1. Aramco Information Assurance Policy
Mohammad bin Fahd University
College of Business
Introduction to Information Assurance
MISY3321
Sec 201
Aramco Information Assurance Policy
Name: Doha J. AL-Mohsen
ID #

2. Table of continent
Type of organization and what type of information it keeps
Organization Information Assurance Policy
Any lost or miss use of Information
Conclusion

3. Officially the Saudi Arabian Oil Company, is the state-owned national oil company of Saudi Arabia.
and 80% more valuable than ExxonMobil

4. Organization activities
Exploration
Drilling
Refining and Chemicals

5. Company principle
(SoD Segregation of Duties) is the concept of having more than one person required to complete a task. In business the segregation by sharing of more than one individual in one single task shall prevent from fraud and error, The concept is alternatively called separation of duties

6. Biz Right ® …
to maintain this principle the I.T department depend a software application Called “Biz Right ®” it is a software application that is report S.A.P (System Access Program ) roles of the organization, the places these roles access or “Try to access”, number of access attempts , if the software recognized a non-authorized access then the user will be subject to Investigation.

7. AP&SD Accounting operations Payroll operations
Payroll operations
Financial systems divisions
Pay roll & benefits
Financial accounting
Treasury
Capital programs
Treasury Services department.
Banking operations divisions
Cash management & Investments

8. Organization Information Assurance Policy
The organization policies:
The organization policies strongly warns of password sharing among the members of the organization
or to persons outside the organization, when violation is happened then investigation over the violator is
due.
Keeping the ID card in Usage restrict to and only for the employee, when losing the card employee may
subject to termination from service.
Shutting off the PCs after using as well as bringing non-authorized PCs is totally prohibited.
Using Intranet and Internet for non-Business purposes is totally prohibited , it subject the violator to
termination from duty.

9. Any lost or miss use of Information:
It happened that some manipulation of Information regarding to the employees financial-related accounts,
In which resulted in sever misapprehension operations, using authorized access by employee or using USPs and
CDs to extract information’s needed to manipulate cash position.

10. Conclusion
The head of the Information securities unit in the AP&SD explicate that the Biz Right ® :” is not an efficient software to
keep track of roles access “ he says , and the reason why “ All that application does is reporting the access of each role
in terms of how many times and where the user to access, but there is no indicates of from where the user and it cannot
prevent the unauthorized access of the user “