IS4550 Security Policies and Implementation Unit 1 Information Security Policy Management

Class Agenda 6/16/16 Introduction Course Syllabus. Learning Objectives Lesson Presentation and Discussions. Discussion on Assignments. Discussion on Lab Activities. Break Times as per School Regulations.

Course Syllabus Introduction of Course Syllabus. Course Summary Course Plan Evaluation Academic integrity Discussion and questions about syllabus.

Name: Williams Obinkyereh Bachelor of Science in Statistics (BSc Stats) Master of Science in Information Technology (MSc IT) Post Masters of Advanced Studies in Software Engineering. Doctor of Computer Science (DCS) Ongoing Contacts: Email: WObinkyereh@itt-tech.edu

Learning Objective Identify the role of an information systems security (ISS) policy framework in overcoming business challenges. Unit 1 cover Chapters 1, 2 and 3

Key Concepts ISS and information assurance in organizations ISS policies and their importance in organizations Four information security controls Business drivers that create the need for ISS policy framework U.S. compliancy laws and industry standards

EXPLORE: CONCEPTS

Information system security and Business. Business exist to make money or to provide some service. Business do not exist because of Security. Business are now faced with security attacks. Discussion. Why do business need security?

Information Security Controls Policy Standards Procedures Guidelines Defines how an organization performs and conducts business functions and transactions with a desired outcome. An established method implemented organization-wide. Steps required to implement a process. A parameter within which a policy, standard, or procedure is suggested.

Why do organization need security policies? Information system Security Information Assurance Information Governance Importance of Governance Importance of policies

Information Security Governance Risk Assessment Security Policy Framework Compliance Information Assurance Information Security Governance

EXPLORE: PROCESS

Process for Creating a Policy Framework (Generic) Business recognizes a need for a new policy to be developed. Purpose and mission for policy Responsibilities for enforcing policy Compliance issues covered by new policy Scope of policy coverage Collect documents relating to the new policy. Analyze existing policies for overlap and coverage. Develop case study relating to the new policy. Examine existing frameworks for policies that can be used. Implement new policy and add to policy change control board process.

EXPLORE: ROLES

Typical Large Public Organization Chief Information Security Officer Security Manager Risk Manager Compliance Officer Information Assurance Auditor

EXPLORE: RATIONALE

Organizational Policy Development and Importance Policy = Business Requirement on Actions or Processes Performed Frameworks Policy Standard Procedure Guideline Threats to Systems Controls on Systems

Summary In this presentation, the following were covered: Four information security controls Components of information security governance Process for creating a policy framework Importance of security policy in an organization

Unit 1 Discussion and Assignments Discussion 1.1 Importance of Security Policies( Group Discussion) Assignment 1.3 Security Policies Overcoming Business Challenges

Unit 1 Lab Activities Lab is in the lab manual on line Lab 1.2 Craft an Organization-Wide Security Management Policy for Acceptable Use Reading assignment: Read chapter 1, 2 and 3

Class Project Project Title Department of Defense DOD Audit This is a Team Project. You will create 3 teams. Deliverables or milestone drafts as specified in the project content will be submitted. Due on Week 11