Running Head: IT 552 aa aa aa aa aa a aa aa aa aa a aa aa aa aa aa aa aa aa aa aa aa aa aa aa a aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa a aa aa aa aa
aa aa aa aa aa aa aa aa aa aa aa aa a aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa 1
IT 552: Final Project
SNHU
IT 552 aa aa aa aa aa aa aa a aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa a aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa a aa
aa aa aa aa aa aa aa aa aa aa aa aa a aa aa aa aa aa aa aa aa aa aa aa aa aa aa a aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa 2
Table of Contents
Executive Summary .................................................................................................................. 3
Proposal Introduction .............................................................................................................. 4
Security Policies Development ............................................................................................... 6
Continuous Monitoring Plan................................................................................................. 16
Communication Plan .............................................................................................................. 20
Conclusion ............................................................................................................................... 26
References ............................................................................................................................... 27
IT 552 aa aa aa aa aa aa aa a aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa a aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa a aa
aa aa aa aa aa aa aa aa aa aa aa aa a aa aa aa aa aa aa aa aa aa aa aa aa aa aa a aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa 3
Executive Summary
In the digitalized era, cyber threats can any side and cripple the Information
Technology ecosystem of an organization. In order to be well equipped against
unknown threats and risks, business entities spend huge volumes of finance so that
they can safeguard themselves against sophisticated threats and attacks in the virtual
setting. Mainly businesses invest money to introduce robust defense and detection
mechanisms so that cyber attackers can be kept at a distance.
As per the case relating to Multiple Unite Security Assurance (MUSA)
Corporation, its security posture is low. One of the main reasons for the poor
security model can be attributed to the human factors that operate in the
organizational setting (Glaspie & Karwowski, 2017). As per numerous researchers, in
many cases, human factors botch up the IT security setting of an organization. Due
to their intentional or unintentional error, unauthorized users gain an access into the
system which ultimately compromises the security (Nobles, 2018).
A number of policies have been presented here that can help to address vital
security issues that can arise in the prevailing organizational context due to human
factors. By implementation of such policies, business organizations can be empowered
to enhance their security posture. The effective management of cybersecurity model
will only be possible if the security policies are taken into consideration the security
threats and risks that arise due to the involvement of the human factors (Nobles,
2018). A robust communication plan has been designed for Multiple Unite Security
Assurance (MUSA) Corporation which will help to addresses and summarize the
importance of a security awareness program.
IT 552 aa aa aa aa aa aa aa a aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa a aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa a aa
aa aa aa aa aa aa aa aa aa aa aa aa a aa aa aa aa aa aa aa aa aa aa aa aa aa aa a aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa 4
Proposal Introduction
Purpose
In the dynamic and unpredictable business setting, it is necessary for
organizations to have a robust cyber security model so that they can be well
equipped against online threats and risks. This security awareness program proposal of
Multiple Unite Security Assurance (MUSA) Corporation has been presented here so
that the existing poor security posture can be strengthened (Bada, Sasse & Nurse,
2019). The present security posture of MUSA is low as it is exposed to a high level
of cyber threats and risks that can cripple the IT ecosystem of the firm and the
business operations.
The fundamental purpose of the security awareness program proposal is to
help Multiple Unite Security Assurance (MUSA) Corporation to upgrade the existing
security posture so that it can function in a safe and secure manner. At present, the
employees do not have proper cybersecurity awareness training and this naturally
adversely influences the security climate within the MUSA organization (Bada, Sasse
& Nurse, 2019). Due to their lack of adequate skills and technical expertise, they are
unable to take suitable actions against different kinds of online threats and attacks.
This proposal intends to empower the organizational personnel of MUSA so that they
will be in a position to deal with different kinds of attacks and threats that can
hamper the business activities and processes.
Security Posture
As per the risk assessment of the organization, it lacks a proper cybersecurity
program in place that can help it to be well prepared to deal with external or
internal threats that can arise on the online platform. As the human factors that
IT 552 aa aa aa aa aa aa aa a aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa a aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa a aa
aa aa aa aa aa aa aa aa aa aa aa aa a aa aa aa aa aa aa aa aa aa aa aa aa aa aa a aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa 5
operate in the business setting do not have the technical skills and they have not
been trained properly by the organization, it faces numerous risks and uncertainties in
the digital environment (Nabi, 2018). This proposal relating to security awareness
program of MUSA has been designed so that the existing gaps in its security system
can be filled and the firm’s security posture can be improved to a significant degree
(The Components of a Successful Security Awareness Program, 2019).
Human Factors
The proposal would also help MUSA to take care of a number of
organizational factors that come into play and contribute to the unhealthy security
culture in the business entity. For instance, it will encompass the relevant security
policies, tools, and techniques that can be implemented in the organizational setting to
strengthen the security approach. In addition to this, the proposal would focus on the
technical training needs of the employees so that they would be in a better position
to identify varying kinds of cyber threats and take necessary actions so that the
security model of the firm would not be compromised (Alotaibi et al., 2016). Thus
the intention of the security awareness program proposal is to make the employees
aware of various kinds of security elements that can be introduced or implemented to
strengthen the cybersecurity infrastructure of Multiple Unite Security Assurance
Corporation. It would also help to constructively mold the factors that come into play
and increase the vulnerability of the business in the cyber setting.
Organizational Factors
A total of ten security gaps have been presented in the security posture of the
business entity that needs to be addressed on an urgent basis. Some of the main
security concerns that have been included in this security awareness proposal are the
lack of annual cybersecurity awareness training for the employees, the absence of
IT 552 aa aa aa aa aa aa aa a aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa a aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa a aa
aa aa aa aa aa aa aa aa aa aa aa aa a aa aa aa aa aa aa aa aa aa aa aa aa aa aa a aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa 6
suitable configuration change management policy, and the lack of intrusion detection
or prevention system. In addition to this, MUSA does not analyze or collect logs.
The absence of media access control policy adds to the security concerns of the
business undertaking. In the unpredictable technological setting, MUSA does not have
encryption or hashing which can control the data flow as well as the unauthorized
alteration of data. These are some of the major security concerns that the firm faces
in an unpredictable technological setting. The business entity has the opportunity to
introduce in place Vulnerability assessment model which will be able to assess the
security posture status of the business undertaking (Öğütçü, Testik & Chouseinoglou,
2016).
The security concerns of Multiple Unite Security Assurance Corporation that
have been identified here not only jeopardize the online sustainability of the business
undertaking but it also has an adverse implication on the morale of the employees
(Korpela, 2015). Due to the high level of security issues that the business encounters
on a usual basis, the level of employee turnover is high and it impacts the
profitability and performance of the business as well. The security awareness program
proposal for MUSA has been designed so that the employees can be empowered to
identify the various online threats and risks that can adversely impact their
Information Technology ecosystem.
Security Policies Development
Proposal for mitigating security threats that arise due to human factors
A perfect security awareness model has been presented here so that it would
help to mitigate the threats that are posed by the human factors to the organization’s
security posture. The proposal that has been designed for the business entity
IT 552 aa aa aa aa aa aa aa a aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa a aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa a aa
aa aa aa aa aa aa aa aa aa aa aa aa a aa aa aa aa aa aa aa aa aa aa aa aa aa aa a aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa 7
encompasses a total of ten security policies that would enable the firm to fill the
security gaps that currently exist and weaken the security posture of MUSA (Threats
to Security, 2019). The policies have been crafted so that the organization would be
in a position to address unintentional threats as well as intentional threats or social
engineering. The policies that have been designed also focus on the quality of data
flow so that it could not be tampered with.
As per the strategy that has been presented here, the cybersecurity threats that
arise before the entity can be categorized into two types namely unintentional threats
and intentional threats. The unintentional threats can be defined as the threats that
arise due to human errors or computer failure (Threats to Security, 2019). The
intentional threats are the ones that arise on the online platform due to various kinds
of malicious elements such as viruses, theft of data, denial of service attack and other
factors that have been malicious intent. The security policies have been strategically
framed so that the existing security gaps can be addressed in an effective manner. aa
Policies
A. Protection against unintentional threats
The following security policies have been proposed here would help Multiple
Unite Security Assurance Corporation to safeguard itself against various kinds of
unintentional threats that arise due to human factors and adversely impact the security
if the organization.
Changes in the remote access mechanism
The remote access is a policy that can enable employees of an organization to
work remotely or work from their home. This policy might be employee friendly but
at the same time, it gives rise to a number of security concerns as unauthorized users
have the opportunity to gain access into the organizational network. The employees
IT 552 aa aa aa aa aa aa aa a aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa a aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa a aa
aa aa aa aa aa aa aa aa aa aa aa aa a aa aa aa aa aa aa aa aa aa aa aa aa aa aa a aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa 8
that work remotely can gain access into the organizational system from anywhere at
any time. There is the possibility that these individuals will unintentionally make
blunders while surfing the internet. Such an innocent error on part of the employees
working remotely can have a detrimental implication on the business entity. For
example, in case the employees, click on the link of a malicious site from their
personal computer, unauthorized attackers could gain entry into their systems and
compromise the security, integrity, and confidentiality of the organizational data.
In order to deal with the cybersecurity threats that arise due to the remote
access policy, there is the need to activate remote access feature that is present in the
firewall. It would make sure that the employees working remotely can gain access in
a safe and secure manner by making use of the Secure Sockets Layer Virtual Private
Network feature (What is SSL VPN (Secure Sockets Layer virtual private network)? -
Definition from WhatIs.com, 2019). By using this security feature, the origination’s
personnel would be in a position to create safe access to the MUSA’s system when
they are working from home. The employees could also use their mobile devices to
work remotely in a safe working environment after the implementation of the security
policy (Remote Access: The Pros and Cons of Virtual Private Networking |
macchina.io Blog, 2019).
Introduction of encryption or hashing
Encryption and/or hashing are regarded to be some of the most basic security
measures that business undertakings need to implement so that the level of security
of their IT infrastructure can be strengthened to a certain degree. This policy has
been proposed so that the security could be strengthened whether the organizational
data is ready for transmission, it is in the process of transmission or it has already
been transmitted. Data encryption would be made mandatory so that it could deter
IT 552 aa aa aa aa aa aa aa a aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa a aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa a aa
aa aa aa aa aa aa aa aa aa aa aa aa a aa aa aa aa aa aa aa aa aa aa aa aa aa aa a aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa 9
malicious parties from gaining unauthorized access into sensitive business information.
The encryption process would basically make use of algorithms which would convert
ta into unique codes. The computers that have the right key would be able to crack
these codes and put them into the original form. There are two types of encryption
methods including symmetric key and public key (or asymmetric). In the former
method, the same key is used or installed in both the systems that are responsible for
receiving and transmitting the information. The public key encryption, on the other
hand, utilizes two sets of keys simultaneously namely a private key and a public key
to strengthen the security level. In the business context of MUSA, the asymmetric
encryption could be introduced to strengthen the security level (Encryption and Its
Importance to Device Networking, 2019).
Similarly, hashing has also been introduced in the security policy. The hash
methods like Secure Hash Algorithms (SHA-1, SHA-2, and SHA-3) could be
employed so that the integrity of the organizational data could be maintained and
strengthened (Secure Hash Algorithms | Brilliant Math & Science Wiki, 2019). These
algorithms are designed with strong encryptions so that they can effectively respond
to online cyber-attacks. This tool would enable the firm to keep a tab on any kind of
modification or tampering of the data that has been transmitted or received. For
example, in case there is even a slight change in any text file, the hash value of the
modified file will be different from the original hash value. Thus the organization
will come to know that data has been tampered with (Secure Hash Algorithms |
Brilliant Math & Science Wiki, 2019). These methods would facilitate the business
entity to have a stronger control over the data flow and thus capture any kind of
unauthorized alteration of data.
Conducting regular checks and auditing of user accounts
IT 552 aa aa aa aa aa aa aa a aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa a aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa a aa
aa aa aa aa aa aa aa aa aa aa aa aa a aa aa aa aa aa aa aa aa aa aa aa aa aa aa a aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa 10
At present, one of the major security gaps that have been identified in the
MUSA organization relates to the fact that the logs of the employees are not
collected or analyzed. There is the need to introduce a robust auditing protocol so
that the accounts of all the organizational personnel of MUSA would be thoroughly
checked and scrutinized. For instance, this security policy could be applied once in a
quarter or once every six months so that the safety and security of the accounts
could be maintained. While conducting the audit process of the user accounts, it is
necessary to take in to account a number of aspects such as whether the account is
active or inactive (disabled). For example, both these accounts could be targeted by
online attackers so that they could gain unauthorized access into the organization’s
system.
Some of the key settings and properties that must be considered while
implementing the security policy relating to the auditing of user accounts include
checking of the login scripts, the activity of the workstations and the frequency of
change of passwords. The audit procedure would help Multiple Unite Security
Assurance (MUSA) Corporation to determine the real-time status of the accounts of
the users. For example, in case an account that has been disabled for a long time is
active the Information Technology team must take necessary actions to check the
activity. Similarly, in case, an employee or user has failed to change or update his
or her password in more than six months, he must be notified to do the same on an
urgent basis. This security policy would be of vital importance as it would encourage
the employees of the firm to take necessary security measures at the individual level.
Employees of the firm would try to take the necessary steps at their individual level
so that the existing security gaps could be effectively addressed.
Introduction of media access control policy
IT 552 aa aa aa aa aa aa aa a aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa a aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa a aa
aa aa aa aa aa aa aa aa aa aa aa aa a aa aa aa aa aa aa aa aa aa aa aa aa aa aa a aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa 11
A robust media access control policy could be introduced in the business
setting to secure the connections on the online platform. In the current times, a large
number of business activities are taking place in open virtual spaces such as social
media platforms which is increasing the vulnerability of the organization. In order to
give a tough fight to cybercriminals, it is necessary to have in place suitable media
access control policies and guidelines which would guide the employees while
carrying out online business activities.
The policy would play a critical role to strengthen the firm’s security system and
address the existing security gaps. This is because; the employees would be able to
carry out activities in a careful and conscious manner so that online hackers would
not get the scope to gain unauthorized access into the network (Media Access
Control Security Overview - TechLibrary - Juniper Networks, 2019). For example, the
firm could use a single login id on social media platforms to design its social media
marketing strategy. In case a second user id is created or used, the same could be
blocked for security reasons. Similarly, MUSA could also implement Data Loss
Prevention (DLP) tools so that it could keep a tab on the flow of the sensitive
information in the corporate network (What is Data Loss Prevention (DLP)? A
Definition of Data Loss Prevention, 2019).
Implementation of configuration change management policy
Change management refers to the formal process of making some kind of
change in the Information Technology system of an organization. In MUSA, a
configuration change management policy could be implemented so that the processes
relating to change could be effectively controlled. The policy could have a
constructive implication on the security model of the organization. For example, the
security policy would make sure that the integrity of the existing policies and codes
IT 552 aa aa aa aa aa aa aa a aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa a aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa a aa
aa aa aa aa aa aa aa aa aa aa aa aa a aa aa aa aa aa aa aa aa aa aa aa aa aa aa a aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa 12
is in place. In addition to this, the new policy would help to identify security flaws.
It would act as a baseline that could be used for comparing the technical codes after
any changes have been introduced in the IT system. The policy would be necessary
for improving the security of the firm as it would make sure that there exists
compliance with the minimum acceptable system configuration requirements (IT0125 -
Configuration Management, 2019, p 1). The policy could safeguard MUSA against
malicious threats and risk that could arise in the virtual environment of the company.
B. Social Engineering
Social engineering can be defined as the act of tricking someone so that he or
she will make security blunders which can ultimately have an adverse impact on the
security model. In the case of Multiple Unite Security Assurance Corporation, the
following policies have been designed so that protection against social engineering
could be possible (What is Social Engineering | Attack Techniques & Prevention
Methods | Imperva, 2019). In the current times, online hackers are using sophisticated
tools so that they can con professionals to disclose sensitive information such as
passwords. The security policies can help MUSA to be well equipped against such
kinds of online threats.
Providing annual cybersecurity awareness training
One of the basic steps is that the organization must design a robust annual
cyber security awareness training program so that its employees in all the departments
would be empowered to handle a tricky situation. As the name suggests, the training
program would be conducted on a yearly basis so that every time, the employees
would be able to handle sophisticated online threats. The training would encompass
basis security concepts such as:
❖ Do not download attachments from unknown parties.
IT 552 aa aa aa aa aa aa aa a aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa a aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa a aa
aa aa aa aa aa aa aa aa aa aa aa aa a aa aa aa aa aa aa aa aa aa aa aa aa aa aa a aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa 13
❖ Do not open the emails and messages that are in spam mail.
❖ Do not open emails that have been sent by unknown parties.
In addition to this, the annual cybersecurity awareness training would also
involve technical concepts that the users need to understand so that the security of
the organization could be strengthened. For instance, MUSA could introduce
educational resources relating to cybersecurity training and conduct regular tests. Only
after the employees of MUSA would be able to pass these tests, they would gain
access to the firm’s system and network.
Introduction of intrusion detection/prevention system
An intrusion detection/ prevention system could be introduced in Multiple
Unite Security Assurance Corporation so that it could thoroughly examine the traffic
of the network. This system would be set behind the firewall so that it could detect
and prevent ‘vulnerability exploits’. Vulnerability exploits can come in the form of
malicious input and could compromise the security of the IT infrastructure of the
business. By introducing this layer of security, harmful content could be filtered out
(What is an Intrusion Prevention System? - Palo Alto Networks, 2019). The intrusion
detection system would be responsible to scan the network traffic and report back on
any identified threats or risks. The intrusion prevention system could be employed as
it would help to carefully analyze and take suitable actions on the network traffic
flow of MUSA. By introducing these tools, the security system of the firm could be
improved and harmful elements in the network could be identified.
Adoption of mandatory vacation policy
Multiple Unite Security Assurance (MUSA) Corporation could implement a
mandatory vacation policy which would require its employees to take leaves on a
yearly basis. Such a policy would have a direct impaction on the security model that
IT 552 aa aa aa aa aa aa aa a aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa a aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa a aa
aa aa aa aa aa aa aa aa aa aa aa aa a aa aa aa aa aa aa aa aa aa aa aa aa aa aa a aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa 14
is implemented in the business setting. A mandatory vacation policy could play a key
role in the organizational context, as the firm would be able to detect fraudulent
activities. The policy would force all employees including the suspicious employees to
take leave. So they would have less amount of time with them to use their position
in the firm to conduct activities with malicious intention (Time off to discover fraud -
FSS, 2019). During the vacation time of suspicious employees, the management of
the company could carry out checks of the Information Technology infrastructure so
that malicious behavior could be identified.
Segregation of duties
Segregation of duties would act as one of the key concepts of internal control
that could positively impact the security of the IT system. By creating specific
responsibilities and duties that each and every employee has to perform in the
business setting, the management of MUSA could make sure that unwanted threats or
risks and conflicts of interests could be avoided (Behr, 2019). The fundamental
objective of the policy would be to disseminate the business activities and linked
privileges so that the security model could be strengthened. Such a policy would
make sure that the employees would use their workstations in a responsible manner
so that no one can use their computer systems to do any work without their prior
knowledge. This regulatory mandate would have a direct impact on the IT security of
MUSA. The proper categorization and division of work would be a major step
towards a safe and secure IT system as the employees would take ownership of their
duties and act in a responsible manner. It could minimize the vulnerability of MUSA
in the virtual setting (Behr, 2019).
Personally identifiable information breaches
IT 552 aa aa aa aa aa aa aa a aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa a aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa a aa
aa aa aa aa aa aa aa aa aa aa aa aa a aa aa aa aa aa aa aa aa aa aa aa aa aa aa a aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa 15
Personally, identifiable information could be introduced so that any data or
information could be used for the purpose of identifying particular organizational
personnel in MUSA. Private data could be saved by the company so that it would be
in a position to identify the individuals that are responsible for a data breach
incident. This policy would make sure that MUSA has the power to take necessary
action or precautionary action to safeguard itself from unauthorized access, data loss
or theft (Behr, 2019). This is a vital security policy that could be implemented at the
organizational level so that specific measures could be taken to tackle data security
breaches and incidents.
Ensuring a sound connection between the data sender and the data receiver
In order to make sure that there exist a sound and secure connection between
a data sender and a data receiver, it is necessary to keep a number of security
instruments in place such as firewall, intrusion detection/ prevention system and
antivirus. Such security tools would play a key role to address the security concerns
and establish a safe environment where communication between a data sender and a
data receiver could take place. Similarly, the use of encryptions or hashing would
also play a critical role. This is because these security approaches would make sure
that the data that is being received or transmitted cannot be tampered with or altered
from its intended meaning (Behr, 2019). These security measures would be of
paramount importance for MUSA as they could strengthen the security infrastructure
and limit the scope of online attackers to alter the sensitive data or information
relating to the business. Thus in order to address the issue relating to poor
communication on the IT platform of MUSA, it is necessary to encrypt all the
messages so that its real meaning could only be deciphered by the intended user. aa aa aa
aa aa aa aa aa aa aa aa aa
IT 552 aa aa aa aa aa aa aa a aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa a aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa a aa
aa aa aa aa aa aa aa aa aa aa aa aa a aa aa aa aa aa aa aa aa aa aa aa aa aa aa a aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa 16
Continuous Monitoring Plan
A continuous monitoring plan is necessary as it can help to keep a check on
the security control model that has been designed and implemented in the
organizational setting. This plan fundamentally lays out the foundation for regularly
and consistently monitoring the organization against malicious activities and intentional
as well as unintentional threats. In order to make sure that the monitoring plan is
effective and serves the desired purpose, it is necessary to focus on a number of
elements such as the core features of the work setting, the work plan, and employee
readiness. In Multiple Unite Security Assurance (MUSA) Corporation, there is the
need to establish a properly functional continuous monitoring plan so that the various
security gaps that exist in the organizational setting can be effectively addressed.
Work Settings
In the work setting, a wide range of factors come into play that can adversely
impact the work ambiance. Some of the most common elements are the non-
implemented security protocols, poorly implemented management policies, and other
distractions and obstacles. It is necessary to take the necessary steps by the managers
and the management team so that such negative elements which increase the security
vulnerability of the firm can be kept at a distance.
The management must take careful measures to ensure that all the security
protocols and policies are systematically implemented throughout the firm. Such a
step is a necessity as it will help the organization in the long run to have better
control over its costs, risks and system network (Five tips for managing project
change requests, 2019). The major changes that take place in the IT setting must be
IT 552 aa aa aa aa aa aa aa a aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa a aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa a aa
aa aa aa aa aa aa aa aa aa aa aa aa a aa aa aa aa aa aa aa aa aa aa aa aa aa aa a aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa 17
carefully documented and recorded so that they can be assessed as per requirement.
Some of the key steps that need to be followed while introducing a major change in
the organization include:
• A request must be made so that a change can be introduced. It needs to be
documented clearly.
• The change log has to be updated in a timely manner so that no details will
be skipped. The key elements that will be altered have to be written down in
this simple document. aa aa a
• The proper assessment of the change request is an important step. It will
basically help to develop a sense of urgency. In the case of MUSA, it is
extremely vital to introduce the necessary changes so that the quality of
security can be upgraded.
• The thorough assessment of the change against the set criteria is of paramount
importance. It will assist in deciding whether the change has to be rejected or
approved
• The final step basically involves the decision that is taken regarding the
approval or the rejection of the change. During this stage, the outcome has to
be communicated to the key stakeholders so that they will be aware of the
changes that have been introduced in MUSA to strengthen the security model
(Five tips for managing project change requests, 2019).
The obstacles such as distractions can be managed by making sure that the
organizational personnel get the requisite space and time to focus on their job. The
managers and supervisors must interact and engage with the subordinates to get to
know of the key factors and elements that bother the employees and adversely impact
their performance (Mark, Czerwinski & Iqbal, 2018).
IT 552 aa aa aa aa aa aa aa a aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa a aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa a aa
aa aa aa aa aa aa aa aa aa aa aa aa a aa aa aa aa aa aa aa aa aa aa aa aa aa aa a aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa 18
MUSA has to make sure that the management policies are properly implemented
and executed throughout the organization (5 bad practices that hinder your security,
and how to improve it | TechBeacon, 2019). It will play a vital role to make sure
that security violations can be curtailed to a possible extent. Some of the negative
practices that must be eliminated at once in the organizational setting are as follows:
• Sharing of common sensitive passwords throughout the entity
• Allowing unauthorized users in the secured and restricted read of the
organization
• Ineffective implementation of the intrusion detection system (IDS) and intrusion
prevention system (IPS)
• Continuing to use outdated technological approaches
These are some of the practices that need to be avoided at any cost on MUSA
so that the security posture can be improved. Similarly, the firm has to introduce
robust security training for its employees so that they will be empowered to take the
necessary steps to improve the level of security of the entity. The firm must
implement both software and hardware firewalls so that a secure layer can be created
which will keep unauthorized users at a distance.
Work Planning and Control
The work and processes that are conducted in MMUSA must be strategically
planned and controlled as they can have a major implication on the performance and
productivity of the organizational personnel. Some of the key aspects that must be
carefully taken into consideration while planning and controlling the work include the
job-related stress and pressure, time factor, the difficulty level of the assigned work
and ineffective task planning.
IT 552 aa aa aa aa aa aa aa a aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa a aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa a aa
aa aa aa aa aa aa aa aa aa aa aa aa a aa aa aa aa aa aa aa aa aa aa aa aa aa aa a aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa 19
Some of the key strategies that can be introduced in MUSA for addressing job
pressure, time factors, task difficulty, routine alteration and lack of knowledge and
skills are introducing proper training sessions, implementing mandatory vacation policy
and conducting ‘vulnerability assessment’ on a frequent basis.
Training sessions
MUSA must take the necessary steps so that the technical knowledge and
expertise of its employees can be upgraded on a regular basis. By providing them
training and development opportunities, the employees would be encouraged to
perform better. They would be able to play an active role to mitigate the risks that
arise in the IT setting of MUSA. This element must be included in the work
planning as it would have a positive implication on the productivity of the
employees.
Mandatory vacation policy
MUSA must introduce mandatory vacation policy so that employees will take
holiday to get a break from the hectic work schedule. It will help them to manage
their work-related stress and pressure (Three Reasons Your Company Should Make
Vacation Mandatory, 2019). This policy can also play a key role to improve the
security framework of the entity. This is because it will help the firm to keep a
check on insider fraud (Slack, 2019). aa aa
Conducting regular vulnerability assessment
By carrying out regular vulnerability assessment, MUSA would be able to
keep a tab on the security aspect of its network and computer system. Such an
evaluation process must be conducted on public holidays so that the day to day work
processes would not be affected because of the security procedure.
Employee Readiness
IT 552 aa aa aa aa aa aa aa a aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa a aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa a aa
aa aa aa aa aa aa aa aa aa aa aa aa a aa aa aa aa aa aa aa aa aa aa aa aa aa aa a aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa 20
Employees are the most critical asset of an entity. So their well-being, moral
and satisfaction must be the top priority of MUSA. It can introduce a number of
strategic approaches so that it would be in a position to address issues relating to
inattentiveness, high level of stress and anxiety, boredom and fatigue, and work-
related illness or injury. Only of the employees are mentally and physically fit and
ready, they would be able to optimally contribute to the performance and security
framework of MUSA.
In order to manage a high level of stress, boredom, and fatigue, MUSA must
introduce mandatory vacation policy. By taking a break from the work, employees
would be able to focus on their personal health and well-being (Three Reasons Your
Company Should Make Vacation Mandatory, 2019). The managers must have a one-
on-one interaction with the subordinates so that they could share their concerns that
make them anxious.
An employee readiness program must be introduced so that the employees could
actively participate in the dynamic organizational setting. This could positively impact
the employee turnover of MUSA. Innovative engagement activities could be
introduced such as group discussions, events, and games so that no employee would
get bored. A healthy work environment must be created by taking into account the
health and well-being of the organizational personnel.
aa aa aa aa aa aa aa aa a aa aa aa a aa aa aa aa aa a aa aa aa a aa aa aa aa a aa aa aa aa a aa aa Communication Plan
The thorough engagement would play a vital role to influence a culture that
gives due importance to IT security. In fact, the communication plan could enhance
the success of the organization as it would assist to convince diverse stakeholders of
the entity to support the healthy security culture. The communication plan is designed
IT 552 aa aa aa aa aa aa aa a aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa a aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa a aa
aa aa aa aa aa aa aa aa aa aa aa aa a aa aa aa aa aa aa aa aa aa aa aa aa aa aa a aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa 21
in a simple and effective manner so that it could make sense for both technical as
well as the non-technical audience. aa
Overview
The security posture of MUSA is quite low so there is the need to introduce
a new and improved security awareness program. In order to make the new security
model work, one of the basic things that must be taken into consideration is the
communication plan. The role of a security communication plan is of paramount
importance as it can help the employees to take necessary steps so that the high
quality of security can be maintained in the best possible manner (Bashay, 2019).
The document acts as a guide which can increase the overall awareness of the
workfare in MUSA on various security aspects. The primary objective of the
communication plan is to safeguard the Confidentiality, Integrity, and Availability of
the digital resources and information of the business entity.
The communication plan sheds light on a number of messaging strategic
approaches that can help MUSA to share details on the new security model. It would
also help the organizational personnel to get a detailed idea about their exact roles
and responsibilities to execute the plan (Where The World Talks Security | RSA
Conference, 2019).
Messaging Strategies
While designing a suitable messaging strategic framework, it is necessary to
identify the important areas that the specific communication message will address.
Some of the main areas include cyber laws, the cost associated with security breaches
in the organizational setting, personally identifiable information (PII) breaches, the
need of security awareness and the implication of awareness programs on the security
posture and culture of the business organization. The effectiveness of MUSA’s new
IT 552 aa aa aa aa aa aa aa a aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa a aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa a aa
aa aa aa aa aa aa aa aa aa aa aa aa a aa aa aa aa aa aa aa aa aa aa aa aa aa aa a aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa 22
security awareness model will largely depend on the lines of communication that are
established by the business undertaking. The management of MUSA must constantly
evaluate the internal communication approach so that the organizational personnel can
be constantly informed of the best security practices that can be implemented to
handle different kinds of security threats.
Implementing different communication methods for different stakeholders
MUSA must ensure that the communication channels and methods that are
introduced to increase the level of awareness of the security model can serve the
purpose. Thus the use of communication approaches must be different when MUSA
interacts with different internal stakeholders such as employees, IT professionals,
senior management team and non-IT members. For example, while sharing a message
on security with non-technical members, video presentations could be used. But while
sharing a message with members from the IT department, emails or memo could be
used (Where The World Talks Security | RSA Conference, 2019, p 6). aa
In order to implement a holistic and integrated messaging strategy that meets
the needs of all the internal personnel, MUSA could partner with its communication
team. Such an approach would be beneficial as the individuals would help to enhance
the messaging approaches so that information reaches all the target audience within
the business setting (Where The World Talks Security | RSA Conference, 2019, p
24).
High level of transparency
In order to enhance the importance of the security awareness plan, the
messaging strategy must be transparent and uniform in nature. Transparency initiatives
must be the key focus of MUSA so that carefully designed so that all the employees
would be on the same page and they would have uniform knowledge on the security
IT 552 aa aa aa aa aa aa aa a aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa a aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa a aa
aa aa aa aa aa aa aa aa aa aa aa aa a aa aa aa aa aa aa aa aa aa aa aa aa aa aa a aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa 23
model of the business entity. By making the information transparent, the employees
across various departments of the business entity would understand how their actions
and duties could impact the security posture of the firm. In fact, a transparent
communication approach could bridge the trust gap between the IT department and
the non-IT department of Multiple Unite Security Assurance Corporation. True
transparency is not merely about giving information to the organizational personnel
within the organizational setting. The messaging strategy should be designed in such
a manner so that the information could be properly understood by the employees
without any kind of confusion or ambiguity (Gontovnikas, 2019).
Focus on the language of the message
Technology is a field which not many people are totally aware of. So while
spreading an important message about the security strategy, technical jargons must not
be used by Information Technology managers. This is an important aspect that
MUSA must keep in mind so that the message that is being communicated by it can
be understood in a clear manner by all the intended audience irrespective of the
department in which they function. According to E Kelly Hansen, the Chief Executive
Officer of Neohapsis Inc., the language of IT cannot be easily understood by non-IT
professionals. So in order to deal with this issue, simple English language must be
used while communicating about the security awareness program and its importance
in the organizational setting. The wrong use of language would naturally encourage to
stop paying attention to the message as it would be going over their heads. So
simple and understandable language needs to be used so that professionals from both
the IT and non-IT department could understand the relevance of the security
awareness program (News, Tips, and Advice for Technology Professionals -
TechRepublic, 2019).
IT 552 aa aa aa aa aa aa aa a aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa a aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa a aa
aa aa aa aa aa aa aa aa aa aa aa aa a aa aa aa aa aa aa aa aa aa aa aa aa aa aa a aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa 24
Starting the communication from the top
The security awareness program could have a major impact on the existence
and sustainability of the business entity. So before communicating about the same, it
is necessary to initiate the communication from the top. This would mean that the
leaders and decision-makers would act as the starting point of the communication.
The visible backing of the leader of Multiple Unite Security Assurance (MUSA)
Corporation would encourage the employees from all across the firm to participate in
the approach (News, Tips, and Advice for Technology Professionals - TechRepublic,
2019). The evidence of executive stewardship would be of paramount importance in
the business context to adopt an interactive and engaging communication approach.
Similarly, the IT professionals in the business setting must take the initiative to make
the leaders and senior managers understand the significance of the security awareness
model which could constructively influence the security posture of MUSA.
Streamlining the communication model
The security success program of MUSA could be successful throughout the
business entity only if a uniform and streamlined communication network would be
deployed. There is the need to constantly evaluate and align the internal
communication channels so that the employees across all the departments of the firm
would be able to understand how the security model could have implications on
them, their department and the entire business entity (News, Tips, and Advice for
Technology Professionals - TechRepublic, 2019). The proper flow of information on
the security program would keep the employees on their toes. They would be
encouraged to adopt safe practices which could restrict the adverse implications on
the security aspect of MUSA.
Security culture
IT 552 aa aa aa aa aa aa aa a aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa a aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa a aa
aa aa aa aa aa aa aa aa aa aa aa aa a aa aa aa aa aa aa aa aa aa aa aa aa aa aa a aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa 25
A healthy security culture is the need of the hour at Multiple Unite Security
Assurance Corporation so that its security posture could be improved. In order to
effectively promote a healthy security culture throughout the business setting, a
number of approaches could be implemented.
Focus on awareness – The management of the business entity must focus on
making the employees aware of the significance of having a robust and healthy
security culture. For example, for developers and testers that functions in the IT
department, an application security awareness approach could be employed. It would
help to carefully evaluate the seriousness of a security threat and take necessary
actions to deal with it (6 ways to develop a security culture in your organization,
2019).
Deployment of leadership-driven cyber governance model – In order to
encourage a healthy security culture, the active involvement of senior managers and
leaders would be indispensable in the organizational context of MUSA. Their
participation would influence the employees at all the levels of MUSA to focus on
their individual roles and duties so that they could contribute to enhancing the level
of security in the business setting (Four Tips for Building a Strong Security Culture
in Your Organization, 2019). Thus the strong commitment by the top management
of MUSA would help to convince diverse stakeholders of MUSA to strengthen the
healthy security culture.
Clear documentation of security policies – Establishment of clear and well-
defined security policies and guidelines would act as the cornerstone of a healthy
security culture. Thus in MUSA, the new security policies must be clearly
documented so that they would guide the employees while conducting the day to day
IT 552 aa aa aa aa aa aa aa a aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa a aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa a aa
aa aa aa aa aa aa aa aa aa aa aa aa a aa aa aa aa aa aa aa aa aa aa aa aa aa aa a aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa 26
business activities and processes (Four Tips for Building a Strong Security Culture in
Your Organization, 2019).
Providing adequate training to the staff members – The management of MUSA must
ensure that the employees get the necessary training to understand the relevance of
security in the unpredictable IT setting. Such an approach would be of paramount
importance as it would assist in fostering a healthy security culture among the
employees (Four Tips for Building a Strong Security Culture in Your Organization,
2019).
Conclusion
The security policies that have been presented here must be introduced by Multiple
Unite Security Assurance (MUSA) Corporation so that it would be in a position to
address the security gaps that exist in its organization. The policies have been
designed in a strategic manner so that the firm would be in a position to deal with
intentional threats as well as unintentional threats that could arise before it. These
policies would primarily empower the business entity and its employees so that they
could take necessary measures to protect the security system. The policies that have
been designed specifically revolve around human errors that give an unfair advantage
to unauthorized individuals and cyber attackers in the virtual platform. These policies
could be effective only if the employees would follow them strictly in the
organizational context. The role of a well-planned communication and messaging
IT 552 aa aa aa aa aa aa aa a aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa a aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa a aa
aa aa aa aa aa aa aa aa aa aa aa aa a aa aa aa aa aa aa aa aa aa aa aa aa aa aa a aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa 27
strategy would be extremely vital to improving the security posture of MUSA. The
various strategic elements that have been encompassed in the communication plan
include the proper implementation of varying communication methods for different
stakeholders, maintaining a high level of transparency, high focus on the language of
the message, starting the communication from the top and streamlining the overall
communication model. There is an urgent need to make the diverse stakeholder of
MUSA understand the importance of a healthy security culture. Various approaches
that could be introduced to promote a healthy security culture include the focus on
awareness, deployment of leadership-driven cyber governance model, clear
documentation of security policies and providing necessary training to the employees.
References
Alotaibi, F., Furnell, S., Stengel, I., & Papadaki, M. (2016). A review of using
gaming technology for cyber-security awareness. Int. J. Inf. Secur. Res.(IJISR),
6(2), 660-666.
Bada, M., Sasse, A. M., & Nurse, J. R. (2019). Cyber security awareness campaigns:
Why do they fail to change behaviour?. arXiv preprint arXiv:1901.02672.
Öğütçü, G., Testik, Ö. M., & Chouseinoglou, O. (2016). Analysis of personal
information security behavior and awareness. Computers & Security, 56, 83-93.
Nabi, I. A. (2018). Growth analysis of cyber security awareness among mass people
of Bangladesh: a case study(Doctoral dissertation, Daffodil International
University).
IT 552 aa aa aa aa aa aa aa a aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa a aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa a aa
aa aa aa aa aa aa aa aa aa aa aa aa a aa aa aa aa aa aa aa aa aa aa aa aa aa aa a aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa 28
Korpela, K. (2015). Improving cyber security awareness and training programs with
data analytics. Information Security Journal: A Global Perspective, 24(1-3), 72-
77.
The Components of a Successful Security Awareness Program. (2019). Retrieved from
https://resources.infosecinstitute.com/components-successful-security-awareness-
program/
Behr, A. (2019). Separation of duties and IT security. Retrieved from
https://www.csoonline.com/article/2123120/separation-of-duties-and-it-security.html
Encryption and Its Importance to Device Networking. (2019). Retrieved from
https://www.lantronix.com/wp-content/uploads/pdf/Encryption-and-Device-
Networking_WP.pdf
Glaspie, H. W., & Karwowski, W. (2017, July). Human factors in information
security culture: A literature review. In International Conference on Applied
Human Factors and Ergonomics (pp. 269-280). Springer, Cham.
IT0125 - Configuration Management. (2019). Retrieved from
https://policy.tennessee.edu/wp-content/uploads//policytech/system-wide/it/IT0125-
Configuration-Management.pdf
Media Access Control Security Overview - TechLibrary - Juniper Networks. (2019).
Retrieved from https://www.juniper.net/documentation/en_US/junos-space-
apps/network-director3.3/topics/concept/macsec-understanding.html
Nobles, C. (2018). Botching Human Factors in Cybersecurity in Business
Organizations. HOLISTICA–Journal of Business and Public Administration, 9(3),
71-88.
IT 552 aa aa aa aa aa aa aa a aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa a aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa a aa
aa aa aa aa aa aa aa aa aa aa aa aa a aa aa aa aa aa aa aa aa aa aa aa aa aa aa a aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa 29
Remote Access: The Pros and Cons of Virtual Private Networking | macchina.io
Blog. (2019). Retrieved from https://macchina.io/blog/security/remote-access-the-
pros-and-cons-of-virtual-private-networking/
Secure Hash Algorithms | Brilliant Math & Science Wiki. (2019). Retrieved from
https://brilliant.org/wiki/secure-hashing-algorithms/
Time off to discover fraud - FSS. (2019). Retrieved from
https://www.forensicstrategic.com/blog/time-off-to-discover-fraud
Threats to Security. (2019). Retrieved from https://www.cerias.purdue.edu/assets/pdf/k-
12/infosec_newsletters/03threats.pdf
What is SSL VPN (Secure Sockets Layer virtual private network)? - Definition from
WhatIs.com. (2019). Retrieved from
https://searchsecurity.techtarget.com/definition/SSL-VPN
What is Data Loss Prevention (DLP)? A Definition of Data Loss Prevention. (2019).
Retrieved from https://digitalguardian.com/blog/what-data-loss-prevention-dlp-
definition-data-loss-prevention
What is Social Engineering | Attack Techniques & Prevention Methods | Imperva.
(2019). Retrieved from https://www.imperva.com/learn/application-security/social-
engineering-attack/
What is an Intrusion Prevention System? - Palo Alto Networks. (2019). Retrieved
from https://www.paloaltonetworks.com/cyberpedia/what-is-an-intrusion-prevention-
system-ips
5 bad practices that hinder your security, and how to improve it | TechBeacon.
(2019). Retrieved from https://techbeacon.com/enterprise-it/5-bad-practices-hinder-
your-security-how-improve-it
IT 552 aa aa aa aa aa aa aa a aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa a aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa a aa
aa aa aa aa aa aa aa aa aa aa aa aa a aa aa aa aa aa aa aa aa aa aa aa aa aa aa a aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa 30
Five tips for managing project change requests. (2019). Retrieved from
https://www.computerweekly.com/opinion/Five-tips-for-managing-project-change-
requests
Mark, G., Czerwinski, M., & Iqbal, S. T. (2018, April). Effects of Individual
Differences in Blocking Workplace Distractions. In Proceedings of the 2018
CHI Conference on Human Factors in Computing Systems (p. 92). ACM.
Slack, Q. (2019). Why vacation at tech companies should be mandatory: better code,
happier people. Retrieved from https://about.sourcegraph.com/blog/why-vacation-at-
tech-companies-should-be-mandatory-better-code-happier-people
Three Reasons Your Company Should Make Vacation Mandatory. (2019). Retrieved
from https://www.forbes.com/sites/amberjohnson-jimludema/2018/06/05/three-
reasons-your-company-should-make-vacation-mandatory/#5bc85c2638ec
6 ways to develop a security culture in your organization. (2019). Retrieved 19 July
2019, from https://techbeacon.com/security/6-ways-develop-security-culture-top-
bottom
Bashay, F. (2019). What Is the CIA Triangle and Why Is It Important for
Cybersecurity Management?. Retrieved 19 July 2019, from
https://www.difenda.com/blog/what-is-the-cia-triangle-and-why-is-it-important-for-
cybersecurity-management
Four Tips for Building a Strong Security Culture in Your Organization. (2019).
Retrieved 19 July 2019, from https://blog.netwrix.com/2018/06/28/four-tips-for-
building-a-strong-security-culture-in-your-organization/
Gontovnikas, M. (2019). Cybersecurity Shouldn’t Be a Secret: Why Transparency
Matters. Retrieved 19 July 2019, from https://auth0.com/blog/cybersecurity-
shouldnt-be-a-secret/
IT 552 aa aa aa aa aa aa aa a aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa a aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa a aa
aa aa aa aa aa aa aa aa aa aa aa aa a aa aa aa aa aa aa aa aa aa aa aa aa aa aa a aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa 31
News, Tips, and Advice for Technology Professionals - TechRepublic. (2019).
Retrieved 19 July 2019, from https://www.techrepublic.com/article/success-
strategies-for-security-awareness/
Where The World Talks Security | RSA Conference. (2019). Retrieved 19 July 2019,
from https://www.rsaconference.com/writable/presentations/file_upload/hum-t09-
building-a-strategic-plan-for-your-security-awareness-program.pdf
