Week8_IT552_FinalAssignment_2023-2024_HumanFactorsSecurity

Running Head: IT 552 yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy

yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy

yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy 1

IT 552: Final Project

IT 552 yy yy yy yy yy y yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy

yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy

yy yy yy 2

Table of Contents

Executive Summary ................................................................................................................. 3

Proposal Introduction ............................................................................................................. 4

Security Policies Development ............................................................................................. 7

Continuous Monitoring Plan .............................................................................................. 17

Communication Plan ............................................................................................................. 22

Conclusion ............................................................................................................................... 28

References ............................................................................................................................... 30

IT 552 yy yy yy yy yy y yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy

yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy

yy yy yy 3

Executive Summary

In the digitalized era, cyber threats can any side and cripple the

Information Technology ecosystem of an organization. In order to be well

equipped against unknown threats and risks, business entities spend huge

volumes of finance so that they can safeguard themselves against

sophisticated threats and attacks in the virtual setting. Mainly businesses

invest money to introduce robust defense and detection mechanisms so that

cyber attackers can be kept at a distance.

As per the case relating to Multiple Unite Security Assurance

(MUSA) Corporation, its security posture is low. One of the main reasons

for the poor security model can be attributed to the human factors that

operate in the organizational setting (Glaspie & Karwowski, 2017). As per

numerous researchers, in many cases, human factors botch up the IT

security setting of an organization. Due to their intentional or unintentional

error, unauthorized users gain an access into the system which ultimately

compromises the security (Nobles, 2018).

A number of policies have been presented here that can help to

address vital security issues that can arise in the prevailing organizational

context due to human factors. By implementation of such policies, business

organizations can be empowered to enhance their security posture. The

effective management of cybersecurity model will only be possible if the

security policies are taken into consideration the security threats and risks

that arise due to the involvement of the human factors (Nobles, 2018). A

robust communication plan has been designed for Multiple Unite Security

IT 552 yy yy yy yy yy y yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy

yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy

yy yy yy 4

Assurance (MUSA) Corporation which will help to addresses and summarize

the importance of a security awareness program.

Proposal Introduction

Purpose

In the dynamic and unpredictable business setting, it is necessary for

organizations to have a robust cyber security model so that they can be

well equipped against online threats and risks. This security awareness

program proposal of Multiple Unite Security Assurance (MUSA) Corporation

has been presented here so that the existing poor security posture can be

strengthened (Bada, Sasse & Nurse, 2019). The present security posture of

MUSA is low as it is exposed to a high level of cyber threats and risks

that can cripple the IT ecosystem of the firm and the business operations.

The fundamental purpose of the security awareness program proposal is

to help Multiple Unite Security Assurance (MUSA) Corporation to upgrade

the existing security posture so that it can function in a safe and secure

manner. At present, the employees do not have proper cybersecurity

awareness training and this naturally adversely influences the security climate

within the MUSA organization (Bada, Sasse & Nurse, 2019). Due to their

lack of adequate skills and technical expertise, they are unable to take

suitable actions against different kinds of online threats and attacks. This

proposal intends to empower the organizational personnel of MUSA so that

they will be in a position to deal with different kinds of attacks and

threats that can hamper the business activities and processes.

IT 552 yy yy yy yy yy y yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy

yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy

yy yy yy 5

Security Posture

As per the risk assessment of the organization, it lacks a proper

cybersecurity program in place that can help it to be well prepared to deal

with external or internal threats that can arise on the online platform. As

the human factors that operate in the business setting do not have the

technical skills and they have not been trained properly by the organization,

it faces numerous risks and uncertainties in the digital environment (Nabi,

2018). This proposal relating to security awareness program of MUSA has

been designed so that the existing gaps in its security system can be filled

and the firm’s security posture can be improved to a significant degree

(The Components of a Successful Security Awareness Program, 2019).

Human Factors

The proposal would also help MUSA to take care of a number of

organizational factors that come into play and contribute to the unhealthy

security culture in the business entity. For instance, it will encompass the

relevant security policies, tools, and techniques that can be implemented in

the organizational setting to strengthen the security approach. In addition to

this, the proposal would focus on the technical training needs of the

employees so that they would be in a better position to identify varying

kinds of cyber threats and take necessary actions so that the security model

of the firm would not be compromised (Alotaibi et al., 2016). Thus the

intention of the security awareness program proposal is to make the

employees aware of various kinds of security elements that can be

introduced or implemented to strengthen the cybersecurity infrastructure of

Multiple Unite Security Assurance Corporation. It would also help to

IT 552 yy yy yy yy yy y yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy

yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy

yy yy yy 6

constructively mold the factors that come into play and increase the

vulnerability of the business in the cyber setting.

Organizational Factors

A total of ten security gaps have been presented in the security

posture of the business entity that needs to be addressed on an urgent

basis. Some of the main security concerns that have been included in this

security awareness proposal are the lack of annual cybersecurity awareness

training for the employees, the absence of suitable configuration change

management policy, and the lack of intrusion detection or prevention system.

In addition to this, MUSA does not analyze or collect logs. The absence

of media access control policy adds to the security concerns of the business

undertaking. In the unpredictable technological setting, MUSA does not have

encryption or hashing which can control the data flow as well as the

unauthorized alteration of data. These are some of the major security

concerns that the firm faces in an unpredictable technological setting. The

business entity has the opportunity to introduce in place Vulnerability

assessment model which will be able to assess the security posture status

of the business undertaking (Öğütçü, Testik & Chouseinoglou, 2016).

The security concerns of Multiple Unite Security Assurance Corporation

that have been identified here not only jeopardize the online sustainability of

the business undertaking but it also has an adverse implication on the

morale of the employees (Korpela, 2015). Due to the high level of security

issues that the business encounters on a usual basis, the level of employee

turnover is high and it impacts the profitability and performance of the

business as well. The security awareness program proposal for MUSA has

IT 552 yy yy yy yy yy y yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy

yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy

yy yy yy 7

been designed so that the employees can be empowered to identify the

various online threats and risks that can adversely impact their Information

Technology ecosystem.

Security Policies Development

Proposal for mitigating security threats that arise due to human factors

A perfect security awareness model has been presented here so that it

would help to mitigate the threats that are posed by the human factors to

the organization’s security posture. The proposal that has been designed for

the business entity encompasses a total of ten security policies that would

enable the firm to fill the security gaps that currently exist and weaken

the security posture of MUSA (Threats to Security, 2019). The policies have

been crafted so that the organization would be in a position to address

unintentional threats as well as intentional threats or social engineering. The

policies that have been designed also focus on the quality of data flow so

that it could not be tampered with.

As per the strategy that has been presented here, the cybersecurity

threats that arise before the entity can be categorized into two types namely

unintentional threats and intentional threats. The unintentional threats can be

defined as the threats that arise due to human errors or computer failure

(Threats to Security, 2019). The intentional threats are the ones that arise

on the online platform due to various kinds of malicious elements such as

viruses, theft of data, denial of service attack and other factors that have

been malicious intent. The security policies have been strategically framed so

that the existing security gaps can be addressed in an effective manner. yy

IT 552 yy yy yy yy yy y yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy

yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy

yy yy yy 8

Policies

A. Protection against unintentional threats

The following security policies have been proposed here would help

Multiple Unite Security Assurance Corporation to safeguard itself against

various kinds of unintentional threats that arise due to human factors and

adversely impact the security if the organization.

Changes in the remote access mechanism

The remote access is a policy that can enable employees of an

organization to work remotely or work from their home. This policy might

be employee friendly but at the same time, it gives rise to a number of

security concerns as unauthorized users have the opportunity to gain access

into the organizational network. The employees that work remotely can gain

access into the organizational system from anywhere at any time. There is

the possibility that these individuals will unintentionally make blunders while

surfing the internet. Such an innocent error on part of the employees

working remotely can have a detrimental implication on the business entity.

For example, in case the employees, click on the link of a malicious site

from their personal computer, unauthorized attackers could gain entry into

their systems and compromise the security, integrity, and confidentiality of

the organizational data.

In order to deal with the cybersecurity threats that arise due to the

remote access policy, there is the need to activate remote access feature

that is present in the firewall. It would make sure that the employees

working remotely can gain access in a safe and secure manner by making

use of the Secure Sockets Layer Virtual Private Network feature (What is

IT 552 yy yy yy yy yy y yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy

yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy

yy yy yy 9

SSL VPN (Secure Sockets Layer virtual private network)? - Definition from

WhatIs.com, 2019). By using this security feature, the origination’s

personnel would be in a position to create safe access to the MUSA’s

system when they are working from home. The employees could also use

their mobile devices to work remotely in a safe working environment after

the implementation of the security policy (Remote Access: The Pros and

Cons of Virtual Private Networking | macchina.io Blog, 2019).

Introduction of encryption or hashing

Encryption and/or hashing are regarded to be some of the most basic

security measures that business undertakings need to implement so that the

level of security of their IT infrastructure can be strengthened to a certain

degree. This policy has been proposed so that the security could be

strengthened whether the organizational data is ready for transmission, it is

in the process of transmission or it has already been transmitted. Data

encryption would be made mandatory so that it could deter malicious parties

from gaining unauthorized access into sensitive business information. The

encryption process would basically make use of algorithms which would

convert ta into unique codes. The computers that have the right key would

be able to crack these codes and put them into the original form. There

are two types of encryption methods including symmetric key and public

key (or asymmetric). In the former method, the same key is used or

installed in both the systems that are responsible for receiving and

transmitting the information. The public key encryption, on the other hand,

utilizes two sets of keys simultaneously namely a private key and a public

key to strengthen the security level. In the business context of MUSA, the

IT 552 yy yy yy yy yy y yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy

yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy

yy yy yy 10

asymmetric encryption could be introduced to strengthen the security level

(Encryption and Its Importance to Device Networking, 2019).

Similarly, hashing has also been introduced in the security policy. The

hash methods like Secure Hash Algorithms (SHA-1, SHA-2, and SHA-3)

could be employed so that the integrity of the organizational data could be

maintained and strengthened (Secure Hash Algorithms | Brilliant Math &

Science Wiki, 2019). These algorithms are designed with strong encryptions

so that they can effectively respond to online cyber-attacks. This tool would

enable the firm to keep a tab on any kind of modification or tampering

of the data that has been transmitted or received. For example, in case

there is even a slight change in any text file, the hash value of the

modified file will be different from the original hash value. Thus the

organization will come to know that data has been tampered with (Secure

Hash Algorithms | Brilliant Math & Science Wiki, 2019). These methods

would facilitate the business entity to have a stronger control over the data

flow and thus capture any kind of unauthorized alteration of data.

Conducting regular checks and auditing of user accounts

At present, one of the major security gaps that have been identified

in the MUSA organization relates to the fact that the logs of the

employees are not collected or analyzed. There is the need to introduce a

robust auditing protocol so that the accounts of all the organizational

personnel of MUSA would be thoroughly checked and scrutinized. For

instance, this security policy could be applied once in a quarter or once

every six months so that the safety and security of the accounts could be

maintained. While conducting the audit process of the user accounts, it is

IT 552 yy yy yy yy yy y yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy

yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy

yy yy yy 11

necessary to take in to account a number of aspects such as whether the

account is active or inactive (disabled). For example, both these accounts

could be targeted by online attackers so that they could gain unauthorized

access into the organization’s system.

Some of the key settings and properties that must be considered

while implementing the security policy relating to the auditing of user

accounts include checking of the login scripts, the activity of the

workstations and the frequency of change of passwords. The audit procedure

would help Multiple Unite Security Assurance (MUSA) Corporation to

determine the real-time status of the accounts of the users. For example, in

case an account that has been disabled for a long time is active the

Information Technology team must take necessary actions to check the

activity. yy yy Similarly, in case, an employee or user has failed to change or

update his or her password in more than six months, he must be notified

to do the same on an urgent basis. This security policy would be of vital

importance as it would encourage the employees of the firm to take

necessary security measures at the individual level. Employees of the firm

would try to take the necessary steps at their individual level so that the

existing security gaps could be effectively addressed.

Introduction of media access control policy

A robust media access control policy could be introduced in the

business setting to secure the connections on the online platform. In the

current times, a large number of business activities are taking place in open

virtual spaces such as social media platforms which is increasing the

vulnerability of the organization. In order to give a tough fight to

IT 552 yy yy yy yy yy y yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy

yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy

yy yy yy 12

cybercriminals, it is necessary to have in place suitable media access control

policies and guidelines which would guide the employees while carrying out

online business activities.

The policy would play a critical role to strengthen the firm’s security

system and address the existing security gaps. This is because; the

employees would be able to carry out activities in a careful and conscious

manner so that online hackers would not get the scope to gain unauthorized

access into the network (Media Access Control Security Overview -

TechLibrary - Juniper Networks, 2019). For example, the firm could use a

single login id on social media platforms to design its social media

marketing strategy. In case a second user id is created or used, the same

could be blocked for security reasons. Similarly, MUSA could also

implement Data Loss Prevention (DLP) tools so that it could keep a tab

on the flow of the sensitive information in the corporate network (What is

Data Loss Prevention (DLP)? A Definition of Data Loss Prevention, 2019).

Implementation of configuration change management policy

Change management refers to the formal process of making some kind

of change in the Information Technology system of an organization. In

MUSA, a configuration change management policy could be implemented so

that the processes relating to change could be effectively controlled. The

policy could have a constructive implication on the security model of the

organization. For example, the security policy would make sure that the

integrity of the existing policies and codes is in place. In addition to this,

the new policy would help to identify security flaws. It would act as a

baseline that could be used for comparing the technical codes after any

IT 552 yy yy yy yy yy y yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy

yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy

yy yy yy 13

changes have been introduced in the IT system. The policy would be

necessary for improving the security of the firm as it would make sure

that there exists compliance with the minimum acceptable system configuration

requirements (IT0125 - Configuration Management, 2019, p 1). The policy

could safeguard MUSA against malicious threats and risk that could arise in

the virtual environment of the company.

B. Social Engineering

Social engineering can be defined as the act of tricking someone so

that he or she will make security blunders which can ultimately have an

adverse impact on the security model. In the case of Multiple Unite

Security Assurance Corporation, the following policies have been designed so

that protection against social engineering could be possible (What is Social

Engineering | Attack Techniques & Prevention Methods | Imperva, 2019). In

the current times, online hackers are using sophisticated tools so that they

can con professionals to disclose sensitive information such as passwords.

The security policies can help MUSA to be well equipped against such

kinds of online threats.

Providing annual cybersecurity awareness training

One of the basic steps is that the organization must design a robust

annual cyber security awareness training program so that its employees in

all the departments would be empowered to handle a tricky situation. As

the name suggests, the training program would be conducted on a yearly

basis so that every time, the employees would be able to handle

sophisticated online threats. The training would encompass basis security

concepts such as:

IT 552 yy yy yy yy yy y yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy

yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy

yy yy yy 14

❖ Do not download attachments from unknown parties.

❖ Do not open the emails and messages that are in spam mail.

❖ Do not open emails that have been sent by unknown parties.

In addition to this, the annual cybersecurity awareness training would

also involve technical concepts that the users need to understand so that the

security of the organization could be strengthened. For instance, MUSA could

introduce educational resources relating to cybersecurity training and conduct

regular tests. Only after the employees of MUSA would be able to pass

these tests, they would gain access to the firm’s system and network.

Introduction of intrusion detection/prevention system

An intrusion detection/ prevention system could be introduced in

Multiple Unite Security Assurance Corporation so that it could thoroughly

examine the traffic of the network. This system would be set behind the

firewall so that it could detect and prevent ‘vulnerability exploits’.

Vulnerability exploits can come in the form of malicious input and could

compromise the security of the IT infrastructure of the business. By

introducing this layer of security, harmful content could be filtered out

(What is an Intrusion Prevention System? - Palo Alto Networks, 2019). The

intrusion detection system would be responsible to scan the network traffic

and report back on any identified threats or risks. The intrusion prevention

system could be employed as it would help to carefully analyze and take

suitable actions on the network traffic flow of MUSA. By introducing these

tools, the security system of the firm could be improved and harmful

elements in the network could be identified.

Adoption of mandatory vacation policy

IT 552 yy yy yy yy yy y yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy

yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy

yy yy yy 15

Multiple Unite Security Assurance (MUSA) Corporation could implement

a mandatory vacation policy which would require its employees to take

leaves on a yearly basis. Such a policy would have a direct impaction on

the security model that is implemented in the business setting. A mandatory

vacation policy could play a key role in the organizational context, as the

firm would be able to detect fraudulent activities. The policy would force

all employees including the suspicious employees to take leave. So they

would have less amount of time with them to use their position in the

firm to conduct activities with malicious intention (Time off to discover

fraud - FSS, 2019). During the vacation time of suspicious employees, the

management of the company could carry out checks of the Information

Technology infrastructure so that malicious behavior could be identified.

Segregation of duties

Segregation of duties would act as one of the key concepts of

internal control that could positively impact the security of the IT system.

By creating specific responsibilities and duties that each and every employee

has to perform in the business setting, the management of MUSA could

make sure that unwanted threats or risks and conflicts of interests could be

avoided (Behr, 2019). The fundamental objective of the policy would be to

disseminate the business activities and linked privileges so that the security

model could be strengthened. Such a policy would make sure that the

employees would use their workstations in a responsible manner so that no

one can use their computer systems to do any work without their prior

knowledge. This regulatory mandate would have a direct impact on the IT

security of MUSA. The proper categorization and division of work would

IT 552 yy yy yy yy yy y yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy

yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy

yy yy yy 16

be a major step towards a safe and secure IT system as the employees

would take ownership of their duties and act in a responsible manner. It

could minimize the vulnerability of MUSA in the virtual setting (Behr,

2019).

Personally identifiable information breaches

Personally, identifiable information could be introduced so that any data

or information could be used for the purpose of identifying particular

organizational personnel in MUSA. Private data could be saved by the

company so that it would be in a position to identify the individuals that

are responsible for a data breach incident. This policy would make sure

that MUSA has the power to take necessary action or precautionary action

to safeguard itself from unauthorized access, data loss or theft (Behr, 2019).

This is a vital security policy that could be implemented at the

organizational level so that specific measures could be taken to tackle data

security breaches and incidents.

Ensuring a sound connection between the data sender and the data

receiver

In order to make sure that there exist a sound and secure connection

between a data sender and a data receiver, it is necessary to keep a

number of security instruments in place such as firewall, intrusion detection/

prevention system and antivirus. Such security tools would play a key role

to address the security concerns and establish a safe environment where

communication between a data sender and a data receiver could take place.

Similarly, the use of encryptions or hashing would also play a critical role.

This is because these security approaches would make sure that the data

IT 552 yy yy yy yy yy y yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy

yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy

yy yy yy 17

that is being received or transmitted cannot be tampered with or altered

from its intended meaning (Behr, 2019). These security measures would be

of paramount importance for MUSA as they could strengthen the security

infrastructure and limit the scope of online attackers to alter the sensitive

data or information relating to the business. Thus in order to address the

issue relating to poor communication on the IT platform of MUSA, it is

necessary to encrypt all the messages so that its real meaning could only

be deciphered by the intended user. yy yy yy yy yy yy yy yy yy

Continuous Monitoring Plan

A continuous monitoring plan is necessary as it can help to keep a

check on the security control model that has been designed and implemented

in the organizational setting. This plan fundamentally lays out the foundation

for regularly and consistently monitoring the organization against malicious

activities and intentional as well as unintentional threats. In order to make

sure that the monitoring plan is effective and serves the desired purpose, it

is necessary to focus on a number of elements such as the core features

of the work setting, the work plan, and employee readiness. In Multiple

Unite Security Assurance (MUSA) Corporation, there is the need to establish

a properly functional continuous monitoring plan so that the various security

gaps that exist in the organizational setting can be effectively addressed.

Work Settings

IT 552 yy yy yy yy yy y yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy

yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy

yy yy yy 18

In the work setting, a wide range of factors come into play that

can adversely impact the work ambiance. Some of the most common

elements are the non-implemented security protocols, poorly implemented

management policies, and other distractions and obstacles. It is necessary to

take the necessary steps by the managers and the management team so that

such negative elements which increase the security vulnerability of the firm

can be kept at a distance.

The management must take careful measures to ensure that all the

security protocols and policies are systematically implemented throughout the

firm. Such a step is a necessity as it will help the organization in the

long run to have better control over its costs, risks and system network

(Five tips for managing project change requests, 2019). The major changes

that take place in the IT setting must be carefully documented and recorded

so that they can be assessed as per requirement. Some of the key steps

that need to be followed while introducing a major change in the

organization include:

• A request must be made so that a change can be introduced. It

needs to be documented clearly.

• The change log has to be updated in a timely manner so that no

details will be skipped. The key elements that will be altered have

to be written down in this simple document. yy yy

• The proper assessment of the change request is an important step. It

will basically help to develop a sense of urgency. In the case of

MUSA, it is extremely vital to introduce the necessary changes so

that the quality of security can be upgraded.

IT 552 yy yy yy yy yy y yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy

yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy

yy yy yy 19

• The thorough assessment of the change against the set criteria is of

paramount importance. It will assist in deciding whether the change

has to be rejected or approved

• The final step basically involves the decision that is taken regarding

the approval or the rejection of the change. During this stage, the

outcome has to be communicated to the key stakeholders so that they

will be aware of the changes that have been introduced in MUSA to

strengthen the security model (Five tips for managing project change

requests, 2019).

The obstacles such as distractions can be managed by making sure that

the organizational personnel get the requisite space and time to focus on

their job. The managers and supervisors must interact and engage with the

subordinates to get to know of the key factors and elements that bother

the employees and adversely impact their performance (Mark, Czerwinski &

Iqbal, 2018).

MUSA has to make sure that the management policies are properly

implemented and executed throughout the organization (5 bad practices that

hinder your security, and how to improve it | TechBeacon, 2019). It will

play a vital role to make sure that security violations can be curtailed to

a possible extent. Some of the negative practices that must be eliminated at

once in the organizational setting are as follows:

• Sharing of common sensitive passwords throughout the entity

• Allowing unauthorized users in the secured and restricted read of the

organization

IT 552 yy yy yy yy yy y yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy

yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy

yy yy yy 20

• Ineffective implementation of the intrusion detection system (IDS) and

intrusion prevention system (IPS)

• Continuing to use outdated technological approaches

These are some of the practices that need to be avoided at any cost

on MUSA so that the security posture can be improved. Similarly, the firm

has to introduce robust security training for its employees so that they will

be empowered to take the necessary steps to improve the level of security

of the entity. The firm must implement both software and hardware firewalls

so that a secure layer can be created which will keep unauthorized users

at a distance.

Work Planning and Control

The work and processes that are conducted in MMUSA must be

strategically planned and controlled as they can have a major implication on

the performance and productivity of the organizational personnel. Some of the

key aspects that must be carefully taken into consideration while planning

and controlling the work include the job-related stress and pressure, time

factor, the difficulty level of the assigned work and ineffective task planning.

Some of the key strategies that can be introduced in MUSA for addressing

job pressure, time factors, task difficulty, routine alteration and lack of

knowledge and skills are introducing proper training sessions, implementing

mandatory vacation policy and conducting ‘vulnerability assessment’ on a

frequent basis.

Training sessions

MUSA must take the necessary steps so that the technical knowledge

and expertise of its employees can be upgraded on a regular basis. By

IT 552 yy yy yy yy yy y yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy

yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy

yy yy yy 21

providing them training and development opportunities, the employees would

be encouraged to perform better. They would be able to play an active

role to mitigate the risks that arise in the IT setting of MUSA. This

element must be included in the work planning as it would have a

positive implication on the productivity of the employees.

Mandatory vacation policy

MUSA must introduce mandatory vacation policy so that employees

will take holiday to get a break from the hectic work schedule. It will

help them to manage their work-related stress and pressure (Three Reasons

Your Company Should Make Vacation Mandatory, 2019). This policy can

also play a key role to improve the security framework of the entity. This

is because it will help the firm to keep a check on insider fraud (Slack,

2019). yy yy

Conducting regular vulnerability assessment

By carrying out regular vulnerability assessment, MUSA would be able

to keep a tab on the security aspect of its network and computer system.

Such an evaluation process must be conducted on public holidays so that

the day to day work processes would not be affected because of the

security procedure.

Employee Readiness

Employees are the most critical asset of an entity. So their well-

being, moral and satisfaction must be the top priority of MUSA. It can

introduce a number of strategic approaches so that it would be in a

position to address issues relating to inattentiveness, high level of stress and

anxiety, boredom and fatigue, and work-related illness or injury. Only of the

IT 552 yy yy yy yy yy y yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy

yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy

yy yy yy 22

employees are mentally and physically fit and ready, they would be able to

optimally contribute to the performance and security framework of MUSA.

In order to manage a high level of stress, boredom, and fatigue,

MUSA must introduce mandatory vacation policy. By taking a break from

the work, employees would be able to focus on their personal health and

well-being (Three Reasons Your Company Should Make Vacation Mandatory,

2019). The managers must have a one-on-one interaction with the

subordinates so that they could share their concerns that make them anxious.

An employee readiness program must be introduced so that the employees

could actively participate in the dynamic organizational setting. This could

positively impact the employee turnover of MUSA. Innovative engagement

activities could be introduced such as group discussions, events, and games

so that no employee would get bored. A healthy work environment must be

created by taking into account the health and well-being of the

organizational personnel.

yy yy yy yy yy yy y yy yy yy yy y yy yy yy yy yy yy yy yy yy yy yy

Communication Plan

The thorough engagement would play a vital role to influence a

culture that gives due importance to IT security. In fact, the communication

plan could enhance the success of the organization as it would assist to

convince diverse stakeholders of the entity to support the healthy security

culture. The communication plan is designed in a simple and effective

manner so that it could make sense for both technical as well as the non-

technical audience. yy

IT 552 yy yy yy yy yy y yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy

yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy

yy yy yy 23

Overview

The security posture of MUSA is quite low so there is the need to

introduce a new and improved security awareness program. In order to make

the new security model work, one of the basic things that must be taken

into consideration is the communication plan. The role of a security

communication plan is of paramount importance as it can help the

employees to take necessary steps so that the high quality of security can

be maintained in the best possible manner (Bashay, 2019). The document

acts as a guide which can increase the overall awareness of the workfare

in MUSA on various security aspects. The primary objective of the

communication plan is to safeguard the Confidentiality, Integrity, and

Availability of the digital resources and information of the business entity.

The communication plan sheds light on a number of messaging

strategic approaches that can help MUSA to share details on the new

security model. It would also help the organizational personnel to get a

detailed idea about their exact roles and responsibilities to execute the plan

(Where The World Talks Security | RSA Conference, 2019).

Messaging Strategies

While designing a suitable messaging strategic framework, it is

necessary to identify the important areas that the specific communication

message will address. Some of the main areas include cyber laws, the cost

associated with security breaches in the organizational setting, personally

identifiable information (PII) breaches, the need of security awareness and

the implication of awareness programs on the security posture and culture of

the business organization. The effectiveness of MUSA’s new security

IT 552 yy yy yy yy yy y yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy

yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy

yy yy yy 24

awareness model will largely depend on the lines of communication that are

established by the business undertaking. The management of MUSA must

constantly evaluate the internal communication approach so that the

organizational personnel can be constantly informed of the best security

practices that can be implemented to handle different kinds of security

threats.

Implementing different communication methods for different stakeholders

MUSA must ensure that the communication channels and methods that

are introduced to increase the level of awareness of the security model can

serve the purpose. Thus the use of communication approaches must be

different when MUSA interacts with different internal stakeholders such as

employees, IT professionals, senior management team and non-IT members.

For example, while sharing a message on security with non-technical

members, video presentations could be used. But while sharing a message

with members from the IT department, emails or memo could be used

(Where The World Talks Security | RSA Conference, 2019, p 6). yy

In order to implement a holistic and integrated messaging strategy that

meets the needs of all the internal personnel, MUSA could partner with its

communication team. Such an approach would be beneficial as the

individuals would help to enhance the messaging approaches so that

information reaches all the target audience within the business setting (Where

The World Talks Security | RSA Conference, 2019, p 24).

High level of transparency

In order to enhance the importance of the security awareness plan,

the messaging strategy must be transparent and uniform in nature.

IT 552 yy yy yy yy yy y yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy

yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy

yy yy yy 25

Transparency initiatives must be the key focus of MUSA so that carefully

designed so that all the employees would be on the same page and they

would have uniform knowledge on the security model of the business entity.

By making the information transparent, the employees across various

departments of the business entity would understand how their actions and

duties could impact the security posture of the firm. In fact, a transparent

communication approach could bridge the trust gap between the IT

department and the non-IT department of Multiple Unite Security Assurance

Corporation. True transparency is not merely about giving information to the

organizational personnel within the organizational setting. The messaging

strategy should be designed in such a manner so that the information could

be properly understood by the employees without any kind of confusion or

ambiguity (Gontovnikas, 2019).

Focus on the language of the message

Technology is a field which not many people are totally aware of.

So while spreading an important message about the security strategy,

technical jargons must not be used by Information Technology managers.

This is an important aspect that MUSA must keep in mind so that the

message that is being communicated by it can be understood in a clear

manner by all the intended audience irrespective of the department in which

they function. According to E Kelly Hansen, the Chief Executive Officer of

Neohapsis Inc., the language of IT cannot be easily understood by non-IT

professionals. So in order to deal with this issue, simple English language

must be used while communicating about the security awareness program and

its importance in the organizational setting. The wrong use of language

IT 552 yy yy yy yy yy y yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy

yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy

yy yy yy 26

would naturally encourage to stop paying attention to the message as it

would be going over their heads. So simple and understandable language

needs to be used so that professionals from both the IT and non-IT

department could understand the relevance of the security awareness program

(News, Tips, and Advice for Technology Professionals - TechRepublic, 2019).

Starting the communication from the top

The security awareness program could have a major impact on the

existence and sustainability of the business entity. So before communicating

about the same, it is necessary to initiate the communication from the top.

This would mean that the leaders and decision-makers would act as the

starting point of the communication. The visible backing of the leader of

Multiple Unite Security Assurance (MUSA) Corporation would encourage the

employees from all across the firm to participate in the approach (News,

Tips, and Advice for Technology Professionals - TechRepublic, 2019). The

evidence of executive stewardship would be of paramount importance in the

business context to adopt an interactive and engaging communication

approach. Similarly, the IT professionals in the business setting must take

the initiative to make the leaders and senior managers understand the

significance of the security awareness model which could constructively

influence the security posture of MUSA.

Streamlining the communication model

The security success program of MUSA could be successful throughout

the business entity only if a uniform and streamlined communication network

would be deployed. yy There is the need to constantly evaluate and align the

internal communication channels so that the employees across all the

IT 552 yy yy yy yy yy y yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy

yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy

yy yy yy 27

departments of the firm would be able to understand how the security

model could have implications on them, their department and the entire

business entity (News, Tips, and Advice for Technology Professionals -

TechRepublic, 2019). The proper flow of information on the security program

would keep the employees on their toes. They would be encouraged to

adopt safe practices which could restrict the adverse implications on the

security aspect of MUSA.

Security culture

A healthy security culture is the need of the hour at Multiple Unite

Security Assurance Corporation so that its security posture could be

improved. In order to effectively promote a healthy security culture

throughout the business setting, a number of approaches could be

implemented.

Focus on awareness – The management of the business entity must

focus on making the employees aware of the significance of having a

robust and healthy security culture. For example, for developers and testers

that functions in the IT department, an application security awareness

approach could be employed. It would help to carefully evaluate the

seriousness of a security threat and take necessary actions to deal with it

(6 ways to develop a security culture in your organization, 2019).

Deployment of leadership-driven cyber governance model – In order to

encourage a healthy security culture, the active involvement of senior

managers and leaders would be indispensable in the organizational context of

MUSA. Their participation would influence the employees at all the levels

of MUSA to focus on their individual roles and duties so that they could

IT 552 yy yy yy yy yy y yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy

yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy

yy yy yy 28

contribute to enhancing the level of security in the business setting (Four

Tips for Building a Strong Security Culture in Your Organization, 2019).

Thus the strong commitment by the top management of MUSA would help

to convince diverse stakeholders of MUSA to strengthen the healthy security

culture.

Clear documentation of security policies – Establishment of clear and

well-defined security policies and guidelines would act as the cornerstone of

a healthy security culture. Thus in MUSA, the new security policies must

be clearly documented so that they would guide the employees while

conducting the day to day business activities and processes (Four Tips for

Building a Strong Security Culture in Your Organization, 2019).

Providing adequate training to the staff members – The management of

MUSA must ensure that the employees get the necessary training to

understand the relevance of security in the unpredictable IT setting. Such an

approach would be of paramount importance as it would assist in fostering

a healthy security culture among the employees (Four Tips for Building a

Strong Security Culture in Your Organization, 2019).

Conclusion

The security policies that have been presented here must be introduced by

Multiple Unite Security Assurance (MUSA) Corporation so that it would be

IT 552 yy yy yy yy yy y yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy

yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy

yy yy yy 29

in a position to address the security gaps that exist in its organization. The

policies have been designed in a strategic manner so that the firm would

be in a position to deal with intentional threats as well as unintentional

threats that could arise before it. These policies would primarily empower

the business entity and its employees so that they could take necessary

measures to protect the security system. The policies that have been

designed specifically revolve around human errors that give an unfair

advantage to unauthorized individuals and cyber attackers in the virtual

platform. These policies could be effective only if the employees would

follow them strictly in the organizational context. The role of a well-planned

communication and messaging strategy would be extremely vital to improving

the security posture of MUSA. The various strategic elements that have

been encompassed in the communication plan include the proper

implementation of varying communication methods for different stakeholders,

maintaining a high level of transparency, high focus on the language of the

message, starting the communication from the top and streamlining the

overall communication model. yy There is an urgent need to make the diverse

stakeholder of MUSA understand the importance of a healthy security culture.

Various approaches that could be introduced to promote a healthy security

culture include the focus on awareness, deployment of leadership-driven cyber

governance model, clear documentation of security policies and providing

necessary training to the employees.

IT 552 yy yy yy yy yy y yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy

yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy

yy yy yy 30

References

Alotaibi, F., Furnell, S., Stengel, I., & Papadaki, M. (2016). A review of

using gaming technology for cyber-security awareness. Int. J. Inf. Secur.

Res.(IJISR), 6(2), 660-666.

Bada, M., Sasse, A. M., & Nurse, J. R. (2019). Cyber security awareness

campaigns: Why do they fail to change behaviour?. arXiv preprint

arXiv:1901.02672.

Öğütçü, G., Testik, Ö. M., & Chouseinoglou, O. (2016). Analysis of

personal information security behavior and awareness. Computers &

Security, 56, 83-93.

Nabi, I. A. (2018). Growth analysis of cyber security awareness among mass

people of Bangladesh: a case study(Doctoral dissertation, Daffodil

International University).

Korpela, K. (2015). Improving cyber security awareness and training programs

with data analytics. Information Security Journal: A Global Perspective,

24(1-3), 72-77.

The Components of a Successful Security Awareness Program. (2019).

Retrieved from https://resources.infosecinstitute.com/components-successful-

security-awareness-program/

Behr, A. (2019). Separation of duties and IT security. Retrieved from

https://www.csoonline.com/article/2123120/separation-of-duties-and-it-security.html

Encryption and Its Importance to Device Networking. (2019). Retrieved from

https://www.lantronix.com/wp-content/uploads/pdf/Encryption-and-Device-

Networking_WP.pdf

IT 552 yy yy yy yy yy y yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy

yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy

yy yy yy 31

Glaspie, H. W., & Karwowski, W. (2017, July). Human factors in

information security culture: A literature review. In International

Conference on Applied Human Factors and Ergonomics (pp. 269-280).

Springer, Cham.

IT0125 - Configuration Management. (2019). Retrieved from

https://policy.tennessee.edu/wp-content/uploads//policytech/system-wide/it/IT0125-

Configuration-Management.pdf

Media Access Control Security Overview - TechLibrary - Juniper Networks.

(2019). Retrieved from https://www.juniper.net/documentation/en_US/junos-

space-apps/network-director3.3/topics/concept/macsec-understanding.html

Nobles, C. (2018). Botching Human Factors in Cybersecurity in Business

Organizations. HOLISTICA–Journal of Business and Public Administration,

9(3), 71-88.

Remote Access: The Pros and Cons of Virtual Private Networking |

macchina.io Blog. (2019). Retrieved from

https://macchina.io/blog/security/remote-access-the-pros-and-cons-of-virtual-private-

networking/

Secure Hash Algorithms | Brilliant Math & Science Wiki. (2019). Retrieved

from https://brilliant.org/wiki/secure-hashing-algorithms/

Time off to discover fraud - FSS. (2019). Retrieved from

https://www.forensicstrategic.com/blog/time-off-to-discover-fraud

Threats to Security. (2019). Retrieved from

https://www.cerias.purdue.edu/assets/pdf/k-12/infosec_newsletters/03threats.pdf

IT 552 yy yy yy yy yy y yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy

yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy

yy yy yy 32

What is SSL VPN (Secure Sockets Layer virtual private network)? -

Definition from WhatIs.com. (2019). Retrieved from

https://searchsecurity.techtarget.com/definition/SSL-VPN

What is Data Loss Prevention (DLP)? A Definition of Data Loss Prevention.

(2019). Retrieved from https://digitalguardian.com/blog/what-data-loss-prevention-

dlp-definition-data-loss-prevention

What is Social Engineering | Attack Techniques & Prevention Methods |

Imperva. (2019). Retrieved from https://www.imperva.com/learn/application-

security/social-engineering-attack/

What is an Intrusion Prevention System? - Palo Alto Networks. (2019).

Retrieved from https://www.paloaltonetworks.com/cyberpedia/what-is-an-intrusion-

prevention-system-ips

5 bad practices that hinder your security, and how to improve it |

TechBeacon. (2019). Retrieved from https://techbeacon.com/enterprise-it/5-bad-

practices-hinder-your-security-how-improve-it

Five tips for managing project change requests. (2019). Retrieved from

https://www.computerweekly.com/opinion/Five-tips-for-managing-project-change-

requests

Mark, G., Czerwinski, M., & Iqbal, S. T. (2018, April). Effects of

Individual Differences in Blocking Workplace Distractions. In Proceedings

of the 2018 CHI Conference on Human Factors in Computing Systems

(p. 92). ACM.

Slack, Q. (2019). Why vacation at tech companies should be mandatory:

better code, happier people. Retrieved from

IT 552 yy yy yy yy yy y yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy

yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy

yy yy yy 33

https://about.sourcegraph.com/blog/why-vacation-at-tech-companies-should-be-

mandatory-better-code-happier-people

Three Reasons Your Company Should Make Vacation Mandatory. (2019).

Retrieved from https://www.forbes.com/sites/amberjohnson-

jimludema/2018/06/05/three-reasons-your-company-should-make-vacation-

mandatory/#5bc85c2638ec

6 ways to develop a security culture in your organization. (2019). Retrieved

19 July 2019, from https://techbeacon.com/security/6-ways-develop-security-

culture-top-bottom

Bashay, F. (2019). What Is the CIA Triangle and Why Is It Important for

Cybersecurity Management?. Retrieved 19 July 2019, from

https://www.difenda.com/blog/what-is-the-cia-triangle-and-why-is-it-important-for-

cybersecurity-management

Four Tips for Building a Strong Security Culture in Your Organization.

(2019). Retrieved 19 July 2019, from

https://blog.netwrix.com/2018/06/28/four-tips-for-building-a-strong-security-culture-in-

your-organization/

Gontovnikas, M. (2019). Cybersecurity Shouldn’t Be a Secret: Why

Transparency Matters. Retrieved 19 July 2019, from

https://auth0.com/blog/cybersecurity-shouldnt-be-a-secret/

News, Tips, and Advice for Technology Professionals - TechRepublic. (2019).

Retrieved 19 July 2019, from https://www.techrepublic.com/article/success-

strategies-for-security-awareness/

Where The World Talks Security | RSA Conference. (2019). Retrieved 19

July 2019, from

IT 552 yy yy yy yy yy y yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy

yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy yy

yy yy yy 34

https://www.rsaconference.com/writable/presentations/file_upload/hum-t09-building-a-

strategic-plan-for-your-security-awareness-program.pdf

Week8_IT552_FinalAssignment_2023-2024_HumanFactorsSecurity

Students also viewed