1. Understand Risks to IT Security
Unit 48 I.T. Security Management
HND in Computing and Systems Development

2. Last week Organisational security procedures An operational model:
Prevention
Detection
Response
Definitions: Policies, Procedures, Standards, Guidelines
Policy life-cycle:
Aspects to consider
Questions to ask
Plan (adjust) for security
Evaluate the effectiveness
Implement the plans
Monitor the implementation

3. Organisational Security Procedures
Need to consider:
data,
network,
systems,
operational impact of security breaches,
web systems,
wireless systems

4. Data What is the data? Where is it stored?
What format is it stored in? Some data may still be stored in paper-form.
Who has access to the data?
Where can they access the data?
What systems can access the data?
Who owns the data?
Who can change the data?
Where is the data backed-up?

5. Procedures So you know about the data…
What procedures will you implement to protect it?
Influenced by:
Computer Misuse Act 1990
Data Protection Act 1998 (principle 7)
“Appropriate technical and organisational measures shall be taken against unauthorised or unlawful processing of personal data and against accidental loss or destruction of, or damage to, personal data.”

6. Guidance from the ICO What needs to be protected?
What level of security?
What measures?
protection/principle-7-security/

7. First line of Defence? Not overly burdensome
prevent breaches from occurring
lay out the proper procedures should a breach occur. 

8. Money
Security as a cost
Creating value from security

9. Task
Draw up a list of procedures that you will implement to protect the systems at MWS.
Explain the rationale behind the choice of the various procedures with reference to:
The data
The company objectives
The appropriate legislation