URGENT 2 PAGES NEED IT IN 5 HOURS

Risk Analysis Paper

Milestone1

Module3

1. Information Technology structure of the ABC Organization

ABC organization makes use of the wireless network for its networking functions or the tasks associated with the network or Internet of the organization. ABC organization has the fifty workers. The organization set up the unique passwords and username for the access to its network. Additionally, BYOD (Bring Your Own device) is authorized from the organization. Therefore, few workers of the organization take their gadgets inside the organization and make access to the network of the organization from their private gadget using the passwords and username of the network of the organization. The network of the organization is wireless, therefore workers of the organization can access the network of the organization at any place from using the password and username of the organization. Since the network of the organization is accessible to the entire workforce for the organization. Therefore, network of the organization is not secure. Any worker or person within organization can make access to the network of the system for her or his own personal sake and make wrong use of the network.

2. Specific Ethical Regulations and Cyber laws that will be appropriate to the organization and its computing functions

Professional ethics: Personal ethics will be appropriate to the ABC organization since they are relevant to the security experts and finest practices. Ethics signify the policies that are applicable when the law does not relevant to a specific circumstance or does not give the apparent guidance for a specific situation. Organizations should become member of the CISSP to set up ethical regulations in it. CISSP (Certified Security Professionals) obligates the organization to uphold and accept “Code of Professional Ethics (ISC) 2” that set up principals of behavior for the security officials.

Cyber law and crimes: These regulations signify the sorts of the computer crime and activities make effective the investigation of computer crime. It put forwards the court systems and law enforcement. Cyber law makes the distinction among the physical, intangible, and tangible crimes. Dissimilar states and nations have dissimilar laws for the cyber crimes. Moreover few organizations are accepted the universal laws for the ethical regulations and cyber crimes. CISSP (Certified Security Professionals) are anticipated to wholly knowledgeable for privacy policies and corporate security and comprehend what is measured as adequate behavior for the workers. CISSP makes aware for the relevant regulations and laws at the national and state scale, comprehending procedures of handling incidents, what thing cause violence in the fortification domain, and how to recognize, control, and gather proof.

Profiles and Motives of attackers: These regulations signify the profiles of attack, objectives and kinds.

Investigation techniques and Incident handling: These regulations signify the investigation procedures of computer crime, comprising handling processes and sorts of evidence and handling procedures. (Spotlight article: Domain 8, Laws, Investigations and Ethics)

3. Organizational Ethical Violations

I. Unethical Behaviors with Examples

The network of the organization is wireless, therefore workers of the organization can access the network of the organization at any place from using the password and username of the organization. Since the network of the organization is accessible to the entire workforce for the organization. Therefore, network of the organization is not secure. Any worker or person within organization can make access to the network of the system for her or his own personal sake and make wrong use of the network. The major difficulty or ethical violation with the open access of the network to the entire team of the organization is the security violations since if anyone has access to the information of the organization then she or he may utilize it for her or his private sake, if she or he is in necessity. For illustration: Let us presume that any worker of the organization is suffering from the monetary shortage or necessity for money. She or he is having the access to the network of the organization. If any opponent organization may offer that worker money if she or he consent to give information of the organization or password and username of the network of the organization in which she or he work to the opponent of the organization, then if worker accept the proposal from the opponent organization for the desire to money, it signifies the ethical violation.

II. Impact of the unethical behavior on IT (Information Technology) and computing inside organization

The implications of the wireless network accessible to the whole workers inside the organization, although from their own equipments (laptops, mobile phones) are as:

Negative Implications:

· Since the workers can make use of the BYOD (Bring Your Own Device) will authorize the work force and the members of the organization to access and use prudent information as regards to the data of the organization. Workers can make illicit use of the information of the organization in opposition to the organization for the desire to money. This wrong use of the money may direct organization towards loss. The prudent information of the organization is identical to the asset of the organization. For this reason, information of the organization is obligatory to be secure. Therefore, a modification to the existing network is obligatory.

· Workers or the members of the organization may utilize the BYOD or their own gadget such as tablet, laptop for their private conversation such as email, use of the social media, messaging, etc. with their private contact all through the time of their work inside the organization. This will have impact on the productivity and worth of the service of the organization as workers may spend their work time in their private conversation or for their private work. This will direct the organization towards a reduction of productivity and incompetent work. Additionally, worth of the service will be impacted.

· If workers of the organization hold access to the concealed information of the organization, then they can make illicit use of the concealed information of the organization for their private sakes or benefits. They might put attempts to carry out wrong or illicit work on behalf of or with the name of the organization. From this thing, image or value of the organization inside marketplace will be impacted and this may possess loss or failure to the organization. In simple phrases, goodwill of the organization may be impacted. (Nicky Jatana and Marlo Johnson Roebuck, 2014)

Positive Implications:

Since the workers can make use of the BYOD (Bring Your Own Device) will authorize the work force and the members of the organization to access and use

· Since the workers can make use of the BYOD (Bring Your Own Device) will authorize the work force and the members of the organization to access and use prudent information as regards to the data of the organization. Workers and members can make use of this information to attain the targets of organization very competently with complete devotion, since it may give employees a realization that company has exposed significance and faith in them. They should keep up this faith with hard work and their skills.

· Utilization of the BYOD will make available flexible work atmosphere to the workers. Flexible work atmosphere will facilitate workers to build up novel and pioneering thoughts utilizing accessible techniques. Therefore, this will facilitate workers and members to do boost up productivity.

· Additionally, utilization of BYOD at location of work will persuade workers to carry out elegant work to enhance productivity of organization as well as to carry out well-organized work and well-organized work will assist to advance marketplace performance or marketplace worth of the organization. (The Ten Commandments of Bring Your Own Device (BYOD))

Milestone2

Module5:

4. Cyber law noncompliance

i. Instances of the Cyber Law non compliance and Violated Regulations

All through the initial week of the January of year 2009, copious mails were delivered to few organizations of the IT of Bangalore, from one cyber café, intimidating attacks of the terrorists. There are lots of instances from the preceding time, where cyber cafes have been utilized as an approach, either for fake or actual conversation. Cyber crimes like theft of the passwords of online banking, consequential falsified extraction of money have furthermore take place from Cyber Cafes. Typically cyber cafes have been utilized for sending obscene messages or mails to the bothered persons. In considering these instances, cyber cafes are judged as one among the vital mediators those necessitate to be synchronized. For this reason, to control cyber cages, numerous states had approved copious policies, few from the “Information Technology Act, 2000” and few from the “State Police Act”. (CYBER LAW Liability Of Cyber Cafe Operators)

Compliancy of Cyber Law has 3 foremost fragments as:

· Digital Agreements

· IPR violations

· Due Diligence (Naavi, 2003)

ii. Impact of noncompliance on IT and computing inside organization

Cyber law non compliance results in danger to the continuity of business as well as profits of the trade. This is the temperament of the non compliance.

Cyber law negligence or non compliance direct the members of the workforce picking up or utilizing any vital tool of the software built up from the organization and give it to the opponent of the organization. One solitary occurrence of this kind could charge any organization adequate to fore it out of trade. (Naavi, 2003)

5. Acceptable use-of-technologies policies research

i. Contrasting and comparing Acceptable use-of-technologies policies from Numerous Organizations

SANS Institute

AUP of SANS institute authorize its policy of human resource and information security that concentrates on and forbid the succeeding pre-Internet breaches: Not permitted discharge of perceptive data from radio, news paper, telephone, book, etc., spending time through the water cooler conversing on trade subjects, telling sexist and racist jokes, talking from the company side devoid of permission from the company. (Lawrence, 2002)

ISAA

The ISAA (Information Systems Security Association) Inc. is contented to give a spot to cultivate collaboration and networking around professional and geographical boundaries. ISAA concentrates on the activities those will preserve the availability, integrity, and confidentiality to the sources of the organizational information comprising:

· Carry out entire proficient activities in harmony with entire pertinent laws and superior ethical standards.

· Uphold universally approved IT existing standards and practices;

· Perform all professional activities and duties in harmony with all applicable laws and the highest ethical principles;

· Promote generally accepted information security current best practices and standards;

· Maintain appropriate discretion of proprietary or else perceptive information come across in the path of specialized activities;

· Set free professional accountabilities with honesty and diligence;

· Abstain from the activities those might amount to any dispute of interest or else harm the goodwill of or is unfavorable to the employers, the stream of information security, or the alliance; and

· Not deliberately impugn or injure the professional status or workings of employers, clients, and colleague.(ISSA Acceptable Use Policy)

Pennsylvania College of Technology IT Acceptable Use Policy

Information Technology Resources of Pennsylvania College of Technology as regards to AUP (Acceptable Use Policy) upholds the lawful, ethical, efficient utilization of information technology sources of Penn College. If anyone makes use of these resources, which judged as incoherent with the purpose and mission of the Penn College will be measured as breach of this rule. This rule is applicable to any person who makes use of IT sources of Penn College. (IT Resources Acceptable Use Policy: Pennsylvania College of Technology)

AT&T Acceptable Use Policy

AUP (Acceptable Use Policy) of AT & T is build up to assist the company to attain the target as: AT & T Company is committed to conforming with regulations and laws prevailing the use of email transmissions, text messaging, and Internet, and upholding for its entire consumers the capability to utilize network and Internet of AT & T devoid of harassment or intrusion from other consumers. AUP is pertains to the services of AT & T that give or comprise access to Internet, together with hosting services (hardware and software applications) or are given from the wireless networks of data or Internet.

AT & T Company forbids the succeeding activities:

· Illegitimate activities

· General forbids

· Threatening content or material

· Infringement of privileges of intellectual property

· Usenet abuse/email/spam

· Child pornography

· Unfortunate interaction with the minors (AT&T Acceptable Use Policy, 2008)

ii. Aspects of Acceptable use-of-technologies policies that could be used to meet the necessities of ABC organization

Commitment to conforming with regulations and laws prevailing the use of email transmissions, text messaging, and Internet, and upholding for its entire consumers the capability to utilize network and Internet of company. Uphold universally approved IT existing standards and practices; Promote generally accepted information security current best practices and standards; maintain appropriate discretion of proprietary or else perceptive information come across in the path of specialized activities; set free professional accountabilities with honesty and diligence; abstain from the activities those might amount to any dispute of interest or else harm the goodwill of or is unfavorable to the employers, the stream of information security, or the alliance; and not deliberately impugn or injure the professional status or workings of employers, clients, and colleague.

This code of ethics will be adapted from practicing these standards inside the organization.

6. Code of Ethics Research

i. Contrasting and comparing IT-specific codes of ethics from numerous organizations

SANS Institute: Code of Ethics

The IT “code of ethics” in the SANS institute concentrate for the persons to know themselves and become honest with their abilities, to conduct a trade into manner which promises that profession of IT is judged one among professionalism and integrity values, to respect confidentiality and privacy. (SANS: IT Code of Ethics, 2004)

ISAA: Code of Ethics

The foremost aim of ISAA (Information Systems Security Association) Inc. is to uphold the practices those will make certain the availability, integrity, and confidentiality of resources of the organizational information. To attain this aim, contributors of ISAA are obligatory to reproduce the principals for the ethical conduct. For this reason, ISAA has set up the succeeding “Code of Ethics”:

· Carry out entire official tasks and activities in harmony with entire appropriate laws and superior ethical standards;

· Uphold universally approved IT existing standards and practices;

· Perform all professional activities and duties in harmony with all applicable laws and the highest ethical principles;

· Promote generally accepted information security current best practices and standards;

· Maintain appropriate discretion of proprietary or else perceptive information come across in the path of specialized activities;

· Set free professional accountabilities with honesty and diligence;

· Abstain from the activities those might amount to any dispute of interest or else harm the goodwill of or is unfavorable to the employers, the stream of information security, or the alliance; and

· Not deliberately impugn or injure the professional status or workings of employers, clients, and colleague. (ISSA Code of Ethics)

K-State Information Technology Employee Code of Ethics

“Code of Ethics” of K-State Information Technology implies the succeeding implementation:

· Entire workers giving innermost support of IT are obligatory to sign and read the “Employee Code of Ethics”.

· Entire supervisors will make certain that they have assessed “Code of Ethics” from their workers and sustain a signed replica into their private documents and give one replica to workers.

· The IT “Employee Code of Ethics” should be assesses on yearly basis with the workers. (K-State Information Technology Employee Code of Ethics, 2013)

Business Code of Ethics

AT&T Code of Ethics

In harmony with the necessities of the New York Stock Exchange and SEC (Securities and Exchange Commission), the “Code of ethics” has been approved from the Board of Directors of the AT & T Inc. to:

· Promote ethical and honest conduct, comprising ethical handling and reasonable dealing of disputes as regards to interest;

· Promote fair, full, adequate, comprehensible, and timely exposé;

· Promote acquiescence with pertinent acts and governmental regulations and rules;

· Make sure the fortification of justifiable trade interests of the company, comprising corporate assets, concealed information, and opportunities.

· Put off wrongdoing. (AT&T Inc. Code Of Ethics)

Microsoft Standards of Business Conduct

Workers of the Microsoft are chasing the succeeding values:

· Honesty and integrity

· Passion for the technology, partners, and consumers

· Considerate and open with other persons and devoted to building them superior

· Keen to accept the vast difficulties and look them through

· Answerable for outcomes, commitments, and worth to shareholders, consumers, workers, and partners.

The entire workers of the Microsoft are accountable for complying and comprehending with these standards, regulations, laws, and policies of Microsoft. (Microsoft Standards of Business Conduct)

ii. Aspects of Code of ethics that could be used to fulfill the necessities of ABC organization

Promote generally accepted information security current best practices and standards; maintain appropriate discretion of proprietary or else perceptive information come across in the path of specialized activities; Set free professional accountabilities with honesty and diligence; are the aspects that could be used to fulfill the necessities of ABC organization. This code of ethics will be adapted from practicing these standards inside the organization.

Works Cited AT&T Acceptable Use Policy. (2008, October 15). Retrieved from www.corp.att.com: http://www.corp.att.com/aup/ AT&T Inc. Code Of Ethics. (n.d.). Retrieved from www.att.com: http://www.att.com/gen/investor-relations?pid=5595 CYBER LAW Liability Of Cyber Cafe Operators. (n.d.). Retrieved from www.lawteacher.net: http://www.lawteacher.net/free-law-essays/technology-law/seminar-paper-cyber-law-liability-law-essays.php ISSA Acceptable Use Policy. (n.d.). Retrieved from www.issa.org: http://www.issa.org/?page=AcceptableUse ISSA Code of Ethics. (n.d.). Retrieved from www.issa.org: http://www.issa.org/?page=codeofethics IT Resources Acceptable Use Policy: Pennsylvania College of Technology. (n.d.). Retrieved from www.pct.edu: https://www.pct.edu/campuslife/studentpolicy/acceptableUse.htm K-State Information Technology Employee Code of Ethics. (2013, October 29). Retrieved from www.k-state.edu: http://www.k-state.edu/its/ethics/ Lawrence, P. (2002, March). SANS Institute InfoSec Reading Room. Retrieved from www.sans.org: https://www.sans.org/reading-room/whitepapers/acceptable/acceptable-use-responsibility-it-3 Microsoft Standards of Business Conduct. (n.d.). Retrieved from sites.google.com: https://sites.google.com/a/email.vccs.edu/bus100mvargas/home/microsoft-code-of-ethics Naavi. (2003, January 15). Six Sigma, ROI and Cyber Law Compliancy. Retrieved from www.naavi.org: http://www.naavi.org/cylawcom/six_sigma.htm Nadella, S. (n.d.). Legal Resources. Retrieved from www.microsoft.com: http://www.microsoft.com/en-us/legal/compliance/buscond/default.aspx Nicky Jatana and Marlo Johnson Roebuck, J. L. (2014, july 14). The Impact of Employees Left to Their Own Devices: Top Ten BYOD Considerations. Retrieved from www.acc.com: http://www.acc.com/legalresources/publications/topten/tioelttod.cfm SANS: IT Code of Ethics. (2004, April 24). Retrieved from www.sans.org: https://www.sans.org/security-resources/ethics.php?ref=3781 Spotlight article: Domain 8, Laws, Investigations and Ethics. (n.d.). Retrieved from searchsecurity.techtarget.com: http://searchsecurity.techtarget.com/feature/Spotlight-article-Domain-8-Laws-Investigations-and-Ethics The Ten Commandments of Bring Your Own Device (BYOD). (n.d.). Retrieved from www.maas360.com: http://www.maas360.com/zf/?id=703&K=byod&A=gsearch&s=HS&ch=PPC&C=GS_India_NonBrand&gclid=CjwKEAjw25SoBRCMn7Gc97Knj0ISJAC7vaMryVnD4uoC18RbtlOqcmjMafYMtXlxwRvCHMcGyEfmzBoCG7rw_wcB