Unit 7 – Organisational Systems Security Organisation rules and guidelines Unit 7 – Organisational Systems Security

LO3: Issues affecting security Policies and guidelines for managing organisational IT security issues. How employment contracts can affect security. Laws related to security and privacy of data. The role of ethical decision making in organisational IT security. Security policies used in an organisation.

Recap Lisa Moon virus Users need protecting from themselves Training/education Policies & guidelines

Common rules and guidelines Budget setting Disaster recovery Schedule for Update and review of security policies Schedule of security audits Codes of conduct

Assignment 3 Task 1 (P4) Explain the policies and guidelines employed by an organisation to manage IT security issues. Give examples of the policies and procedures. > one slide per topic: Disaster recovery policies Updating security procedures Codes of conduct Surveillance and monitoring policies Risk management Budget setting

Question What is a policy? How is it different from a procedure?

Policy High-level, written by management Describes organisations position on an issue Not specific in detail Focus on result Do not describe method for achieving result

Points about policies Need updating less frequently than the procedures related to them Should be reviewed by organisation’s legal counsel Need plan to show how employees will be made aware Can refer to an outside authority (eg legal obligation), may refer to internal authority (CEO, department head etc)

Procedures Step-by-step Prescribe how employees should act In a certain situation To achieve a certain result Policies may be general and apply across an industry Standards and procedures will mostly be organisation-specific

…Edexcel required policies Disaster recovery policies Updating security procedures Codes of conduct Surveillance and monitoring policies Risk management Budget setting

Disaster Recovery Policy Relate to recovery from: Natural disasters Fire Power failure Terrorist attack Organised/deliberate disruptions (incl. virus) System/equipment failure Human error Legal issues Industrial action Loss of personnel

Disaster Recovery Policy Should include: Data relocation Alternative sites Hiring of personnel Hiring of equipment Must be supported by top level management and appropriate finance (incl. insurance)

Updating security Security needs to be reviewed against new threats and current knowledge: over 2 million new threats every month!* 75% of companies have suffered a malware attack in the last 12 months* Security and systems need updating but updates should be tested before roll-out. * Lumension Whitepaper, Best Practice Guide to addressing Web 2.0 Risks (See wiki)

Scheduling audits Regular audits of security – both physical and network should take place Do you notify employees when these are due? Audit logs need to be analysed White-hat attacks – hacking, DoS, physical break-ins?

Codes of conduct Training for users How to behave Could cover? E-mail Internet use User storage area Password protection Will emphasise right to monitor

Surveillance and monitoring policies CCTV Auditing Event logs Email Internet use Codes of conduct will underline right to monitor

Risk management Assess risk – Mitigation Possible strategies to deal Level of possible consequences Likelihood Mitigation Possible strategies to deal Avoid risk (don’t do that, do this) Offset risk (insurance) Meet risk head-on (eg malware) Do nothing (risk is too big, or too small)

Budget setting Security costs money, need to budget for? Software updates Replacement hardware Staff Auditing Anti-malware and firewall software Hot-site DRP Task: find quotes for these!