Finding commonalities allows us to identify ways to reduce costs and improve efficient allocation of resources to deliver required levels of security.

Business Functions

The day-to-day business operations of organizations are typically organized into five functional areas (see figure 1). Each functional area is supported by business processes and assets. As business becomes e-business and commerce becomes e-commerce, businesses must reevaluate their security programs to ensure that the confidentiality, integrity, and availability of business processes and assets are protected against threats (sources of harm or loss). The figure below shows the five functional areas typically found in the day-to-day operations and activities of an organization. Notice that “security” is a separate business function yet is fully integrated within the business enterprise. Security both supports and is supported by the other functional areas of the business.

Figure 2. Day-to-Day Business Operations

Accounting and Finance Functions

The accounting and finance functions of a business include:

• accounting and bookkeeping • budget preparation and monitoring • fiscal analysis and reporting • sales or other financial transaction processing

CSIA 300: Cybersecurity for Leaders and Managers

5

Copyright ©2020 by University of Maryland Global Campus. All Rights Reserved

Security is required for devices and information systems which process or provide access to financial information. Required security functions include providing authentication, authorization, and nonrepudiation for access to and use of both physical and digital assets containing financial information.

Additional security services may also be required to ensure compliance with federal and state laws and regulations (e.g., Gramm-Leach-Bliley Act, Sarbanes-Oxley Act, Fair Credit Reporting Act, etc.).

Commercial Functions

The commercial functions of a business include:

• sales • marketing and business intelligence • customer relationship management

Security needs for commercial functions include:

• protection of confidential business information (client lists, sales/marketing plans, etc.), trade secrets, and other forms of intellectual property

• protection of customer and vendor information (including personally identifiable information) • provision of authentication, authorization, and nonrepudiation for access to and use of

information systems involved in the collection, use, reporting, and storage of customer information

Additional security services may be required to comply with provisions federal and state laws regarding privacy, data breach reporting, and corporate transparency.

For marketing and business intelligence functions, the organization may need to incorporate auditing and control functions to ensure that the information collected about competitors does not violate the Economic Espionage Act or other applicable laws.

General and Functional Management Functions

According to Henri Fayol (Svenson, 1961), the management functions of a business include:

• Planning, organizing, and coordinating the work of the organization • Allocating and controlling resources (including budgeting) • Monitoring and controlling (“commanding”) the work of the organization

These management functions frequently involve decision-making activities which require access to and the ability to benefit from a variety of information that the organization collects, processes, transmits, and stores (Tannenbaum, 1950). Such information includes:

CSIA 300: Cybersecurity for Leaders and Managers

6

Copyright ©2020 by University of Maryland Global Campus. All Rights Reserved

• business records • confidential business information (client lists, sales/marketing plans, corporate strategies, etc.) • customer data (including personally identifiable information) • financial data and forecasts • plans and schedules • trade secrets • other forms of intellectual property

The information and confidential business processes used in the general and functional management activities of an organization must be protected against unauthorized access or disclosure. Typically, this is done by putting restrictions in place which control access to information and information resources. These restrictions must be balanced against legitimate uses and disclosures of information while communicating, coordinating, and collaborating as part of the day-to-day operations of the business.

Security Functions

Security of the business, from assets to operations and all the functions in between, is a shared responsibility for all managers and employees (Kovacich & Halibozek, 2003). This responsibility includes diligence in the performance of duties under the duty of care (Reynolds, 2010). The reasonable person standard is used to determine if an individual has performed these responsibilities with the same level of diligence and care that a conscientious person would put forth.

The effectiveness and efficiency of security functions are improved when there is a single manager with primary responsibility for these functions (Kovacich & Halibozek, 2003).

The security manager has both an operational and a strategic role in the business and must use a great deal of influence and collaboration to ensure cooperation on security matters throughout the organization (Kovacich & Halibozek, 2003). The security manager is usually supported by a dedicated organization whose personnel are specifically trained in security administration, physical security, personnel security, operations security, and information security. The security manager is responsible for the establishment and management of the organization’s security program. These responsibilities include ensuring compliance with laws, regulations, and standards for corporate security. The security manager and supporting security personnel are also trained in risk management, fraud deterrence, internal investigations, contingency planning, disaster recovery, and crisis management.

The security functions of an organization include (Kovacich & Halibozek, 2003):

• protect against harm or loss • detect attempts to cause harm or loss • react to events causing harm or loss • document incidents and responses

CSIA 300: Cybersecurity for Leaders and Managers

7

Copyright ©2020 by University of Maryland Global Campus. All Rights Reserved

• prevent by planning and implementing security measures to prevent future incidents • assist in ensuring compliance with laws and regulations

The protection of business functions which depend upon cyberspace and digital assets which can be accessed from cyberspace has become an increasingly important area of responsibility for security managers. A separate sub-specialty or functional area for security, Cybersecurity (Department of Homeland Security, 2017), has emerged as a result of this growing need.

Technical Functions

The technical functions of a business are those activities, which directly or indirectly contribute to the conversion of inputs (raw materials and labor) into outputs (products and services which can be sold or otherwise converted into monetary value). These functions include:

• business operations • product development and production • purchasing and logistics • research and development

The security needs of each activity area vary by the types and sensitivity levels of the processes and information required by the activity and the degree to which each activity interacts with or relies upon the external environment. These activities require security protections that ensure the confidentiality, integrity, and availability of information (data) and services. Many of these activities also require auditing, monitoring, and control capabilities (security services) that provide for nonrepudiation of actions taken by both insiders and external actors.

E-Business/E-Commerce Infrastructure

E-business and e-commerce infrastructures are built from capabilities provided by the technical and commercial functions of a business. These infrastructures are then used to provide products and services that are either delivered in cyberspace or which are accessible from cyberspace (e.g. products ordered via an online ordering system). Special care must be taken to ensure that the data storage, processing, and transmission capabilities (see figure 2) within the e-business and e-commerce infrastructure protect the confidentiality, integrity, and availability of information and services.

CSIA 300: Cybersecurity for Leaders and Managers

8

Copyright ©2020 by University of Maryland Global Campus. All Rights Reserved

Figure 3. E-Business/E-Commerce Infrastructure

Cybersecurity and Businesses

Cybersecurity is a type of security that a business needs to have in place to protect its operations and assets which exist in cyberspace or which can be accessed via computers, devices, and networks that have connections into cyberspace. Put another way, Cybersecurity focuses primarily upon protecting and defending assets that exist in digital form or assets that receive, process, store, and transmit digital information. Cybersecurity is also concerned with providing protection that ensures the confidentiality, availability, and integrity of information and information based services which are accessed via the Internet. Cyberspace exists because enabling technologies such as the Internet provide global connections between computers and between people using computers.

Figure 4. Cyberspace (the Internet)

CSIA 300: Cybersecurity for Leaders and Managers

9

Copyright ©2020 by University of Maryland Global Campus. All Rights Reserved

References

Department of Homeland Security. (2017). Glossary. Retrieved from https://niccs.us-cert.gov/glossary

Entrepreneur Staff. (2017a). Partnership. Retrieved from https://www.entrepreneur.com/encyclopedia/partnership

Entrepreneur Staff. (2017b). Sole proprietorship. Retrieved from https://www.entrepreneur.com/encyclopedia/sole-proprietorship

Investopedia. (2017). Corporation. Retrieved from http://www.investopedia.com/terms/i/incorporate.asp

ISACA. (2009). An introduction to the Business Model for Information Security. Retrieved from http://www.isaca.org/knowledge-center/research/documents/introduction-to-the-business- model-for-information-security_res_eng_0109.pdf

Kovacich, G. L., & Halibozek, E. P. (2003). The manager’s handbook for corporate security: Establishing and managing a successful assets protection program. Burlington, MA: Elsevier.

Reynolds, G. W. (2010). Ethics in information technology (3rd ed.). Boston, MA: Course Technology.

Svenson, A. L. (1961). Pioneers of management organization theory. Management International 1(5/6), 115-130.

Tannenbaum, R. (1950). Managerial decision-making. The Journal of Business of the University of Chicago, 23(1), 22-39.

CSIA 300 Padgett-Beale Intern Welcome Letter 2020.pdf