IT Security Management: A Comprehensive Guide for Organizations

SECURITY
1

TABLE OF CONTENT
Introduction......................................................................................................................................1
LO1 Assess risks to IT security.......................................................................................................2
P1 Identify types of security risks to organisation......................................................................2
P2 Describe organisational security procedures..........................................................................4
M1 Propose a method to assess and treat IT security risks.........................................................6
D1 Investigate how a ‘trusted network’ may be part of an IT security solution.........................7
LO2 Describe IT security solutions.................................................................................................9
P3 Identify the potential impact to IT security of incorrect configuration of firewall policies
and third-party VPNs...................................................................................................................9
P4 Show, using an example for each, how implementing a DMZ, static IP and NAT in a
network can improve Network Security....................................................................................11
M2 Discuss three benefits to implement network monitoring systems with supporting reasons
...................................................................................................................................................12
LO3 Review mechanisms to control organisational IT security...................................................13
P5 Discuss risk assessment procedures.....................................................................................13
P6 Explain data protection processes and regulations as applicable to an organisation...........15
M3 Summarize the ISO 31000 risk management methodology and its application in IT
security.......................................................................................................................................16
M4 Discuss possible impacts to organisational security resulting from an IT security audit.. .17
D2 Consider how IT security can be aligned with organisational policy, detailing the security
impact of any misalignment.......................................................................................................18
LO4 Manage organisational security.............................................................................................19
P7 Design and implement a security policy for an organisation...............................................19
P8 List the main components of an organisational disaster recovery plan, justifying the reasons
for inclusion...............................................................................................................................20
M5 Discuss the roles of stakeholders in the organisation to implement security audit
recommendations.......................................................................................................................21
D3 Evaluate the suitability of the tools used in an organisational policy..................................22
Conclusion.....................................................................................................................................23
References......................................................................................................................................24
2

LIST OF TABLES
Table 1: IT security aligned...........................................................................................................18
3

LIST OF FIGURES
Figure 1: Type of risk......................................................................................................................2
Figure 2: Risk procedure.................................................................................................................4
Figure 3: Type of networks..............................................................................................................7
Figure 4: Firewall............................................................................................................................9
Figure 5: VPNs functioning...........................................................................................................10
Figure 6: Benefit of the network monitoring.................................................................................12
Figure 7: Risk assessment procedure.............................................................................................13
Figure 8: Process View of the ISO 31000.....................................................................................16
4

Introduction
The project is based on the security of the information technology in the organisation. As the
organisation face the lot of problems due to the lack of the security. The organisation is used in
the project is Maria for which the different type of network security has been described. Under
this project we have also explained the implementation of the DMZ, static IP and NAT for the
improvement of the network in the organisation. The network benefits and risk assessment has
also described in the project so that the risk can be manage and analysis in the proper way. The
data protection and regulation has also used in the project. The stakeholder audit is arranged by
the organisation for the recommendation of the project security. The stakeholder audit is one of
the best factors in the project as it will provide the proper measurement for the security of the
system.
1

LO1 Assess risks to IT security
P1 Identify types of security risks to organisation.
For the security of the organisation the proper inspection has to be done for the security of the
system. There are various type of risk arrive in the system that can cause the impact on the data
security and integrity.
Figure 1: Type of risk
(Source: Author)
Ransome and Malware Attack: The Ransome and malware attack can occur in the system while
accessing operation of the computer system. The attack usually corrupts the files and folder in
system after locking the machine that can damage the files hide and steal the information etc.
Viruses: The viruses can cause the effect on the operations of the system by slowing the speed
the computer operations, damaging the data, deleting the files etc.
2
IT Risk
Hackers
Ransom
e and
malware
attack
Viruses
Spaywa
re