IT Security: A Comprehensive Guide to Protecting Your Organization

IT SECURITY

TABLE OF CONTENTS
Introduction..................................................................................................................................................1
Task 1...........................................................................................................................................................2
P1.1 Identify and evaluate types of security risks to organisations.........................................................2
P1.2 Evaluate organisational security procedures...................................................................................4
Task 2...........................................................................................................................................................7
P 2.1 Discuss risk assessment procedure.................................................................................................7
P 2.2 Evaluate data protection processes and regulations as applicable to an organisation..................10
P 2.3 Analyse physical security issues for an organisation...................................................................13
Task 3.........................................................................................................................................................17
P3.1 Design and implement a security policy for an organisation........................................................17
P3.2 Evaluate the suitability of the tools used in an organisational policy............................................20
P 3.3 Discuss the human resource issues that have to be considered when carrying out security audits
...............................................................................................................................................................23
Conclusion.................................................................................................................................................24
References..................................................................................................................................................25

LIST OF FIGURES
Figure 1: Risk assessment procedure...........................................................................................................9
Figure 2: ISO 31000 standard....................................................................................................................12
Figure 3: Physical security.........................................................................................................................13
Figure 4: Physical security on the doors....................................................................................................16
Figure 5: IT system monitoring tool by solarwinds...................................................................................20
Figure 6: PRTG network monitoring tool..................................................................................................21
Figure 7: NetFort tool................................................................................................................................22

Introduction
Information technology enables the organization to process the data in faster and reliable manner but it
also has threats from the environment which can influence the data security and asset functioning.
Today, information systems are the most critical and expensive sources for the organization those work
as backbone for many business operations. The report will discuss different types of the security risks
and security procedure of the organization to manage the risks. Hilton Hotel, a leading hotel chain is
considered as the case study for the report so that appropriate risk assessment procedure and data
protection process and regulations can be discussed. The report will focus on the physical security issues
of the IT systems in the organization and recommend the practices to resolve the issues. Later, report
will design and implement security policy, evaluate the suitability of the tool to monitor the user
activities and network. Also human issues to be considered during security audit will be discussed for
the organization.
1

Task 1
P1.1 Identify and evaluate types of security risks to organisations
Increasing use of the information technology in the business has provided the strength to manage the
data more effectively but also opened the door of insecurity with poor implementation and configuration
of the systems. At present, security risks to the organizations are impacting the business to achieve the
reliability, data confidentiality and performance along with security. The organization is facing security
risks on the loss of access to the devices, poor configuration leading unauthorized access and
modification to the system or data sources, theft of the information and damage to the assets for
continuance of operations. The organization can face the following types of the security risks:
Intellectual property theft and business espionage
Attackers are establishing root in the organizational network or information systems to monitor the
network and fetch the data to gain business espionage. For example, patents, confidential data, financial
records, ideas for new products and strategic growth, business plans or military secrets can be theft from
the organization. Access or theft of such confidential details of the organization can deliver the
profitability to the attacker. In competitive environment, attackers trying to steal the information for the
longer time till they are identified and continue to monitor the business for profitable intellectual
property (Roger, 2017).
Malware mercenaries
It is the program intentionally created to damage the computing resources or impact the user activities
on the system. However, the traditional system to create and impact the single user has been changed in
the multi user environment where malware is injected on the customer or clients computers as an
innocent program. It follows the mother-ship where all the malware programs are connected to a single
server and wait for the instructions to initialize the damage or malfunctioning (Michael, 2010). The
organizations infected with the malware program have low performance, low security on the
confidential data and reduced control on the functions within the network or system. The goal of the
malware mercenaries is the exploit the multiple computers through a single server at a time for the
particular goal or objectives.
2

The increasingly compromised web
The poor configuration of the web server can impact the business for the security risks. Attackers are
targeting web servers to exploit the risks to the connected client computers. Normally, attackers in the
network system use the vulnerabilities, weaknesses and poor configuration on the server to bypass the
security mechanism which helped them to control the web server. With bypass they can change the
authentication details or code the malicious scripts for the clients. Poor password, SQL injections,
vulnerable software, cross-site scripting vulnerabilities and insecure permissions are the some of the
vulnerabilities on web server (Rapid7.com, 2018). Such attacks can impact the organization for the poor
connectivity, performance and reduced security to the users whereas confidentiality and privacy of the
user data over the website might be compromised.
Hacking activities
IT systems have high threat of the activities from the user or attacker to become administrator for
complete control. Hacking activities can impact the system for the user management, file permissions,
access to the resources and services for the operations. In a network system, the organization might loss
the access to the resources providing easy communication and security in the network. Also, hacking
has main goal to influence the users, generate the profitability through device access, data security or
demand of the capital for access and to impact the reputation of the organization (Conklin et al, 2015).
Infrastructure
The organizational infrastructure might become the prompter for the security risks as the poor
classification of the computing devices can allow them to access regardless of their role and
responsibilities in the organization. Also poor infrastructure can motivate the main-in-middle attacks
through the direct connections to the computing devices. Infrastructure for the wireless connectivity and
open access to the network components can reduce the security on the data and assets. It can generate
the loss of financial and physical assets on the organization.
All-in-one malware
The code designed to infect the computing devices in the network is called malware. However, a
malware can take the form of virus, Trojan horse, worms and malware. Virus can infect the system code
3

for the malfunctioning and damage the data for the usability (Carroll, 2014). Also, Trojan horse is a
program which is embedded into the legitimate program code so that it installs automatically and
performs background operations to impact the computer security. Worms are also programs like virus
but they consume storage space and perform background operations to breach the security. Worms
never affect tor damage the assets in the system.
P1.2 Evaluate organisational security procedures
The organizational security procedure can be defined as the way to control the security among the users,
systems and network technologies so that business operation continuance can be assured. The
organization normally follows the four major stages during the establishment of the security procedures:
focus on the business continuance, back up and restoration of data, audits on security and testing
procedures after implementation. However the organizational security procedures can be evaluated in
following sections:
Administrative procedures
This section has focus on the security of the systems through the administrative operations. It constrains
the users for the use and ownership of the system and data. The administrative procedure of the
organization is effective to manage the user access to the network resources and utilization of the
services for the business. The organization also has focused on the security and proprietary information
being collected and processed in the administrative operations of the organization. It controls
unacceptable use of the systems (Information security procedures, 2018). Therefore, it works as
guideline for the users to make use of the resources and information for the business purpose only.
However, it has enforced the monitoring practices and resulting outcomes if procedure is not followed
by the users.
Technical procedures
The security procedure for the technical set up and configuration has involvement of the procedures for
the password management and rules, anti-virus process, server security process, security on router and
wireless connections, remote access, encryption, web access and database storing confidential
information. The technical procedure has focus on the security of the data and assets through the
technical set up of the communication mechanism, network resources and user configuration along with
4

management of the information sensitivity for sharing and processing (Ray, 2018). However, it provides
strong guidelines for the password and user detail management in database systems, ownership and
responsibility of the server security, authentication and encryption during the communication and access
to the website with high security risks.
Physical security procedure
This procedure has focus on the security of the system and network assets. It has focus on the security of
the server machines, client computing devices including computers, printers and fax machines, storage
devices and network components like switches, router and firewall. The physical security procedure of
the organization has used to limit the user access to the assets to prevent the unwanted use of the system.
It provides server room security through the guidance and recommendations. It ensures the data storage
with high security and prevents the destruction of the storage of the sensitive information. It also
enforces the legal compliance of the regulations for the data protection.
Impact of security breach to an organization
The security procedure needs to be executed effectively in the organization to prevent the unauthorized
access or data theft. Security breaches in the organization can impact the organization for the poor
availability of the data so that users cannot get the required information on time or unable to the fetch
the data from the server. Operational activities cannot get the data for the business continuance and in
this manner; the organization has poor performance and productivity. Security breaches also can theft
the data from the system so that authenticated users cannot avail the data. Loss of such confidential
information on business plan or product ideas can impact the business for financial loss or high risks on
the sustainability (Zafar et al, 2012). The attacker also breaches into the security to monitor the data
over a long time with the help of the organization resources. Such activities can transmit the business
data to the remote location and the organizational efforts for the ideas or concept through data can be
used by attacker to make profitability.
Security breaches in the competitive environment also has goal to prevent the organization to achieve
the specific benefits. For example, competitor in market can promote the attacker to damage the
resources in the network of the other organization so that that organization has reduced performance,
5