1. Unit 7 – Organisational Systems Security
Organisation rules and guidelines
Unit 7 – Organisational Systems Security

2. LO3: Issues affecting security
Policies and guidelines for managing organisational IT security issues.
How employment contracts can affect security.
Laws related to security and privacy of data.
The role of ethical decision making in organisational IT security.
Security policies used in an organisation.

3. Recap Lisa Moon virus Users need protecting from themselves
Training/education
Policies & guidelines

4. Common rules and guidelines
Budget setting
Disaster recovery
Schedule for Update and review of security policies
Schedule of security audits
Codes of conduct

5. Assignment 3
Task 1 (P4)
Explain the policies and guidelines employed by an organisation to manage IT security issues.
Give examples of the policies and procedures.
> one slide per topic:
Disaster recovery policies
Updating security procedures
Codes of conduct
Surveillance and monitoring policies
Risk management
Budget setting

6. Question
What is a policy?
How is it different from a procedure?

7. Policy High-level, written by management
Describes organisations position on an issue
Not specific in detail
Focus on result
Do not describe method for achieving result

8. Points about policies
Need updating less frequently than the procedures related to them
Should be reviewed by organisation’s legal counsel
Need plan to show how employees will be made aware
Can refer to an outside authority (eg legal obligation),
may refer to internal authority (CEO, department head etc)

9. Procedures Step-by-step Prescribe how employees should act
In a certain situation
To achieve a certain result
Policies may be general and apply across an industry
Standards and procedures will mostly be organisation-specific

10. …Edexcel required policies
Disaster recovery policies
Updating security procedures
Codes of conduct
Surveillance and monitoring policies
Risk management
Budget setting

11. Disaster Recovery Policy
Relate to recovery from:
Natural disasters
Fire
Power failure
Terrorist attack
Organised/deliberate disruptions (incl. virus)
System/equipment failure
Human error
Legal issues
Industrial action
Loss of personnel

12. Disaster Recovery Policy
Should include:
Data relocation
Alternative sites
Hiring of personnel
Hiring of equipment
Must be supported by top level management and appropriate finance (incl. insurance)

13. Updating security
Security needs to be reviewed against new threats and current knowledge: over 2 million new threats every month!*
75% of companies have suffered a malware attack in the last 12 months*
Security and systems need updating but updates should be tested before roll-out.
* Lumension Whitepaper, Best Practice Guide to addressing Web 2.0 Risks (See wiki)

14. Scheduling audits
Regular audits of security – both physical and network should take place
Do you notify employees when these are due?
Audit logs need to be analysed
White-hat attacks – hacking, DoS, physical break-ins?

15. Codes of conduct Training for users How to behave Could cover?
Internet use
User storage area
Password protection
Will emphasise right to monitor

16. Surveillance and monitoring policies
CCTV
Auditing
Event logs
Internet use
Codes of conduct will underline right to monitor

17. Risk management Assess risk – Mitigation Possible strategies to deal
Level of possible consequences
Likelihood
Mitigation
Possible strategies to deal
Avoid risk (don’t do that, do this)
Offset risk (insurance)
Meet risk head-on (eg malware)
Do nothing (risk is too big, or too small)

18. Budget setting Security costs money, need to budget for?
Software updates
Replacement hardware
Staff
Auditing
Anti-malware and firewall software
Hot-site
DRP
Task: find quotes for these!