Information System and Security

This report provides a detailed plan for implementing access control methods, password policy, cryptography, and network security in XYZ Corporation's information system. It covers topics such as discretionary access control, mandatory access control, role-based access control, password complexity requirements, encryption methods, remote access plan, and network security measures.

Running head: INFORMATION SYSTEM AND SECURITY
Information System and Security
Name of Student-
Name of University-
Author’s Note-

1INFORMATION SYSTEM AND SECURITY
Table of Contents
Introduction......................................................................................................................................1
Detailed plan to implement Access Control Methods.....................................................................1
Implementing Password Policy in XYZ Corporation......................................................................2
Implementing Cryptography Method..............................................................................................4
Implementing Remote Access Plan.................................................................................................5
Implementing Network Security......................................................................................................6
References........................................................................................................................................9

2INFORMATION SYSTEM AND SECURITY
Introduction
XYZ Corporation considered for this project wants to implement a new networking
system in the working process so that they can keep the data in the network safe. There are many
procedures that are to be implemented for implementing secured network and those processes are
clearly explained in this report below.
Detailed plan to implement Access Control Methods
Implementing Security Access Control is very much important aspect for implementing
new system in the XYZ organization. The SAC is a particular act that ensures all the
authenticated users to access only the authorized person and no other can access the data (Zhang
et al., 2018). The access control method is mainly used for identifying the individual who
includes specific job, authenticate the jobs and after that continue to provide some individual to
access the information and data. The SAC methods that are to be include in the system of XYZ
organization are listed below:
1. Discretionary Access Control (DAC):
The DAC is considered as control access system which includes the responsibility of the
business owner who has the responsibility for deciding the people who are allowed for a
particular location, digitally or physically. This particular access control is very restrictive when
compared to any other access control and this helps to allow the individuals for completing the
control over the objects as well as have control over the network owned by them and includes
programs related with the objects (Sookhak et al., 2017). The main disadvantage that DAC
provides includes all facts that all the end user having complete control to the security level and
includes different users to get complete control that includes different setting of security level for

3INFORMATION SYSTEM AND SECURITY
all the users as well as needs permissions are given to all end user that are inherited from the
other programs which can lead to malware that is being executed without the awareness of end
users.
2. Mandatory Access Control (MAC):
MAC can be utilized commonly in the XYZ organization as because elevated emphasis is
done on confidentiality as well as classification of the data. The MAC usually does not permit
the owners to know the entities have an access in the unit or includes facility which only a
particular owner can manage and have access control (Hu et al., 2015). MAC can be classified
with all the end users as well as provide labels that helps to permit the users for gaining access
via security along with security guidelines.
3. Role based Access Control (RBAC):
This access control method is considered as the most demanded method of access control
compared to all other methods. In this particular method, the access is given by the system
administrator and is mainly based on different role within the organization as well as the
household and privileges are mostly related to limitation that defines the job responsibilities
(O'Toole, 2015). So in this access control, assigning different individual as a security manager,
the position of security manager has the responsibility to access control that is assigned to him.
This access control includes many individuals for some particular access and includes system
administrator mostly assign particular job titles.
Implementing Password Policy in XYZ Corporation
For implementing password policy in the XYZ organization, there is need to include
strong password policy in the defense for protecting the financial transactions, the private

4INFORMATION SYSTEM AND SECURITY
information, as well as includes the personal communications that are stored online. For all the
end users, a strong password is very important at the work and it is the personal bodyguard that
defends on everything including security threats, the hackers as well as scammers in the
organization (Johannisson, 2017). the password policies that are to be set in the XYZ
organization includes a set of security rules that creates for increasing the computer security to
encourage the users that includes reliable, as well as secured passwords and store those data as
well as utilize the data properly. The below mentioned are the password policies that can be
included in the working process of the XYZ organization.
1. Password should be able to satisfy the complexity of the requirement policy: For
enabling the password, the password should meet the requirement policy complexity (Shankar et
al., 2018). With the basic password policy as well as account policies, the user should ensure that
all the password that are used in the organization should be secured with many guidelines.
The passwords included should not include user name or should not include the full name
of the user or the first name of the user.
The password should include more than three types of character which includes:
lowercase letters, numbers, symbols, as well as uppercase letters in the passwords.
2. Resetting the Password: The password that is used locally should be changed in every
180 days (Hilles & Salem, 2018). This would ensure more security as well as the password of
service account is to be reset once in a year and that can be done during the maintenance time
3. Using strong passphrases: There should be very strong passphrases that should
include minimum of 15 characters and should also protect the domain administrator accounts.
The passwords as well as passphrases serves same purpose, the passwords that are usually short

5INFORMATION SYSTEM AND SECURITY
and are hard to remember should be implemented and should be easy to crack (Zamrani et al.,
2016). Compared to passwords, passphrases are easy to remember and is very difficult to crack
because of its length.
4. E-mail Notifications: The password should be connected with e-mail notification
before the password gets expires. The user should get email notification when there is need to
change the password.
Implementing Cryptography Method
To ensure the data security, there should be a cryptography method to ensure security of
data in the organization. There is always a fear of data breach in the industries and cryptography
includes financial organization for protecting the data (Enayatifar et al., 2017). The process of
encryption helps to protect the data in the organization. Encryption strategy is an effective
strategy as it includes database as well as penalties of storage performance that encrypts many
data.
XYZ organization should include encryption process that contains the sensitive data
which is considered as the best practice in the organization (Modieginyane et al., 2018). This
encryption method helps to minimize the total number of bytes that is encrypted and with the
smallest performance impact in the infrastructure of the organization.
1. Triple DES: This methodology can be used in XYZ organization as because this might
help to replace the original DES (Data Encryption Standard) algorithm which are learned by the
hackers eventually that defeat the cyber-attack. This triple DES algorithm is generally
recommended standard in the industry.

6INFORMATION SYSTEM AND SECURITY
The triple DES mainly includes three different individual keys with 56 bits in each key.
Total length of the password should include 168 bits (Dhingra, 2016). The triple DES helps to
manage the solution of hardware encryption included in the financial services as well as in other
industries like XYZ.
2. RSA: The second encryption technique that can be used in the business process of
XYZ organization might include public key encryption as well as the standard encryption of data
that is sent over internet. The RSA method is considered as one of the best methods that are used
in PGP programs and in GPG programs. Unlike the DES algorithm, the RSA algorithm is
generally considered as an asymmetric algorithm because it includes a pair of keys. If the user
forgets the public key which is mainly used for encrypting all the message, include private key
can be used for decrypting all message (Harrington, 2016). The main result of the RSA
encryption technique is considered as a huge batch and time is taken for the hackers to hack the
network or the data in the network.
Implementing Remote Access Plan
Implementing remote access plan in the XYZ organization mainly refers the ability for
monitoring as well as control access to the computer or to the computer network at any time. The
employees mainly includes leverage that provides the user the ability to work from remote areas
which is outside the office premises. This also helps to retain the access to distant network.
Access control plan is implemented in the computer network to control the Local area network,
the WANs, and the VPNs so that the data can be secured remotely. There are certain access plan
that can be utilized in the XYZ organization for the following reasons.

7INFORMATION SYSTEM AND SECURITY
Direct (Physical) Line: The remote access plan can be implemented as direct line from
the LAN of the computer network. The direct line or the same line can also be used for
connecting the home LAN and the LAN of the company (Pathan, 2016). This direct lines mainly
provides connection that provides faster speed and is more expensive as well as requires high
maintenance because of hardware usage. But this direct line also includes certain limitations. The
direct line is costly because it contains cables as well as hardware for establishing the
connection. There is also routing limitation as routing is limited to structure of rooting from one
point to another which is known as router hub. The direct line has to go through an area which is
non-controlled. The direct line remote access is also not much secure as because interaction is
taken place in the cables which the users does not know. There might also be a prone to failure as
damage can be done to the cables or the hardware peripherals from outside conditions.
Virtual Private Network: There is another method of remote access which is known as
VPN. This particular network is mainly used for connecting remote sites that needs connection
of internet and mainly use encryption techniques as well as tunneling techniques for accessing
the network of the computer. This option is very much ideal for small organization like XYZ
organization. But there are also some limitations that this network provides (Fielder et al., 2016).
There are additional software for establishing secured connection and needs to install new
software for establishing secure connection. There are also restriction because of the operating
system. This network needs particular OS that depends on the software of the client. The
configuration of the network is also complex as because the VPN can be configured and can be
appointed as some account on all the user.
Implementing Network Security

8INFORMATION SYSTEM AND SECURITY
XYZ organization also needs to implement the network security that states there is a need
of malware security providing vital protection layer to the computer network in the organization.
The organization should implement a robust antivirus of software package which is considered
as the technological defense for the network of the organization. Some of the network security
that is to be installed in the organization are detailed below.
1. Monitor the performance of firewall: Firewall is considered as a software set or
some hardware design that helps to block all the unauthorized access in the network of computer
in the organization (Philip & Shah, 2019). The firewall is considered as set of software or series
of rules that helps to control all the network traffic that are incoming as well as outgoing from
the network. The computers and the networks follows the rules that are allowed and prevent the
access of system.
2. Updating the password in every four months: In every four months, it is
recommended that the passwords are to be changed or updated. The changing of passwords
might lead to confusion, but updating password every four months helps to secure the network.
3. Maintaining the anti-virus software: If regular updates are not done in the
organization, it is recommended to use anti-virus software. If there is no anti-virus, there is a
greater risk and there are many hackers who finds ways for cracking the tools as well as set new
viruses. Latest version of anti-virus is to be downloaded for maintaining the network (Shin et al.,
2016). Training is also to be given to the employees who needs to know about how to maintain
the software.
4. Creating a VPN: VPN commonly known as Virtual Private network is created for
developing a secured connection between the remote computers as well as from all other local

9INFORMATION SYSTEM AND SECURITY
computers as well as servers. Those particular networks are only available for the people as well
as equipment in a particular system that increases likelihood of the hackers to break the system
network.
5. Training: Training is an essential practice that has to be included in every business
operations. There are certain risks that are to be managed in the XYZ organization and there
should be certain steps that can be followed to mitigate them. Proper training should be given to
the employees so that they can get the idea about how to mitigate the risks and keep the network
safe. Educating the employees is to be done about how to avoid the risks in the network and
lessen the cybercrime.
Conclusion
In the report above, the detailed report is stated above that shows the changing procedure
of the networking in the system in the XYZ organization. This report states a detailed process of
Access Control Methods that are to be secured in the organization along with the password
policy that might be capable of to do complex requirement in the organization. This report also
shows the cryptography method that is to be installed in the networking process to make the
network more secure. There is detailed process provided in this report that might help the XYZ
organization to secure the network from malware and some other malicious attacks.

10INFORMATION SYSTEM AND SECURITY
References
Dhingra, M. (2016). Legal issues in secure implementation of bring your own device
(BYOD). Procedia Computer Science, 78, 179-184.
Enayatifar, R., Abdullah, A. H., Isnin, I. F., Altameem, A., & Lee, M. (2017). Image encryption
using a synchronous permutation-diffusion technique. Optics and Lasers in
Engineering, 90, 146-154.
Fielder, A., Panaousis, E., Malacaria, P., Hankin, C., & Smeraldi, F. (2016). Decision support
approaches for cyber security investment. Decision Support Systems, 86, 13-23.
Harrington, J. L. (2016). Relational database design and implementation. Morgan Kaufmann.
Hilles, S. M., & Salem, M. A. (2018). Selective Image Encryption and Compression
Technique. Arrasikhun Journal, 4(1), 39-42.
Hu, V. C., Kuhn, D. R., Ferraiolo, D. F., & Voas, J. (2015). Attribute-based access
control. Computer, 48(2), 85-88.
Johannisson, B. (2017). Networking and entrepreneurial growth. The Blackwell handbook of
entrepreneurship, 368-386.
Modieginyane, K. M., Letswamotse, B. B., Malekian, R., & Abu-Mahfouz, A. M. (2018).
Software defined wireless sensor networks application opportunities for efficient network
management: A survey. Computers & Electrical Engineering, 66, 274-287.
O'Toole Jr, L. J. (2015). Networks and networking: The public administrative agendas. Public
administration review, 75(3), 361-371.

11INFORMATION SYSTEM AND SECURITY
Pathan, A. S. K. (Ed.). (2016). Security of self-organizing networks: MANET, WSN, WMN,
VANET. CRC press.
Philip, J., & Shah, D. (2019). Implementing Signature Recognition System as SaaS on Microsoft
Azure Cloud. In Data Management, Analytics and Innovation (pp. 479-488). Springer,
Singapore.
Shankar, K., Elhoseny, M., Kumar, R. S., Lakshmanaprabu, S. K., & Yuan, X. (2018). Secret
image sharing scheme with encrypted shadow images using optimal homomorphic
encryption technique. Journal of Ambient Intelligence and Humanized Computing, 1-13.
Shin, S., Xu, L., Hong, S., & Gu, G. (2016, August). Enhancing network security through
software defined networking (SDN). In 2016 25th international conference on computer
communication and networks (ICCCN) (pp. 1-9). IEEE.
Sookhak, M., Yu, F. R., Khan, M. K., Xiang, Y., & Buyya, R. (2017). Attribute-based data
access control in mobile cloud computing: Taxonomy and open issues. Future
Generation Computer Systems, 72, 273-287.
Zamrani, W., Ahouzi, E., Lizana, A., Campos, J., & Yzuel, M. J. (2016). Optical image
encryption technique based on deterministic phase masks. Optical Engineering, 55(10),
103108.
Zhang, Y., Kasahara, S., Shen, Y., Jiang, X., & Wan, J. (2018). Smart contract-based access
control for the internet of things. IEEE Internet of Things Journal, 6(2), 1594-1605.