Running_aa Head:_aa IT_aa 552_aa aa_aa a_aa aa_aa aa_ aa_aa aa_aa _aa aa_a aa_aa aa_aa _aa aa_aa aa_ aa_aa aa_ aa_aa aa_aa aa_aa aa_aa _aa aa_aa a_aa aa_aa
_aa aa_aa aa_a aa_aa aa_aa _aa aa_aa _aa aa_aa aa_ aa_aa _aa aa_aa aa_ aa_aa aa_ aa_aa aa_a aa_aa aa_aa _aa _aa aa_aa _aa aa_aa _aa aa_aa aa_ aa_aa _aa aa_aa aa_a aa_aa aa_aa _aa
_aa aa_aa aa_a aa_aa aa_aa _aa aa_aa aa_ aa_aa aa_ aa_aa aa_ aa_aa aa_a aa_aa aa_ aa_aa aa_aa _aa aa_aa aa_a aa_aa aa_aa aa_aa aa_aa aa_a aa_aa aa_aa _aa aa_ aa_aa aa_aa _aa aa_aa a _aa
_aa aa_aa aa_a aa_aa aa_aa _aa aa_aa _aa aa_aa aa_aa _aa aa_aa aa_a aa_aa aa_aa _aa 1
IT_aa 552:_aa Final_aa Project
July_aa 28_aa ,2019
IT_aa 552_aa aa_aa aa_ aa_aa aa_a aa_aa aa_aa _aa aa_aa aa_ aa_aa aa_ aa_aa aa_a aa_aa aa_aa _aa aa_aa _aa aa_aa _aa _aa aa_aa aa_ aa_aa aa_ aa_aa aa_ aa_aa aa_aa aa_ aa_aa
_aa aa_aa aa_a aa_aa aa_aa _aa aa_aa _aa aa_aa aa_ aa_aa _aa aa_aa aa_ aa_aa aa_ aa_aa aa_a aa_aa aa_aa _aa _aa aa_aa _aa aa_aa _aa aa_aa aa_ aa_aa _aa aa_aa aa_a aa_aa aa_aa _aa
_aa aa_aa aa_a aa_aa aa_aa aa_ aa_aa aa_a aa_aa aa_ aa_aa aa_ aa_aa aa_a aa_aa aa_aa _aa aa_aa aa_ aa_aa aa_aa _aa aa_aa _aa aa_aa _aa aa_aa aa_aa aa_ aa_aa a _aa aa_aa aa_ aa_aa aa_
_aa aa_aa aa_a aa_aa aa_aa _aa aa_aa _aa aa_aa aa_ aa_aa _aa aa_aa aa_aa aa_aa aa_ aa_aa aa_a aa_aa aa_ aa_aa aa_aa _aa aa_aa aa_ aa_aa aa_a aa_aa aa_ aa_aa aa_a aa_aa aa_aa aa_aa 2
Table_aa of_aa Contents
Executive_aa Summary ............................................................................................................... 3
Proposal_aa Introduction ............................................................................................................ 4
Security_aa Policies_aa Development .......................................................................................... 7
Continuous_aa Monitoring_a Plan ............................................................................................ 18
Communication_aa Plan ........................................................................................................... 24
Conclusion ............................................................................................................................... 30
References ............................................................................................................................... 32
IT_aa 552_aa aa_aa aa_ aa_aa aa_a aa_aa aa_aa _aa aa_aa aa_ aa_aa aa_ aa_aa aa_a aa_aa aa_aa _aa aa_aa _aa aa_aa _aa _aa aa_aa aa_ aa_aa aa_ aa_aa aa_ aa_aa aa_aa aa_ aa_aa
_aa aa_aa aa_a aa_aa aa_aa _aa aa_aa _aa aa_aa aa_ aa_aa _aa aa_aa aa_ aa_aa aa_ aa_aa aa_a aa_aa aa_aa _aa _aa aa_aa _aa aa_aa _aa aa_aa aa_ aa_aa _aa aa_aa aa_a aa_aa aa_aa _aa
_aa aa_aa aa_a aa_aa aa_aa aa_ aa_aa aa_a aa_aa aa_ aa_aa aa_ aa_aa aa_a aa_aa aa_aa _aa aa_aa aa_ aa_aa aa_aa _aa aa_aa _aa aa_aa _aa aa_aa aa_aa aa_ aa_aa a _aa aa_aa aa_ aa_aa aa_
_aa aa_aa aa_a aa_aa aa_aa _aa aa_aa _aa aa_aa aa_ aa_aa _aa aa_aa aa_aa aa_aa aa_ aa_aa aa_a aa_aa aa_ aa_aa aa_aa _aa aa_aa aa_ aa_aa aa_a aa_aa aa_ aa_aa aa_a aa_aa aa_aa aa_aa 3
Executive_aa Summary
In_aa the_aa digitalized_aa era,_aa cyber_aa threats_ can _a any_ side _aa and _ cripple _aa
the_aa Information_aa Technology_aa ecosystem_aa of_aa an_aa organization._aa In_aa order_aa to_aa
be_aa well_aa equipped_aa against_aa unknown_aa threats_aa and_aa risks,_aa business_aa entities_aa
spend_aa huge_aa volumes_aa of_aa finance_aa so_aa that_aa they_a can_aa safeguard_aa themselves_aa
against_aa sophisticated_aa threats_aa and_ attacks _aa in _a the _aa virtual _aa setting. _aa Mainly _aa
businesses_aa invest_aa money_aa to_aa introduce_aa robust_aa defense_aa and_aa detection_aa
mechanisms_aa so_aa that_a cyber_aa attackers_aa can_aa be_aa kept_aa at_aa a_aa distance._aa
As_aa per_aa the_aa case_aa relating_aa to_aa Multiple_aa Unite_aa Security_aa Assurance_aa
(MUSA)_aa Corporation,_aa its_aa security_aa posture_aa is_aa low._aa One_aa of _ the_aa main_aa
reasons_aa for_aa the_aa poor_aa security_aa model_aa can_a be_aa attributed_aa to_aa the_aa human_aa
factors_aa that_ operate_aa in_aa the_aa organizational_aa setting_aa (Glaspie_aa &_aa Karwowski,_aa
2017)._aa As_aa per_aa numerous_aa researchers,_aa in_aa many_aa cases,_aa human_aa factors_aa
botch_aa up_aa the_aa IT_aa security_aa setting_aa of_aa an_aa organization._aa Due_aa to_aa their_aa
intentional_aa or_aa unintentional_aa error,_aa unauthorized_aa users_aa gain_aa an_aa access_aa into_aa
the_aa system_aa which_aa ultimately_aa compromises_aa the_aa security_aa (Nobles,_aa 2018)._aa
A_aa number_ of_aa policies_ have_aa been_aa presented_aa here_aa that_aa can_aa help_aa
to_aa address_aa vital_aa security_aa issues_aa that_aa can_aa arise_aa in_a the _aa prevailing _aa
organizational_aa context_aa due_aa to_aa human_aa factors._aa By_ implementation_aa of_aa such_
policies,_aa business_aa organizations_aa can_aa be_aa empowered_ to _aa enhance _aa their _aa
security_aa posture._aa _aa The_aa effective_aa management_aa of_aa cybersecurity_aa model_aa will_aa
only_aa be_aa possible_aa if_aa the_aa security_aa policies_aa are_aa taken_aa into_aa consideration_aa
the_ security_aa threats_aa and_aa risks_aa that_aa arise_aa due_aa to_ the_aa involvement_aa of_aa
IT_aa 552_aa aa_aa aa_ aa_aa aa_a aa_aa aa_aa _aa aa_aa aa_ aa_aa aa_ aa_aa aa_a aa_aa aa_aa _aa aa_aa _aa aa_aa _aa _aa aa_aa aa_ aa_aa aa_ aa_aa aa_ aa_aa aa_aa aa_ aa_aa
_aa aa_aa aa_a aa_aa aa_aa _aa aa_aa _aa aa_aa aa_ aa_aa _aa aa_aa aa_ aa_aa aa_ aa_aa aa_a aa_aa aa_aa _aa _aa aa_aa _aa aa_aa _aa aa_aa aa_ aa_aa _aa aa_aa aa_a aa_aa aa_aa _aa
_aa aa_aa aa_a aa_aa aa_aa aa_ aa_aa aa_a aa_aa aa_ aa_aa aa_ aa_aa aa_a aa_aa aa_aa _aa aa_aa aa_ aa_aa aa_aa _aa aa_aa _aa aa_aa _aa aa_aa aa_aa aa_ aa_aa a _aa aa_aa aa_ aa_aa aa_
_aa aa_aa aa_a aa_aa aa_aa _aa aa_aa _aa aa_aa aa_ aa_aa _aa aa_aa aa_aa aa_aa aa_ aa_aa aa_a aa_aa aa_ aa_aa aa_aa _aa aa_aa aa_ aa_aa aa_a aa_aa aa_ aa_aa aa_a aa_aa aa_aa aa_aa 4
the_aa human_aa factors_aa (Nobles,_aa 2018)._aa A_aa robust_aa communication_aa plan_aa has_aa
been_aa designed_aa for_aa Multiple_aa Unite_aa Security_aa Assurance_aa (MUSA)_aa Corporation_aa
which_aa will_aa help_aa to_aa addresses_aa and_aa summarize_aa the_aa importance_aa of_aa a_aa
security_aa awareness_aa program._aa
Proposal_aa Introduction
Purpose
In_aa the_aa dynamic_aa and_ unpredictable _aa business _aa setting, _aa it _aa is _aa necessary _aa
for_aa organizations_aa to_aa have_aa a_aa robust_aa cyber_aa security_aa model_aa so_aa that_aa they_aa
can_aa be_aa well_aa equipped_aa against_ online_aa threats_aa and_aa risks._ This_ security_aa
awareness_aa program_aa proposal_ of _aa Multiple _aa Unite _aa Security _a Assurance _aa
(MUSA)_aa Corporation_aa has_aa been_aa presented_aa here_aa so_aa that_aa the_aa existing_aa poor_aa
security_aa posture_aa can_aa be_aa strengthened_aa (Bada,_aa Sasse_aa &_aa Nurse,_aa 2019)._aa The_aa
present_aa security_aa posture_aa of_aa MUSA_aa is_aa low_aa as_aa it_aa is_aa exposed_aa to_aa a_aa
high_aa level_aa of_aa cyber_aa threats_aa and_aa risks_ that_aa can_aa cripple_aa the_aa IT_aa
ecosystem_aa of_aa the_aa firm_aa and_aa the_ business_aa operations._aa
The_aa fundamental_aa purpose_aa of_aa the_aa security_aa awareness_aa program_aa
proposal_aa is_aa to_aa help_aa Multiple_aa Unite _aa Security _ Assurance _aa (MUSA) _
Corporation_aa to_aa upgrade_aa the_aa existing_aa security_aa posture_aa so_aa that_aa it_aa can_aa
function_aa in_aa a _ safe _ and _aa secure_aa manner. _ At _aa present,_aa the_aa employees_aa do_aa
not_aa have_aa proper_aa cybersecurity_aa awareness_aa training_aa and_aa this_aa naturally_aa
adversely_aa influences_aa the_aa security _aa climate_aa within_aa the_aa MUSA _aa organization_aa
(Bada,_aa Sasse_aa &_aa Nurse,_aa 2019)._aa Due_aa to_aa their_aa lack_aa of_aa adequate_aa skills_aa
and_aa technical_a expertise,_aa they_aa are_aa unable_aa to_aa take_aa suitable_aa actions_aa against_aa
IT_aa 552_aa aa_aa aa_ aa_aa aa_a aa_aa aa_aa _aa aa_aa aa_ aa_aa aa_ aa_aa aa_a aa_aa aa_aa _aa aa_aa _aa aa_aa _aa _aa aa_aa aa_ aa_aa aa_ aa_aa aa_ aa_aa aa_aa aa_ aa_aa
_aa aa_aa aa_a aa_aa aa_aa _aa aa_aa _aa aa_aa aa_ aa_aa _aa aa_aa aa_ aa_aa aa_ aa_aa aa_a aa_aa aa_aa _aa _aa aa_aa _aa aa_aa _aa aa_aa aa_ aa_aa _aa aa_aa aa_a aa_aa aa_aa _aa
_aa aa_aa aa_a aa_aa aa_aa aa_ aa_aa aa_a aa_aa aa_ aa_aa aa_ aa_aa aa_a aa_aa aa_aa _aa aa_aa aa_ aa_aa aa_aa _aa aa_aa _aa aa_aa _aa aa_aa aa_aa aa_ aa_aa a _aa aa_aa aa_ aa_aa aa_
_aa aa_aa aa_a aa_aa aa_aa _aa aa_aa _aa aa_aa aa_ aa_aa _aa aa_aa aa_aa aa_aa aa_ aa_aa aa_a aa_aa aa_ aa_aa aa_aa _aa aa_aa aa_ aa_aa aa_a aa_aa aa_ aa_aa aa_a aa_aa aa_aa aa_aa 5
different_aa kinds_aa of_aa online_aa threats_aa and_aa attacks._aa This_aa proposal_aa intends_aa to_aa
empower_aa the_aa organizational_aa personnel_aa of_aa MUSA_aa so_aa that_aa they_aa will_aa be_aa
in_aa a_ position_aa to_aa deal_aa with_aa different_aa kinds_aa of_aa attacks_aa and_aa threats _ that_aa
can_aa hamper_aa the_aa business_aa activities_aa and_aa processes._aa
Security_aa Posture
As_aa per_aa the_aa risk_aa assessment _aa of_aa the_aa organization,_aa it_aa lacks_aa a_aa
proper_aa cybersecurity_aa program_aa in_aa place_aa that_aa can_aa help_aa it_aa to_aa be_aa well_aa
prepared_aa to_aa deal_aa with_aa external_aa or_aa internal_aa threats_aa that_ can_aa arise_aa on_aa
the_aa online_aa platform._aa As_aa the_aa human_aa factors_aa that_aa operate_aa in_aa the_aa business_aa
setting_aa do_aa not_aa have_aa the_aa technical_aa skills_aa and_ they_aa have_aa not_aa been_a
trained_aa properly_a by_aa the_aa organization,_aa it_aa faces_aa numerous_aa risks_aa and_aa
uncertainties_aa in_aa the_aa digital_aa environment_aa (Nabi,_aa 2018)._a This_aa proposal_aa
relating_aa to_aa security_aa awareness_aa program_aa of_aa MUSA_aa has_aa been_aa designed_aa so_aa
that_aa the_aa existing_aa gaps_aa in_aa its_aa security_aa system_aa can_aa be_aa filled_aa and_aa the_aa
firm’s_aa security_aa posture_aa can_aa be_aa improved_aa to_aa a_aa significant_ degree_aa (The _a
Components_aa of_aa a_aa Successful_aa Security_aa Awareness_ Program,_aa 2019)._aa
Human_aa Factors
The_aa proposal_aa would_ also _aa help _aa MUSA _aa to _aa take _aa care _aa of _aa a _aa
number_aa of_aa organizational_aa factors_aa that_aa come_aa into_aa play_aa and_aa contribute_aa to_aa
the_aa unhealthy_a security_aa culture _aa in_a the_aa business_aa entity._aa For_aa instance, _aa it_aa
will_aa encompass_aa the_aa relevant_aa security_aa policies,_aa tools,_aa and_ techniques_aa that_a
can_aa be_aa implemented_ in _aa the _aa organizational _aa setting _aa to _aa strengthen _aa the _aa
security_aa approach._aa In_aa addition_aa to_ this,_aa the_aa proposal_aa would _aa focus_aa on _aa
the_aa technical_aa training_aa needs_aa of_aa the_aa employees_aa so_aa that_aa they_aa would_aa be_aa
in_aa a_a better_aa position_aa to_aa identify_a varying_aa kinds_ of_aa cyber_aa threats_aa and_aa
IT_aa 552_aa aa_aa aa_ aa_aa aa_a aa_aa aa_aa _aa aa_aa aa_ aa_aa aa_ aa_aa aa_a aa_aa aa_aa _aa aa_aa _aa aa_aa _aa _aa aa_aa aa_ aa_aa aa_ aa_aa aa_ aa_aa aa_aa aa_ aa_aa
_aa aa_aa aa_a aa_aa aa_aa _aa aa_aa _aa aa_aa aa_ aa_aa _aa aa_aa aa_ aa_aa aa_ aa_aa aa_a aa_aa aa_aa _aa _aa aa_aa _aa aa_aa _aa aa_aa aa_ aa_aa _aa aa_aa aa_a aa_aa aa_aa _aa
_aa aa_aa aa_a aa_aa aa_aa aa_ aa_aa aa_a aa_aa aa_ aa_aa aa_ aa_aa aa_a aa_aa aa_aa _aa aa_aa aa_ aa_aa aa_aa _aa aa_aa _aa aa_aa _aa aa_aa aa_aa aa_ aa_aa a _aa aa_aa aa_ aa_aa aa_
_aa aa_aa aa_a aa_aa aa_aa _aa aa_aa _aa aa_aa aa_ aa_aa _aa aa_aa aa_aa aa_aa aa_ aa_aa aa_a aa_aa aa_ aa_aa aa_aa _aa aa_aa aa_ aa_aa aa_a aa_aa aa_ aa_aa aa_a aa_aa aa_aa aa_aa 6
take_aa necessary_ actions_ so _ that _aa the _ security _aa model_aa of_aa the _aa firm _aa would_aa
not_aa be_aa compromised_aa (Alotaibi_aa et_aa al.,_aa 2016)._aa Thus_a the_aa intention_aa of_aa the_aa
security_aa awareness_aa program_aa proposal_ is_aa to_aa make_aa the_aa employees_aa aware_aa
of_aa various_aa kinds_ of_aa security_aa elements_aa that_aa can_ be_aa introduced_aa or_aa
implemented_aa to_aa strengthen_aa the_aa cybersecurity_aa infrastructure_aa of_aa Multiple_aa
Unite_aa Security_aa Assurance_aa Corporation._aa It_aa would_aa also_aa help_ to_aa
constructively_aa mold_aa the_aa factors_aa that_aa come_aa into_aa play_aa and_aa increase_aa the_aa
vulnerability_aa of_aa the_aa business_aa in_aa the_ cyber_aa setting._a
Organizational_aa Factors_aa
A_aa total_aa of_aa ten_aa security_aa gaps_aa have_aa been_aa presented_aa in_aa the_aa
security_aa posture_aa of_aa the_aa business_aa entity_aa that_aa needs_aa to_aa be_aa addressed_aa on_aa
an_aa urgent_aa basis._aa Some_aa of_aa the_ main_aa security_aa concerns_ that_aa have_aa been_aa
included_aa in_aa this_aa security_a awareness_aa proposal_aa are_aa the_aa lack_aa of_aa annual_aa
cybersecurity_aa awareness_aa training_aa for_aa the_aa employees,_aa the_aa absence_aa of_aa
suitable_aa configuration_aa change_aa management_aa policy,_aa and_ the_aa lack_aa of_aa
intrusion_aa detection_aa or_ prevention_aa system._aa In_aa addition_ to_aa this,_aa MUSA_aa
does_aa not_aa analyze_aa or_aa collect_aa logs._aa The_aa absence_ of_aa media_aa access_aa control_aa
policy_aa adds_aa to_aa the_aa security_aa concerns_aa of_aa the_aa business_a undertaking._aa In_aa
the_aa unpredictable_aa technological_aa setting,_aa MUSA_aa does_aa not_aa have_aa encryption_a
or_aa hashing_aa which_aa can_aa control_aa the_aa data_aa flow_aa as_aa well_aa as_aa the_aa
unauthorized_aa alteration_aa of_aa data._aa These_aa are_ some _aa of _aa the _aa major _aa security _aa
concerns_aa that_aa the_aa firm_aa faces_aa in_aa an_aa unpredictable_aa technological_aa setting._aa
The_aa business_aa entity_aa has_aa the_aa opportunity_aa to_a introduce_aa in_aa place_aa
Vulnerability_aa assessment_aa model_aa which_aa will_aa be_aa able_aa to_aa assess_aa the_aa
IT_aa 552_aa aa_aa aa_ aa_aa aa_a aa_aa aa_aa _aa aa_aa aa_ aa_aa aa_ aa_aa aa_a aa_aa aa_aa _aa aa_aa _aa aa_aa _aa _aa aa_aa aa_ aa_aa aa_ aa_aa aa_ aa_aa aa_aa aa_ aa_aa
_aa aa_aa aa_a aa_aa aa_aa _aa aa_aa _aa aa_aa aa_ aa_aa _aa aa_aa aa_ aa_aa aa_ aa_aa aa_a aa_aa aa_aa _aa _aa aa_aa _aa aa_aa _aa aa_aa aa_ aa_aa _aa aa_aa aa_a aa_aa aa_aa _aa
_aa aa_aa aa_a aa_aa aa_aa aa_ aa_aa aa_a aa_aa aa_ aa_aa aa_ aa_aa aa_a aa_aa aa_aa _aa aa_aa aa_ aa_aa aa_aa _aa aa_aa _aa aa_aa _aa aa_aa aa_aa aa_ aa_aa a _aa aa_aa aa_ aa_aa aa_
_aa aa_aa aa_a aa_aa aa_aa _aa aa_aa _aa aa_aa aa_ aa_aa _aa aa_aa aa_aa aa_aa aa_ aa_aa aa_a aa_aa aa_ aa_aa aa_aa _aa aa_aa aa_ aa_aa aa_a aa_aa aa_ aa_aa aa_a aa_aa aa_aa aa_aa 7
security_aa posture_aa status_aa of_aa the_aa business_aa undertaking_aa (Öğütçü, _a Testik_aa &_aa
Chouseinoglou,_aa 2016)._aa
The_aa security_aa concerns_aa of_aa Multiple_aa Unite_aa Security_aa Assurance_aa
Corporation_aa that_aa have_aa been_aa identified_aa here_aa not_aa only_aa jeopardize_aa the_aa
online_aa sustainability_aa of_aa the_aa business_aa undertaking_aa but_aa it_aa also_aa has_aa an_aa
adverse_aa implication_aa on_aa the_aa morale_aa of_aa the_aa employees_aa (Korpela,_aa 2015)._
Due_aa to_aa the_aa high_aa level_aa of_ security_aa issues_aa that_aa the_aa business_aa encounters_aa
on_aa a_aa usual_aa basis,_aa the_aa level_aa of_aa employee_aa turnover_a is_aa high_aa and_aa it_aa
impacts_aa the_aa profitability_aa and_aa performance_aa of_aa the_aa business_aa as_aa well._aa The_aa
security_aa awareness_aa program_aa proposal_aa for_aa MUSA_aa has_aa been _aa designed_ so_aa
that_aa the_aa employees_a can_aa be_aa empowered_aa to_aa identify_aa the_aa various_aa online_aa
threats_aa and_aa risks_aa that_aa can_ adversely_aa impact_aa their_aa Information_aa Technology_aa
ecosystem._aa _aa
Security_aa Policies_aa Development
Proposal_aa for_aa mitigating_aa security_aa threats_aa that_aa arise_aa due_aa to_aa human_aa
factors_aa
A_aa perfect_aa security_a awareness_aa model_aa has_aa been_aa presented_aa here_aa so_aa
that_aa it_aa would_aa help_aa to_aa mitigate_aa the_aa threats_aa that_aa are_aa posed_aa by_aa the_aa
human_aa factors_aa to_aa the_aa organization’s_aa security_aa posture._aa The_aa proposal_aa that_aa
has_aa been_aa designed_ for_aa the_aa business_aa entity_aa encompasses_aa a_aa total_aa of_aa ten_aa
security_ policies_aa that_aa would_aa enable_aa the_aa firm_a to_aa fill_aa the_aa security_aa gaps_aa
that_aa currently_aa exist_aa and_aa weaken_aa the_aa security_aa posture_aa of_aa MUSA_aa (Threats_aa
to_aa Security,_aa 2019)._a The_aa policies_aa have_aa been_aa crafted_aa so_ that_aa the_aa
organization_aa would_aa be_aa in_aa a_aa position_aa to_aa address_aa unintentional_aa threats_aa as_aa
IT_aa 552_aa aa_aa aa_ aa_aa aa_a aa_aa aa_aa _aa aa_aa aa_ aa_aa aa_ aa_aa aa_a aa_aa aa_aa _aa aa_aa _aa aa_aa _aa _aa aa_aa aa_ aa_aa aa_ aa_aa aa_ aa_aa aa_aa aa_ aa_aa
_aa aa_aa aa_a aa_aa aa_aa _aa aa_aa _aa aa_aa aa_ aa_aa _aa aa_aa aa_ aa_aa aa_ aa_aa aa_a aa_aa aa_aa _aa _aa aa_aa _aa aa_aa _aa aa_aa aa_ aa_aa _aa aa_aa aa_a aa_aa aa_aa _aa
_aa aa_aa aa_a aa_aa aa_aa aa_ aa_aa aa_a aa_aa aa_ aa_aa aa_ aa_aa aa_a aa_aa aa_aa _aa aa_aa aa_ aa_aa aa_aa _aa aa_aa _aa aa_aa _aa aa_aa aa_aa aa_ aa_aa a _aa aa_aa aa_ aa_aa aa_
_aa aa_aa aa_a aa_aa aa_aa _aa aa_aa _aa aa_aa aa_ aa_aa _aa aa_aa aa_aa aa_aa aa_ aa_aa aa_a aa_aa aa_ aa_aa aa_aa _aa aa_aa aa_ aa_aa aa_a aa_aa aa_ aa_aa aa_a aa_aa aa_aa aa_aa 8
well_aa as_aa intentional_aa threats_aa or_aa social_aa engineering._aa The_aa policies_aa that_aa have_aa
been_aa designed_aa also_aa focus_aa on_a the_aa quality_aa of_aa data_aa flow_aa so_ that_aa it_aa
could_aa not_aa be_aa tampered_aa with.
As_aa per_aa the_aa strategy_aa that_aa has_aa been_aa presented_aa here,_aa the_aa
cybersecurity_aa threats_aa that_ arise_aa before_aa the_aa entity_aa can_aa be_aa categorized_aa into_aa
two_aa types_aa namely_ unintentional _aa threats_ and_aa intentional _aa threats. _aa The _aa
unintentional_aa threats_aa can_aa be_aa defined_aa as_aa the_aa threats_aa that_aa arise_aa due_aa to_aa
human_aa errors_aa or_aa computer_aa failure _aa (Threats_aa to_aa Security,_aa 2019)._aa The_aa
intentional_aa threats_aa are_aa the_ ones_aa that_aa arise_aa on_a the_aa online_aa platform_aa due_aa
to_aa various_aa kinds_aa of_aa malicious_aa elements_aa such_aa as_aa viruses,_aa theft_aa of_aa data,_aa
denial_aa of_aa service_aa attack_aa and_aa other_aa factors_aa that_aa have_aa been_aa malicious_aa
intent._aa The_aa security_aa policies_aa have_aa been_aa strategically_aa framed_aa so_aa that_aa the_aa
existing_aa security_aa gaps_aa can_aa be_aa addressed_aa in_ an_aa effective_aa manner._aa aa_aa
Policies_aa
A. Protection_aa against_aa unintentional_aa threats_aa
The_aa following_aa security_aa policies_aa have_aa been_aa proposed_aa here_aa would_aa help_aa
Multiple_aa Unite_a Security_ Assurance_aa Corporation_aa to_ safeguard_aa itself_aa against_aa
various_aa kinds_aa of_aa unintentional_aa threats_aa that_aa arise_aa due_a to_aa human_aa factors_aa
and_aa adversely_aa impact_ the_aa security_aa if_aa the_aa organization. _aa
Changes_aa in_aa the_aa remote_aa access_aa mechanism_aa
The_aa remote_aa access_aa is_ a_aa policy_aa that_aa can _aa enable_aa employees_ of _aa an _aa
organization_aa to_aa work_ remotely _aa or_ work _aa from _aa their _aa home. _aa This _aa policy _aa
might_aa be_aa employee_ friendly _aa but _aa at _aa the _ same _aa time, _aa it _aa gives _aa rise _aa to_aa a_aa
number_aa of_ security_aa concerns_aa as_aa unauthorized_aa users_aa have_aa the_aa opportunity_
to_aa gain_aa access_aa into_aa the_aa organizational_aa network._aa The_aa employees_aa that_aa
IT_aa 552_aa aa_aa aa_ aa_aa aa_a aa_aa aa_aa _aa aa_aa aa_ aa_aa aa_ aa_aa aa_a aa_aa aa_aa _aa aa_aa _aa aa_aa _aa _aa aa_aa aa_ aa_aa aa_ aa_aa aa_ aa_aa aa_aa aa_ aa_aa
_aa aa_aa aa_a aa_aa aa_aa _aa aa_aa _aa aa_aa aa_ aa_aa _aa aa_aa aa_ aa_aa aa_ aa_aa aa_a aa_aa aa_aa _aa _aa aa_aa _aa aa_aa _aa aa_aa aa_ aa_aa _aa aa_aa aa_a aa_aa aa_aa _aa
_aa aa_aa aa_a aa_aa aa_aa aa_ aa_aa aa_a aa_aa aa_ aa_aa aa_ aa_aa aa_a aa_aa aa_aa _aa aa_aa aa_ aa_aa aa_aa _aa aa_aa _aa aa_aa _aa aa_aa aa_aa aa_ aa_aa a _aa aa_aa aa_ aa_aa aa_
_aa aa_aa aa_a aa_aa aa_aa _aa aa_aa _aa aa_aa aa_ aa_aa _aa aa_aa aa_aa aa_aa aa_ aa_aa aa_a aa_aa aa_ aa_aa aa_aa _aa aa_aa aa_ aa_aa aa_a aa_aa aa_ aa_aa aa_a aa_aa aa_aa aa_aa 9
work_aa remotely_aa can_aa gain_aa access_aa into_aa the_aa organizational_aa system_aa from_aa
anywhere_aa at_aa any_aa time._aa There_aa is_aa the_aa possibility_aa that_aa these_aa individuals_aa
will_aa unintentionally_aa make_aa blunders_aa while_aa surfing_aa the_aa internet._aa Such_aa an_aa
innocent_aa error_aa on_aa part_aa of_aa the_aa employees_aa working_aa remotely_aa can_aa have_aa a_aa
detrimental_aa implication_aa on_aa the_aa business_aa entity._aa For_aa example,_aa in_aa case_aa the_a
employees,_aa click_aa on_ the_aa link_ of_aa a_ malicious_aa site_aa from_aa their_aa personal_aa
computer,_aa unauthorized_aa attackers_aa could_aa gain_aa entry_aa into_aa their_aa systems_aa and_aa
compromise_aa the_aa security,_aa integrity,_aa and_aa confidentiality_aa of_aa the _aa
organizational_aa data._aa
In_aa order_aa to_aa deal_aa with_aa the_a cybersecurity _aa threats_aa that_ arise_aa due _ to_aa
the_aa remote_aa access_aa policy,_aa there_aa is_aa the_aa need_aa to_aa activate_aa remote_aa access_aa
feature_aa that_a is_aa present_aa in_ the_aa firewall._aa It_aa would_aa make_aa sure_aa that_aa the_aa
employees_aa working_aa remotely_aa can_a gain_aa access_aa in_aa a_aa safe_aa and_aa secure_aa
manner_aa by_aa making_ use_aa of_aa the_aa Secure_aa Sockets_aa Layer_aa Virtual_aa Private_
Network_aa feature_ (What _aa is_ SSL_ VPN _aa (Secure_aa Sockets_aa Layer _aa virtual_aa
private_aa network)?_aa -_ Definition_aa from_aa WhatIs.com,_aa 2019)._aa _aa By _aa using_aa this_aa
security_aa feature,_aa the_aa origination’s_ personnel_aa would_aa be_aa in_aa a_aa position_aa to_aa
create_aa safe_aa access_aa to_aa the_a MUSA’s_aa system_aa when_a they_aa are_aa working_aa
from_aa home._aa The_aa employees_aa could_aa also_aa use_ their _aa mobile _aa devices_aa to _aa
work_aa remotely_aa in_aa a_aa safe_aa working_aa environment_ after_ the_aa implementation_aa
of_aa the_aa security_aa policy_aa (Remote_aa Access:_aa The_aa Pros_aa and_aa Cons_aa of_aa Virtual_
Private_aa Networking_aa |_aa macchina.io_ Blog, _aa 2019)._aa
Introduction_aa of_aa encryption_aa or_aa hashing_aa
Encryption_aa and/or_aa hashing_aa are_aa regarded_aa to_aa be_aa some_aa of_aa the_aa most_aa
basic_aa security_aa measures_aa that_aa business_aa undertakings_aa need_aa to_aa implement_aa so_aa
IT_aa 552_aa aa_aa aa_ aa_aa aa_a aa_aa aa_aa _aa aa_aa aa_ aa_aa aa_ aa_aa aa_a aa_aa aa_aa _aa aa_aa _aa aa_aa _aa _aa aa_aa aa_ aa_aa aa_ aa_aa aa_ aa_aa aa_aa aa_ aa_aa
_aa aa_aa aa_a aa_aa aa_aa _aa aa_aa _aa aa_aa aa_ aa_aa _aa aa_aa aa_ aa_aa aa_ aa_aa aa_a aa_aa aa_aa _aa _aa aa_aa _aa aa_aa _aa aa_aa aa_ aa_aa _aa aa_aa aa_a aa_aa aa_aa _aa
_aa aa_aa aa_a aa_aa aa_aa aa_ aa_aa aa_a aa_aa aa_ aa_aa aa_ aa_aa aa_a aa_aa aa_aa _aa aa_aa aa_ aa_aa aa_aa _aa aa_aa _aa aa_aa _aa aa_aa aa_aa aa_ aa_aa a _aa aa_aa aa_ aa_aa aa_
_aa aa_aa aa_a aa_aa aa_aa _aa aa_aa _aa aa_aa aa_ aa_aa _aa aa_aa aa_aa aa_aa aa_ aa_aa aa_a aa_aa aa_ aa_aa aa_aa _aa aa_aa aa_ aa_aa aa_a aa_aa aa_ aa_aa aa_a aa_aa aa_aa aa_aa 10
that_aa the_aa level_ of _aa security _aa of _aa their _aa IT _aa infrastructure _aa can _aa be _aa
strengthened_aa to_aa a_aa certain_aa degree._aa This_aa policy_aa has_aa been_a proposed_aa so_aa
that_aa the_aa security_aa could_aa be_aa strengthened_aa whether_aa the_aa organizational_aa data_aa
is_aa ready_ for_aa transmission,_aa it_ is_aa in_aa the_aa process_aa of_aa transmission_aa or_a it_aa
has_aa already_aa been_aa transmitted._aa Data_aa encryption_aa would_aa be_aa made_aa mandatory_aa
so_aa that_a it_aa could_aa deter_aa malicious_aa parties_aa from_aa gaining_aa unauthorized_aa
access_aa into_aa sensitive_aa business_aa information._ The_aa encryption_aa process_aa would_aa
basically_aa make_aa use_a of_aa algorithms_aa which _aa would_aa convert _ ta _aa into _aa unique _aa
codes._aa The_ computers_aa that_aa have _ the_aa right_aa key_ would_aa be _ able _aa to_aa
crack_aa these_a codes _ and _aa put_aa them _ into _ the _aa original _aa form. _aa There _aa are _aa
two_aa types_aa of_aa encryption_a methods_aa including_aa symmetric_ key_aa and_aa public_a
key_aa (or_aa asymmetric)._aa In_aa the_aa former_aa method,_aa the_aa same_aa key_aa is_aa used_aa or _
installed_aa in_aa both_aa the_aa systems_aa that_aa are_aa responsible_aa for_aa receiving_aa and_aa
transmitting_aa the_aa information._aa The_aa public_aa key_aa encryption,_aa on_aa the_aa other_aa
hand,_aa utilizes_aa two_a sets_aa of_ keys_aa simultaneously_aa namely_aa a_aa private_aa key_aa
and_aa a_aa public_ key_ to_aa strengthen_aa the_aa security_aa level._aa In_aa the_aa business_aa
context_aa of_aa MUSA,_a the_aa asymmetric_aa encryption_aa could_aa be_aa introduced _a to_aa
strengthen_aa the_aa security_aa level_aa (Encryption_aa and_aa Its_aa Importance_aa to_aa Device_aa
Networking,_aa 2019)._aa
Similarly,_aa hashing_aa has_aa also_aa been_aa introduced_aa in_aa the_aa security_aa policy._aa
The_aa hash_a methods_aa like_aa Secure _ Hash _aa Algorithms _aa (SHA-1, _aa SHA-2, _aa and _aa
SHA-3)_aa could_aa be_aa employed_aa so_aa that_a the_aa integrity_aa of_aa the _ organizational_aa
data_aa could_aa be_aa maintained_aa and_aa strengthened_aa (Secure_aa Hash_aa Algorithms_aa |_aa
Brilliant_aa Math_aa &_aa Science_aa Wiki,_aa 2019)._ These_ algorithms_aa are_aa designed_aa
with_aa strong_aa encryptions_aa so_ that_aa they_aa can_aa effectively_aa respond_aa to_aa online_aa
IT_aa 552_aa aa_aa aa_ aa_aa aa_a aa_aa aa_aa _aa aa_aa aa_ aa_aa aa_ aa_aa aa_a aa_aa aa_aa _aa aa_aa _aa aa_aa _aa _aa aa_aa aa_ aa_aa aa_ aa_aa aa_ aa_aa aa_aa aa_ aa_aa
_aa aa_aa aa_a aa_aa aa_aa _aa aa_aa _aa aa_aa aa_ aa_aa _aa aa_aa aa_ aa_aa aa_ aa_aa aa_a aa_aa aa_aa _aa _aa aa_aa _aa aa_aa _aa aa_aa aa_ aa_aa _aa aa_aa aa_a aa_aa aa_aa _aa
_aa aa_aa aa_a aa_aa aa_aa aa_ aa_aa aa_a aa_aa aa_ aa_aa aa_ aa_aa aa_a aa_aa aa_aa _aa aa_aa aa_ aa_aa aa_aa _aa aa_aa _aa aa_aa _aa aa_aa aa_aa aa_ aa_aa a _aa aa_aa aa_ aa_aa aa_
_aa aa_aa aa_a aa_aa aa_aa _aa aa_aa _aa aa_aa aa_ aa_aa _aa aa_aa aa_aa aa_aa aa_ aa_aa aa_a aa_aa aa_ aa_aa aa_aa _aa aa_aa aa_ aa_aa aa_a aa_aa aa_ aa_aa aa_a aa_aa aa_aa aa_aa 11
cyber-attacks._aa This_aa tool_aa would_aa enable_aa the_aa firm_aa to_aa keep _aa a _aa tab _aa on_aa any_aa
kind_aa of_aa modification_aa or_aa tampering_aa of_aa the_aa data_aa that_aa has_aa been_aa
transmitted_aa or_ received. _aa For_aa example, _aa in_aa case_aa there _aa is_aa even _aa a _aa slight _aa
change_aa in_aa any_aa text_aa file,_aa the_aa hash_aa value_aa of_aa the_aa modified_aa file_aa will_aa be_aa
different_aa from_aa the_a original_aa hash_aa value. _aa Thus_aa the_aa organization _aa will_aa come_aa
to_aa know_aa that_aa data_aa has_aa been_aa tampered_aa with_aa (Secure_aa Hash_aa Algorithms_aa |_aa
Brilliant_aa Math_aa &_aa Science_aa Wiki,_aa 2019)._ These_aa methods_aa would_aa facilitate_aa
the_aa business_aa entity_aa to_aa have_aa a_aa stronger_aa control_aa over_aa the_aa data_aa flow_aa
and_ thus_aa capture_ any_aa kind_aa of_aa unauthorized_aa alteration_aa of_aa data.
Conducting_aa regular_aa checks_aa and_aa auditing_aa of_aa user_aa accounts_aa
At_aa present,_aa one_aa of_ the_aa major_aa security_a gaps_aa that_aa have_aa been_aa
identified_aa in_aa the_aa MUSA_aa organization_aa relates_aa to_aa the_aa fact_aa that_aa the_aa logs_aa
of_aa the_aa employees_aa are_aa not_aa collected_aa or_aa analyzed._aa There_aa is_aa the_aa need_aa to_aa
introduce_aa a_aa robust_aa auditing_aa protocol_aa so _aa that_aa the_aa accounts_aa of_aa all_aa the_aa
organizational_aa personnel_aa of_aa MUSA_aa would_aa be_aa thoroughly_aa checked_aa and_aa
scrutinized._aa For_aa instance,_aa this_aa security_aa policy_aa could_aa be_aa applied_aa once_aa in_aa
a_a quarter_aa or_aa once_aa every_aa six_aa months_aa so_ that_a the_aa safety_ and_aa security_a
of_aa the_aa accounts_aa could_aa be_aa maintained._ While_aa conducting_ the_aa audit_aa
process_aa of_aa the_aa user_aa accounts,_aa it_aa is_aa necessary_aa to_aa take_aa in_aa to_aa account_a
a_aa number_aa of_aa aspects_aa such_aa as_aa whether_aa the_ account_aa is_aa active_aa or_aa
inactive_aa (disabled)._aa For_aa example,_aa both_aa these_aa accounts_aa could_ be _ targeted _aa
by_aa online_aa attackers_aa so_a that_aa they_aa could_aa gain_aa unauthorized_aa access_aa into_aa
the_aa organization’s_aa system._aa
Some_aa of_aa the_aa key_aa settings_aa and_aa properties_aa that_aa must_ be_aa considered_aa
while_aa implementing_aa the_aa security_aa policy_aa relating_aa to_aa the_aa auditing_aa of_aa user_aa
IT_aa 552_aa aa_aa aa_ aa_aa aa_a aa_aa aa_aa _aa aa_aa aa_ aa_aa aa_ aa_aa aa_a aa_aa aa_aa _aa aa_aa _aa aa_aa _aa _aa aa_aa aa_ aa_aa aa_ aa_aa aa_ aa_aa aa_aa aa_ aa_aa
_aa aa_aa aa_a aa_aa aa_aa _aa aa_aa _aa aa_aa aa_ aa_aa _aa aa_aa aa_ aa_aa aa_ aa_aa aa_a aa_aa aa_aa _aa _aa aa_aa _aa aa_aa _aa aa_aa aa_ aa_aa _aa aa_aa aa_a aa_aa aa_aa _aa
_aa aa_aa aa_a aa_aa aa_aa aa_ aa_aa aa_a aa_aa aa_ aa_aa aa_ aa_aa aa_a aa_aa aa_aa _aa aa_aa aa_ aa_aa aa_aa _aa aa_aa _aa aa_aa _aa aa_aa aa_aa aa_ aa_aa a _aa aa_aa aa_ aa_aa aa_
_aa aa_aa aa_a aa_aa aa_aa _aa aa_aa _aa aa_aa aa_ aa_aa _aa aa_aa aa_aa aa_aa aa_ aa_aa aa_a aa_aa aa_ aa_aa aa_aa _aa aa_aa aa_ aa_aa aa_a aa_aa aa_ aa_aa aa_a aa_aa aa_aa aa_aa 12
accounts_aa include_aa checking_aa of_a the_aa login_aa scripts,_a the_aa activity_aa of_a the_aa
workstations_aa and_aa the_aa frequency_aa of_aa change_aa of_aa passwords._aa The_aa audit_aa
procedure_aa would_aa help_ Multiple_aa Unite_ Security _aa Assurance _aa (MUSA) _aa
Corporation_aa to_aa determine_aa the_aa real-time_a status _ of _aa the _aa accounts _aa of _aa the _aa
users._aa For_aa example,_aa in_aa case_aa an_aa account_aa that_aa has_aa been_aa disabled_aa for_aa a_aa
long_aa time_aa is_aa active_aa the_aa Information_aa Technology_aa team_aa must_aa take_aa
necessary_aa actions_aa to_ check_aa the_aa activity._aa _aa _aa Similarly,_aa in_aa case,_aa an_aa
employee_aa or_aa user_ has_aa failed_aa to_aa change_aa or_aa update_aa his_aa or_aa her_aa
password_aa in_aa more_aa than_aa six_aa months,_aa he_aa must_aa be_aa notified_aa to_aa do_aa the_aa
same_aa on_aa an_aa urgent_aa basis._aa This_aa security_aa policy_aa would_aa be _aa of _aa vital_aa
importance_aa as_aa it_aa would_aa encourage_aa the_aa employees_a of_aa the_aa firm_aa to_aa take_aa
necessary_aa security_aa measures_aa at_aa the_aa individual_aa level._aa Employees_aa of_aa the_aa
firm_aa would_aa try_aa to_aa take_aa the_aa necessary_aa steps_aa at_aa their_aa individual_aa level_aa
so_aa that_aa the_a existing_aa security_aa gaps_ could_aa be_a effectively_aa addressed._aa
Introduction_aa of_aa media_aa access_aa control_aa policy_aa
A_a robust_aa media_ access _aa control _aa policy_aa could _ be _aa introduced _aa in _aa the _aa
business_aa setting_aa to_aa secure_aa the_aa connections_aa on_aa the_aa online_aa platform._aa In_
the_aa current_aa times,_aa a_aa large_aa number_aa of_aa business_ activities_aa are_aa taking_aa
place_aa in_aa open_aa virtual_ spaces_aa such_aa as_aa social_aa media_aa platforms_aa which _ is_aa
increasing_aa the_aa vulnerability_aa of_aa the_aa organization._aa In_aa order_aa to_aa give_aa a_aa
tough_aa fight_aa to_aa cybercriminals,_aa it_aa is_aa necessary_aa to_aa have_aa in_aa place_aa suitable_aa
media_aa access_aa control_aa policies_aa and_aa guidelines_aa which_aa would_aa guide_aa the_aa
employees_aa while_aa carrying_aa out_ online_aa business_aa activities._aa
The_aa policy_aa would_aa play_aa a_aa critical_aa role_aa to_aa strengthen_aa the_aa firm’s_aa security_aa
system_aa and_aa address_aa the_ existing_aa security_aa gaps._aa This_aa is_aa because;_aa the_aa
IT_aa 552_aa aa_aa aa_ aa_aa aa_a aa_aa aa_aa _aa aa_aa aa_ aa_aa aa_ aa_aa aa_a aa_aa aa_aa _aa aa_aa _aa aa_aa _aa _aa aa_aa aa_ aa_aa aa_ aa_aa aa_ aa_aa aa_aa aa_ aa_aa
_aa aa_aa aa_a aa_aa aa_aa _aa aa_aa _aa aa_aa aa_ aa_aa _aa aa_aa aa_ aa_aa aa_ aa_aa aa_a aa_aa aa_aa _aa _aa aa_aa _aa aa_aa _aa aa_aa aa_ aa_aa _aa aa_aa aa_a aa_aa aa_aa _aa
_aa aa_aa aa_a aa_aa aa_aa aa_ aa_aa aa_a aa_aa aa_ aa_aa aa_ aa_aa aa_a aa_aa aa_aa _aa aa_aa aa_ aa_aa aa_aa _aa aa_aa _aa aa_aa _aa aa_aa aa_aa aa_ aa_aa a _aa aa_aa aa_ aa_aa aa_
_aa aa_aa aa_a aa_aa aa_aa _aa aa_aa _aa aa_aa aa_ aa_aa _aa aa_aa aa_aa aa_aa aa_ aa_aa aa_a aa_aa aa_ aa_aa aa_aa _aa aa_aa aa_ aa_aa aa_a aa_aa aa_ aa_aa aa_a aa_aa aa_aa aa_aa 13
employees_aa would_aa be_aa able_aa to_aa carry_aa out_aa activities_aa in_aa a_aa careful_aa and_aa
conscious_aa manner_aa so_aa that_aa online_aa hackers_ would _aa not _aa get _a the_aa scope_aa to_aa
gain_aa unauthorized_aa access_aa into_aa the_aa network_aa (Media_aa Access_aa Control_aa
Security_aa Overview_aa -_aa TechLibrary_aa -_aa Juniper_aa Networks,_aa 2019)._aa For_aa
example,_aa the_aa firm_aa could_aa use_aa a_aa single_aa login_aa id_aa on_aa social_aa media_aa
platforms_aa to_ design_a its_a social_a media_ marketing_aa strategy._ In_aa case _ a _
second_aa user_aa id_aa is_aa created_aa or_aa used,_aa the_aa same_aa could_aa be_aa blocked_aa for_aa
security_aa reasons._aa _aa Similarly,_aa MUSA_aa could_aa also_aa implement_aa Data_a Loss_aa
Prevention_aa (DLP)_aa tools_aa so_aa that_aa it_aa could_ keep_aa a_aa tab_aa on_aa the_aa flow_aa of_aa
the_aa sensitive_aa information_aa in_aa the_aa corporate_aa network_aa (What_aa is_aa Data_aa Loss_aa
Prevention_aa (DLP)?_aa A_aa Definition_aa of_aa Data_aa Loss_aa Prevention,_aa 2019)._aa
Implementation_aa of_aa configuration_aa change_aa management_aa policy_aa
Change_aa management_aa refers_aa to_aa the_aa formal_aa process_aa of_aa making_aa some_aa
kind_aa of_aa change_aa in_aa the_aa Information_aa Technology_aa system_aa of_aa an_aa
organization._a In_aa MUSA,_aa a_aa configuration_aa change_aa management_aa policy_aa could_aa
be_aa implemented_aa so_aa that_aa the_aa processes_aa relating_aa to_ change_aa could_ be_aa
effectively_aa controlled._aa The_aa policy_aa could_aa have_aa a_aa constructive_aa implication_aa
on_aa the_aa security_ model _aa of _aa the _aa organization. _aa For _aa example, _aa the _ security _aa
policy_aa would_a make_aa sure _ that_aa the_aa integrity_aa of_aa the_aa existing_aa policies_aa and_aa
codes_aa is_aa in_aa place._aa In_aa addition_aa to_aa this,_aa the_aa new_aa policy_aa would_aa help_aa
to_aa identify_aa security_aa flaws._aa It_aa would_aa act_aa as_aa a_aa baseline_aa that_aa could_aa be_
used_aa for_aa comparing_aa the_aa technical_aa codes_aa after_aa any_aa changes_aa have_aa been_aa
introduced_aa in_aa the_aa IT_aa system._aa _aa The_aa policy_a would_aa be_ necessary_aa for_aa
improving_aa the_aa security_ of_aa the_aa firm_aa as_aa it_aa would_aa make_aa sure_aa that_aa there_aa
exists_aa compliance_aa with_aa the_aa minimum_aa acceptable_aa system_aa configuration_aa
IT_aa 552_aa aa_aa aa_ aa_aa aa_a aa_aa aa_aa _aa aa_aa aa_ aa_aa aa_ aa_aa aa_a aa_aa aa_aa _aa aa_aa _aa aa_aa _aa _aa aa_aa aa_ aa_aa aa_ aa_aa aa_ aa_aa aa_aa aa_ aa_aa
_aa aa_aa aa_a aa_aa aa_aa _aa aa_aa _aa aa_aa aa_ aa_aa _aa aa_aa aa_ aa_aa aa_ aa_aa aa_a aa_aa aa_aa _aa _aa aa_aa _aa aa_aa _aa aa_aa aa_ aa_aa _aa aa_aa aa_a aa_aa aa_aa _aa
_aa aa_aa aa_a aa_aa aa_aa aa_ aa_aa aa_a aa_aa aa_ aa_aa aa_ aa_aa aa_a aa_aa aa_aa _aa aa_aa aa_ aa_aa aa_aa _aa aa_aa _aa aa_aa _aa aa_aa aa_aa aa_ aa_aa a _aa aa_aa aa_ aa_aa aa_
_aa aa_aa aa_a aa_aa aa_aa _aa aa_aa _aa aa_aa aa_ aa_aa _aa aa_aa aa_aa aa_aa aa_ aa_aa aa_a aa_aa aa_ aa_aa aa_aa _aa aa_aa aa_ aa_aa aa_a aa_aa aa_ aa_aa aa_a aa_aa aa_aa aa_aa 14
requirements_aa (IT0125_aa -_aa Configuration_aa Management,_aa 2019,_aa p_a 1)._aa _aa The_aa
policy_aa could_aa safeguard_aa MUSA_aa against_aa malicious_aa threats_aa and_aa risk_aa that_aa
could_aa arise_aa in_a the_aa virtual_a environment_aa of_aa the_aa company._aa
B. Social_aa Engineering
Social_aa engineering_aa can_aa be_aa defined_aa as_aa the_aa act_aa of_aa tricking_aa someone_aa
so_aa that_aa he_aa or_aa she_aa will_aa make_aa security_aa blunders_ which _aa can _aa ultimately _aa
have_aa an_aa adverse_aa impact_aa on_aa the_aa security_aa model._aa In_aa the_aa case_aa of_aa
Multiple_aa Unite_aa Security_ Assurance_aa Corporation, _aa the _aa following_aa policies _aa
have_aa been_a designed_aa so_aa that_aa protection_aa against_aa social_aa engineering_aa could_aa
be_aa possible_aa (What_aa is_aa Social_a Engineering_aa |_aa Attack _aa Techniques_aa &_aa
Prevention_aa Methods_aa |_aa Imperva,_aa 2019)._aa In_aa the_aa current_ times,_aa online _aa
hackers_aa are_aa using_aa sophisticated_aa tools_aa so_aa that_aa they_ can_aa con_aa professionals_aa
to_aa disclose_aa sensitive_aa information_aa such_aa as_aa passwords._aa The_aa security_aa policies_aa
can_aa help_aa MUSA_aa to_aa be_aa well_aa equipped_ against_ such _aa kinds_aa of _ online _aa
threats._aa
Providing_aa annual_aa cybersecurity_aa awareness_aa training_aa
One_aa of_aa the_aa basic_aa steps_aa is_aa that_aa the_aa organization_aa must_aa design _aa a_aa
robust_aa annual_aa cyber_aa security_aa awareness_aa training_aa program_aa so_aa that_aa its_aa
employees_aa in_aa all_aa the_aa departments_aa would_aa be_aa empowered_aa to_aa handle_aa a_aa
tricky_aa situation._aa As_aa the_aa name_ suggests,_aa the_aa training_ program_aa would_aa be_aa
conducted_aa on_aa a_aa yearly_aa basis_ so_aa that_aa every_aa time,_aa the_ employees_aa would_aa
be_aa able_aa to_aa handle_aa sophisticated_aa online_aa threats._aa The_aa training_aa would_aa
encompass_aa basis_aa security_aa concepts_aa such_aa as:
❖ Do_aa not_aa download_aa attachments_aa from_aa unknown _a parties.
❖ Do_aa not_aa open_aa the_a emails_aa and_aa messages_a that_aa are_aa in_aa spam_aa mail.
IT_aa 552_aa aa_aa aa_ aa_aa aa_a aa_aa aa_aa _aa aa_aa aa_ aa_aa aa_ aa_aa aa_a aa_aa aa_aa _aa aa_aa _aa aa_aa _aa _aa aa_aa aa_ aa_aa aa_ aa_aa aa_ aa_aa aa_aa aa_ aa_aa
_aa aa_aa aa_a aa_aa aa_aa _aa aa_aa _aa aa_aa aa_ aa_aa _aa aa_aa aa_ aa_aa aa_ aa_aa aa_a aa_aa aa_aa _aa _aa aa_aa _aa aa_aa _aa aa_aa aa_ aa_aa _aa aa_aa aa_a aa_aa aa_aa _aa
_aa aa_aa aa_a aa_aa aa_aa aa_ aa_aa aa_a aa_aa aa_ aa_aa aa_ aa_aa aa_a aa_aa aa_aa _aa aa_aa aa_ aa_aa aa_aa _aa aa_aa _aa aa_aa _aa aa_aa aa_aa aa_ aa_aa a _aa aa_aa aa_ aa_aa aa_
_aa aa_aa aa_a aa_aa aa_aa _aa aa_aa _aa aa_aa aa_ aa_aa _aa aa_aa aa_aa aa_aa aa_ aa_aa aa_a aa_aa aa_ aa_aa aa_aa _aa aa_aa aa_ aa_aa aa_a aa_aa aa_ aa_aa aa_a aa_aa aa_aa aa_aa 15
❖ Do_aa not_aa open_aa emails_aa that_aa have_aa been_aa sent_ by_aa unknown_aa parties.
In_aa addition_aa to_aa this,_aa the_aa annual_aa cybersecurity_aa awareness_aa training_aa
would_aa also_aa involve_aa technical_aa concepts_aa that_aa the_aa users_aa need_aa to_aa understand_aa
so_aa that_ the_aa security_aa of_aa the_aa organization_aa could_aa be_ strengthened._aa For_aa
instance,_aa MUSA_aa could_aa introduce_aa educational_aa resources_aa relating_a to_aa
cybersecurity_aa training_aa and_aa conduct _aa regular_aa tests._aa Only_aa after_aa the_aa
employees_aa of_aa MUSA_aa would_aa be_aa able_aa to_aa pass_aa these_aa tests,_aa they_aa would_aa
gain_aa access_aa to_ the_aa firm’s_aa system_a and_aa network._aa
Introduction_aa of_aa intrusion_aa detection/prevention_aa system_aa
An_aa intrusion_aa detection/_aa prevention_aa system_aa could_aa be_ introduced_aa in_aa
Multiple_aa Unite_aa Security_aa Assurance_aa Corporation_aa so_aa that_aa it_aa could_aa
thoroughly_aa examine_aa the_ traffic _aa of _aa the _aa network. _aa This _aa system _aa would _aa be _aa
set_aa behind_aa the_aa firewall_aa so_a that_aa it_ could_aa detect_aa and_aa prevent_a
‘vulnerability_aa exploits’._aa Vulnerability_aa exploits_aa can_aa come_aa in_aa the_aa form_aa of_aa
malicious_aa input_ and _ could_aa compromise_aa the_aa security_aa of_aa the_aa IT_aa
infrastructure_aa of_aa the_aa business._aa _aa By_aa introducing_aa this_aa layer_aa of_aa security,_aa
harmful_aa content_aa could_aa be_aa filtered_aa out_ (What_aa is_aa an_aa Intrusion_ Prevention _aa
System?_aa -_ Palo_aa Alto_ Networks, _ 2019). _aa The _a intrusion _aa detection _aa system _a
would_aa be_aa responsible_aa to_aa scan_aa the_aa network_aa traffic_aa and_aa report_aa back_aa on_aa
any_aa identified_aa threats_aa or_aa risks._aa The_aa intrusion_aa prevention_aa system_aa could_aa
be_aa employed_aa as_aa it_aa would_aa help_a to_ carefully_aa analyze_aa and_aa take_aa suitable_aa
actions_aa on_aa the_aa network_aa traffic_aa flow_aa of_ MUSA._aa By_aa introducing_aa these_aa
tools,_aa the_aa security_aa system_aa of_aa the_aa firm_aa could_aa be_aa improved_aa and_aa harmful_aa
elements_aa in_aa the_aa network_aa could_ be_aa identified._aa
Adoption_aa of_aa mandatory_aa vacation_aa policy
IT_aa 552_aa aa_aa aa_ aa_aa aa_a aa_aa aa_aa _aa aa_aa aa_ aa_aa aa_ aa_aa aa_a aa_aa aa_aa _aa aa_aa _aa aa_aa _aa _aa aa_aa aa_ aa_aa aa_ aa_aa aa_ aa_aa aa_aa aa_ aa_aa
_aa aa_aa aa_a aa_aa aa_aa _aa aa_aa _aa aa_aa aa_ aa_aa _aa aa_aa aa_ aa_aa aa_ aa_aa aa_a aa_aa aa_aa _aa _aa aa_aa _aa aa_aa _aa aa_aa aa_ aa_aa _aa aa_aa aa_a aa_aa aa_aa _aa
_aa aa_aa aa_a aa_aa aa_aa aa_ aa_aa aa_a aa_aa aa_ aa_aa aa_ aa_aa aa_a aa_aa aa_aa _aa aa_aa aa_ aa_aa aa_aa _aa aa_aa _aa aa_aa _aa aa_aa aa_aa aa_ aa_aa a _aa aa_aa aa_ aa_aa aa_
_aa aa_aa aa_a aa_aa aa_aa _aa aa_aa _aa aa_aa aa_ aa_aa _aa aa_aa aa_aa aa_aa aa_ aa_aa aa_a aa_aa aa_ aa_aa aa_aa _aa aa_aa aa_ aa_aa aa_a aa_aa aa_ aa_aa aa_a aa_aa aa_aa aa_aa 16
Multiple_aa Unite_a Security_aa Assurance_aa (MUSA)_aa Corporation_aa could_aa
implement_aa a_aa mandatory_aa vacation_aa policy_aa which_aa would_aa require_aa its_aa
employees_aa to_aa take_ leaves_aa on_aa a_aa yearly_ basis. _aa Such _aa a_aa policy _aa would _aa
have_aa a_aa direct_aa impaction_aa on_aa the_aa security_aa model_aa that_aa is_aa implemented_aa in_aa
the_aa business_aa setting._aa A_aa mandatory _ vacation_aa policy_ could_aa play_ a_aa key_aa
role_aa in_aa the_aa organizational_aa context,_aa as_ the_aa firm_aa would_aa be_aa able_aa to_a
detect_aa fraudulent_aa activities._aa The_aa policy_aa would_aa force_aa all_aa employees_aa
including_aa the_aa suspicious_aa employees_aa to_aa take_aa leave._aa So_aa they_aa would_aa have_a
less_aa amount_a of_aa time_aa with_aa them_aa to_aa use_aa their_aa position_aa in_aa the_aa firm_aa to_aa
conduct_aa activities_aa with_aa malicious_aa intention_aa (Time_aa off_aa to_aa discover_aa fraud_aa -
_aa FSS, _aa 2019). _aa During _aa the _aa vacation _aa time _aa of _aa suspicious _aa employees, _aa the _aa
management_aa of_aa the_aa company_aa could_aa carry_aa out_aa checks_aa of_aa the_aa Information_aa
Technology_a infrastructure_aa so_aa that_aa malicious_aa behavior_aa could_aa be_aa identified._aa
Segregation_aa of_aa duties_aa
Segregation_aa of_aa duties_aa would_aa act_aa as_aa one_aa of_aa the_aa key_aa concepts_aa of_aa
internal_aa control_aa that_aa could_aa positively_aa impact_aa the_aa security_aa of_aa the_aa IT_aa
system._aa By_aa creating_aa specific_aa responsibilities_aa and_aa duties_aa that _ each _ and _aa
every_aa employee_aa has_aa to_aa perform_aa in_aa the_aa business_aa setting,_aa the_aa management_aa
of_aa MUSA_ could _aa make _aa sure _aa that _aa unwanted _aa threats _aa or _aa risks _aa and _aa
conflicts_aa of_aa interests_aa could_aa be_aa avoided_aa (Behr,_aa 2019)._aa The_aa fundamental_aa
objective_aa of_aa the_ policy_aa would_aa be_aa to_aa disseminate_aa the_aa business_aa activities_aa
and_aa linked_aa privileges_aa so_a that_aa the_aa security_aa model_aa could_aa be_aa strengthened._aa
Such_aa a_aa policy_aa would_aa make _aa sure_aa that _ the _ employees _aa would _aa use _aa their _aa
workstations_aa in_ a_aa responsible_aa manner _aa so _aa that_aa no_aa one_aa can_aa use_aa their_aa
computer_aa systems_aa to_aa do_aa any_aa work_a without_aa their_aa prior_aa knowledge._aa This_aa
IT_aa 552_aa aa_aa aa_ aa_aa aa_a aa_aa aa_aa _aa aa_aa aa_ aa_aa aa_ aa_aa aa_a aa_aa aa_aa _aa aa_aa _aa aa_aa _aa _aa aa_aa aa_ aa_aa aa_ aa_aa aa_ aa_aa aa_aa aa_ aa_aa
_aa aa_aa aa_a aa_aa aa_aa _aa aa_aa _aa aa_aa aa_ aa_aa _aa aa_aa aa_ aa_aa aa_ aa_aa aa_a aa_aa aa_aa _aa _aa aa_aa _aa aa_aa _aa aa_aa aa_ aa_aa _aa aa_aa aa_a aa_aa aa_aa _aa
_aa aa_aa aa_a aa_aa aa_aa aa_ aa_aa aa_a aa_aa aa_ aa_aa aa_ aa_aa aa_a aa_aa aa_aa _aa aa_aa aa_ aa_aa aa_aa _aa aa_aa _aa aa_aa _aa aa_aa aa_aa aa_ aa_aa a _aa aa_aa aa_ aa_aa aa_
_aa aa_aa aa_a aa_aa aa_aa _aa aa_aa _aa aa_aa aa_ aa_aa _aa aa_aa aa_aa aa_aa aa_ aa_aa aa_a aa_aa aa_ aa_aa aa_aa _aa aa_aa aa_ aa_aa aa_a aa_aa aa_ aa_aa aa_a aa_aa aa_aa aa_aa 17
regulatory_aa mandate_aa would_aa have_aa a_aa direct_aa impact_aa on_aa the_aa IT_aa security_aa of_aa
MUSA._aa _aa The_aa proper_aa categorization_aa and_aa division_aa of_aa work_aa would_aa be_aa a_aa
major_aa step_aa towards_aa a_ safe_aa and_aa secure_aa IT_aa system_aa as_aa the_aa employees_aa
would_aa take_ ownership_aa of_aa their_aa duties_aa and_aa act_aa in_aa a_aa responsible_aa manner._aa
It_ could_aa minimize_aa the_aa vulnerability_aa of_aa MUSA_aa in_aa the_aa virtual_aa setting_aa
(Behr,_aa 2019)._aa
Personally_aa identifiable_aa information_aa breaches_aa
Personally,_aa identifiable_aa information_aa could_aa be_aa introduced_aa so_aa that_aa any_aa
data_aa or_aa information_aa could_aa be_aa used_aa for_aa the_aa purpose_aa of_aa identifying_aa
particular_aa organizational_aa personnel_aa in_aa MUSA._aa Private_aa data_aa could_aa be_aa
saved_aa by_aa the_aa company_aa so_aa that_aa it_aa would_aa be_aa in_aa a_aa position_aa to_aa identify_aa
the_aa individuals_aa that_aa are_aa responsible_aa for_aa a_aa data_aa breach_aa incident._aa This_aa
policy_aa would_aa make_aa sure_a that_aa MUSA_aa has_aa the_aa power_aa to_aa take_aa necessary_aa
action_aa or_aa precautionary_aa action_aa to_aa safeguard_aa itself_aa from_aa unauthorized_aa
access,_aa data_aa loss_aa or_aa theft_aa (Behr,_aa 2019)._aa This_aa is_aa a_aa vital_aa security_aa
policy_aa that_aa could_aa be_aa implemented_a at_aa the_a organizational_aa level_aa so_a that_aa
specific_aa measures_aa could_ be_ taken _ to _a tackle _aa data _aa security _aa breaches _aa and _aa
incidents._aa
Ensuring_aa a_aa sound_aa connection_aa between_aa the_aa data_aa sender_aa and_aa the_a
data_aa receiver_aa
In_aa order_aa to_aa make_aa sure_aa that_aa there_aa exist_aa a_aa sound_aa and_aa secure_aa
connection_aa between_aa a_aa data_aa sender_aa and_a a_aa data_aa receiver,_aa it_aa is_aa necessary_aa
to_aa keep_aa a_aa number_aa of_aa security_aa instruments_aa in_aa place_aa such_aa as_aa firewall,_aa
intrusion_aa detection/_aa prevention_aa system_aa and_aa antivirus._aa Such_aa security_aa tools_aa
would_aa play_aa a_aa key_aa role_aa to_aa address_aa the_aa security_aa concerns_aa and_aa establish_aa
IT_aa 552_aa aa_aa aa_ aa_aa aa_a aa_aa aa_aa _aa aa_aa aa_ aa_aa aa_ aa_aa aa_a aa_aa aa_aa _aa aa_aa _aa aa_aa _aa _aa aa_aa aa_ aa_aa aa_ aa_aa aa_ aa_aa aa_aa aa_ aa_aa
_aa aa_aa aa_a aa_aa aa_aa _aa aa_aa _aa aa_aa aa_ aa_aa _aa aa_aa aa_ aa_aa aa_ aa_aa aa_a aa_aa aa_aa _aa _aa aa_aa _aa aa_aa _aa aa_aa aa_ aa_aa _aa aa_aa aa_a aa_aa aa_aa _aa
_aa aa_aa aa_a aa_aa aa_aa aa_ aa_aa aa_a aa_aa aa_ aa_aa aa_ aa_aa aa_a aa_aa aa_aa _aa aa_aa aa_ aa_aa aa_aa _aa aa_aa _aa aa_aa _aa aa_aa aa_aa aa_ aa_aa a _aa aa_aa aa_ aa_aa aa_
_aa aa_aa aa_a aa_aa aa_aa _aa aa_aa _aa aa_aa aa_ aa_aa _aa aa_aa aa_aa aa_aa aa_ aa_aa aa_a aa_aa aa_ aa_aa aa_aa _aa aa_aa aa_ aa_aa aa_a aa_aa aa_ aa_aa aa_a aa_aa aa_aa aa_aa 18
a_aa safe_ environment_ where_aa communication _aa between_aa a _a data_aa sender _aa and _ a _aa
data_aa receiver_aa could_aa take_aa place._aa Similarly,_aa the_aa use_aa of_ encryptions_aa or_aa
hashing_aa would_aa also_aa play_aa a_aa critical_aa role._aa This_aa is_aa because_aa these_aa security_aa
approaches_aa would_a make_aa sure _aa that_aa the_aa data_aa that_aa is_aa being_aa received_a or_aa
transmitted_aa cannot_ be_aa tampered_ with _a or _aa altered _aa from _aa its _aa intended _aa
meaning_aa (Behr,_aa 2019)._aa These_a security_aa measures_aa would_a be_ of_aa paramount_aa
importance_aa for_aa MUSA_aa as_aa they_aa could_aa strengthen_aa the _aa security_aa
infrastructure_aa and_aa limit_aa the_aa scope_aa of_aa online_aa attackers_aa to_aa alter_aa the_aa
sensitive_aa data_aa or_aa information_aa relating_aa to_aa the_ business._aa Thus_aa in_ order_aa to_a
address_aa the_aa issue_aa relating _aa to_aa poor_aa communication_aa on_aa the_aa IT_aa platform_aa
of_aa MUSA,_aa it_aa is_aa necessary_aa to_aa encrypt_ all _aa the _aa messages _ so _aa that _aa its _aa
real_aa meaning_aa could_aa only_aa be_aa deciphered_aa by_aa the_aa intended_aa user._aa _ _aa _aa _aa
_aa aa_aa aa_aa _aa aa_aa aa_aa _aa aa_aa _aa aa_aa aa_aa
Continuous_aa Monitoring_aa Plan
A_aa continuous_aa monitoring_aa plan_aa is_aa necessary_aa as_aa it_aa can_aa help_aa to_aa
keep_aa a_aa check_aa on_aa the_aa security_aa control_aa model_aa that_aa has_aa been_aa designed_aa
and_aa implemented_aa in_aa the_ organizational_aa setting._ This_aa plan_ fundamentally_aa
lays_aa out_aa the_aa foundation_aa for_aa regularly_aa and_aa consistently_aa monitoring_aa the_aa
organization_aa against_ malicious_aa activities_aa and_aa intentional_aa as_aa well_aa as_aa
unintentional_aa threats._aa In_aa order_aa to_aa make_aa sure_aa that_aa the_aa monitoring_a plan_aa
is_aa effective_aa and_aa serves_aa the_aa desired_aa purpose,_aa it_aa is_aa necessary_aa to_aa focus_aa
on_aa a_aa number_aa of_a elements_aa such_aa as_aa the_aa core_aa features_aa of_aa the_aa work_aa
IT_aa 552_aa aa_aa aa_ aa_aa aa_a aa_aa aa_aa _aa aa_aa aa_ aa_aa aa_ aa_aa aa_a aa_aa aa_aa _aa aa_aa _aa aa_aa _aa _aa aa_aa aa_ aa_aa aa_ aa_aa aa_ aa_aa aa_aa aa_ aa_aa
_aa aa_aa aa_a aa_aa aa_aa _aa aa_aa _aa aa_aa aa_ aa_aa _aa aa_aa aa_ aa_aa aa_ aa_aa aa_a aa_aa aa_aa _aa _aa aa_aa _aa aa_aa _aa aa_aa aa_ aa_aa _aa aa_aa aa_a aa_aa aa_aa _aa
_aa aa_aa aa_a aa_aa aa_aa aa_ aa_aa aa_a aa_aa aa_ aa_aa aa_ aa_aa aa_a aa_aa aa_aa _aa aa_aa aa_ aa_aa aa_aa _aa aa_aa _aa aa_aa _aa aa_aa aa_aa aa_ aa_aa a _aa aa_aa aa_ aa_aa aa_
_aa aa_aa aa_a aa_aa aa_aa _aa aa_aa _aa aa_aa aa_ aa_aa _aa aa_aa aa_aa aa_aa aa_ aa_aa aa_a aa_aa aa_ aa_aa aa_aa _aa aa_aa aa_ aa_aa aa_a aa_aa aa_ aa_aa aa_a aa_aa aa_aa aa_aa 19
setting,_aa the_aa work_aa plan,_aa and_aa employee_aa readiness._aa In_aa Multiple_aa Unite_aa
Security_aa Assurance_aa (MUSA)_aa Corporation,_aa there_aa is_aa the_aa need_aa to_ establish_aa
a_aa properly_aa functional_aa continuous_aa monitoring_aa plan_aa so_a that_aa the_aa various_aa
security_aa gaps_ that_aa exist_ in_aa the_aa organizational_aa setting_aa can_aa be_aa effectively_aa
addressed._aa
Work_aa Settings
In_aa the_aa work_aa setting,_aa a_aa wide_ range_aa of_aa factors_aa come_aa into_aa play_aa
that_aa can_aa adversely_aa impact_aa the_aa work_aa ambiance._aa Some_aa of_aa the_aa most_
common_aa elements_aa are_aa the_ non-implemented _aa security _aa protocols,_aa poorly_aa
implemented_aa management_aa policies,_aa and_aa other_aa distractions_aa and_ obstacles._aa It_aa
is_aa necessary_aa to_aa take_aa the_aa necessary_aa steps_aa by_aa the_aa managers_aa and_aa the_aa
management_aa team_aa so_aa that_aa such_aa negative_aa elements_aa which_aa increase_aa the_aa
security_aa vulnerability_aa of_aa the_aa firm_aa can_aa be_aa kept_aa at_aa a_aa distance._aa
The_aa management_aa must_aa take_aa careful_aa measures_aa to_aa ensure_aa that_aa all_a the_aa
security_aa protocols_a and_aa policies_aa are_ systematically_aa implemented_aa throughout_aa
the_aa firm._aa Such_aa a_aa step_aa is_a a_aa necessity_aa as_aa it_aa will_aa help_aa the_aa organization_aa
in_aa the_aa long_aa run_aa to_aa have_a better_aa control_ over_aa its_aa costs,_aa risks_aa and_aa
system_aa network_aa (Five_aa tips_aa for_aa managing_aa project_aa change_aa requests,_aa 2019)._aa
The_aa major_aa changes_aa that_aa take_aa place_aa in_aa the_aa IT_aa setting_aa must_aa be_aa
carefully_aa documented_aa and_aa recorded_aa so_aa that_aa they_aa can_aa be_aa assessed_aa as_aa
per_aa requirement._aa Some_ of _aa the _ key _aa steps _aa that _aa need _aa to _aa be _aa followed _aa
while_aa introducing_aa a_a major_aa change_aa in_aa the_aa organization_aa include:
• A_aa request_aa must_aa be_aa made_aa so_aa that_aa a_ change_aa can_aa be_aa introduced._aa
It_ needs_aa to_ be_aa documented_aa clearly.
IT_aa 552_aa aa_aa aa_ aa_aa aa_a aa_aa aa_aa _aa aa_aa aa_ aa_aa aa_ aa_aa aa_a aa_aa aa_aa _aa aa_aa _aa aa_aa _aa _aa aa_aa aa_ aa_aa aa_ aa_aa aa_ aa_aa aa_aa aa_ aa_aa
_aa aa_aa aa_a aa_aa aa_aa _aa aa_aa _aa aa_aa aa_ aa_aa _aa aa_aa aa_ aa_aa aa_ aa_aa aa_a aa_aa aa_aa _aa _aa aa_aa _aa aa_aa _aa aa_aa aa_ aa_aa _aa aa_aa aa_a aa_aa aa_aa _aa
_aa aa_aa aa_a aa_aa aa_aa aa_ aa_aa aa_a aa_aa aa_ aa_aa aa_ aa_aa aa_a aa_aa aa_aa _aa aa_aa aa_ aa_aa aa_aa _aa aa_aa _aa aa_aa _aa aa_aa aa_aa aa_ aa_aa a _aa aa_aa aa_ aa_aa aa_
_aa aa_aa aa_a aa_aa aa_aa _aa aa_aa _aa aa_aa aa_ aa_aa _aa aa_aa aa_aa aa_aa aa_ aa_aa aa_a aa_aa aa_ aa_aa aa_aa _aa aa_aa aa_ aa_aa aa_a aa_aa aa_ aa_aa aa_a aa_aa aa_aa aa_aa 20
• The_aa change_aa log_aa has_aa to_aa be_aa updated_aa in_aa a_aa timely_aa manner_aa so_aa
that_aa no_aa details_aa will_aa be_aa skipped._aa The_aa key_aa elements_aa that_aa will_aa be_aa
altered_aa have_aa to_ be_aa written_aa down_ in_aa this_aa simple_aa document._aa a_aa aa_aa aa_
• The_aa proper_aa assessment_aa of_aa the_aa change_aa request_aa is_aa an_aa important_aa
step._aa It_aa will_aa basically_a help _ to _aa develop_aa a_a sense_aa of_ urgency._aa In_aa
the_aa case_ of _aa MUSA, _aa it _aa is_aa extremely_ vital _aa to_ introduce _aa the _aa
necessary_aa changes_aa so_aa that_aa the_aa quality_aa of_aa security_aa can_aa be_aa
upgraded._aa
• The_aa thorough_aa assessment_aa of_a the_aa change_aa against_aa the_aa set_aa criteria_aa
is_aa of_aa paramount_ importance._aa It_aa will_aa assist_aa in_aa deciding_aa whether_aa
the_aa change_aa has_aa to_aa be_aa rejected_aa or_aa approved_aa
• The_aa final_aa step_ basically_aa involves_aa the_ decision _aa that _aa is _ taken _aa
regarding_aa the_aa approval_aa or_aa the_aa rejection_aa of_aa the_aa change._aa During_aa
this_aa stage,_aa the_aa outcome_aa has_aa to_aa be_ communicated_aa to _aa the_aa key_aa
stakeholders_aa so_aa that_aa they_aa will_aa be_aa aware_aa of_aa the_aa changes_aa that_aa
have_aa been_aa introduced_aa in_aa MUSA_aa to_aa strengthen_aa the_aa security_aa model_aa
(Five_aa tips_aa for_a managing_aa project_aa change_aa requests,_aa 2019).
The_aa obstacles_aa such_aa as_aa distractions_aa can_aa be_aa managed_ by_aa making_aa
sure_a that_aa the_aa organizational_aa personnel_aa get_ the _ requisite _aa space_aa and_aa time_aa
to_aa focus_aa on_ their_aa job._aa The_a managers_aa and_aa supervisors_a must_aa interact_aa and_aa
engage_aa with_aa the_aa subordinates_aa to_ get_aa to_ know_aa of_aa the_aa key_aa factors_aa and_aa
elements_aa that_aa bother_aa the_aa employees_aa and_ adversely _aa impact _ their _aa
performance_aa (Mark,_aa Czerwinski_aa &_aa Iqbal,_aa 2018)._a
MUSA_aa has_aa to_aa make_aa sure_aa that_aa the_aa management_aa policies_aa are_aa
properly_aa implemented_aa and_ executed_aa throughout_aa the_aa organization_aa (5_aa bad_aa
IT_aa 552_aa aa_aa aa_ aa_aa aa_a aa_aa aa_aa _aa aa_aa aa_ aa_aa aa_ aa_aa aa_a aa_aa aa_aa _aa aa_aa _aa aa_aa _aa _aa aa_aa aa_ aa_aa aa_ aa_aa aa_ aa_aa aa_aa aa_ aa_aa
_aa aa_aa aa_a aa_aa aa_aa _aa aa_aa _aa aa_aa aa_ aa_aa _aa aa_aa aa_ aa_aa aa_ aa_aa aa_a aa_aa aa_aa _aa _aa aa_aa _aa aa_aa _aa aa_aa aa_ aa_aa _aa aa_aa aa_a aa_aa aa_aa _aa
_aa aa_aa aa_a aa_aa aa_aa aa_ aa_aa aa_a aa_aa aa_ aa_aa aa_ aa_aa aa_a aa_aa aa_aa _aa aa_aa aa_ aa_aa aa_aa _aa aa_aa _aa aa_aa _aa aa_aa aa_aa aa_ aa_aa a _aa aa_aa aa_ aa_aa aa_
_aa aa_aa aa_a aa_aa aa_aa _aa aa_aa _aa aa_aa aa_ aa_aa _aa aa_aa aa_aa aa_aa aa_ aa_aa aa_a aa_aa aa_ aa_aa aa_aa _aa aa_aa aa_ aa_aa aa_a aa_aa aa_ aa_aa aa_a aa_aa aa_aa aa_aa 21
practices_aa that_aa hinder_aa your_aa security,_aa and_aa how_aa to_aa improve_aa it_aa |_aa
TechBeacon,_aa 2019)._aa It_aa will_a play_aa a_aa vital_aa role_ to_aa make_aa sure_aa that_aa
security_aa violations_aa can_aa be_aa curtailed_aa to_aa a_aa possible_aa extent._aa Some_aa of_aa the_aa
negative_aa practices_aa that_aa must_aa be_aa eliminated_aa at_aa once_aa in_aa the_aa organizational_aa
setting_aa are_aa as_aa follows:_aa
• Sharing_aa of_aa common_aa sensitive_aa passwords_aa throughout_aa the_ entity
• Allowing_aa unauthorized_a users_aa in_aa the_aa secured_aa and_aa restricted_aa read_aa of_aa
the_aa organization
• Ineffective_aa implementation_aa of_ the _aa intrusion _ detection _aa system _aa (IDS)_aa
and_aa intrusion_aa prevention_aa system_aa (IPS)
• Continuing_aa to_aa use_a outdated_aa technological_aa approaches
These_aa are_aa some_aa of_aa the_aa practices_aa that_aa need_aa to_aa be_aa avoided_aa at_aa
any_aa cost_ on_a MUSA_aa so _ that_aa the_aa security_aa posture _aa can_aa be _ improved. _aa
Similarly,_aa the_aa firm_aa has_aa to_aa introduce_aa robust_aa security_aa training_aa for_aa its_aa
employees_aa so_aa that_aa they_aa will_aa be_aa empowered_aa to_aa take_aa the_aa necessary_aa
steps_aa to_aa improve_aa the_aa level_aa of_a security_aa of_aa the_aa entity._aa The_aa firm_aa must_aa
implement_aa both_aa software_aa and_aa hardware_aa firewalls_aa so_aa that_aa a_aa secure_aa layer_aa
can_aa be_aa created_aa which_aa will_aa keep_aa unauthorized_aa users_a at_aa a_aa distance._aa
Work_aa Planning_aa and_aa Control
The_aa work_aa and_aa processes_aa that_aa are_aa conducted_aa in_aa MMUSA_aa must_aa
be_aa strategically_aa planned_aa and_aa controlled_aa as_aa they_aa can_a have_aa a_aa major_aa
implication_aa on_aa the_aa performance_aa and_aa productivity_aa of_aa the_aa organizational_aa
personnel._aa Some_aa of_aa the_ key_aa aspects_aa that_aa must_aa be_aa carefully_aa taken_aa into_aa
consideration_aa while_aa planning_ and_aa controlling_aa the_aa work_aa include_aa the_aa job-
IT_aa 552_aa aa_aa aa_ aa_aa aa_a aa_aa aa_aa _aa aa_aa aa_ aa_aa aa_ aa_aa aa_a aa_aa aa_aa _aa aa_aa _aa aa_aa _aa _aa aa_aa aa_ aa_aa aa_ aa_aa aa_ aa_aa aa_aa aa_ aa_aa
_aa aa_aa aa_a aa_aa aa_aa _aa aa_aa _aa aa_aa aa_ aa_aa _aa aa_aa aa_ aa_aa aa_ aa_aa aa_a aa_aa aa_aa _aa _aa aa_aa _aa aa_aa _aa aa_aa aa_ aa_aa _aa aa_aa aa_a aa_aa aa_aa _aa
_aa aa_aa aa_a aa_aa aa_aa aa_ aa_aa aa_a aa_aa aa_ aa_aa aa_ aa_aa aa_a aa_aa aa_aa _aa aa_aa aa_ aa_aa aa_aa _aa aa_aa _aa aa_aa _aa aa_aa aa_aa aa_ aa_aa a _aa aa_aa aa_ aa_aa aa_
_aa aa_aa aa_a aa_aa aa_aa _aa aa_aa _aa aa_aa aa_ aa_aa _aa aa_aa aa_aa aa_aa aa_ aa_aa aa_a aa_aa aa_ aa_aa aa_aa _aa aa_aa aa_ aa_aa aa_a aa_aa aa_ aa_aa aa_a aa_aa aa_aa aa_aa 22
related_aa stress_aa and_aa pressure,_aa time_aa factor,_aa the_aa difficulty_aa level_aa of _ the_aa
assigned_aa work_aa and_aa ineffective_aa task_aa planning.
Some_aa of_aa the_aa key_aa strategies_aa that_aa can_aa be_aa introduced_aa in_aa MUSA_aa for_aa
addressing_aa job_ pressure,_aa time_aa factors,_ task_ difficulty,_a routine_ alteration_aa
and_aa lack_aa of_aa knowledge_aa and_aa skills_aa are_aa introducing_aa proper_aa training_aa
sessions,_aa implementing_aa mandatory_aa vacation_aa policy_aa and_aa conducting_aa
‘vulnerability_aa assessment’_aa on_aa a_aa frequent_aa basis._aa
Training_aa sessions
MUSA_aa must_aa take_aa the_aa necessary_aa steps_ so _aa that_aa the _aa technical_aa
knowledge_aa and_aa expertise_aa of_aa its_aa employees_aa can_aa be_aa upgraded_aa on_aa a_
regular_aa basis._aa By_aa providing_aa them_aa training_aa and_aa development_aa opportunities,_aa
the_aa employees_aa would_aa be_a encouraged_aa to_aa perform_aa better._aa They_aa would_aa be_aa
able_aa to_aa play_a an_aa active_aa role_aa to_a mitigate_aa the_aa risks_aa that_aa arise_aa in_aa the_aa
IT_aa setting_aa of_aa MUSA._aa This_aa element_aa must_aa be_aa included_aa in_aa the_ work_aa
planning_aa as_aa it_aa would_aa have_aa a_aa positive_aa implication_aa on_ the _ productivity_aa
of_aa the_aa employees._a
Mandatory_aa vacation_aa policy
MUSA_aa must_aa introduce_aa mandatory_aa vacation_aa policy_aa so_aa that_aa
employees_aa will_aa take_aa holiday_aa to_aa get_aa a_aa break_aa from_aa the_aa hectic_aa work_
schedule._aa It_aa will_aa help_aa them_aa to_a manage_aa their_aa work-related_aa stress_aa and_aa
pressure_aa (Three_aa Reasons_aa Your_aa Company_aa Should_aa Make_aa Vacation_aa
Mandatory,_aa 2019)._aa This_aa policy_aa can_aa also_aa play_aa a_aa key_aa role_aa to_aa improve_aa
the_aa security_aa framework_aa of_aa the_aa entity._aa This_aa is_aa because_aa it_a will_aa help_aa the_a
firm_aa to_aa keep_aa a_aa check_aa on_aa insider_aa fraud_ (Slack,_aa 2019)._aa aa_a aa_aa
Conducting_aa regular_aa vulnerability_a assessment
IT_aa 552_aa aa_aa aa_ aa_aa aa_a aa_aa aa_aa _aa aa_aa aa_ aa_aa aa_ aa_aa aa_a aa_aa aa_aa _aa aa_aa _aa aa_aa _aa _aa aa_aa aa_ aa_aa aa_ aa_aa aa_ aa_aa aa_aa aa_ aa_aa
_aa aa_aa aa_a aa_aa aa_aa _aa aa_aa _aa aa_aa aa_ aa_aa _aa aa_aa aa_ aa_aa aa_ aa_aa aa_a aa_aa aa_aa _aa _aa aa_aa _aa aa_aa _aa aa_aa aa_ aa_aa _aa aa_aa aa_a aa_aa aa_aa _aa
_aa aa_aa aa_a aa_aa aa_aa aa_ aa_aa aa_a aa_aa aa_ aa_aa aa_ aa_aa aa_a aa_aa aa_aa _aa aa_aa aa_ aa_aa aa_aa _aa aa_aa _aa aa_aa _aa aa_aa aa_aa aa_ aa_aa a _aa aa_aa aa_ aa_aa aa_
_aa aa_aa aa_a aa_aa aa_aa _aa aa_aa _aa aa_aa aa_ aa_aa _aa aa_aa aa_aa aa_aa aa_ aa_aa aa_a aa_aa aa_ aa_aa aa_aa _aa aa_aa aa_ aa_aa aa_a aa_aa aa_ aa_aa aa_a aa_aa aa_aa aa_aa 23
By_aa carrying_aa out_aa regular_aa vulnerability_aa assessment,_aa MUSA_aa would_aa be_aa
able_aa to_aa keep_aa a_aa tab_aa on_aa the_aa security_aa aspect_aa of_aa its_aa network_aa and_aa
computer_aa system._aa Such_aa an_aa evaluation_aa process_aa must_aa be_aa conducted_aa on_aa
public_aa holidays_aa so_aa that_ the_aa day_aa to_aa day_aa work_aa processes_aa would_ not_aa be_aa
affected_aa because_aa of_aa the_ security_aa procedure._aa
Employee_aa Readiness
Employees_aa are_aa the_aa most_aa critical_aa asset_aa of_aa an_aa entity._aa So_aa their_aa well-
being,_aa moral_aa and_aa satisfaction_aa must_aa be_aa the_aa top_aa priority_aa of_aa MUSA._aa It_aa
can_aa introduce_aa a_aa number_aa of_aa strategic_aa approaches_aa so_aa that_aa it_aa would_aa be_aa
in_aa a_aa position_a to_aa address_aa issues_aa relating_ to_aa inattentiveness,_aa high_aa level_a
of_aa stress_aa and_aa anxiety,_aa boredom_aa and_aa fatigue,_aa and_aa work-related_aa illness_aa or_aa
injury._aa Only_aa of_aa the_aa employees_aa are_aa mentally_aa and_aa physically_aa fit_aa and_aa
ready,_aa they_ would_aa be_aa able_aa to_aa optimally_aa contribute _a to_aa the_aa performance_aa
and_aa security_aa framework_aa of_aa MUSA.
In_a order_aa to_aa manage_aa a_aa high_aa level_aa of_aa stress,_aa boredom,_aa and_aa
fatigue,_aa MUSA_aa must_aa introduce_aa mandatory_aa vacation_aa policy._aa By_aa taking_aa a_aa
break_aa from_ the_aa work,_aa employees_aa would_aa be_aa able_aa to_aa focus_aa on_aa their_aa
personal_aa health_aa and_ well-being_aa (Three_aa Reasons_aa Your_aa Company_aa Should_aa
Make_aa Vacation_aa Mandatory,_aa 2019)._aa The_aa managers_aa must_aa have_aa a_aa one-on-
one_aa interaction_aa with_aa the_aa subordinates_aa so_ that_aa they_aa could_aa share_aa their_aa
concerns_aa that_aa make_aa them_aa anxious._aa
An_aa employee_aa readiness_aa program_aa must_aa be_aa introduced_aa so_aa that_aa the_aa
employees_aa could_aa actively_aa participate_ in_aa the_aa dynamic_aa organizational_aa setting._aa
This_aa could_aa positively_aa impact_aa the_aa employee_aa turnover_aa of_aa MUSA._aa
Innovative_aa engagement_aa activities_aa could_ be_aa introduced_aa such_aa as_aa group_aa
IT_aa 552_aa aa_aa aa_ aa_aa aa_a aa_aa aa_aa _aa aa_aa aa_ aa_aa aa_ aa_aa aa_a aa_aa aa_aa _aa aa_aa _aa aa_aa _aa _aa aa_aa aa_ aa_aa aa_ aa_aa aa_ aa_aa aa_aa aa_ aa_aa
_aa aa_aa aa_a aa_aa aa_aa _aa aa_aa _aa aa_aa aa_ aa_aa _aa aa_aa aa_ aa_aa aa_ aa_aa aa_a aa_aa aa_aa _aa _aa aa_aa _aa aa_aa _aa aa_aa aa_ aa_aa _aa aa_aa aa_a aa_aa aa_aa _aa
_aa aa_aa aa_a aa_aa aa_aa aa_ aa_aa aa_a aa_aa aa_ aa_aa aa_ aa_aa aa_a aa_aa aa_aa _aa aa_aa aa_ aa_aa aa_aa _aa aa_aa _aa aa_aa _aa aa_aa aa_aa aa_ aa_aa a _aa aa_aa aa_ aa_aa aa_
_aa aa_aa aa_a aa_aa aa_aa _aa aa_aa _aa aa_aa aa_ aa_aa _aa aa_aa aa_aa aa_aa aa_ aa_aa aa_a aa_aa aa_ aa_aa aa_aa _aa aa_aa aa_ aa_aa aa_a aa_aa aa_ aa_aa aa_a aa_aa aa_aa aa_aa 24
discussions,_aa events,_aa and_aa games_aa so_aa that_aa no_aa employee_aa would_aa get_aa bored._aa
A_aa healthy_aa work_aa environment_ must _aa be _a created _aa by _aa taking _aa into _aa account _aa
the_aa health_aa and_a well-being_aa of_aa the_a organizational_aa personnel._aa
_aa aa_aa aa_ aa_aa aa_aa _aa aa_aa a _aa aa_aa _aa aa_aa a _aa aa_aa aa_aa a _aa aa_aa aa_ aa_aa aa_a aa_aa aa_ _aa aa_ aa_aa aa_aa a _aa aa_aa a _aa aa_aa aa_aa aa_ aa_aa a _aa
_aa aa_aa aa_ aa_aa Communication _aa Plan
The_aa thorough_aa engagement_aa would_aa play_aa a_aa vital_aa role_aa to_aa influence_aa a_aa
culture_aa that_aa gives_aa due_aa importance_aa to_aa IT_aa security._aa In_aa fact,_aa the_
communication_aa plan_ could_aa enhance_aa the_ success _aa of_ the_aa organization _aa as_ it_aa
would_aa assist_aa to_aa convince_aa diverse_aa stakeholders_aa of_aa the_aa entity_aa to_aa support_aa
the_aa healthy_aa security_aa culture._aa The_aa communication_ plan_aa is _aa designed _aa in_ a _aa
simple_aa and_ effective_aa manner_aa so_aa that_aa it_ could_a make_aa sense_aa for_aa both_aa
technical_aa as_aa well_aa as_aa the_aa non-technical_aa audience._aa aa_aa
Overview
The_aa security_a posture_aa of_aa MUSA_aa is_aa quite_ low_aa so_aa there_aa is_aa the_aa
need_aa to_aa introduce_aa a_ new_aa and_aa improved_aa security_aa awareness_aa program._aa In_aa
order_aa to_aa make_aa the_aa new_aa security_aa model_aa work,_aa one_aa of_aa the_aa basic_aa things_aa
that_aa must_aa be_aa taken_aa into_aa consideration_aa is_aa the_ communication _ plan._aa The_aa
role_aa of_aa a_aa security_aa communication_a plan_aa is_aa of_aa paramount_aa importance_aa as_aa
it_aa can_aa help_aa the_a employees_aa to_ take_aa necessary_aa steps_aa so_aa that_aa the_aa high_aa
quality_aa of_aa security_ can_aa be_aa maintained_aa in_a the_ best_a possible_aa manner_aa
(Bashay,_aa 2019)._aa The_aa document_aa acts_aa as_aa a_ guide_aa which_aa can_aa increase_aa the_aa
overall_aa awareness_aa of_aa the_aa workfare_aa in_aa MUSA_aa on_aa various_aa security_aa
aspects._aa The_aa primary_aa objective_aa of_aa the_aa communication_aa plan_aa is_aa to_aa
IT_aa 552_aa aa_aa aa_ aa_aa aa_a aa_aa aa_aa _aa aa_aa aa_ aa_aa aa_ aa_aa aa_a aa_aa aa_aa _aa aa_aa _aa aa_aa _aa _aa aa_aa aa_ aa_aa aa_ aa_aa aa_ aa_aa aa_aa aa_ aa_aa
_aa aa_aa aa_a aa_aa aa_aa _aa aa_aa _aa aa_aa aa_ aa_aa _aa aa_aa aa_ aa_aa aa_ aa_aa aa_a aa_aa aa_aa _aa _aa aa_aa _aa aa_aa _aa aa_aa aa_ aa_aa _aa aa_aa aa_a aa_aa aa_aa _aa
_aa aa_aa aa_a aa_aa aa_aa aa_ aa_aa aa_a aa_aa aa_ aa_aa aa_ aa_aa aa_a aa_aa aa_aa _aa aa_aa aa_ aa_aa aa_aa _aa aa_aa _aa aa_aa _aa aa_aa aa_aa aa_ aa_aa a _aa aa_aa aa_ aa_aa aa_
_aa aa_aa aa_a aa_aa aa_aa _aa aa_aa _aa aa_aa aa_ aa_aa _aa aa_aa aa_aa aa_aa aa_ aa_aa aa_a aa_aa aa_ aa_aa aa_aa _aa aa_aa aa_ aa_aa aa_a aa_aa aa_ aa_aa aa_a aa_aa aa_aa aa_aa 25
safeguard_aa the_aa Confidentiality,_aa Integrity,_aa and_aa Availability_a of_aa the_aa digital_aa
resources_aa and_aa information_aa of_aa the_aa business_aa entity. _a
The_aa communication_aa plan_aa sheds_aa light_aa on_aa a_aa number_aa of_aa messaging_aa
strategic_aa approaches_aa that_aa can_aa help_aa MUSA_aa to_aa share_aa details_aa on_aa the_aa new_aa
security_aa model._a It_aa would_aa also_aa help_aa the_aa organizational_aa personnel_aa to_aa get_a
a_aa detailed_aa idea_a about_ their_aa exact_aa roles_ and_aa responsibilities_aa to _ execute _aa
the_aa plan_aa (Where_aa The_aa World_aa Talks_a Security_aa |_aa RSA_aa Conference,_aa 2019)._aa
Messaging_aa Strategies
While_aa designing_aa a_aa suitable_aa messaging_aa strategic_aa framework,_aa it_aa is_aa
necessary_aa to_aa identify_aa the_aa important_aa areas_aa that_aa the_aa specific_aa communication_aa
message_aa will_aa address._aa Some_aa of_aa the_aa main_aa areas_aa include_aa cyber_aa laws,_aa the_aa
cost_aa associated_aa with_aa security_aa breaches_aa in_aa the_aa organizational_aa setting,_aa
personally_aa identifiable_aa information_aa (PII)_aa breaches,_aa _aa the_aa need_aa of_aa security_aa
awareness_aa and_aa the_aa implication_aa of_aa awareness_aa programs_aa on_aa the_aa security_aa
posture_aa and_aa culture_ of_aa the_a business_aa organization._aa The_aa effectiveness _aa of_aa
MUSA’s_aa new_a security_aa awareness_aa model_aa will_aa largely_aa depend_aa on_aa the_aa
lines_aa of_aa communication_aa that_aa are_aa established_aa by_aa the_ business_aa undertaking._aa
The_aa management_aa of_ MUSA_aa must_aa constantly_aa evaluate_aa the_aa internal_aa
communication_aa approach_aa so_aa that_aa the_aa organizational_aa personnel_aa can_aa be_aa
constantly_aa informed_aa of_aa the_aa best_aa security_aa practices_ that_aa can_aa be_aa
implemented_aa to_aa handle_aa different_aa kinds_aa of_aa security_aa threats._aa
Implementing_aa different_aa communication_aa methods_aa for_aa different_aa
stakeholders_aa
MUSA_aa must_aa ensure_aa that_aa the_aa communication_aa channels_aa and_aa methods_aa
that_aa are_aa introduced_aa to_aa increase _aa the_aa level _aa of_aa awareness_aa of_aa the _aa security_aa
IT_aa 552_aa aa_aa aa_ aa_aa aa_a aa_aa aa_aa _aa aa_aa aa_ aa_aa aa_ aa_aa aa_a aa_aa aa_aa _aa aa_aa _aa aa_aa _aa _aa aa_aa aa_ aa_aa aa_ aa_aa aa_ aa_aa aa_aa aa_ aa_aa
_aa aa_aa aa_a aa_aa aa_aa _aa aa_aa _aa aa_aa aa_ aa_aa _aa aa_aa aa_ aa_aa aa_ aa_aa aa_a aa_aa aa_aa _aa _aa aa_aa _aa aa_aa _aa aa_aa aa_ aa_aa _aa aa_aa aa_a aa_aa aa_aa _aa
_aa aa_aa aa_a aa_aa aa_aa aa_ aa_aa aa_a aa_aa aa_ aa_aa aa_ aa_aa aa_a aa_aa aa_aa _aa aa_aa aa_ aa_aa aa_aa _aa aa_aa _aa aa_aa _aa aa_aa aa_aa aa_ aa_aa a _aa aa_aa aa_ aa_aa aa_
_aa aa_aa aa_a aa_aa aa_aa _aa aa_aa _aa aa_aa aa_ aa_aa _aa aa_aa aa_aa aa_aa aa_ aa_aa aa_a aa_aa aa_ aa_aa aa_aa _aa aa_aa aa_ aa_aa aa_a aa_aa aa_ aa_aa aa_a aa_aa aa_aa aa_aa 26
model_aa can_aa serve_aa the_aa purpose._aa Thus_aa the_aa use_ of_aa communication_aa
approaches_aa must_aa be_aa different_aa when_aa MUSA_aa interacts_aa with_aa different_aa
internal_aa stakeholders_aa such_aa as_aa employees,_aa IT_aa professionals,_aa senior_aa
management_aa team_aa and_aa non-IT_aa members._aa For_aa example,_aa while_aa sharing_aa a_aa
message_aa on_aa security _ with_aa non-technical_aa members,_aa video_aa presentations_aa
could_a be_aa used._aa But_aa while_aa sharing_aa a_aa message_aa with_aa members_aa from_aa the_aa
IT_aa department,_aa emails_aa or_aa memo_aa could_aa be_aa used_aa (Where_aa The_aa World_aa
Talks_aa Security_aa |_aa RSA_aa Conference, _ 2019, _aa p _aa 6). _aa aa_aa
In_aa order_ to _aa implement_aa a _aa holistic _aa and _aa integrated _aa messaging _aa
strategy_aa that_aa meets_ the_aa needs_aa of_aa all_aa the_aa internal_aa personnel,_aa MUSA_aa
could_aa partner_aa with_aa its_aa communication_aa team._aa Such_aa an_aa approach_aa would_aa
be_aa beneficial_aa as_aa the_aa individuals_aa would_ help_aa to_aa enhance_aa the_aa messaging_aa
approaches_aa so_aa that_aa information_aa reaches_aa all_aa the_ target_aa audience_aa within_aa
the_aa business_aa setting_aa (Where_aa The_aa World_aa Talks_aa Security_aa |_aa RSA_aa
Conference,_aa 2019,_aa p_aa 24)._a
High_aa level_aa of_aa transparency
In_a order_aa to_aa enhance_aa the_aa importance_aa of_aa the_ security_aa awareness_aa
plan,_aa the_aa messaging_aa strategy_aa must_aa be_aa transparent_aa and_aa uniform_aa in_aa nature._aa
Transparency_aa initiatives_aa must_aa be_aa the_aa key_aa focus_aa of_a MUSA_aa so_aa that_aa
carefully_aa designed_aa so_aa that_aa all_aa the_aa employees_aa would_aa be_aa on_aa the_aa same_aa
page_aa and_aa they_aa would_aa have_aa uniform_aa knowledge_aa on_aa the_aa security_aa model_aa
of_aa the_aa business_aa entity._aa By_aa making_aa the_aa information_aa transparent,_aa the_aa
employees_aa across_aa various_aa departments_aa of_aa the_aa business_ entity_aa would_aa
understand_aa how_aa their_aa actions_aa and_aa duties_aa could_aa impact_aa the_aa security_aa
posture_aa of_aa the_aa firm._aa In_aa fact,_aa a_aa transparent_aa communication_aa approach_aa
IT_aa 552_aa aa_aa aa_ aa_aa aa_a aa_aa aa_aa _aa aa_aa aa_ aa_aa aa_ aa_aa aa_a aa_aa aa_aa _aa aa_aa _aa aa_aa _aa _aa aa_aa aa_ aa_aa aa_ aa_aa aa_ aa_aa aa_aa aa_ aa_aa
_aa aa_aa aa_a aa_aa aa_aa _aa aa_aa _aa aa_aa aa_ aa_aa _aa aa_aa aa_ aa_aa aa_ aa_aa aa_a aa_aa aa_aa _aa _aa aa_aa _aa aa_aa _aa aa_aa aa_ aa_aa _aa aa_aa aa_a aa_aa aa_aa _aa
_aa aa_aa aa_a aa_aa aa_aa aa_ aa_aa aa_a aa_aa aa_ aa_aa aa_ aa_aa aa_a aa_aa aa_aa _aa aa_aa aa_ aa_aa aa_aa _aa aa_aa _aa aa_aa _aa aa_aa aa_aa aa_ aa_aa a _aa aa_aa aa_ aa_aa aa_
_aa aa_aa aa_a aa_aa aa_aa _aa aa_aa _aa aa_aa aa_ aa_aa _aa aa_aa aa_aa aa_aa aa_ aa_aa aa_a aa_aa aa_ aa_aa aa_aa _aa aa_aa aa_ aa_aa aa_a aa_aa aa_ aa_aa aa_a aa_aa aa_aa aa_aa 27
could_aa bridge_aa the_aa trust_ gap_aa between_aa the_aa IT_ department_aa and_aa the_aa non-IT _aa
department_aa of_aa Multiple_aa Unite_aa Security_aa Assurance_aa Corporation._aa True_aa
transparency_aa is_aa not_aa merely_aa about_aa giving_aa information_aa to_aa the_aa organizational_aa
personnel_aa within_aa the_aa organizational_aa setting._aa The_aa messaging_aa strategy_aa should_aa
be_aa designed_aa in_aa such_aa a_aa manner_aa so_ that_aa the_aa information_aa could_aa be_aa
properly_aa understood_aa by_aa the_aa employees_aa without_aa any_aa kind_aa of_aa confusion_aa
or_aa ambiguity_a (Gontovnikas,_aa 2019)._aa
Focus_aa on_aa the_aa language_aa of_aa the_aa message_aa
Technology_aa is_aa a_aa field_aa which_aa not_aa many_aa people_aa are_ totally_aa aware_aa
of._aa So_aa while_aa spreading_aa an_aa important_aa message_aa about_aa the_aa security_aa
strategy,_aa technical_aa jargons_aa must_aa not_aa be_aa used_ by _aa Information_aa Technology _aa
managers._aa This_aa is_ an_aa important_aa aspect_aa that_aa MUSA_aa must_aa keep_aa in_aa mind_aa
so_aa that_aa the_aa message_aa that_aa is_aa being_aa communicated_aa by_aa it_aa can_aa be_aa
understood_aa in_aa a_aa clear_aa manner_aa by_aa all_aa the _aa intended_aa audience_aa irrespective_aa
of_aa the_aa department_aa in_aa which_aa they_aa function._aa According_aa to_aa E_aa Kelly_aa
Hansen,_aa the_aa Chief_aa Executive_aa Officer_aa of_aa Neohapsis_aa Inc.,_aa the_aa language_aa of_aa
IT_aa cannot_aa be_aa easily_ understood_aa by_aa non-IT_aa professionals._aa So_aa in_aa order_aa
to_aa deal_aa with_aa this_ issue,_aa simple_aa English_aa language_aa must_aa be_aa used_aa while_
communicating_aa about_aa the_aa security_aa awareness_aa program_aa and_aa its_a importance_aa
in_aa the_aa organizational_ setting. _aa The _aa wrong _aa use _aa of _aa language _aa would _aa
naturally_aa encourage_aa to_aa stop_aa paying_aa attention_aa to_aa the_aa message_aa as_aa it_aa
would_aa be_aa going_aa over_aa their_aa heads._aa So_aa simple_aa and_aa understandable_aa
language_aa needs_ to_aa be_ used_aa so_aa that_aa professionals_aa from_aa both_aa the _ IT_aa
and_aa non-IT_aa department_aa could_aa understand_aa the_aa relevance_aa of_ the_ security_aa
IT_aa 552_aa aa_aa aa_ aa_aa aa_a aa_aa aa_aa _aa aa_aa aa_ aa_aa aa_ aa_aa aa_a aa_aa aa_aa _aa aa_aa _aa aa_aa _aa _aa aa_aa aa_ aa_aa aa_ aa_aa aa_ aa_aa aa_aa aa_ aa_aa
_aa aa_aa aa_a aa_aa aa_aa _aa aa_aa _aa aa_aa aa_ aa_aa _aa aa_aa aa_ aa_aa aa_ aa_aa aa_a aa_aa aa_aa _aa _aa aa_aa _aa aa_aa _aa aa_aa aa_ aa_aa _aa aa_aa aa_a aa_aa aa_aa _aa
_aa aa_aa aa_a aa_aa aa_aa aa_ aa_aa aa_a aa_aa aa_ aa_aa aa_ aa_aa aa_a aa_aa aa_aa _aa aa_aa aa_ aa_aa aa_aa _aa aa_aa _aa aa_aa _aa aa_aa aa_aa aa_ aa_aa a _aa aa_aa aa_ aa_aa aa_
_aa aa_aa aa_a aa_aa aa_aa _aa aa_aa _aa aa_aa aa_ aa_aa _aa aa_aa aa_aa aa_aa aa_ aa_aa aa_a aa_aa aa_ aa_aa aa_aa _aa aa_aa aa_ aa_aa aa_a aa_aa aa_ aa_aa aa_a aa_aa aa_aa aa_aa 28
awareness_aa program_aa (News,_aa Tips,_aa and_aa Advice_aa for_aa Technology_aa Professionals_aa
-_aa TechRepublic,_aa 2019)._aa
Starting_aa the_aa communication_aa from_aa the_ top
The_aa security_aa awareness_aa program_aa could_ have_aa a_aa major_aa impact_aa on_aa
the_aa existence_aa and_aa sustainability_aa of_aa the_aa business_aa entity._aa So_aa before_aa
communicating_aa about_aa the _aa same, _aa it _aa is _aa necessary_aa to_aa initiate_ the_aa
communication_aa from_aa the_aa top._ This_ would_aa mean_aa that_aa the_aa leaders_aa and_
decision-makers_aa would_aa act_aa as_aa the_aa starting_aa point_aa of_aa the_aa communication._aa
The_aa visible_aa backing_aa of_aa the_aa leader _a of_aa Multiple_aa Unite_aa Security_aa Assurance_aa
(MUSA)_aa Corporation_aa would_aa encourage_aa the_ employees _a from _aa all _aa across _aa the _aa
firm_aa to_aa participate_aa in_aa the_aa approach_aa (News,_aa Tips,_aa and_aa Advice_aa for_a
Technology_aa Professionals_aa -_aa TechRepublic,_ 2019)._aa The_aa evidence_aa of_aa
executive_aa stewardship_aa would_aa be_aa of_aa paramount_aa importance_aa in_aa the_ business_aa
context_aa to_aa adopt_aa an_aa interactive_aa and_aa engaging_aa communication_aa approach._aa
Similarly,_aa the_ IT _aa professionals_aa in_aa the_aa business_aa setting_aa must_aa take_ the_a
initiative_aa to_aa make_aa the_aa leaders_aa and_aa senior_aa managers_aa understand_aa the_
significance_aa of_aa the_aa security_aa awareness_aa model_aa which_aa could_aa constructively_aa
influence_aa the_aa security_ posture_aa of_aa MUSA._aa
Streamlining_aa the_aa communication_aa model_aa
The_aa security_aa success_aa program_aa of_aa MUSA_aa could_aa be_a successful_aa
throughout_aa the_aa business_aa entity_aa only_aa if_aa a_aa uniform_aa and_aa streamlined_aa
communication_aa network_aa would_aa be_aa deployed._aa _aa There_aa is_aa the_aa need_aa to_aa
constantly_aa evaluate_aa and_aa align_a the _a internal_aa communication_aa channels_aa so_aa
that_aa the_ employees_aa across_aa all_ the_aa departments_aa of_aa the_aa firm_aa would_aa be_aa
able_aa to_aa understand_aa how_aa the_aa security_aa model_aa could_aa have_aa implications_aa on_aa
IT_aa 552_aa aa_aa aa_ aa_aa aa_a aa_aa aa_aa _aa aa_aa aa_ aa_aa aa_ aa_aa aa_a aa_aa aa_aa _aa aa_aa _aa aa_aa _aa _aa aa_aa aa_ aa_aa aa_ aa_aa aa_ aa_aa aa_aa aa_ aa_aa
_aa aa_aa aa_a aa_aa aa_aa _aa aa_aa _aa aa_aa aa_ aa_aa _aa aa_aa aa_ aa_aa aa_ aa_aa aa_a aa_aa aa_aa _aa _aa aa_aa _aa aa_aa _aa aa_aa aa_ aa_aa _aa aa_aa aa_a aa_aa aa_aa _aa
_aa aa_aa aa_a aa_aa aa_aa aa_ aa_aa aa_a aa_aa aa_ aa_aa aa_ aa_aa aa_a aa_aa aa_aa _aa aa_aa aa_ aa_aa aa_aa _aa aa_aa _aa aa_aa _aa aa_aa aa_aa aa_ aa_aa a _aa aa_aa aa_ aa_aa aa_
_aa aa_aa aa_a aa_aa aa_aa _aa aa_aa _aa aa_aa aa_ aa_aa _aa aa_aa aa_aa aa_aa aa_ aa_aa aa_a aa_aa aa_ aa_aa aa_aa _aa aa_aa aa_ aa_aa aa_a aa_aa aa_ aa_aa aa_a aa_aa aa_aa aa_aa 29
them,_aa their_aa department_aa and_aa the_aa entire_aa business_aa entity_aa (News,_aa Tips,_aa and_aa
Advice_aa for_aa Technology_aa Professionals_aa -_ TechRepublic,_aa 2019)._aa The_aa proper_aa
flow_aa of_aa information_aa on_aa the_aa security_aa program_aa would_aa keep_aa the_aa employees_aa
on_aa their_aa toes._aa They_aa would_aa be_ encouraged_aa to_aa adopt_aa safe_aa practices_aa
which_aa could_aa restrict_aa the_aa adverse_aa implications_aa on_aa the_aa security_aa aspect_aa of_aa
MUSA._aa
Security_aa culture_aa
A_aa healthy_aa security_aa culture_aa is_aa the_aa need_aa of_aa the_aa hour_aa at_aa Multiple_aa
Unite_aa Security_aa Assurance_aa Corporation_aa so_a that_aa its_aa security_aa posture_aa could_aa
be_aa improved._a In_aa order_aa to_aa effectively_aa promote_aa a_aa healthy_aa security_aa culture_aa
throughout_aa the_aa business_aa setting,_aa a_aa number_aa of_aa approaches_aa could_aa be_aa
implemented._a
Focus_aa on_aa awareness_aa –_aa The_aa management_aa of_aa the_aa business_aa entity_aa
must_aa focus_aa on_aa making_aa the_aa employees_aa aware_aa of_aa the_aa significance_ of _aa
having_aa a_aa robust_aa and_aa healthy_aa security_aa culture._aa For_aa example,_aa for_aa
developers_aa and_aa testers_aa that_aa functions_aa in_aa the_aa IT_aa department,_aa an_aa
application_aa security_ awareness_aa approach_aa could_aa be_aa employed._aa It_aa would_aa
help_aa to_aa carefully_aa evaluate_aa the_aa seriousness_aa of_aa a_aa security_aa threat_aa and_aa take_aa
necessary_aa actions_aa to_ deal_aa with_aa it_aa (6_aa ways_aa to_aa develop_aa a_aa security_aa
culture_aa in_aa your_a organization,_aa 2019)._aa
Deployment_aa of_aa leadership-driven_aa cyber_aa governance_aa model_aa –_aa In_aa
order_aa to_aa encourage_aa a_aa healthy_aa security_aa culture,_aa the_aa active_aa involvement_ of _aa
senior_aa managers_aa and_aa leaders_aa would_aa be_aa indispensable_aa in_aa the_ organizational_aa
context_aa of_aa MUSA._aa Their_aa participation_aa would_aa influence_aa the_aa employees_aa at_aa
all_aa the_aa levels_aa of_aa MUSA_aa to_aa focus_aa on_aa their_aa individual_a roles_aa and_aa duties_aa
IT_aa 552_aa aa_aa aa_ aa_aa aa_a aa_aa aa_aa _aa aa_aa aa_ aa_aa aa_ aa_aa aa_a aa_aa aa_aa _aa aa_aa _aa aa_aa _aa _aa aa_aa aa_ aa_aa aa_ aa_aa aa_ aa_aa aa_aa aa_ aa_aa
_aa aa_aa aa_a aa_aa aa_aa _aa aa_aa _aa aa_aa aa_ aa_aa _aa aa_aa aa_ aa_aa aa_ aa_aa aa_a aa_aa aa_aa _aa _aa aa_aa _aa aa_aa _aa aa_aa aa_ aa_aa _aa aa_aa aa_a aa_aa aa_aa _aa
_aa aa_aa aa_a aa_aa aa_aa aa_ aa_aa aa_a aa_aa aa_ aa_aa aa_ aa_aa aa_a aa_aa aa_aa _aa aa_aa aa_ aa_aa aa_aa _aa aa_aa _aa aa_aa _aa aa_aa aa_aa aa_ aa_aa a _aa aa_aa aa_ aa_aa aa_
_aa aa_aa aa_a aa_aa aa_aa _aa aa_aa _aa aa_aa aa_ aa_aa _aa aa_aa aa_aa aa_aa aa_ aa_aa aa_a aa_aa aa_ aa_aa aa_aa _aa aa_aa aa_ aa_aa aa_a aa_aa aa_ aa_aa aa_a aa_aa aa_aa aa_aa 30
so_aa that_aa they_aa could_aa contribute_aa to_aa enhancing_aa the_aa level_aa of_aa security_aa in_aa
the_aa business_aa setting_aa (Four_aa Tips_aa for_aa Building_aa a_aa Strong_aa Security_aa Culture_aa
in_aa Your_aa Organization,_aa 2019)._ _aa Thus_aa the_aa strong_aa commitment_aa by_aa the_
top_aa management_aa of_aa MUSA_aa would_aa help_ to_a convince_aa diverse_aa stakeholders_aa
of_aa MUSA_aa to_a strengthen_aa the_a healthy_aa security_aa culture._aa
Clear_aa documentation_aa of_aa security_aa policies_aa –_aa Establishment_aa of_aa clear_aa
and_aa well-defined_aa security_aa policies_aa and_aa guidelines_aa would_aa act_aa as_aa the_aa
cornerstone_aa of_aa a_aa healthy_aa security_aa culture._aa Thus_aa in_aa MUSA,_aa the_aa new_aa
security_aa policies_aa must_ be_aa clearly_aa documented_aa so_aa that_aa they_ would_aa guide_aa
the_aa employees_a while_aa conducting_aa the_aa day _ to _aa day _aa business _aa activities _aa and _aa
processes_aa (Four_aa Tips_aa for_aa Building_aa a_aa Strong_aa Security_aa Culture_aa in_aa Your_aa
Organization,_aa 2019)._aa
Providing_aa adequate_aa training_aa to_aa the_aa staff_aa members_aa –_a The_aa management_aa of_aa
MUSA_aa must_a ensure_aa that_aa the_aa employees_aa get_aa the_aa necessary_aa training_aa to_aa
understand_aa the_aa relevance_aa of_aa security_aa in_aa the_aa unpredictable_aa IT_aa setting._aa
Such_aa an_aa approach_aa would_aa be_aa of_aa paramount_aa importance_aa as_aa it_aa would_aa
assist_aa in_aa fostering_aa a_aa healthy_aa security_aa culture_aa among _ the_aa employees_aa
(Four_aa Tips_aa for_aa Building_ a_ Strong_aa Security_aa Culture _aa in _aa Your_aa
Organization,_aa 2019)._aa
Conclusion
IT_aa 552_aa aa_aa aa_ aa_aa aa_a aa_aa aa_aa _aa aa_aa aa_ aa_aa aa_ aa_aa aa_a aa_aa aa_aa _aa aa_aa _aa aa_aa _aa _aa aa_aa aa_ aa_aa aa_ aa_aa aa_ aa_aa aa_aa aa_ aa_aa
_aa aa_aa aa_a aa_aa aa_aa _aa aa_aa _aa aa_aa aa_ aa_aa _aa aa_aa aa_ aa_aa aa_ aa_aa aa_a aa_aa aa_aa _aa _aa aa_aa _aa aa_aa _aa aa_aa aa_ aa_aa _aa aa_aa aa_a aa_aa aa_aa _aa
_aa aa_aa aa_a aa_aa aa_aa aa_ aa_aa aa_a aa_aa aa_ aa_aa aa_ aa_aa aa_a aa_aa aa_aa _aa aa_aa aa_ aa_aa aa_aa _aa aa_aa _aa aa_aa _aa aa_aa aa_aa aa_ aa_aa a _aa aa_aa aa_ aa_aa aa_
_aa aa_aa aa_a aa_aa aa_aa _aa aa_aa _aa aa_aa aa_ aa_aa _aa aa_aa aa_aa aa_aa aa_ aa_aa aa_a aa_aa aa_ aa_aa aa_aa _aa aa_aa aa_ aa_aa aa_a aa_aa aa_ aa_aa aa_a aa_aa aa_aa aa_aa 31
The_aa security_aa policies_aa that_aa have_aa been_aa presented_aa here_aa must_aa be_aa introduced_aa
by_aa Multiple_aa Unite_aa Security_a Assurance_aa (MUSA)_ Corporation_aa so_aa that_aa it_
would_aa be_aa in_aa a_aa position_aa to_aa address_aa the_aa security_aa gaps_aa that_aa exist_aa in_aa
its_aa organization._aa The_aa policies_aa have_aa been_aa designed_aa in_aa a_aa strategic_aa manner_aa
so_aa that_aa the_ firm_aa would_aa be_aa in_aa a_aa position_aa to_aa deal_aa with_aa intentional_aa
threats_aa as_aa well_aa as_aa unintentional_aa threats _ that _a could _aa arise _aa before_aa it._aa _aa
These_a policies_aa would_aa primarily_aa empower_aa the_aa business_aa entity_aa and_aa its_
employees_aa so_a that_aa they_aa could_aa take_aa necessary_aa measures_aa to_aa protect_aa the_aa
security_aa system._aa The_aa policies_aa that_aa have_aa been_ designed_ specifically _aa
revolve_aa around_aa human_aa errors_aa that_aa give_aa an_aa unfair_aa advantage_aa to_aa
unauthorized_aa individuals_aa and_aa cyber_ attackers_aa in_aa the_aa virtual_aa platform._
These_aa policies_aa could_aa be_ effective_aa only_aa if_aa the_aa employees_aa would_aa follow_
them_aa strictly_aa in_aa the _aa organizational_aa context._aa The _aa role_aa of_aa a_aa well-planned_aa
communication_aa and_aa messaging_aa strategy_aa would_aa be_aa extremely_aa vital_aa to_aa
improving_aa the_aa security_aa posture_aa of_aa MUSA._aa _aa The_aa various_aa strategic_aa
elements_aa that_aa have_aa been_aa encompassed_aa in_aa the_aa communication_aa plan_aa include_aa
the_aa proper_aa implementation _aa of_aa varying _ communication _aa methods _aa for _a different _aa
stakeholders,_aa maintaining_aa a_aa high_aa level_aa of_aa transparency,_aa high_aa focus_aa on_aa
the_aa language_aa of_aa the_aa message,_aa starting_aa the_aa communication_aa from_aa the_a top _aa
and_aa streamlining_aa the_aa overall_aa communication_aa model._aa aa_aa There_aa is_aa an_aa urgent_aa
need_aa to_ make_aa the_aa diverse_aa stakeholder_aa of_aa MUSA_aa understand_aa the_aa
importance_aa of_aa a_aa healthy_aa security_aa culture._aa Various_a approaches_aa that_aa could_aa
be_aa introduced_aa to_aa promote_aa a_aa healthy_aa security_aa culture_aa include_aa the_aa focus_
on_aa awareness,_aa deployment_aa of_ leadership-driven _aa cyber _aa governance_aa model, _aa
IT_aa 552_aa aa_aa aa_ aa_aa aa_a aa_aa aa_aa _aa aa_aa aa_ aa_aa aa_ aa_aa aa_a aa_aa aa_aa _aa aa_aa _aa aa_aa _aa _aa aa_aa aa_ aa_aa aa_ aa_aa aa_ aa_aa aa_aa aa_ aa_aa
_aa aa_aa aa_a aa_aa aa_aa _aa aa_aa _aa aa_aa aa_ aa_aa _aa aa_aa aa_ aa_aa aa_ aa_aa aa_a aa_aa aa_aa _aa _aa aa_aa _aa aa_aa _aa aa_aa aa_ aa_aa _aa aa_aa aa_a aa_aa aa_aa _aa
_aa aa_aa aa_a aa_aa aa_aa aa_ aa_aa aa_a aa_aa aa_ aa_aa aa_ aa_aa aa_a aa_aa aa_aa _aa aa_aa aa_ aa_aa aa_aa _aa aa_aa _aa aa_aa _aa aa_aa aa_aa aa_ aa_aa a _aa aa_aa aa_ aa_aa aa_
_aa aa_aa aa_a aa_aa aa_aa _aa aa_aa _aa aa_aa aa_ aa_aa _aa aa_aa aa_aa aa_aa aa_ aa_aa aa_a aa_aa aa_ aa_aa aa_aa _aa aa_aa aa_ aa_aa aa_a aa_aa aa_ aa_aa aa_a aa_aa aa_aa aa_aa 32
clear_aa documentation_a of_aa security_aa policies_aa and _aa providing_aa necessary_aa training_aa
to_aa the_aa employees._aa
References
Alotaibi,_aa F.,_aa Furnell,_aa S.,_ Stengel,_aa I.,_aa &_aa Papadaki, _ M. _a (2016). _aa A _aa review _aa
of_aa using_aa gaming_aa technology_aa for_aa cyber-security_aa awareness._aa Int. _aa J. _aa
Inf._aa Secur._aa Res.(IJISR),_aa 6(2),_a 660-666.
Bada,_aa M.,_aa Sasse,_ A._aa M.,_aa &_aa Nurse,_aa J._ R._aa (2019)._aa Cyber_aa security_aa
awareness_aa campaigns:_aa Why_ do_aa they_aa fail _aa to_aa change_aa behaviour?. _aa
arXiv_aa preprint_aa arXiv:1901.02672.
Öğütçü,_aa G.,_aa Testik,_aa Ö._aa M.,_aa &_aa Chouseinoglou,_aa O._aa (2016)._aa Analysis_aa of_aa
personal_aa information_aa security_aa behavior_aa and_aa awareness._a Computers_aa &_aa
Security,_aa 56,_aa 83-93.
Nabi,_aa I._ A._aa (2018)._aa Growth_aa analysis_aa of_aa cyber_aa security_aa awareness_aa
among_aa mass_ people_aa of_aa Bangladesh:_aa a_aa case_aa study(Doctoral _aa
dissertation,_aa Daffodil_aa International_aa University).
Korpela,_aa K._aa (2015)._aa Improving_aa cyber_aa security_aa awareness_aa and_aa training_aa
programs_aa with_aa data_aa analytics._ Information _aa Security _aa Journal: _aa A _aa
Global_aa Perspective,_aa 24(1-3),_aa 72-77.
The_aa Components_aa of_aa a_aa Successful_aa Security_aa Awareness_aa Program._aa (2019)._aa
Retrieved_aa from_aa https://resources.infosecinstitute.com/components-successful-
security-awareness-program/
IT_aa 552_aa aa_aa aa_ aa_aa aa_a aa_aa aa_aa _aa aa_aa aa_ aa_aa aa_ aa_aa aa_a aa_aa aa_aa _aa aa_aa _aa aa_aa _aa _aa aa_aa aa_ aa_aa aa_ aa_aa aa_ aa_aa aa_aa aa_ aa_aa
_aa aa_aa aa_a aa_aa aa_aa _aa aa_aa _aa aa_aa aa_ aa_aa _aa aa_aa aa_ aa_aa aa_ aa_aa aa_a aa_aa aa_aa _aa _aa aa_aa _aa aa_aa _aa aa_aa aa_ aa_aa _aa aa_aa aa_a aa_aa aa_aa _aa
_aa aa_aa aa_a aa_aa aa_aa aa_ aa_aa aa_a aa_aa aa_ aa_aa aa_ aa_aa aa_a aa_aa aa_aa _aa aa_aa aa_ aa_aa aa_aa _aa aa_aa _aa aa_aa _aa aa_aa aa_aa aa_ aa_aa a _aa aa_aa aa_ aa_aa aa_
_aa aa_aa aa_a aa_aa aa_aa _aa aa_aa _aa aa_aa aa_ aa_aa _aa aa_aa aa_aa aa_aa aa_ aa_aa aa_a aa_aa aa_ aa_aa aa_aa _aa aa_aa aa_ aa_aa aa_a aa_aa aa_ aa_aa aa_a aa_aa aa_aa aa_aa 33
Behr,_aa A._ (2019)._aa Separation _aa of_aa duties_aa and_aa IT_ security._aa Retrieved_aa from_aa
https://www.csoonline.com/article/2123120/separation-of-duties-and-it-security.html
Encryption_aa and_aa Its_aa Importance_aa to_aa Device_aa Networking._aa (2019)._aa Retrieved_aa
from_aa https://www.lantronix.com/wp-content/uploads/pdf/Encryption-and-Device-
Networking_WP.pdf
Glaspie,_aa H._aa W.,_aa &_aa Karwowski,_aa W._aa (2017,_aa July)._aa Human_aa factors_aa in_aa
information_aa security_aa culture:_aa A_aa literature_aa review._aa In_ International _aa
Conference_aa on_aa Applied_aa Human_aa Factors_aa and_aa Ergonomics_aa (pp._aa 269-
280)._aa Springer,_aa Cham.
IT0125_aa -_aa Configuration_aa Management._aa (2019)._aa Retrieved_aa from_aa
https://policy.tennessee.edu/wp-content/uploads//policytech/system-wide/it/IT0125-
Configuration-Management.pdf
Media_aa Access_aa Control_aa Security_aa Overview_aa -_aa TechLibrary_aa -_aa Juniper_aa
Networks._aa (2019)._aa Retrieved_aa from_aa
https://www.juniper.net/documentation/en_US/junos-space-apps/network-
director3.3/topics/concept/macsec-understanding.html
Nobles,_aa C._a (2018)._aa Botching_aa Human_aa Factors_aa in_aa Cybersecurity_aa in_aa
Business_aa Organizations._aa HOLISTICA–Journal_aa of_aa Business_aa and_aa Public_aa
Administration,_aa 9(3),_aa 71-88.
Remote_aa Access:_aa The_aa Pros_aa and_aa Cons_aa of_aa Virtual_aa Private_aa Networking_aa |_aa
macchina.io_aa Blog._aa (2019)._aa Retrieved_aa from_aa
https://macchina.io/blog/security/remote-access-the-pros-and-cons-of-virtual-private-
networking/
Secure_aa Hash_aa Algorithms_aa |_aa Brilliant_aa Math_aa &_aa Science_aa Wiki._aa (2019)._aa
Retrieved_ from_aa https://brilliant.org/wiki/secure-hashing-algorithms/
IT_aa 552_aa aa_aa aa_ aa_aa aa_a aa_aa aa_aa _aa aa_aa aa_ aa_aa aa_ aa_aa aa_a aa_aa aa_aa _aa aa_aa _aa aa_aa _aa _aa aa_aa aa_ aa_aa aa_ aa_aa aa_ aa_aa aa_aa aa_ aa_aa
_aa aa_aa aa_a aa_aa aa_aa _aa aa_aa _aa aa_aa aa_ aa_aa _aa aa_aa aa_ aa_aa aa_ aa_aa aa_a aa_aa aa_aa _aa _aa aa_aa _aa aa_aa _aa aa_aa aa_ aa_aa _aa aa_aa aa_a aa_aa aa_aa _aa
_aa aa_aa aa_a aa_aa aa_aa aa_ aa_aa aa_a aa_aa aa_ aa_aa aa_ aa_aa aa_a aa_aa aa_aa _aa aa_aa aa_ aa_aa aa_aa _aa aa_aa _aa aa_aa _aa aa_aa aa_aa aa_ aa_aa a _aa aa_aa aa_ aa_aa aa_
_aa aa_aa aa_a aa_aa aa_aa _aa aa_aa _aa aa_aa aa_ aa_aa _aa aa_aa aa_aa aa_aa aa_ aa_aa aa_a aa_aa aa_ aa_aa aa_aa _aa aa_aa aa_ aa_aa aa_a aa_aa aa_ aa_aa aa_a aa_aa aa_aa aa_aa 34
Time_aa off_aa to_aa discover_aa fraud_aa -_aa FSS._aa (2019)._aa Retrieved_aa from_aa
https://www.forensicstrategic.com/blog/time-off-to-discover-fraud
Threats_aa to_aa Security._a (2019)._aa Retrieved_aa from_aa
https://www.cerias.purdue.edu/assets/pdf/k-12/infosec_newsletters/03threats.pdf
What_aa is_aa SSL_aa VPN_aa (Secure_aa Sockets_aa Layer_aa virtual_aa private_aa network)?_aa -_aa
Definition_aa from_aa WhatIs.com._aa (2019)._aa Retrieved_aa from_
https://searchsecurity.techtarget.com/definition/SSL-VPN
What_aa is_ Data_a Loss_aa Prevention_aa (DLP)?_aa A_aa Definition_aa of_aa Data_aa Loss_aa
Prevention._aa (2019)._aa Retrieved_aa from_ https://digitalguardian.com/blog/what-data-
loss-prevention-dlp-definition-data-loss-prevention
What_aa is_a Social_aa Engineering_aa |_aa Attack_aa Techniques_aa &_aa Prevention_aa Methods_a
|_aa Imperva._aa (2019)._aa Retrieved_aa from_aa
https://www.imperva.com/learn/application-security/social-engineering-attack/
What_aa is_aa an_aa Intrusion_aa Prevention_aa System?_aa -_aa Palo_a Alto_aa Networks._aa (2019)._aa
Retrieved_aa from_aa https://www.paloaltonetworks.com/cyberpedia/what-is-an-
intrusion-prevention-system-ips
5_aa bad_aa practices_aa that_aa hinder_aa your_ security,_aa and _a how _aa to _aa improve_aa it_aa |_aa
TechBeacon._aa (2019)._aa Retrieved_aa from_aa https://techbeacon.com/enterprise-it/5-
bad-practices-hinder-your-security-how-improve-it
Five_aa tips_aa for_aa managing_aa project_a change_aa requests._aa (2019)._aa Retrieved_aa from_aa
https://www.computerweekly.com/opinion/Five-tips-for-managing-project-change-
requests
Mark,_aa G.,_aa Czerwinski,_aa M.,_aa &_aa Iqbal,_aa S._aa T._aa (2018,_aa April)._aa Effects_aa of_aa
Individual_aa Differences_aa in_aa Blocking_aa Workplace_aa Distractions._aa In_aa
IT_aa 552_aa aa_aa aa_ aa_aa aa_a aa_aa aa_aa _aa aa_aa aa_ aa_aa aa_ aa_aa aa_a aa_aa aa_aa _aa aa_aa _aa aa_aa _aa _aa aa_aa aa_ aa_aa aa_ aa_aa aa_ aa_aa aa_aa aa_ aa_aa
_aa aa_aa aa_a aa_aa aa_aa _aa aa_aa _aa aa_aa aa_ aa_aa _aa aa_aa aa_ aa_aa aa_ aa_aa aa_a aa_aa aa_aa _aa _aa aa_aa _aa aa_aa _aa aa_aa aa_ aa_aa _aa aa_aa aa_a aa_aa aa_aa _aa
_aa aa_aa aa_a aa_aa aa_aa aa_ aa_aa aa_a aa_aa aa_ aa_aa aa_ aa_aa aa_a aa_aa aa_aa _aa aa_aa aa_ aa_aa aa_aa _aa aa_aa _aa aa_aa _aa aa_aa aa_aa aa_ aa_aa a _aa aa_aa aa_ aa_aa aa_
_aa aa_aa aa_a aa_aa aa_aa _aa aa_aa _aa aa_aa aa_ aa_aa _aa aa_aa aa_aa aa_aa aa_ aa_aa aa_a aa_aa aa_ aa_aa aa_aa _aa aa_aa aa_ aa_aa aa_a aa_aa aa_ aa_aa aa_a aa_aa aa_aa aa_aa 35
Proceedings_aa of_aa the_aa 2018_aa CHI_ Conference_aa on_aa Human_aa Factors_aa in_aa
Computing_aa Systems_aa (p._ 92)._aa ACM.
Slack,_aa Q._aa (2019)._ Why_aa vacation_aa at_aa tech_aa companies_ should_a be_
mandatory:_aa better_aa code,_aa happier_aa people._aa Retrieved_aa from_aa
https://about.sourcegraph.com/blog/why-vacation-at-tech-companies-should-be-
mandatory-better-code-happier-people
Three_aa Reasons_aa Your_aa Company_aa Should_aa Make_aa Vacation_aa Mandatory._aa (2019)._aa
Retrieved_aa from_aa https://www.forbes.com/sites/amberjohnson-
jimludema/2018/06/05/three-reasons-your-company-should-make-vacation-
mandatory/#5bc85c2638ec
6_aa ways_aa to_aa develop_a a_aa security_aa culture_aa in_aa your_aa organization._aa (2019)._aa
Retrieved_aa 19_aa July_aa 2019,_aa from_aa https://techbeacon.com/security/6-ways-
develop-security-culture-top-bottom
Bashay,_aa F._aa (2019)._aa What_aa Is_aa the_aa CIA_aa Triangle_aa and_aa Why_aa Is_aa It_
Important_aa for_aa Cybersecurity_aa Management?._aa Retrieved_aa 19_aa July_ 2019, _aa
from_aa https://www.difenda.com/blog/what-is-the-cia-triangle-and-why-is-it-important-
for-cybersecurity-management
Four_aa Tips_aa for_aa Building_aa a_aa Strong_aa Security_aa Culture_aa in_aa Your _ Organization._aa
(2019)._aa Retrieved_aa 19_aa July_aa 2019,_aa from_aa
https://blog.netwrix.com/2018/06/28/four-tips-for-building-a-strong-security-culture-in-
your-organization/
Gontovnikas,_aa M._aa (2019)._aa Cybersecurity_aa Shouldn’t_aa Be_aa a_aa Secret:_aa Why_aa
Transparency_aa Matters._aa Retrieved_aa 19_aa July_aa 2019,_aa from_aa
https://auth0.com/blog/cybersecurity-shouldnt-be-a-secret/
IT_aa 552_aa aa_aa aa_ aa_aa aa_a aa_aa aa_aa _aa aa_aa aa_ aa_aa aa_ aa_aa aa_a aa_aa aa_aa _aa aa_aa _aa aa_aa _aa _aa aa_aa aa_ aa_aa aa_ aa_aa aa_ aa_aa aa_aa aa_ aa_aa
_aa aa_aa aa_a aa_aa aa_aa _aa aa_aa _aa aa_aa aa_ aa_aa _aa aa_aa aa_ aa_aa aa_ aa_aa aa_a aa_aa aa_aa _aa _aa aa_aa _aa aa_aa _aa aa_aa aa_ aa_aa _aa aa_aa aa_a aa_aa aa_aa _aa
_aa aa_aa aa_a aa_aa aa_aa aa_ aa_aa aa_a aa_aa aa_ aa_aa aa_ aa_aa aa_a aa_aa aa_aa _aa aa_aa aa_ aa_aa aa_aa _aa aa_aa _aa aa_aa _aa aa_aa aa_aa aa_ aa_aa a _aa aa_aa aa_ aa_aa aa_
_aa aa_aa aa_a aa_aa aa_aa _aa aa_aa _aa aa_aa aa_ aa_aa _aa aa_aa aa_aa aa_aa aa_ aa_aa aa_a aa_aa aa_ aa_aa aa_aa _aa aa_aa aa_ aa_aa aa_a aa_aa aa_ aa_aa aa_a aa_aa aa_aa aa_aa 36
News,_aa Tips,_aa and_aa Advice_aa for_aa Technology_aa Professionals_aa -_aa TechRepublic._aa
(2019)._aa Retrieved_aa 19_aa July_aa 2019,_aa from_aa
https://www.techrepublic.com/article/success-strategies-for-security-awareness/
Where_aa The_aa World_aa Talks_aa Security_aa |_aa RSA_aa Conference._aa (2019)._aa Retrieved_aa
19_aa July_aa 2019,_aa from_aa
https://www.rsaconference.com/writable/presentations/file_upload/hum-t09-building-a-
strategic-plan-for-your-security-awareness-program.pdf
