project 2

Contents 1.0. Security Requirements 2 1.1. Hypothesized Organization: Compufy Limited 2 1.1.1. Corporate organizational chart 4 1.1.2. Work Group structure and ties added to the corporate organizational chart 4 1.1.3. Communication flows of Work Groups of Compufy Limited 5 2.0. Security Business Requirements 7 3.0. Security Policy 8 4.0. System Design Principles 9 5.0. The Training Module 10 References 11

Compufy Limited

Network security consists of procedures and practices that are initiated to inhibit access by unsanctioned persons, exploitation, and alteration by these kinds of people or denial of computer network and resources that can be accessed through a given interface. Such networks are controlled by network administrators who are given authority to authorize access of certain data to a given group of individuals. The focus of this paper is on the security of networks which involves a number of significant features for it to be considered secure. Some of these features include the authentication of users and the denial of a computer network to intruders (Lincke, 2015).

There are a number of attacks that can be faced in any network, more so where a loophole is noted by the attackers. Some of these attacks include: Port Scanning, Wiretapping Denial-of-Service (DoS), Distributed Denial-of-Service (DDoS) attack, Phishing, Cross-Site Request Forgery (CSRF), SQL Injections, XSS Attack, ARP Poisoning, Buffer Overflow (McNab, 2007). With these being identified, a strong security management plan needs to be put into place whereby, these loopholes need to be secured.

Compufy Limited, a company that was established to help different organizations to secure their information through ensuring that there exists a high and efficient level of network and information security, is located in the United States, and was set up in 2016 with the aim of developing the network and information security (NIS) in the society and also to create awareness of NIS and as a result, contributing towards the development of the internal market. Its primary aim was to create minimal risks associated to the network, thus allowing their users and organizations to handle their network easily without any disruption. The company is, therefore, found to contain all these strengths where the use of IDs and passwords are used to authorize viewing of information among other network management strategies. The company aims to ensure that the community and its members are protected from malfunctions in the network that affects the information saved on anyone’s device. Of much importance, Compufy Limited aims at managing risks and assessing them. These are found to be essential parts of information security management and, as a result, are vital to the founding of security in organizations.

1.1.0. Initial Security Projects

Primarily, the company has been working hand in hand with different organizations to secure their networks. One of the first security projects was the accountability of information use. This involved the privacy and fairness in decision-making systems (Zubairi, 2009). This project dealt with the making of decisions of the automated systems that process personal data of the company’s clients. Most organizations and working groups which linked up with the Compufy Limited were excited over the positive contributions of the systems installed in their premises. However, most of them raised severe trepidations of their data not being secure and private. This, after this project, has been identified to be the major concern of most organizations. With updated systems containing machine learning algorithms, such problems have been curbed, and the company aims at helping more organizations stabilize and gain control of their network and information systems. Thus, the issue was subdued by explaining to the users how the systems were automated to be accountable for their privacy.

The cloud is rapidly changing the face of the web infrastructure, allowing even the minute corporates to create quick web and mobile applications for their users through taking advantage of the of the scale of flexibility of the physical shared infrastructure created by cloud providers, the academic community, however, is at risk of being left out of this hypothetical change. A problem Compufy identified was the network virtualization, which was found to be a hindrance. However, the company came up with suitable network virtualization that puts all the non-significant packet transformations at the verge of the corporeal system. The company is further planning on developing programs that will extend to a more sophisticated network functionality that will enable clients to be able to manage all their data in the small cloud space.

The company’s structure can briefly be outlined as below.

This is based on the major departments, their functions and sub-functions, and also their activities.

The Workgroup structure is based on the realistic goal of the company which is aimed at reaching maximum security stabilization in the networks. To begin with, there is the deputy of Compufy who reports to the head of the company. The deputy is also advised by the Information Security Council that is made up of the Chief Risk Officer, CFO among other major leaders of the company who take part in major decisions of the company before any process is executed.

For an organization to have realistic goals there must be an order in which decisions are made. For Compufy Limited, the Chief Strategy Officer (CSO), who is responsible for executing the major security programs and protecting the information assets of the company, reports to the Chief Information Officer (CIO). In exceptional cases that require financial aid, the CSO reports to the Chief Risk Officer. This, therefore, helps in the coordination of the security team in the execution of the security policies of the organization. Moving down, there is the network infrastructure officer who ensures that security of data, i.e., through networks, endpoints and data centers are safe and secure. Irrespective of where the work is being done, the infrastructure officer needs to ensure that all resources are well-coordinated.

There is also the application and asset security department which ensures that the CSO is not caught by surprise in case of any Network and Information System failures. The officer always checks all systems and networks randomly to ensure that there are no exploits that can compromise the client or organization. If any faults are found, then suitable assets are provided to fix concerns found. The officer has also the mandate to issue internal social engineering for respective companies to prepare for attacks. If, for instance, a new network attack vector is identified, in a penetration test, then the manager is held accountable. The program Management officer (PMO) and the entire department perform all the activities required to develop and implement an information security plan for client companies including the program based on the plan. There are many roles to be executed by the PMO. They include; is expected to develop and execute the information security programs and procedures; outline the roles and responsibilities of information security; report and communicate with both the interior and exterior clients and stakeholders and manage funds allocated for any information security activities. The PMO, in conjunction with the network infrastructure department, is also expected to manage the servers of the company where they should ensure that the servers are always secure to use and reliable. They should also be able to liaise in checking for threats in their systems and those of their clients.

Data management and cloud computing are deemed to be a vital aspect of network and information security (Vacca, 2012). As a result, the management of data in the networks needs to be reliable since all users rely on them to run their daily company programs. As a result, Compufy Limited has set policies to ensure that the privacy of such data is guaranteed, together with their encryption. Moreover, the Company stores most of their data and that of their client on Cloud which is the most basic practice incorporated into the successful management of data. Thus, cloud computing in conjunction with big data is one of the most exceptional effects that could transpire in any networking system.

TBD

TBD

TBD

 TBD

TBD

TBD

TBD

TBD

TBD

TBD

TBD

TBD

Lincke, S. (2015). Security Planning: An Applied Approach. Cham : Springer International Publishing.

McNab, C. (2007). Network security assessment: know your network. " O'Reilly Media, Inc.".

Vacca, J. R. (2012). Computer and information security handbook.Newnes.

Zubairi, J. A. (Ed.). (2009). Applications of Modern High Performance Networks.Bentham Science Publishers.