9-1 Final Project Submission: Security Awareness Program Proposal

Assignment: 2-2 Final Project Milestone One: Statement of Work

Terri Y. Hudson

Southern New Hampshire University – IT 552

November 6, 2016

Agency-wide security awareness Program Proposal

Introduction

For the organization to comply with the current PCT DSS requirement version 12,6, a security awareness program must be in place. The CISCO of the organization has an immediate requirement of creating an agency-wide security awareness program. As a means of implementing security awareness program the organization has conducted a security gap analysis which is one of the component of security awareness program which showed the 10 security findings. As one of the means of conducting the program, I will submit awareness program proposal.

Objective

This SOW (Statement of Work) is being done on behalf of the senior information officer. He has requested for the creation of an agency-wide security awareness program by handing over the security gap analysis which was done prior to this process. Hence the major aim of this document is to set a security awareness program which shows ten major key security findings. The document will also include a risk assessment of the current security awareness practices, processes and practices. By having this document, the organization will be able to have a well-organized maintenance plan. It is also important in maintaining and establishing an information-security awareness program (United States, 2000).

Background

The mission of the organization is to provide efficient IT services with the best security program in place with an aim of protecting organizations assets.

1. Technical infrastructure

The organization is engaged in short-term effort aiming at modernizing its information-processing infrastructure. These efforts have incorporated software enhancements, installation of firewalls and high end network systems for an improved communication. The senior information officer is the one who is responsible top oversee modernization effort. He has of late completed conducting a security awareness program and deployment of the organization’s LAN (Local area Network). The hardware being used is of CISCO products.

2. Computing Environment

The organization’s desktop computers are of Windows 2007/ 98 and 95. The servers are of Pentium with over 1 GB RAM. The current NOS (Network operating system) are window based.

3. Security Posture of the Organization

The organization has a basic network structure with only one router which acts as a firewall. It has several working stations and switches to this working stations. In addition the organization has installed Kasperky’s antivirus in of their desktop machines with a motive of reducing external threats. The data server is highly secured with Kaspersky’s antivirus. The organization physical security in server rooms has rocks, network closets and the network cabinet is rocked always. The organization has a worry on its current security plan this is because of hackers, spammers and cybercrimes. Also the security plan of the organization has not proved to have the best controls after the current security gap analysis that was conducted.

Security Gaps Findings

From the findings one of the largest organization’s risks is not the weakness in the IT infrastructure but the action and reaction of the employees. This has happen through disclosure of sensitive information by the workers and social engineering attacks. After the gap analysis report, the organization found that confidential customer data and the some of the IT assets were at risk. From the gap analysis findings it is evident that loss of customer confidential information was very high. The risks in Information technology assets were classified as moderate. The top ten security findings were internet; this has become one of the greatest avenues for hackers. Others are data breaches, ransom ware, browser plug-ins, virus, worms, spyware, key loggers, rogue security software and pharming. Lastly some of the organization factors are contributing to unhealthy of IT assets. Example a poor plan by the organization CEO of the best IT personnel, identification of the critical assets of the organization, wrong mapping of the existing cyber security capabilities across the organization so as to identify organizational risks, poor assessment of the organization’s security maturity level and poor identification of the potential cyber security threats (Roper, 2006).

The best practices in the organizational security program

Assemble all the security awareness team. The team will be mandated in ensuring development, maintenance and delivery of the security awareness. The recommendation is for the team to be well-staffed. In addition to this all the employee dough to be trained on the ten securities gas findings. The security awareness program ought to have reference materials such as ISO 27002:2013 which outlines the code practices of the information security control, the NIST (National Institute of Standards and Technology) and COBIT 5 (Desman, 2002).

Tasks

Some of the roles to be performed include performing a general description of the security posture of the organization and a risk analysis, drafting security deliverable of the organization and outlining responsibilities of each and every member in the organization in ensuring the security of organizational assets.

Personnel

It is highly recommended that security training includes how social engineering happens and what are the consequences to the organization IT assets. One of the ways hackers are using social engineering is to acquire user’s credentials. The program should tailor this awareness to reflect the types of attacks that the organization is encountering and what the organization can encounter in long-run. As one of the findings from the security gap is confidentiality of customers’ data, it is highly recommended that different ways of how to safeguard customers’ information to be covered at the basic level for all the personnel. Example is protecting data in electronic and non-electronic form. Others that need to be included in the awareness program is organization’s security awareness policy, the impact of unauthorized access and the awareness of the CHD security requirements (Gardner, 2014).

Conclusion

This SOW document has highlighted the objective of SOW. The document has addressed four critical elements which must be addressed in the security program, these are; the security posture of the organization and the major findings from the security gap analysis, the human factors which undermine the security of the organization IT assets and organization factors that contribute to unhealthy of the organization. Lastly I have included what need to be done in the security awareness program.

References

United States. & United States. (2000). Summary statement of work. Washington: National Commission on Air Quality.

Desman, M. B. (2002). Building an information security awareness program. Boca Raton: Auerbach Publications.

Gardner, B., & Thomas, V. (2014). Building an information security awareness program: Defending against social engineering and technical threats. Waltham, Massachusetts: Syngress.

Roper, C. A., Grau, J. J., & Fischer, L. F. (2006). Security education, awareness, and training: From theory to practice. Burlington, MA: Elsevier Butterworth-Heinemann.