Cyber Security: Policy, Implementation, and Steps for Individuals and Organizations

This report discusses the various benefits, concerns activities and various steps that University of Sunderland can undertake to enhance its cyber clinic's security. It covers cyber security policy, its implementation, and steps that individuals and organizations can take to enhance their cyber security. It also covers the benefits and concerns of establishing a cyber clinic service in University of Sunderland.

CYBER SECURITY
1

Table of Contents
INTRODUCTION...........................................................................................................................3
PART-1............................................................................................................................................3
Cyber security policy:..................................................................................................................3
Main requirements of Cyber data security by organizations:......................................................3
Basic Elements of security Policy:..............................................................................................3
Importance of the Elements:........................................................................................................4
Implementation of Cyber security policy:...................................................................................5
PART-2............................................................................................................................................5
Benefits of a Cyber clinic service in University of Sunderland:.......................................5
Types of activities undertaken by Cyber clinic:................................................................6
Concerns arising from Cyber clinic service:.....................................................................6
PART-3........................................................................................................................................7
Steps that can be taken by individuals to enhance their Cyber security:...........................7
Steps that can be taken by organizations to enhance their Cyber security:.......................8
Evaluation of steps undertaken:.........................................................................................8
CONCLUSION................................................................................................................................9
REFERENCES..............................................................................................................................10
2

INTRODUCTION
Cyber security are the methods which offers defences against digital threats occurring
from networks, devices and services (Schatz, Bashroush and Wall, 2017). They are necessary
because nowadays every organization have to depend upon computers and internet. This report
will discuss the various benefits, concerns activities and various steps that University of
Sunderland can undertake to enhance its cyber clinic's security.
PART-1
Cyber security policy:
Cyber security is a very important issue in IT sector. Each employee in the organization
has to play a major role in maintaining the security. Cyber security policy is a practical way for
the working staff of the organization to learn about the importance of security (Lallie and et.al.,
2021). It describes about the role and responsibilities of each member to protect the data and IT
systems. Also, it sets the rules of behavior for staff to restrict the social media usage and the
other activities.
It is important for the organizations to make sure that their data is safe from data
breaching, from both external and internal factors. The main aim of Cyber security is to keep the
company's data confidential and free from data loss.
Main requirements of Cyber data security by organizations:
The network enabled Cyber attacks are increasing rapidly, and to eliminate the risk from
Cyber attacks. Threats can occur on the internet when there is any potential weakness in the
system. The cloud computing has also spread which also added security risks (Corradini, 2020).
With the increased need of Cyber security, well-trained and skilled people are also required for
the organizations to protect the systems, data from attack and unauthorized access.
Basic Elements of security Policy:
The list shows the important elements while developing security policy:
1. Purpose.
2. Audience.
3. Objectives.
4. Data support and operation.
5. Authority and the access control of the policy.
6. Classification of data.
3

7. Security awareness.
8. Responsibility, rights and duties
Defining the 3 major elements:
1. Authority and the access control: Outline the authority and the access control of the
policy. The senior manager can have the authority to share the data. And also has the
control who can access the data.
2. Classification of data: The policies should classify the data into categories. This data
classification is required because the important data needs more security and to avoid the
needless security measures to unimportant data (He and Zhang, 2019). Which may
include public, secrete and confidential data.
3. Security awareness: The workers of the organizations are required to know and informed
about the security measures, including the data protection.
Importance of the Elements:
Authority and access control policy
A security policy has a hierarchy based control in which a junior staff cannot share any
amount of information unless they are authorized. Whereas, a senior employee is authorized to
make decision about accessing and sharing the data. The senior manager is not bound to the
same security policy term as the junior employee (Aldawood and Skinner, 2019). In this type of
control, juniors have authority over their own work, the project manager has authority over the
tasks that are allotted to the belonging groups and the administrative has the power to access over
all the system files.
Classification of data
The information is classified on the basis of the importance of the data. They are
classified as high risk data, confidential data and public class data. The high risk data, these data
are protected by the law (Ahmad and et.al., 2020). This includes payrolls, financial and
personnel data. The confidential data, this data is judged by the data owner that it should be
protected by the disclosure or not. Public class data, this type of information can be freely shared
and accessed.
Security awareness
Awareness about the security policy is an important step for the organizations to make
the employees learn, acknowledge, and understand the procedures to protect the data. For that,
4

training sessions are provided to the employees (Dawson, 2018). These training session should
cover the topics like how to collect and use the data, maintaining the quality of the data,
management of the records, privacy, confidentiality, correct usage of social sites etc.
Implementation of Cyber security policy:
By taking the following points into consideration, organization can implement the security
policy: Assess the current state of security: It is important to assess the current security and their
effectiveness. Once reviewed, new strategies can be employed. Monitor and manage the networks: It helps to spot the slow and failing components that
are threatening the system. Set security measures and controls: After determining all the risks, find the best solution
and apply it to the system.
 Create a dynamic security culture: Most data breach occurs due to human error.
Everyone in the organization should have the proper knowledge about the data security
(Alhayani and et.al., 2021).
PART-2
Benefits of a Cyber clinic service in University of Sunderland:
Establishing a cyber security clinic service in the Sunderland university can be very
beneficial as:
9. Protection against unwanted malware: Cyber security clinic can help the university in
protecting its systems against viruses, worms, spyware and other unwanted programs. It
also provides security to protect against data from theft and being hacked.
10. Provides privacy: Cyber security systems provides privacy to all the users (Gunduz and
Das, 2020.). People at the university can have privacy of their data and usage if the cyber
security systems are installed in the university.
11. Stops websites from going down: The cyber security systems can protect the websites
from force shut down or the other viruses which can block the webpages.
5

Types of activities undertaken by Cyber clinic:
Cyber security activities that can be undertaken by the cyber clinic at university of
Sunderland:
4. End user protection: Cyber security will provide protection from accidental or intentional
uploads of malwares in the systems of university of Sunderland. The security programs
will confine potentially malicious programs to a virtual bubble separate from the user's
network (Berman and et.al., 2019).
5. Malware detection: E-security protocols have features which can focus on real time
malware detection. Heuristic and behavioural analysis will be used to monitor a program
and its code to defend against viruses which can change their shapes in each execution.
6. Protection against cyberattacks, crimes and threats: The cyber clinic will be updating all
the softwares and anti-virus softwares which can harm the university data security. It can
provide protection from various threats like Dridex and Emotet malware and cyber
crimes like frauds, phishing, threatening, drug trafficking, stalking or spams etc., (Gupta,
2018).
Concerns arising from Cyber clinic service:
Apart from providing various benefits there are certain issues that can emerge from
establishing a Cyber clinic at university of Sunderland. The firewalls can be very difficult to
configure correctly and if the firewalls and configured incorrectly they might block users from
performing certain actions n internet. They can also make the systems way lower than before.
Issues concerning liability:
Cyber security Liabilities arise when the actions or activities under taken by cyber clinic
which harms a person or organization. The university might be liable of all the costs incurred by
the users or the third parties through cyber attacks. The clinic will also be liable to pay regulatory
fees if they breach state or federal regulations (El Mrabet and et.al., 2018.). The university will
also be liable to notify users if a data breach occurs or even if it is suspected. And system or data
recoveries in repairing or replacing computer systems.
Issues concerning legality or Profession
6

Cyber securities have to various cyber laws. With the increase in usage of digital
technology, the cyber clinics are very likely to experience emerging laws. The country does not
have a comprehensive security law, instead it has various legal frameworks for cybersecurity
which University of Sunderland have to follow before establishing cyber clinic they are; The
Computer Misuse Act 1990 which lists various cyber cries, the Privacy and Electronic
Communications Regulations, 2003 which includes security obligations to be followed regarding
personal data which applies to public e-communication service providers and Data Protection
Act 2018, which implies following Brexit policies to the incidents which involve personal data.
PART-3
Steps that can be taken by individuals to enhance their Cyber security:
Before attack: Wi-Fi security: The strong and unique Wi-Fi systems must be installed to prevent
unknowns from using the internet. Keeping backup: The data which is sensitive and important should be made a copy and
kept aside for future safety (Humayun and et.al., 2020). Updated softwares: The antivirus and anti-malware softwares needs to be kept up to date
to prevent these threats.
After attack: Changing passwords and re-routing: The first action that the individual can take, will be
of changing the Wi-Fi password and re-router his internet. The internet accesses provided
will also be controlled (Croasdell, Elste and Hill, A., 2018). Launching backup: The data backups that were made prior will be launched to recover
the data. Taking action: The individual have to take action immediately to reduce or control the
damage because, the intruders can return and attempt to regain the access to the networks.
 Consulting a professional: To deal with a cyber attack the individual might need a
professional to respond to that attack. They can help in discovering what has been
accessed and damages which caused data breach (Wang and et.al, 2019).
7

Steps that can be taken by organizations to enhance their Cyber security:
Before attack: Training the staff: The organizations can raise security awareness and policy enforcement
and provide training to the staff who deals with sensitive data. Data backup: The organization will try to keep the backups of sensitive data. Control access: The organization will monitor and control the accesses which will be
given to the employees (Soceanu, Vasylenko and Gradinaru, 2017).
After attack: Survey the damage: The organization will survey the damages through internal
investigation and will try to identify the attacker and the improvements need to be made
(HansOn, 2021). Limit the damage: The next step will be re-routing network or blocking traffic to ensure
no spreading of additional damages. Recording the details: The organization will then record the actions which were taken to
respond the damage. Engaging the legislations: After a major breach the organization will report to law
enforcement according to the crime or breach. Notifying the affected: The organization have the liability to notify those affected through
letter, email, phone or in person.
 Learning from experience: The organization will develop the processes to learn from
breaches by documenting, accessing or ensuring training processes (Barrett, 2018).
Evaluation of steps undertaken:
If the individuals or the organization takes the precautions it can protect the systems
before possible cyber attacks. After attack the organization and individuals can follow these
steps. Although it is not possible to reverse the damage, but these actions can reduce or prevent
the additional damages from occurring and also suggest various ways to improve the
effectiveness of cyber security.
8

CONCLUSION
It can be concluded that the Cyber security are the measures adopted by the individuals or
organizations to prevent possible digital threats and crimes. They can be very beneficial to
University of Sunderland however, they also have legal and liabilities challenges. The
companies/individuals can take various precautions to prevent and various steps after breaching
of cyber security.
9

REFERENCES
Books and journals:
Ahmad, A. and et.al., 2020. How integration of cyber security management and incident
response enables organizational learning. Journal of the Association for Information
Science and Technology. 71(8). pp.939-953.
Aldawood, H. and Skinner, G., 2019. Reviewing cyber security social engineering training and
awareness programs—Pitfalls and ongoing issues. Future Internet. 11(3). p.73.
Alhayani, B. and et.al., 2021. Effectiveness of artificial intelligence techniques against cyber
security risks apply of IT industry. Materials Today: Proceedings.
Barrett, M.P., 2018. Framework for improving critical infrastructure cybersecurity. National
Institute of Standards and Technology, Gaithersburg, MD, USA, Tech. Rep.
Berman, D.S. and et.al., 2019. A survey of deep learning methods for cyber security.
Information. 10(4). p.122.
Corradini, I., 2020. Building a Cybersecurity Culture in Organizations: How to Bridge the Gap
Between People and Digital Technology. 284. Springer Nature.
Croasdell, D., Elste, J. and Hill, A., 2018. Cyber Clinics: Re-imagining Cyber Security
Awareness.
Dawson, M., 2018. Applying a holistic cybersecurity framework for global IT organizations.
Business Information Review. 35(2). pp.60-67.
El Mrabet, Z. and et.al., 2018. Cyber-security in smart grid: Survey and challenges. Computers
& Electrical Engineering. 67. pp.469-482.
Gunduz, M.Z. and Das, R., 2020. Cyber-security on smart grid: Threats and potential solutions.
Computer networks. 169. p.107094.
Gupta, B.B. ed., 2018. Computer and cyber security: principles, algorithm, applications, and
perspectives. CRC Press.
HansOn, D., 2021. Normalizing Cybersecurity: Improving Cyber Incident Response with the
Incident Command System (Doctoral dissertation, Monterey, CA; Naval Postgraduate
School).
He, W. and Zhang, Z., 2019. Enterprise cybersecurity training and awareness programs:
Recommendations for success. Journal of Organizational Computing and Electronic
Commerce. 29(4). pp.249-257.
Humayun, M. and et.al., 2020. Cyber security threats and vulnerabilities: a systematic mapping
study. Arabian Journal for Science and Engineering. 45(4). pp.3171-3189.
Lallie, H.S. and et.al., 2021. Cyber security in the age of covid-19: A timeline and analysis of
cyber-crime and cyber-attacks during the pandemic. Computers & Security. 105.
p.102248.
Schatz, D., Bashroush, R. and Wall, J., 2017. Towards a more representative definition of cyber
security. Journal of Digital Forensics, Security and Law. 12(2). p.8.
Soceanu, A., Vasylenko, M. and Gradinaru, A., 2017, March. Improving cybersecurity skills
using network security virtual labs. In Proceedings of the International MultiConference
of Engineers and Computer Scientists 2017 Vol II, IMECS.
Wang, H. and et.al, 2019. Deep learning aided interval state prediction for improving cyber
security in energy internet. Energy. 174. pp.1292-1304.
10