Organizational Information Security Risks and Policies

This report discusses the potential risks and security measures needed for the Shopaholic's application used by a retail shop in East London. It also covers the impacts of incorrect firewall and VPN configuration, DMZ configuration, and network address translation. The report proposes a security policy and a disaster recovery plan for the retail shop.

Running head: ORGANIZATIONAL INFORMATION SECURITY RISKS AND POLICIES
ORGANIZATIONAL INFORMATION SECURITY RISKS AND POLICIES
Name of the student:
Name of the university:
Author note:

1
ORGANIZATIONAL INFORMATION SECURITY RISKS AND POLICIES
Executive summary:
Information security is one of the most important concerns of the companies in today’s world.
There are different kinds of issues that are being faced by the organizations regarding data theft
and security breach. Therefore, it is of utmost importance that the organizations come up with
innovative security policies, ensure that there is a proper data backup system, and risk
management strategy within the working operations. The following report will study the working
of a retail shop in East London, which uses an application called shopaholics, and study the
different threats related to the application. The paragraphs will highlight how the disaster
recovery can be carried out in the organization and the security systems can be designed keeping
in mind the recent DoS attack and virus infection issue faced by the retail shop. By the end of the
report, the reader will have a clear idea on the organizational security measures that can be
implemented within the organization.

2
ORGANIZATIONAL INFORMATION SECURITY RISKS AND POLICIES
Table of Contents
Introduction:....................................................................................................................................4
Potential risks for the shopaholic’s application:..............................................................................4
P1. IT industry risks:....................................................................................................................5
Data theft:....................................................................................................................................5
DOS attacks:................................................................................................................................5
Employee Vandalism:..................................................................................................................6
P2. Security measures needed for the retail shop:.......................................................................6
Setting strong passwords in the servers and workstations:......................................................6
Usage of strong enterprise antivirus programs and network firewalls:...................................6
Use of proper data back up and disaster management system:...............................................7
Risk assessment procedure for the retail shop:................................................................................7
P3. Potential impacts of incorrect firewall and VPN configuration:...............................................8
DMZ configuration:.....................................................................................................................9
Static IP configuration:..............................................................................................................10
Network address translation (NAT) configuration and its advantages:.....................................11
P5. Data protection procedures:.................................................................................................11
P6. Processes of data protection:...............................................................................................11
Organizational regulations:........................................................................................................12

3
ORGANIZATIONAL INFORMATION SECURITY RISKS AND POLICIES
Benefits of network monitoring systems:..................................................................................12
Improvement as well as identification of security threats:....................................................12
Easy upgrade of equipment’s:...............................................................................................12
Immediate returns of investments:.........................................................................................13
Trusted networks:......................................................................................................................13
ISO 31000 risk management methodology, purpose and scope:...................................................13
Security audits and its alignment with organizational policy for the retail shop:.....................14
P7. Proposed security policy:........................................................................................................15
A security council:.....................................................................................................................15
A real-time notification system for changes:.............................................................................15
P8. Disaster recovery (DR) plan:...................................................................................................15
Role of stakeholders in security audits:.........................................................................................16
Conclusion:....................................................................................................................................16
References:....................................................................................................................................17

4
ORGANIZATIONAL INFORMATION SECURITY RISKS AND POLICIES
Introduction:
Information security within the organizations is one of the most important concerns that
are being considered by the managers and the organizational leaders in today’s world. This
report will identify the security threats the different organizations. There is a retail shop in based
East London, which has come up with its shopping application known as shopaholics that can
ease the business-oriented tasks for the customers as well as the workers of the shop including
the partners and the stakeholders associated to the retail shop. Customers can now do online
shopping from the application. By the end of this report, the reader will understand the security
related issues faced by the application, which was connected to the internet1.
Potential risks for the shopaholic’s application:
The shopaholics application stores information online in using the software solution and
there are chances that the information is hacked since the hackers use advanced hacking tools to
breach the privacy of the network and access the databases. Recently the company had faced a
DoS attack, which causes disruption of normal business operation for long hours. The
application had also faced a major virus infection. Virus infection is again a very prominent risk
for the application as well as the company since it can cause potential tax frauds and other illegal
activities2.
1 Huth, Carly L., David W. Chadwick, William R. Claycomb, and Ilsun You. "Guest editorial: A brief
overview of data leakage and insider threats." Information Systems Frontiers 15, no. 1 (2013): 1-4.
2 Jouini, Mouna, Latifa Ben Arfa Rabai, and Anis Ben Aissa. "Classification of security threats in
information systems." Procedia Computer Science 32 (2014): 489-496.

5
ORGANIZATIONAL INFORMATION SECURITY RISKS AND POLICIES
P1. IT industry risks:
Data theft:
The hackers can use advanced techniques to break into the organizational networks, and
use the important financial data and the organizational tax sheets to do tax frauds and other
illegal activities or they can also in turn blackmail the company to pay them huge amounts of
money in order to prevent the misuse of the data3.
DOS attacks:
DoS attack which is distributed in nature is a denial of service that occurs when the
available bandwidth of the target system is flooded by requests from many systems at the same
time. It usually occurs in case of many web servers4. It is a form of cybercrime in which, the
penetrator makes a machine or another network resource unavailable to its intended users
temporarily or even permanently disrupting the services of the host connected to the network of
the internet. Recently there was a DoS attack in the retail shop of east London, wherein the
servers were down for 4 hours5. All the important tasks were halted and it caused many problems
for the customers as well as the shop authorities.
Employee Vandalism:
This occurs when the employees purposely cause corruption of the important data if they
have a revengeful mentality towards the fellow employees or even the organization as a whole
for their own personal interests6.
3
43Dover, Jeremy M. "A denial of service attack against the Open Floodlight SDN controller." Dover
Networks, Tech. Rep.(2013).
54 Hardy, Seth, Masashi Crete-Nishihata, Katharine Kleemola, Adam Senft, Byron Sonne, Greg Wiseman,
Phillipa Gill, and Ronald J. Deibert. "Targeted Threat Index: Characterizing and Quantifying Politically-
Motivated Targeted Malware." In USENIX Security Symposium, pp. 527-541. 2014.
65 Greenbaum, Rebecca L., Mary Bardes Mawritz, David M. Mayer, and Manuela Priesemuth. "To act out,
to withdraw, or to constructively resist? Employee reactions to supervisor abuse of customers and the
moderating role of employee moral identity." Human Relations 66, no. 7 (2013): 925-950.

6
ORGANIZATIONAL INFORMATION SECURITY RISKS AND POLICIES
P2. Security measures needed for the retail shop:
Setting strong passwords in the servers and workstations:
A strong password is a combination of uppercase as well as lower case alphabets,
numbers and symbols. No two computers within the shop should have the same password.
Setting up a strong password will ensure that employees cannot access each other’s computers as
well as the emails, which in turn can reduces data theft and issues like employee vandalism
within the retail shop.
Usage of strong enterprise antivirus programs and network firewalls:
There are different enterprise level antivirus software’s like the Kaspersky internet
security as well as the Norton antivirus program that are available for the corporates for securing
their organizational systems7.
Network firewalls should also be implemented in the local area networks (LAN) within
the shop to prevent the computer from opening up any kind of malicious website on the
computers. These attacks occurs when the packets are being routed from a particular routing
device located in the given network8. Unnecessary inbound traffic apart from the data related to
the shopaholic site, is blocked when the systems/servers remain connected to the VyprVPN
(Vypr virtual private network), thereby acting as firewall.
Use of proper data back up and disaster management system:
An efficient data backup cycle will ensure that even if there are any kinds of unforeseen
situations of data insecurity, there are no troubles and the data is retained safe. There should be
centralized servers that should store all the information of the customers as well as the
76 Zhang-Kennedy, Leah, Sonia Chiasson, and Robert Biddle. "Stop clicking on “update later”: Persuading
users they need up-to-date antivirus protection." In International Conference on Persuasive Technology,
pp. 302-322. Springer, Cham, 2014.
87 Sood, Aditya K., and Richard J. Enbody. "Targeted cyberattacks: a superset of advanced persistent
threats." IEEE security & privacy 11, no. 1 (2013): 54-61.

7
ORGANIZATIONAL INFORMATION SECURITY RISKS AND POLICIES
management and operations information of the shopaholic’s application thereby reducing the risk
of data loss and misuse in case of accidents and server breakdowns9.
The employees should also be adequately trained so that in case of any such unforeseen
conditions the employees are efficient enough to handle the recovery tools10.
P3. Potential impacts of incorrect firewall and VPN configuration:
If the private and secure connection is not completed successfully, secure data
transmission between the source and the destination is not possible. There are different kinds of
security implications for VPNs configures in transport and the tunnel mode. Considering the case
of the classic client-based Internet Protocol sec VPN, there are two parties of each VPN
connections: the VPN client and the VPN gateway. Manipulation proposals of Phase 1 and/or
Phase 2 in the IPsec connection can cause security compromises, if VPN is not configures
properly11.
Another threat of incorrect VPN configuration is that when the users change the client
parameters like the pre-shared key values. The key value is generally unknown to the user and
the client will therefore not be able to establish a valid VPN connection. Therefore, in order to
make it work again the user will try to obtain the exact VPN configuration. In the process of
transmission of the important security value (key value) security breaches can occur.
DMZ configuration:
The steps to set up a DMZ on a network are explained below:
98 Van De Walle, Bartel, Murray Turoff, and Starr Roxanne Hiltz. Information systems for emergency
management, 2014.
109 Jehanzeb, Khawaja, and Nadeem Ahmed Bashir. "Training and development program and its benefits
to employee and organization: A conceptual study." European Journal of business and management 5,
no. 2 (2013).
1110 Kumar, KM Sumesh, and Kinn Abass Bakon. "The Analysis of Firewall and VPN in Enterprise Network
Performances."

8
ORGANIZATIONAL INFORMATION SECURITY RISKS AND POLICIES
1. A web browser has to be launched from the smartphone or the computer, which is already
connected to the network of the router.
2. The default username and password is admin and password respectively.
3. Under the ADVANCED option >select “Setup” > then select “LAN Setup”.
4. The Default DMZ check box of the Server has to be selected.
5. The IP address has to be manually typed12.
6. Click on apply.
P4. Advantages of DMZ in network security:
Adding a DMZ provides a “quarantined” network area in case of a virus attack or an
intrusion that attacks only part of the network and the rest of the network remains unaffected,
thereby allowing the affected network area to be partitioned from the rest of the working
network.
1211 Dart, Eli, Lauren Rotman, Brian Tierney, Mary Hester, and Jason Zurawski. "The science dmz: A
network design pattern for data-intensive science." Scientific Programming 22, no. 2 (2014): 173-185.

9
ORGANIZATIONAL INFORMATION SECURITY RISKS AND POLICIES
Fig 1: Working of a DMZ network (Source: As used by the author).
Static IP configuration:
A static (IP) address or Internet Protocol address is useful for gaming, Voice over
Internet Protocol services as well as website hosting. The different steps to implement static IP
address in the network are explained below:
1. Click on the Start Menu >go to Control Panel > Open network and sharing Center.
2. Click on “Change adapter settings”.
3. Right-click on the option ‘Local Area Connection” and then click on Properties.
4. Select the option “Internet Protocol Version 4” or (TCP/IPv4) and then click the
Properties option.

10
ORGANIZATIONAL INFORMATION SECURITY RISKS AND POLICIES
5. Select "Use the following IP address" option and then the IP address, Default Gateway as
well as the DNS server subnet mask should be entered13. Then click on Ok and close the
dialog box.
Network address translation (NAT) configuration and its advantages:
Network Address Translation or NAT helps in protecting the identity of the internal
network and no internal IP addresses re being exposed in the internet. Therefore, it can protect
the data of the retail shop in East London from being attacked by the hackers 14. Firstly, it hides
the IP addresses of any devices on the organizational network from the outside world, giving
them all a single address. Secondly, the incoming traffic (packets) are only allowed by the
network of the retail shop if it has been requested by any of the computers, else not.
P5. Data protection procedures:
A procedure wherein an administrator should be appointed who will handle all the
incoming requests from the employees regarding accessing data from the systems. The
administrator will also be responsible for assigning priority levels to the employees. Stringent
internet policies should also be implemented within the organizations to ensure it is not misused
for any kind of data misuse.
Risk assessment procedure for the retail shop:
Three most important question s have to be answered in order to develop a proper
procedure to reduce the IT data risks within the retails hosp. Those questions are: which is the
risk that has to be addressed on a priority basis? Is the most cost effecting way been used to
reduce it?. Since the company has recently faced issues like DoS attacks and virus infections, it
1312 Piyare, Rajeev. "Internet of things: ubiquitous home control and monitoring system using android
based smart phone." International Journal of Internet of Things 2, no. 1 (2013): 5-11.
1413 Troan, Ole, David Miles, Satoru Matsushima, Tadahisa Okimoto, and Dan Wing. Ipv6 multihoming
without network address translation. No. RFC 7157. 2014.

11
ORGANIZATIONAL INFORMATION SECURITY RISKS AND POLICIES
is of utmost priority that it secures the servers from DoS attacks and starts using proper antivirus
software’s as well as firewall in order to efficiently secure all the organizational workstations
from any kind of data theft or misuse by the intruders. Enterprise antivirus software’s such as
Norton as well as Kaspersky software’s can be used to run regular and routines scans
mandatorily on the all the computers.
In case of qualitative risk analysis, the risks faced by the organizations are first identified
such as data theft, virus infections. Alter the risks have been identified the mitigation techniques
such as installing antivirus programs as well as network firewalls are implemented in order to
overcome such risks. A detailed qualitative study about the nature of the threats is carried out.
Quantitative risk analysis is done only on a set of potential threats that have been
identified to be the most dangerous risks and have to be mitigated on the highest priority base
done the results from the qualitative study of the risks. This analysis is only performed on risks,
which are marked for further analysis by Perform Qualitative Risk Analysis process.
ISO 31000 risk management methodology, purpose and scope:
The different risks in terms of data security and other risks faced by the retail shop in
East London can have multiple effects in terms of its professional performance as well as
economic reputation. Other risks in terms of its social, environmental as well as safety measures
can have long-term negative outcomes on the working of the organization. Therefore, a proper
risk management methodology is needed for the retail shop to ensure its smooth functioning in
the future.

12
ORGANIZATIONAL INFORMATION SECURITY RISKS AND POLICIES
The purpose of the the ISO 31000:2018 is to provide the principles, process as well as the
framework for managing the organizational risks. Its purpose is to integrate the risk management
into a more strategic as well as operational system of management 15.
The scope says that the objectives can be better achieved and opportunities as well as
threats can be better identified using this risk management methodology. Proper risk assessment
benchmarks can be set using this methodology and can be effectively used within the retail
shop16.
P6. Processes of data protection:
A procedure wherein an administrator should be appointed who will handle all the
incoming requests from the employees and will also be responsible for assigning priority levels
to the employees. Stringent internet policies should also be implemented within the organizations
to ensure it is not misused for any kind of data misuse. Personal data is data related to any
human, which can be used to identify an individual.
Role of data protection and data protection principles:
Organizational data is extremely important and it should be protected from any kind of
security breaches form the hackers since they can cause tax frauds as well as manipulate
important data of the organizations. Hackers can corrupt important data to cause loss and other
harmful effects for the business as well as claim money through ransom ware attacks. Hacker can
also blackmail the organizations in different ways once their data has been stolen or
compromised.
The six GDPR principles for data protection are explained below:
1516 Olechowski, Alison, Josef Oehmen, W. Seering, and M. Ben-Daya. "The professionalization of risk
management: What role can the ISO 31000 risk management principles play?." International Journal of
Project Management 34, no. 8 (2016): 1568-1578.
1617 Sadgrove, Kit. The complete guide to business risk management, 2016.

13
ORGANIZATIONAL INFORMATION SECURITY RISKS AND POLICIES
- Lawfulness, fairness as well as transparency in processing and using data.
- Purpose of accessing data should only be for the legitimate and necessary reasons used
for taking important business decisions.
- Usage of minimum data only according to the needs.
- Accuracy should be maintained in logging details of the organizational data.
- Storage should be minimized to ensure increased bandwidth and better utilization of the
available resources.
- Integrity and confidentiality should be maintained by the employees in storing data.
Benefits of network monitoring systems:
Improvement as well as identification of security threats:
Security threats are identified much in advance if the activities occurring in the network
devices re monitored and kept under a check. For example, the NAT firewalls help in managing
the inflowing traffic into the network therefore proactively checking for unwanted traffic and
possible malicious attacks on the hosts.
Easy upgrade of equipment’s:
Whenever there is a technology or even a hardware, upgrade within the organization the
network monitoring devices can be easily upgraded within the network since the IP addresses
remain unchanged therefore they can be easily integrated into the newer systems. Dynamic host
control protocol or DHCP can be used in order to automatically assign the IP address to the new
computers in the network.
Immediate returns of investments:
By investing on these systems and technologies there is immediate effect on the overall
security of the information that is distributed over the network and data can be stored on the

14
ORGANIZATIONAL INFORMATION SECURITY RISKS AND POLICIES
network servers. Investments in the monitoring tools such as NAT as well as other antivirus and
firewall software’s can not only help in protecting the data but also ensure better disaster
recovery mechanisms within the retails outlet17.
Trusted networks:
Trusted Networks are under the direct control of the control of network administrator and
it enhances the network security. It can be said that these networks are defined under the
perimeters of optimum network security18.
For environments that use more than one servers user ID authentication is already done
by the use of a server where user IDs are already authenticated by a server which are then
asserted on a metadata server using a trusted connection. Peer session trusted network or
connections are used to achieve this. User ID’s within the East London retail company do not
need to have a separate account on the SAS server storing the metadata thereby making the
authentication process simpler and easy to use.
Security audits and its alignment with organizational policy for the retail shop:
Internal audits in organizational data security can help the retail shop to keep their
security policies as well as the compliance programs updated and the strategies can be aimed at
the right direction. Security breaches can be prevented and the effect of breaches that has already
occurred can be controlled and managed using a proper audit policy. This in turn will help
prevent defamation of the brand name of the retail shop and will prevent the company from
being in an ethically answerable situation in the future19.
1714 Hou, Kewei, Chen Xue, and Lu Zhang. "Digesting anomalies: An investment approach." The Review
of Financial Studies 28, no. 3 (2015): 650-705.
1815 Karatzogianni, Athina, and Martin Gak. "Hack or be hacked: The quasi-totalitarianism of global trusted
networks." New Formations 84, no. 84-85 (2015): 130-147.
1918 Accorsi, Rafael, Thomas Stocker, and Günter Müller. "On the exploitation of process mining for
security audits: the process discovery case." In Proceedings of the 28th Annual ACM Symposium on
Applied Computing, pp. 1462-1468. ACM, 2013.

15
ORGANIZATIONAL INFORMATION SECURITY RISKS AND POLICIES
For the retail shop that is being studied in this report, it should be ensured that all the
customers’ personal information like their names, phone numbers, email as well as physical
addresses should be stored securely. Online servers and databases should be used to store the
data where all the important data should be stored in an encrypted format to ensure data security.
This will not only help the shop to gain the trust of the customers but will also help in improving
their satisfaction. In addition, acts of employee vandalism can be prevented to ensure there is no
mismatch of data or corruption of data to ensure the product information databases remain
updated20.
P7. Proposed security policy:
A proper security policy within the retail shop will define the guidelines as well as the
procedures that the shop employees are expected to comply with in order to achieve some
common security goals. Some of the inclusions of the security policy are explained below:
A security council:
This will include security personnel such as the chief security officer, the
information security officer who will be responsible for taking all important decisions related to
the electronic data as well as physical security of the shop21.
A real-time notification system for changes:
A computerized automatic notification systems should be incorporated within the shop
that will immediately raise alarms or notify the security personnel regarding any changes in the
shop.
2019 Soin, Kim, and Paul Collier. "Risk and risk management in management accounting and control."
(2013): 82-87.
2120 Wood, Michael. "The Interpretation of Security Council Resolutions, Revisited." Max Planck Yearbook
of United Nations Law Online 20, no. 1 (2017): 1-35.

16
ORGANIZATIONAL INFORMATION SECURITY RISKS AND POLICIES
P8. Disaster recovery (DR) plan:
A disaster recovery plan can be designed for the retail shop, which will have a proper
data backup system such that there are regular back up cycles of data. Data backup cycles should
be such that one in the day and one in the midnight in periodic intervals so that all the
information are backed up in the cloud servers. Necessary cash or other resources should be
gathered as required as per the situation22. The necessary personnel should be immediately
informed within the shop using automated notification systems and applications.
Role of stakeholders in security audits:
Stakeholders are the investors whose actions usually define the business outcome for the
shop and do not necessarily have to be equity shareholders23. It is extremely important for them
to take part in the internal security audit of the shop since their business decisions. Their actions
indirectly affect the outcome of the shop business24. Employee vandalism can be prevented in the
same way.
Conclusion:
Therefore, it can be concluded for the above paragraphs that even though the shop is
growing in its business and has immense potential to capture the market in the future there are
still different areas of improvement that the retail shop can focus on. There are different security
related issues that still exist in the company such as DoS attack and virus infections through
email that has to be well addressed to prevent future security issues and ensure a smooth
2221 Wallace, Michael, and Lawrence Webber. The disaster recovery handbook: A step-by-step plan to
ensure business continuity and protect vital operations, facilities, and assets. Amacom, 2017.
2322 Bachlechner, Daniel, Stefan Thalmann, and Ronald Maier. "Security and compliance challenges in
complex IT outsourcing arrangements: A multi-stakeholder perspective." Computers & Security 40 (2014):
38-59.
2423 Ahmad, Atif, Sean B. Maynard, and Graeme Shanks. "A case analysis of information systems and
security incident responses." International Journal of Information Management35, no. 6 (2015): 717-723.

17
ORGANIZATIONAL INFORMATION SECURITY RISKS AND POLICIES
functioning of the shop management. Proper antivirus software’s should be installed in all the
systems.

18
ORGANIZATIONAL INFORMATION SECURITY RISKS AND POLICIES
References:
Accorsi, Rafael, Thomas Stocker, and Günter Müller. "On the exploitation of process mining for
security audits: the process discovery case." In Proceedings of the 28th Annual ACM Symposium
on Applied Computing, pp. 1462-1468. ACM, 2013.
Ahmad, Atif, Sean B. Maynard, and Graeme Shanks. "A case analysis of information systems
and security incident responses." International Journal of Information Management35, no. 6
(2015): 717-723.
Bachlechner, Daniel, Stefan Thalmann, and Ronald Maier. "Security and compliance challenges
in complex IT outsourcing arrangements: A multi-stakeholder perspective." Computers &
Security 40 (2014): 38-59.
Dart, Eli, Lauren Rotman, Brian Tierney, Mary Hester, and Jason Zurawski. "The science dmz:
A network design pattern for data-intensive science." Scientific Programming 22, no. 2 (2014):
173-185.
Dover, Jeremy M. "A denial of service attack against the Open Floodlight SDN
controller." Dover Networks, Tech. Rep.(2013).
Greenbaum, Rebecca L., Mary Bardes Mawritz, David M. Mayer, and Manuela Priesemuth. "To
act out, to withdraw, or to constructively resist? Employee reactions to supervisor abuse of
customers and the moderating role of employee moral identity." Human Relations 66, no. 7
(2013): 925-950.
Hardy, Seth, Masashi Crete-Nishihata, Katharine Kleemola, Adam Senft, Byron Sonne, Greg
Wiseman, Phillipa Gill, and Ronald J. Deibert. "Targeted Threat Index: Characterizing and

19
ORGANIZATIONAL INFORMATION SECURITY RISKS AND POLICIES
Quantifying Politically-Motivated Targeted Malware." In USENIX Security Symposium, pp. 527-
541. 2014.
Hou, Kewei, Chen Xue, and Lu Zhang. "Digesting anomalies: An investment approach." The
Review of Financial Studies 28, no. 3 (2015): 650-705.
Hu, Hongxin, Wonkyu Han, Gail-Joon Ahn, and Ziming Zhao. "FLOWGUARD: building robust
firewalls for software-defined networks." In Proceedings of the third workshop on Hot topics in
software defined networking, pp. 97-102. ACM, 2014.
Huth, Carly L., David W. Chadwick, William R. Claycomb, and Ilsun You. "Guest editorial: A
brief overview of data leakage and insider threats." Information Systems Frontiers 15, no. 1
(2013): 1-4.
Jehanzeb, Khawaja, and Nadeem Ahmed Bashir. "Training and development program and its
benefits to employee and organization: A conceptual study." European Journal of business and
management 5, no. 2 (2013).
Karatzogianni, Athina, and Martin Gak. "Hack or be hacked: The quasi-totalitarianism of global
trusted networks." New Formations 84, no. 84-85 (2015): 130-147
Kumar, KM Sumesh, and Kinn Abass Bakon. "The Analysis of Firewall and VPN in Enterprise
Network Performances."
Lee, Martin, and Darren Lewis. "Clustering disparate attacks: mapping the activities of the
advanced persistent threat." Last accessed June 26 (2013).
Olechowski, Alison, Josef Oehmen, W. Seering, and M. Ben-Daya. "The professionalization of
risk management: What role can the ISO 31000 risk management principles
play?." International Journal of Project Management 34, no. 8 (2016): 1568-1578.

20
ORGANIZATIONAL INFORMATION SECURITY RISKS AND POLICIES
Piyare, Rajeev. "Internet of things: ubiquitous home control and monitoring system using
android based smart phone." International Journal of Internet of Things 2, no. 1 (2013): 5-11.
Sadgrove, Kit. The complete guide to business risk management, 2016.
Soin, Kim, and Paul Collier. "Risk and risk management in management accounting and
control." (2013): 82-87.
Sood, Aditya K., and Richard J. Enbody. "Targeted cyberattacks: a superset of advanced
persistent threats." IEEE security & privacy 11, no. 1 (2013): 54-61.
Troan, Ole, David Miles, Satoru Matsushima, Tadahisa Okimoto, and Dan Wing. Ipv6
multihoming without network address translation. No. RFC 7157. 2014.
Van De Walle, Bartel, Murray Turoff, and Starr Roxanne Hiltz. Information systems for
emergency management. 2014.
Wallace, Michael, and Lawrence Webber. The disaster recovery handbook: A step-by-step plan
to ensure business continuity and protect vital operations, facilities, and assets. Amacom, 2017.
Wood, Michael. "The Interpretation of Security Council Resolutions, Revisited." Max Planck
Yearbook of United Nations Law Online 20, no. 1 (2017): 1-35
Zhang-Kennedy, Leah, Sonia Chiasson, and Robert Biddle. "Stop clicking on “update later”:
Persuading users they need up-to-date antivirus protection." In International Conference on
Persuasive Technology, pp. 302-322. Springer, Cham, 2014.