IT Security: A Comprehensive Guide to Protecting Your Organization

IT Security

TABLE OF CONTENTS
Introduction..................................................................................................................................................1
LO 1.............................................................................................................................................................2
P1 Identify types of security risks to organisations.................................................................................2
P2 Describe organisational security procedures......................................................................................3
M1 Propose a method to assess and treat IT security risks......................................................................4
LO2..............................................................................................................................................................7
P3 Identify the potential impact to IT security of incorrect configuration of firewall policies and third-
party VPNs...............................................................................................................................................7
P4 Show, using an example for each, how implementing a DMZ, static IP and NAT in a network can
improve Network Security.......................................................................................................................9
M2 Discuss three benefits to implement network monitoring systems with supporting reasons..........10
LO 3...........................................................................................................................................................12
P5 Discuss risk assessment procedures..................................................................................................12
P6 Explain data protection processes and regulations as applicable to an organisation........................13
M3 Summarise the ISO 31000 risk management methodology and its application in IT security.......13
M4 Discuss possible impacts to organisational security resulting from an IT security audit................15
LO 4...........................................................................................................................................................16
P7 Design and implement a security policy for an organisation...........................................................16
P8 List the main components of an organisational disaster recovery plan, justifying the reasons for
inclusion.................................................................................................................................................17
M5 roles of stakeholders in the organisation to implement security audit recommendations...............18
Conclusion.................................................................................................................................................19
References..................................................................................................................................................20

LIST OF FIGURES
Figure 1:Type of security risk.....................................................................................................................2
Figure 2:Sercurity procedure.......................................................................................................................3
Figure 3: Risk as the function of vulnerabilities, threats and risks..............................................................5
Figure 4: phases for IT security risk assessment.........................................................................................5
Figure 5: Firewall.........................................................................................................................................7
Figure 6:VPNS.............................................................................................................................................8
Figure 7:DMZ Functioning..........................................................................................................................9
Figure 8:NAT functioning.........................................................................................................................10
Figure 9: ISO 31000 standard....................................................................................................................14

Introduction
The project is based on the study of the security for the information technology to implement the new
technologies for the protection of the organisation. The Ramsac is the organisation that is used in the
project and the factors are implemented for the growth and development by reducing the safety
precaution in IT security. The type of security risk is explained along with the security procedure and IT
risk treatments. The project has provided the incorrect configuration of the VPNs and firewall that
provide the protection from the hackers and viruses. DMZ, Static IP and NAT network security is used
for the organisations security. The risk methodology is used in the project for the IT security and the
stakeholder audit and recommendation is explained in the project for the implementation of the new
technologies.
1

LO 1
P1 Identify types of security risks to organisations.
The organisation main aim is to protect the operation of the system so that the records and data can be
keep safe and secure. The organisation faces the various aspects of problem and difficulties in terms of
the security. The types of security risk that affect the organisation is explained below:
Figure 1:Type of security risk
(Source: Self created)
Internet and network attack: The internet and network occur the huge level of the viruses and threats
while transferring the information from one path to other. The organisation cannot keep the internet
isolated it has to be used in all the way so must be used in such a way that cannot break the security of
the organisation (Eriksson, 2017).
Unauthorized access and use: The organisation must keep the security strong so that the unauthorized
user cannot hack the confidential data and record. It is most increasing risk type in field of the security
as the third person easily breaks the security so it should be protected.
2
Internet and network attack
unathorized access and use
Hardware / Software theft
Information theft
system failure

Hardware and software theft: The security level can be break or hacked by the unauthorized user by
damaging the software and hardware of the operating system. The Ramsac organization can configure
the high level of software and hardware so that it can be keep safe and secure from the hacker and thefts.
System Failure: The system protection is major source of risk security the hacker and theft make the
system track stop the functioning of the system operation. The user can make the system recheck so that
the system failure problem cannot arise in the computers. The authentication can make the strong so that
the system can be protected from the theft and viruses. The system failure cause by the large no of
viruses by using the internet and network as these carries viruses in no of amount that can affect the
working of the system.
P2 Describe organisational security procedures
The security procedure of the organisation can make the level of the security high and keep the process
follow so that protection can be increase. The procedures refer to the proper functioning of the system
by indulging the security in the operation of the system. The organisation can follow the below process
for the security of the computer system are given below:
Figure 2:Sercurity procedure
(Source: self created)
3
Implementation and
treatement
Review and
monitoring
Identofication of risk
Risk assessment
Treamtement
identifcation
Corrective and
preventive actions
Act
Plan
Do Check