Fluent Essays

Using your enterprise security plan proposal as a guide, write the enterprise technical infrastructure security plan for the organization. The framework should describe the technology infrastructure Plan as it relates to your chosen company. This document built for the future should be an ever-evolving document and will always be in a state of flux as the technical aspects of your infrastructure will be in the same state. This framework and its supporting documents address the need to both formalize a technology infrastructure plan and to articulate technology standards that guide management in decisions that best support company technology goals. It should be a 4 page paper (a minimum of three pages of content) to discuss the enterprise technical infrastructure plan for the organization that you have chosen. It should include the technical aspects of your chosen company. All servers, workstations, telephony and answering systems (voice communications), operation systems, database systems, physical structures, logical structures, mobile connections by users, and any online structures (virtual systems or Cloud Service connections) should be listed and any planned implementation and schedules defined. A link for an example of a Technology Infrastructure Plan: http://its.uncg.edu/About/ITS_Technology_Infrastructure%20Plan.pdf it's building upon the last assignments. Running head: ENTERPRISE SECURITY POLICY 1 ENTERPRISE SECURITY PROPOSAL 5 Enterprise Security Policy Jamarious Jones Bellevue University 09/25/2020 ASSURANT INSURANCE SECURITY POLICY 1. Overview Contemporary companies rely on information as one of their primary organizational assets in the course of their operations. Consequently, data management is an integral part of corporate governance and running. Like all assets, information is valuable, and as such, a vulnerable asset that risks losing value in the event of loss, damage or distortion and misrepresentation. Regarding Assurant Insurance’s primary objective of establishing practical and functional systems aimed at guaranteeing user convenience, the policy herein focuses on providing a roadmap to confidentiality and operational availability of data management and security protocols. The policy also seeks to protect company data from any form of compromise from any source whatsoever. In line with the objectives mentioned earlier, the policy appeals for collective involvement in ensuring data security for the company. Holistic active participation in protection measures is geared towards preventing unauthorized access, use and modification of company data, and mitigating destruction and avoiding delay in service. 2. Purpose This policy aims to guide Assurant Insurance employees on the best possible way of achieving the security threshold for data security; confidentiality, integrity, and availability. It also seeks to encourage all employees to use all the facilities provided for by the company to effectively enhance data security within their respective organizational jurisdictions. 3. Scope The Assurant Insurance Security Policy is a document addressed to all company employees whose job descriptions require the application of computers and computer-related devices. However, the particular emphasis is directed at individuals serving in the IT Department as they have supervisory discretion over all other staff members on matters of Information Communication Technology. 4. Risk Management and Security Principles. 4.1 Organizational Roles. Dealing with the company’s security threats requires all company stakeholders' involvement, albeit in different ways. Each individual contributes to the safety of Assurant Insurance as per their qualifications and job description in the company organizational structure. The absence of an organization undermines order, which interferes with the ability to function correctly. 4..1.1. User Responsibilities. All users, regardless of the job dispensation, are expected to follow specific guidelines recommended by I.T experts to enhance system security within the organization. Such recommendations for all users include; 1. Compliance with security procedures and protocols. 2. Protecting one’s user ID and password 3. Inform the I.T and Risk Management Department of any security issues, problems or concerns with your system as soon as they arise. 4. Back up all the systems that support I.T systems on your desk. 5. Value awareness of vulnerabilities and intrusions and report in case of an incident. 4.1.2. System Administrator. The system administrator has access to hubs, firewalls, routers and host systems, which help their functional roles. He/she is responsible for regular system checks of allocated work stations and even scheduled checks on the system. Administrator passwords for individuals who’ve been terminated are cleared as soon as they exit the building. Due to their nature's sensitivity, admin passwords require more frequent updates than the recommended two weeks for other employees. Password updates for administrators are undertaken every 72 hours. 4.1.3. Manager’s Duty. Managers serve as the ultimate link between employees and the I.T department. For security, they shall charge the I.T department with updating the security protocols of any compromised employee. Other than that, managers could only play a supervisory role over the employees to enforce clauses of the security policy. 4.2. Planning Processes. Planning for security and management of organizational data is a cyclic process with no definitive ending. As information evolves, so does threats and various intrusions techniques that malicious individuals apply. However, risk assessment provides an insight into certain aspects of system security and vulnerability. If the resultant insight is harnessed correctly, it could be the first line of defense. 4.2.1. Risk Assessment. Standard risk management procedures call for problem identification and speculation of its impact on the organization based on size and intensity and its effect on the organization. Risk assessment protocols include a survey on current security trends, identification of Assurant Insurance’s most valuable data asset and establishing ways through which an intruder may try to gain entry. Each of those steps requires regular monitoring and reports, and establishing a proper chain of communication meant explicitly for the assessment process. 5. Policy 1.1. Information Classification For the purposes of security, company employees only have access to information relevant to their work. In that way, a compromise on a single employee’s dataset only affects a section of Assurant Insurance. Also, office data for higher ranking receive more security attention based on the magnitude of such data as well as the sensitivity they bear. 1.2. Encryption. Like classification, encryption works in a discriminatory manner and the choice of encryption level attained for a device depends on an employee’s position in the company. However, each employee’s device has some level of encryption within to at least provide security cover. 1.3. Non-Employee Personnel and Security. For non-employee personnel with essential business to conduct with any of Assurant Insurance personnel, they are granted temporary clearance for access to the company’s system under the watchful eye of the employee they engage and an appointed I.T escort. Their clearances are as valid as their presence in the building and once they are gone, the system on which they worked undergoes a security update. As for security, they have access to employee logs matching a device/company resource to a particular employee but nothing more. 1.4. Application Communications. When sharing information and applications have to interact, the employees responsible have to ensure that each device is in the standard security status. On that note, employees are discouraged from using personal communication devices to handle work issues since it opens the door for security compromises. 1.5. Viruses and Malicious Code. For viruses and malicious codes, employees are required to activate ad blockers for certain sites under the direction of an employee from the I.T department. Also, anti-virus and anti-malware updates for each resident computer is available for each computer subject to request from an affected employee. In the case of a virus infraction into a computer though, the affected employee should quickly log out from any network in a bid to prevent further spread before consulting the I.T department. 1.6. Physical Security. While it still remains a source of risk for data security, instances of physical infringements into an organization’s data space are on the decline today. However, there still lies need for precaution and the introduction of various protocols for physical security. For starters, having a fixed security presence in the form of guards could be helpful. Also, embracing the practice of multiple locks to secure a device protects it from physical harm. 1.7. Incident Reporting and Response. The greatest asset in possession of an organization during times of crises is an efficient response protocol. In case of any issue that threatens the security of a system, Assurant Insurance employees are expected to act fast and decisively to quash the situation in its premature stages. The point of origin (employee affected) should sound an alarm by sending an alert and exiting the system altogether. For extreme cases, total system shutdown is acceptable since the company has a backup server. After exiting the system, the affected employee has to report to the ICT security manager the events of the incident in detail and with clarity. Running head: ENTERPRISE SECURITY PROPOSAL 1 ENTERPRISE SECURITY PROPOSAL 2 Enterprise Security Proposal Name Course Tutor Date Enterprise Security Proposal Introduction Many organizations consider information security as their number one concern. In the last five years, CIOs of many big companies have explained why information security is now taking the top slot among great concern to organizations. Several companies' business models heavily rely on data capturing, mining, analysis, sharing, and storage. Insecurity in data management can lead to huge losses to an organization, some of which can be detrimental to its going concern. Internally, organizational IT departments are often met with challenges of dividing and distributing responsibilities related to information security throughout the organization. An enterprise comprises many departments undertaking related or unrelated activities. It is such settings that present complexity when it comes to rolling out a comprehensive enterprise-wide security plan. Furthermore, it is important to note that not all departments in an organization will always agree while implementing respective policies. It is always characteristic of these departments to compete in terms of interests. Division and distribution of information security responsibilities, if not properly handled, can stir problems instead of addressing them. Proposed Plan Assurant is a U.S based global provider of risk management products and services. Headquartered in New York City, the company was founded in 1892 and now controls 0.9% of the insurance market share. Assurant currently has a presence in more than 100 countries, with $5.6 billion direct premiums written. Over the years, the company has had a history of information security challenges, with the most memorable incident being the massive data theft that occurred in 2018. Recent information security-related complaints from the organization show that the company's entire IT infrastructure security has never been addressed. For such a reason, we come up with a comprehensive enterprise security proposal for the company. Establish Security Oversight Board Several strategies can be used to develop a comprehensive enterprise-wide security plan. In this proposal, we suggest a strategy that involves a security oversight board at the helm of all information security-related matters. The board's composition includes the management representatives from the corporate functional office and all organization's business units. There has to be the information security committee under the board whose actual responsibility is to divide and distribute information security responsibilities among the organization's departments as the need may demand. Being an oversight body, the board can choose to be involved in the day-to-day information security activities in the organization or supervise the committee's activities. Assignment of Responsibilities to Governance Categories Education, Training, and Awareness Under the supervision of the board, the committee will ensure that all governance categories of IT information security are assigned responsibilities and periodically updated as required by the already laid down policies. For instance, the committee will conduct periodic training and awareness to the organization's employees, especially those exposed to critical organization data and systems (Multi-dimensional enterprise-wide security: An action plan, 2020). Due to information technology's changing nature, the committee must conduct education, training, and awareness exercises every six months (infosec.gov.2020). Such an opportunity will expose the organization’s employees and other system users to the latest information security updates. Regulatory and Legal Requirements Another governance category that the committee, also under the close supervision of the board, will undertake its compliance to industry regulations and those laid out by the professional organizations concerned with enterprise information security. Additionally, compliance with the legal requirements will also be necessary. Audit and Validation Another governance category that the committee will also undertake will include audit and validation of the company's systems and protection mechanisms. These will include penetration tests, configuration reviews, and controls validation, moving all point-in-time validation procedures to continuous validations, and finally, automating security system validation. Policies, procedures, and standards Finally, the governance category is policies, procedures, and standards. The implementation committee will review the already existing policies and recommend necessary changes. Policies are simply the operating principles that an organization uses. Common information security policies that the committee will try to enforce include password policies and company document handling policies. On the other hand, procedures refer to a step-by-step outline of how things are done. In the organization, the committee will issue or enforce the procedure of system user authentication. Finally, we talk about standards. These are rules and controls that the committee will rely on while enforcing the above-listed policies. For instance, we have the ISO standards of the requirements for establishing, implementing, maintaining, and continually improving an information security management system within the context of the organization (Tricomi, 2020). Other Core-Security Dimensions Another important area that the security committee will ensure they assign responsibilities to includes the core-security dimensions. These are other important elements of any information security plan and include the end-users organization employees, business partners, organization customers, and suppliers. The committee will define their roles and scope as far as the security management is concerned. Conclusion The adoption of this proposal is subject to the review and approval of the organization's administrative management. It provides a clear picture of how the company, Assurant, can manage its information security going forward. References (www.infosec.gov.hk)I. (2020). Infosec: IT Security Standards and Best Practices. Retrieved 11 September 2020, from https://www.infosec.gov.hk/en/useful-resources/it-security-standards-and-best-practices Multi-dimensional enterprise-wide security: An action plan. (2020). Retrieved 11 September 2020, from https://searchsecurity.techtarget.com/feature/Multi-dimensional-enterprise-wide-security-An-action-plan Tricomi, K. (2020): Policies, Procedures, and Standards | BPMInstitute.org. (2020). Retrieved 11 September 2020, from https://www.bpminstitute.org/resources/articles/policies-procedures-and-standards Running head: ENTERPRISE SECURITY POLICY 1 ENTERPRISE SECURITY PROPOSAL 5 Enterprise Security Policy Jamarious Jones Bellevue University 09/25/2020 ASSURANT INSURANCE SECURITY POLICY 1. Overview Contemporary companies rely on information as one of their primary organizational assets in the course of their operations. Consequently, data management is an integral part of corporate governance and running. Like all assets, information is valuable, and as such, a vulnerable asset that risks losing value in the event of loss, damage or distortion and misrepresentation. Regarding Assurant Insurance’s primary objective of establishing practical and functional systems aimed at guaranteeing user convenience, the policy herein focuses on providing a roadmap to confidentiality and operational availability of data management and security protocols. The policy also seeks to protect company data from any form of compromise from any source whatsoever. In line with the objectives mentioned earlier, the policy appeals for collective involvement in ensuring data security for the company. Holistic active participation in protection measures is geared towards preventing unauthorized access, use and modification of company data, and mitigating destruction and avoiding delay in service. 2. Purpose This policy aims to guide Assurant Insurance employees on the best possible way of achieving the security threshold for data security; confidentiality, integrity, and availability. It also seeks to encourage all employees to use all the facilities provided for by the company to effectively enhance data security within their respective organizational jurisdictions. 3. Scope The Assurant Insurance Security Policy is a document addressed to all company employees whose job descriptions require the application of computers and computer-related devices. However, the particular emphasis is directed at individuals serving in the IT Department as they have supervisory discretion over all other staff members on matters of Information Communication Technology. 4. Risk Management and Security Principles. 4.1 Organizational Roles. Dealing with the company’s security threats requires all company stakeholders' involvement, albeit in different ways. Each individual contributes to the safety of Assurant Insurance as per their qualifications and job description in the company organizational structure. The absence of an organization undermines order, which interferes with the ability to function correctly. 4..1.1. User Responsibilities. All users, regardless of the job dispensation, are expected to follow specific guidelines recommended by I.T experts to enhance system security within the organization. Such recommendations for all users include; 1. Compliance with security procedures and protocols. 2. Protecting one’s user ID and password 3. Inform the I.T and Risk Management Department of any security issues, problems or concerns with your system as soon as they arise. 4. Back up all the systems that support I.T systems on your desk. 5. Value awareness of vulnerabilities and intrusions and report in case of an incident. 4.1.2. System Administrator. The system administrator has access to hubs, firewalls, routers and host systems, which help their functional roles. He/she is responsible for regular system checks of allocated work stations and even scheduled checks on the system. Administrator passwords for individuals who’ve been terminated are cleared as soon as they exit the building. Due to their nature's sensitivity, admin passwords require more frequent updates than the recommended two weeks for other employees. Password updates for administrators are undertaken every 72 hours. 4.1.3. Manager’s Duty. Managers serve as the ultimate link between employees and the I.T department. For security, they shall charge the I.T department with updating the security protocols of any compromised employee. Other than that, managers could only play a supervisory role over the employees to enforce clauses of the security policy. 4.2. Planning Processes. Planning for security and management of organizational data is a cyclic process with no definitive ending. As information evolves, so does threats and various intrusions techniques that malicious individuals apply. However, risk assessment provides an insight into certain aspects of system security and vulnerability. If the resultant insight is harnessed correctly, it could be the first line of defense. 4.2.1. Risk Assessment. Standard risk management procedures call for problem identification and speculation of its impact on the organization based on size and intensity and its effect on the organization. Risk assessment protocols include a survey on current security trends, identification of Assurant Insurance’s most valuable data asset and establishing ways through which an intruder may try to gain entry. Each of those steps requires regular monitoring and reports, and establishing a proper chain of communication meant explicitly for the assessment process. 5. Policy 1.1. Information Classification For the purposes of security, company employees only have access to information relevant to their work. In that way, a compromise on a single employee’s dataset only affects a section of Assurant Insurance. Also, office data for higher ranking receive more security attention based on the magnitude of such data as well as the sensitivity they bear. 1.2. Encryption. Like classification, encryption works in a discriminatory manner and the choice of encryption level attained for a device depends on an employee’s position in the company. However, each employee’s device has some level of encryption within to at least provide security cover. 1.3. Non-Employee Personnel and Security. For non-employee personnel with essential business to conduct with any of Assurant Insurance personnel, they are granted temporary clearance for access to the company’s system under the watchful eye of the employee they engage and an appointed I.T escort. Their clearances are as valid as their presence in the building and once they are gone, the system on which they worked undergoes a security update. As for security, they have access to employee logs matching a device/company resource to a particular employee but nothing more. 1.4. Application Communications. When sharing information and applications have to interact, the employees responsible have to ensure that each device is in the standard security status. On that note, employees are discouraged from using personal communication devices to handle work issues since it opens the door for security compromises. 1.5. Viruses and Malicious Code. For viruses and malicious codes, employees are required to activate ad blockers for certain sites under the direction of an employee from the I.T department. Also, anti-virus and anti-malware updates for each resident computer is available for each computer subject to request from an affected employee. In the case of a virus infraction into a computer though, the affected employee should quickly log out from any network in a bid to prevent further spread before consulting the I.T department. 1.6. Physical Security. While it still remains a source of risk for data security, instances of physical infringements into an organization’s data space are on the decline today. However, there still lies need for precaution and the introduction of various protocols for physical security. For starters, having a fixed security presence in the form of guards could be helpful. Also, embracing the practice of multiple locks to secure a device protects it from physical harm. 1.7. Incident Reporting and Response. The greatest asset in possession of an organization during times of crises is an efficient response protocol. In case of any issue that threatens the security of a system, Assurant Insurance employees are expected to act fast and decisively to quash the situation in its premature stages. The point of origin (employee affected) should sound an alarm by sending an alert and exiting the system altogether. For extreme cases, total system shutdown is acceptable since the company has a backup server. After exiting the system, the affected employee has to report to the ICT security manager the events of the incident in detail and with clarity. Running head: ENTERPRISE SECURITY PROPOSAL 1 ENTERPRISE SECURITY PROPOSAL 2 Enterprise Security Proposal Name Course Tutor Date Enterprise Security Proposal Introduction Many organizations consider information security as their number one concern. In the last five years, CIOs of many big companies have explained why information security is now taking the top slot among great concern to organizations. Several companies' business models heavily rely on data capturing, mining, analysis, sharing, and storage. Insecurity in data management can lead to huge losses to an organization, some of which can be detrimental to its going concern. Internally, organizational IT departments are often met with challenges of dividing and distributing responsibilities related to information security throughout the organization. An enterprise comprises many departments undertaking related or unrelated activities. It is such settings that present complexity when it comes to rolling out a comprehensive enterprise-wide security plan. Furthermore, it is important to note that not all departments in an organization will always agree while implementing respective policies. It is always characteristic of these departments to compete in terms of interests. Division and distribution of information security responsibilities, if not properly handled, can stir problems instead of addressing them. Proposed Plan Assurant is a U.S based global provider of risk management products and services. Headquartered in New York City, the company was founded in 1892 and now controls 0.9% of the insurance market share. Assurant currently has a presence in more than 100 countries, with $5.6 billion direct premiums written. Over the years, the company has had a history of information security challenges, with the most memorable incident being the massive data theft that occurred in 2018. Recent information security-related complaints from the organization show that the company's entire IT infrastructure security has never been addressed. For such a reason, we come up with a comprehensive enterprise security proposal for the company. Establish Security Oversight Board Several strategies can be used to develop a comprehensive enterprise-wide security plan. In this proposal, we suggest a strategy that involves a security oversight board at the helm of all information security-related matters. The board's composition includes the management representatives from the corporate functional office and all organization's business units. There has to be the information security committee under the board whose actual responsibility is to divide and distribute information security responsibilities among the organization's departments as the need may demand. Being an oversight body, the board can choose to be involved in the day-to-day information security activities in the organization or supervise the committee's activities. Assignment of Responsibilities to Governance Categories Education, Training, and Awareness Under the supervision of the board, the committee will ensure that all governance categories of IT information security are assigned responsibilities and periodically updated as required by the already laid down policies. For instance, the committee will conduct periodic training and awareness to the organization's employees, especially those exposed to critical organization data and systems (Multi-dimensional enterprise-wide security: An action plan, 2020). Due to information technology's changing nature, the committee must conduct education, training, and awareness exercises every six months (infosec.gov.2020). Such an opportunity will expose the organization’s employees and other system users to the latest information security updates. Regulatory and Legal Requirements Another governance category that the committee, also under the close supervision of the board, will undertake its compliance to industry regulations and those laid out by the professional organizations concerned with enterprise information security. Additionally, compliance with the legal requirements will also be necessary. Audit and Validation Another governance category that the committee will also undertake will include audit and validation of the company's systems and protection mechanisms. These will include penetration tests, configuration reviews, and controls validation, moving all point-in-time validation procedures to continuous validations, and finally, automating security system validation. Policies, procedures, and standards Finally, the governance category is policies, procedures, and standards. The implementation committee will review the already existing policies and recommend necessary changes. Policies are simply the operating principles that an organization uses. Common information security policies that the committee will try to enforce include password policies and company document handling policies. On the other hand, procedures refer to a step-by-step outline of how things are done. In the organization, the committee will issue or enforce the procedure of system user authentication. Finally, we talk about standards. These are rules and controls that the committee will rely on while enforcing the above-listed policies. For instance, we have the ISO standards of the requirements for establishing, implementing, maintaining, and continually improving an information security management system within the context of the organization (Tricomi, 2020). Other Core-Security Dimensions Another important area that the security committee will ensure they assign responsibilities to includes the core-security dimensions. These are other important elements of any information security plan and include the end-users organization employees, business partners, organization customers, and suppliers. The committee will define their roles and scope as far as the security management is concerned. Conclusion The adoption of this proposal is subject to the review and approval of the organization's administrative management. It provides a clear picture of how the company, Assurant, can manage its information security going forward. References (www.infosec.gov.hk)I. (2020). Infosec: IT Security Standards and Best Practices. Retrieved 11 September 2020, from https://www.infosec.gov.hk/en/useful-resources/it-security-standards-and-best-practices Multi-dimensional enterprise-wide security: An action plan. (2020). Retrieved 11 September 2020, from https://searchsecurity.techtarget.com/feature/Multi-dimensional-enterprise-wide-security-An-action-plan Tricomi, K. (2020): Policies, Procedures, and Standards | BPMInstitute.org. (2020). Retrieved 11 September 2020, from https://www.bpminstitute.org/resources/articles/policies-procedures-and-standards