Understand Risks to IT Security Unit 48 I.T. Security Management HND in Computing and Systems Development

Last week Organisational security procedures An operational model: Prevention Detection Response Definitions: Policies, Procedures, Standards, Guidelines Policy life-cycle: Aspects to consider Questions to ask Plan (adjust) for security Evaluate the effectiveness Implement the plans Monitor the implementation

Organisational Security Procedures Need to consider: data, network, systems, operational impact of security breaches, web systems, wireless systems

Data What is the data? Where is it stored? What format is it stored in? Some data may still be stored in paper-form. Who has access to the data? Where can they access the data? What systems can access the data? Who owns the data? Who can change the data? Where is the data backed-up?

Procedures So you know about the data… What procedures will you implement to protect it? Influenced by: Computer Misuse Act 1990 Data Protection Act 1998 (principle 7) “Appropriate technical and organisational measures shall be taken against unauthorised or unlawful processing of personal data and against accidental loss or destruction of, or damage to, personal data.”

Guidance from the ICO What needs to be protected? What level of security? What measures? https://ico.org.uk/for-organisations/guide-to-data- protection/principle-7-security/

First line of Defence? Not overly burdensome prevent breaches from occurring lay out the proper procedures should a breach occur. 

Money Security as a cost Creating value from security

Task Draw up a list of procedures that you will implement to protect the systems at MWS. Explain the rationale behind the choice of the various procedures with reference to: The data The company objectives The appropriate legislation