Principles of Security

This document discusses the importance of security in a company and the need to implement robust security protocols to protect against cybersecurity threats. It covers topics such as vulnerability assessment, risk management, weighted factor analysis technique, risk register, and risk control strategies.

Principles of Security
By
Name of Student
Name of Supervisor
Course Affiliated
Date

2
Executive summary
The success of a company depends mostly on the role played by the management. A strong
management team will ensure all workers work accordingly through regular consultation with
staffs. Another critical issue is security issues in the Company, securing the Company data
protocol is essential. The company competitors should not access the company policy and
strategies at any cost. It is necessary for companies to install robust security protocols to
safeguard the company system from cybersecurity threats and other malware that may make the
company lost a lot of resources and customers in the process.

3
Table of Contents
Executive summary 2
Introduction 4
Weighted Factor Analysis Technique5
Risk register 7
Control strategy 9
Summary 11
Reference ………..………………………………………………………………………………12

4
Introduction
Vulnerability is the ability of the company to assess the working environment in terms of work
delivery and profits. It is essential for Companies to identify the weakness and the strength of the
company daily (Gaillard, 2010:2018). Adopting new technology might be a challenge for most
organizations. For this case study, the Company experience with security threats. With a
dynamic increase of clients, the company faces the risks of system failure as a result of the large
number of customers which the company can face a challenge to maintain them. Acquiring
service from other companies to help the company operate is also a risk due to poor control
measure set by the company. The competing company can obtain vital information from the
company and start their branch; this is a significant risk to the survival of the company. There is
no explicit partnership agreement that the company is making with the services providers.
Another threat the company faces is making losses as the company cannot establish a transparent
payment system. Making unclear payment can lead to corruptions and dissatisfaction among the
workers which can lead to a poor working environment (Stephenson, 2010:25).
Another vulnerable risk established is that the company poor management (Kusiak, 2018:408).
Most workers don’t know what they are doing in the company yet they are being paid. It is clear
that most workers don’t have the skills to work in the company; thus they don’t take an active
involvement in the running of the business. The company has failed to provide a clear role that
each in the company is supposed to do. There is poor integration of the Company database that
will control all the company process; with an overwhelming increase in the number of customers
the system could not manage all clients well.

5
Some of the threats most Company experience is the cybersecurity issues; this mostly happens
when the company system hankers due to secure leakage. Hacking the Company system is a big
challenge as most companies end up losing a lot of funds in the process. Another threat is
competitions, due to high competitions from emerging business; many companies close down
within a short time of operation. The powerful technology has become a threat to business as
some companies fail to adapt to new technology hence ending up closing down in the long run.
Other risks include the system opens to get to malware, whereby the viruses enter the companies
system. Corporate secrets revealed the vulnerability of business accounts associates, indirect
financial losses among other threads that hinder the Company performance (Jansen, 2010).

6
Weighted Factor Analysis Technique
According Francis (2011), risk management involves identifying any potential risk in the
company, analyzing those risks and taking firm precautions against them to ensure the survival
of the business. The risks can be internal or external sources it can be associated with legal issues
or mostly financial matters that pose a challenge to the growth of the business. Quantitative risk
management involves converting the impacts of risk on the market into numerical terms assessed
and analyzed. Weighted factors analysis is the approach followed by experts in identifying
problems, evaluating them and manipulating the knowledge for a problem in terms of high and
strategic levels (Breiman, 2017:456).
This technique most is used to evaluate the alternative by comparing the percentage score of the
items into consideration against the criteria which weighted in reflecting the importance of the
final decision. The technique allows the procurement of essential assets and ensures the
transparent and right decision made in the time of resources allocations (Morrow, 2012).
The table below illustrates how the weighted appears all the factors that are considered affect the
company operation is reviewed and analyzed another of time to obtain appropriate value from
varies outcomes. When finding the means, each number multiplies by its weight; weighted
scores are added together then multiply by 100 to get the percentage. The percentage should add
up to 100. This technique is used to reduce the number of variables to a fewer number of factors.
It obtains a maximum common variance from the available variable and arranges the
performance for the standard score. In identifying the assets, the following procedure followed.
As per Cattell (2012), the first step is establishing the context of the risk which involves
analyzing the situation of the business, the problem, weakness, and strengths. The next step

7
consists of identifying all the risk the company may experience at that particle moment all risk is
list in order of agency or weight. The other step is analyzing the uncertainty in both the negative
side part and a crucial part. After analyzing the next step is evaluating the test how can the risk
be handle without affecting the business structure and policy. Treating the risk is the next step
after analyzing and finding the best solution; it is time to act. The next step involves monitoring
the chance to ensure that the risk does not hurt the running of the business (Priest, 2012). The last
step is making communication and consultations with all stakeholders involved to ensure that all
parties are informed. The table below is an example of a weighted factor technique used to
analyze the company performance

8
Criteria 1:
impact to
revenue
Criteria 2:
Impact to
profitability
Criteria 3:
Impact to
public image
criteria Weight score A B C
Value 20% 80 45 40
Risk 20% 60 85 30
Difficulty 15% 55 80 50
success 10% 80 60 55
Compliance 5% 35 50 60
Relationship 5% 80 70 50
Stakeholder 15% 25 50 45
Urgency 100% 60 25 40
Weighted
score
100% 54.0 60.0 43.3

9
Risk register
Risk registers a record of keeping items in the proper order by company objectives (Hillson,
2013: 23). The document prepared in order of the agency or the most demanding item, or need
should come top on of the list ending with those which are of least priorities. In creating the
registry, the following step is necessary is essential to follow to obtain the best risk register for
any business. The first step is risk identification; identifying all items or tool that needs an agent
in the registry is essential. The next step is to describe the risk; it is critical to inform the
stakeholder about the process. The size of the risk always depends on the complexity of the
company or the project priorities. It is essential to list all part to ensure a strong foundation in
finding the solution (Hopkinson, 2017:22).
The next step is stating the impact that the risk posed to the progress of the business. The risk
positive or negative impact on the growth of the market, but mostly it affects business
performance (Taroun, 2014:101). After identifying the result the next step is to identify the
source of the risk or the ownership. The last thing is taking notes; taking key point will act as a
reminder on how to identify risk and solved it happens again in the future. The table below
illustrates how some of the risk where identify in the company. Having a clear outline provide a
systematic procedure to handle uncertainty in an effective manner where both sides will be
satisfied. Following all the risk management process will help the company achieve its objective
in the most effective way using minimum cost.

10
Ris
k
ID
Risk Name Description Risk
Category
Right
Type
Probabil
ity
Impa
ct
Risk
score
001 Upgrading
database server
DB server to be
upgrade to latest
version
technical threat 2 3 6
002 Delivery
overrun driver
module
Driver is complex
and that lead to
overrun
schedule threat 3 4 12
003 Need of
separate
automation
Automation of
software is needed
to be stable
Cost threat 3 3 9
004 Resume of
middleware
framework
Middleware
developed by
framework team
technical opportunit
y
2 4 8
005 Availability of
experts
Senior designer to
develop on front
end design
Resource threat 3 3 9

11
Risk control strategies
Risk control strategies refer to the defensive measures employed by IT experts to manage risks
and vulnerabilities in organizations. Risk assessment is a primary measure used to identify and
determine threats and vulnerabilities. A risk control strategy that is effective follows certain
mechanisms and control measures. The company should institute appropriate measures to control
the identified risks. When implementing a risk control strategy, hierarchy control with a set of
prioritized risk control measures is needed. Some of the hierarchy control measures include;
elimination of any recorded risk (Rossing, 2013:175). This means that the company should get
rid of the risk such as not allowing employees to take company devices out of the premises
without any permission from the authorities. Another one is controlling the risk at source for
instance in Game World company they had a problem with setting up safe communication with
their customers; the company should create safer ways and means of relating with their
customers globally. Also, minimize the risk by educating the employees on their job
responsibilities, provide for personal protective equipment’s and lastly instituting a programmer
to monitor the risks to which employees may be involved or exposed. One of the essential
aspects of the hierarchy of control is to develop a program to monitor the risks and design a
programmer to provide regular feedback to the relevant risk committee (Weber, 2010:1849).
Some of the risk control strategies that the company should adopt are risk dissection. It means
that the company should analyze the identified risks and learn more about the probabilities of
those risks and look for ways of preventing them (Boudreau, 2010). Dissecting dangers means
identifying the risks in the company whether they are financial, strategic or environmental risks.
The company management should set up clear job responsibilities for every employee in the
company because employees do not have clear roles which are a challenge to database integrity.

12
Another control strategy is risk budgeting and financing. The most significant risk a company
might face is a financial risk, and this means funding and budgeting for the risks is an essential
risk control strategy. The company is working on a limited budget which is a challenge because
they would like to optimize their security threat approach. Security is a crucial matter especially
when it comes to internet security, and therefore, the company should provide enough resources
to the security matter for the company to perform well and gain the trust of their clients. With the
increased security threats, the company should update their software regularly to prevent hackers
from exploiting their weaknesses (Sheehan, 2010:25).
Risk control is another strategy that involves managing the risks and taking necessary measures
to reduce the identified risks. Applying these steps and rules minimize those risks from
occurring. The company should not allow its employees to take the company devices out of the
premises because it can lead to damage or even loss of those devices.
Adopting Avoidance strategy is an effective way of controlling risks. When the company keeps
off from associating with risk activities, it reduces losses that the business my experience. It may
seem not an affecting way in handling things in a competitive environment but it appropriate to a
company that is the process of establishing itself to the business world. In assessing activities
that the business must avoid the following must be put in place to ensure no interference with the
business progress. One, the event is seen as beyond business control not accepted by business
policy, the exercises involve large fund that will cost the company, and the operation is assumed
to be dangerous which could affect the business strategy. Avoidance comes with the risk of the
business losing customers and partnership, but it could be necessary to secure the business
(Lloret, 2016:418).

13
Another strategy is the termination of the risk. One of the essential ways to control risk is to
terminate the activity that is associated with the threat. The company should remove the server
from the network since it has determined that the resources are more than the benefits. In cases
where the company continues to make permanent losses, the management may opt to dissolve
the business. No company tolerates losses; hence I could be appropriate the best way terminate
the market at an early stage of failures to avoid misunderstanding and incurring debts.
Duplication of resources is another strategy that will save the company from unexpected
misfortune like huge debts and permanent losses (Hammes, 2012:75). This strategy involves
having a backup’s facilities or plans in cases of unforeseen situations that interrupt the flow of
the business. The companies should always have robust policies in place to act in cases where
competition is high making the industry to change its line of operation. Another backup’s
procedure is involved in the process of security failure. The company should have a standby
system to act in case the primary system fails to work. When the company security protocol fails,
there should be an alternative means of ensuring the Company database is secured (Yinghong,
2010: 115).

14
Summary
Data security in most organizations has become a challenge nowadays. With new technology and
competitions, experts have developed a system to try and secure the data from vulnerability.
Leaking the company information to competitors is a big problem that may lead to the company
closing down. Cybersecurity issues have become a significant challenge to the progress of the
company. The companies are a force to use firewalls and other encryption methods to ensure the
data security is guaranteed. Installing back up security measure is also another measure that most
companies are using to ensure the flow of activities is not interrupted. The major challenge that
is affecting businesses is the issue of cyber security which remains to pose challenges to the
success of the business. The company also needs to have an organized environment where all
staffs know their roles no workers remain ideal. The employment of staff should base on the
skills obtained. Employing experts will assist most organizations in solving internal problems
like a system failure. Having active management is also vital in ensuring all staff is participating
actively in safeguarding the company reputations.

15
References
Boudreau, K., 2010. Open platform strategies and innovation: Granting access vs. devolving
control. Management science, 56(10), pp.1849-1872.
Breiman, L., 2017. Classification and regression trees. Routledge.
Cattell, R. ed., 2012. The scientific use of factor analysis in behavioral and life sciences.
Springer Science & Business Media.
Francis, R.C., 2011. Data weighting in statistical fisheries stock assessment models. Canadian
Journal of Fisheries and Aquatic Sciences, 68(6), pp.1124-1138.
Gaillard, J.C., 2010. Vulnerability, capacity and resilience: perspectives for climate and
development policy. Journal of International Development: The Journal of the Development
Studies Association, 22(2), pp.218-232.
Hammes, T.X., 2012, June. Offshore control: a proposed strategy for an unlikely conflict.
In Strategic Forum (No. 278, p. 1). National Defense University Press.
Hillson, D., 2013. Implicit and explicit risk management. PM World Journal, p.1.
Hopkinson, M., 2017. The project risk maturity model: Measuring and improving risk
management capability. Routledge.
Jansen, W., 2010. Directions in security metrics research. Diane Publishing.
Kusiak, A., 2018. Smart manufacturing. International Journal of Production Research, 56(1-2),
pp.508-517.

16
Lloret, A., 2016. Modeling corporate sustainability strategy. Journal of Business
Research, 69(2), pp.418-425.
Morrow, B., 2012. BYOD security challenges: control and protect your most sensitive
data. Network Security, 2012(12), pp.5-8.
Priest, S.D., 2012. Discontinuity analysis for rock engineering. Springer Science & Business
Media.
Rossing, C.P., 2013. Tax strategy control: The case of transfer pricing tax risk
management. Management Accounting Research, 24(2), pp.175-194.
Sheehan, N.T., 2010. A risk-based approach to strategy execution. Journal of business
strategy, 31(5), pp.25-37.
Stephenson, A.V., 2010. Benchmarking the resilience of organisations.
Taroun, A., 2014. Towards a better modelling and assessment of construction risk: Insights from
a literature review. International journal of Project management, 32(1), pp.101-115.
Weber, R.H., 2010. Internet of Things–New security and privacy challenges. Computer law &
security review, 26(1), pp.23-30.
Yinghong, Z., 2010. An empirical study on moderating role of environment dynamism on
relationship of entrepreneurial strategy and performance [j]. China Industrial Economics, 1,
pp.105-114.