Aramco Information Assurance Policy Mohammad bin Fahd University College of Business Introduction to Information Assurance MISY3321 Sec 201 Aramco Information Assurance Policy Name: Doha J. AL-Mohsen ID #200600346

Table of continent Type of organization and what type of information it keeps Organization Information Assurance Policy Any lost or miss use of Information Conclusion

Officially the Saudi Arabian Oil Company, is the state-owned national oil company of Saudi Arabia. and 80% more valuable than ExxonMobil

Organization activities Exploration Drilling Refining and Chemicals

Company principle (SoD Segregation of Duties) is the concept of having more than one person required to complete a task. In business the segregation by sharing of more than one individual in one single task shall prevent from fraud and error, The concept is alternatively called separation of duties

Biz Right ® … to maintain this principle the I.T department depend a software application Called “Biz Right ®” it is a software application that is report S.A.P (System Access Program ) roles of the organization, the places these roles access or “Try to access”, number of access attempts , if the software recognized a non-authorized access then the user will be subject to Investigation.

AP&SD Accounting operations Payroll operations   Payroll operations Financial systems divisions Pay roll & benefits Financial accounting Treasury Capital programs Treasury Services department. Banking operations divisions Cash management & Investments

Organization Information Assurance Policy The organization policies: The organization policies strongly warns of password sharing among the members of the organization   or to persons outside the organization, when violation is happened then investigation over the violator is due. Keeping the ID card in Usage restrict to and only for the employee, when losing the card employee may subject to termination from service. Shutting off the PCs after using as well as bringing non-authorized PCs is totally prohibited. Using Intranet and Internet for non-Business purposes is totally prohibited , it subject the violator to termination from duty.

Any lost or miss use of Information: It happened that some manipulation of Information regarding to the employees financial-related accounts, In which resulted in sever misapprehension operations, using authorized access by employee or using USPs and CDs to extract information’s needed to manipulate cash position.

Conclusion The head of the Information securities unit in the AP&SD explicate that the Biz Right ® :” is not an efficient software to keep track of roles access “ he says , and the reason why “ All that application does is reporting the access of each role in terms of how many times and where the user to access, but there is no indicates of from where the user and it cannot prevent the unauthorized access of the user “