Security Management

This document discusses the defense in depth approach in physical security and its importance. It explains how to incorporate this approach into a protection plan to ensure facility safety. The document also covers additional security barriers and steps to develop a business continuity plan.

Running head: SECURITY MANAGEMENT
SECURITY MANAGEMENT
Name of the student:
Name of the university:
Author Note:

1SECURITY MANAGEMENT
Question 1
Fully explain the defense in depth approach and why is it important in physical security?
Lastly, how would you incorporate this into a protection plan to keep your (or another)
facility safe?
The defense in depth approach is stated to be the coordinated usage of the various
security countermeasures that tends to protect the integrity regarding the assets of the
information within an enterprise. This is an effective strategy, which is developed based on
military principles (Smith & Brooks, 2012). This also adheres difficulties regarding an enemy
for defeating a complex as well as multi-layered defense system, which tends to penetrate an
individual barrier.
This approach intends to minimize the relative probability regarding the success of the
malicious hackers to restrict them to hack anyone’s computer that consists important as well
as necessary data that could be vulnerable if accessed by hackers. An effective and properly
designed strategy for the defense in depth mechanism is set to provide benefit to the
administrators of the system as well as personals associated with the organization’s network
security tends to identify the persons who ever makes an unethical attempt regarding the
compromise the data present within the server systems, computer systems as well ISP or
Internet Service Providers within the organization. If in this context, a hacker without any
restriction gains access to the computer systems within any organization the approach of the
defense in the depth tends to minimize the adverse impacts that can persist with the secure
data (Jordan, Jordan & Ruddell, 2018). Moreover, this also tends to provide the
administrators as well as the time of the engineers for the deployment if the new as well as
updated countermeasures in respect to prevent the recurrence of this type of attacks.

2SECURITY MANAGEMENT
The major components that comprises of the defense in depth mechanisms includes
the presence of antivirus software, the anti-spyware softwares, network firewall, strong
hierarchical passwords and many more. In addition to this electronic form of
countermeasures, there is also a need for the physical business protection methodologies that
should be provided within the organization (Levillain, Gourdin & Debar, 2015). This
physical protection includes the ethical training methodologies that enhances the security of
the important data and restricts them from vulnerable threats such as data compromise,
destruction as well as theft from the data hackers.
In order to keep the present data within the organization to be safe the most efficient
and strategic methodology of the defense in depth system is to be adhered by the
organization. This tends to provide the enhanced amount of security of the data within the
organizational premises and thus provides the data to be safe. In order to implement the
defense in depth methodology within the organizational premises as well as in the network
server the areas are to be decided on which the organization possess the most important
amount of data that will enhance the organization’s success (Yadav, Verma & Solanki, 2019).
The organization must tend to implement the security of the defense in depth with the help of
the mechanism as stated above. This will effectively provide an enhanced level of security to
the various sectors of the data that are present within the overall environment of the selected
organization.

3SECURITY MANAGEMENT
Question 2
As a security manager for your facility, you have been given the duty to add additional
security barriers at your facility. Which barriers would you incorporate and what factors
would you use in your decision-making process? Explain in detail.
As a manager of the security regarding the facility within an organization the
additional features that I would like to implement the below stated features within the
environment of the network servers for the security of the data or information present within
it.
Firstly, the feature that I would like to implement for the enhancement of the network
security is depicted as the Fencing, which falls under the physical security program. This
defines a particular area, which includes the installation of the military security features thus
providing the legal intent of evidences (van Staalduinen & Khan, 2015). This holds the
necessary information as well as the necessary security measures that are required for
maintain the security of the overall data or information associated with the organization.
Moreover, the best approach related with the fencing methodology deals with the chain link
fencing that provides enhanced level of security for the necessary data or information within
the environment of the organization.
Secondly, the security measure that will be tried by me for maintaining the security of
the information within the overall organization is stated to be as Lighting. This approach is
mainly used for several purposes within the physical security program. This tends to defer
unauthorized as well as unethical entry within the network premises regarding the hackers
who may try to breach the security measures and try to gain access to the information of the
organization (Zakariya & Kahn, 2015). A well designed as well as properly installed lighting
system mainly helps the organization to allow the forces of security for the detection of the

4SECURITY MANAGEMENT
intruders beforehand they can achieve their set target. This will help the restriction of the
unethical intrusion of the people thus maintaining the security of the organization.
Thirdly, the implementation of the Closed Circuit Television within the security
premises of the organization can be depicted as the most important and significant step that
will help the maintenance of the security of the overall network area (Song, Khan & Yang,
2018). The information captured within the CCTV can help the organisation to maintain a
track of the overall activity of the network servers as well as the employees that are working
within the network environment of the organization.
Thus from the above depicted steps it can be well adhered that these barriers will
provide an additional level of security within the network premises of the facility that I will
be maintaining (Praus, Kastner& Palensky, 2016). Moreover, these stated steps may provide
a detailed as well as continued track of the overall data or information that are being present
within the environment of the organization which will further tend to keep the data or
information safe which are mainly used in the decision making procedure to cope with the
organizational scope as well as goals.

5SECURITY MANAGEMENT
Question 3
As the security manager for your facility, you have been charged with developing the
business continuity plan for your organization. What are the immediate steps you will take
in the development of the plan?
The Business continuity plan is stated to be a process that involves the development
of a system in regards to the prevention as well as recovery of the data or information from
any potential or significant threats that may occur within an organization (McMurray, Cross
& Caponecchia, 2019). This plan assures the data assets as well as personnel to be protected
from every sort of issues that might occur within the organization’s network premises. The
steps provide an ability to function effectively in case of any disaster.
Four primary and significant steps will be adhered by me for the implementation of
the business continuity plan within the environment of the organisation. These are briefly
stated as follows.
The first step that is to be undertaken by me is stated as the development of the
perfect business impact analysis. Every department present within the organization should
develop an effective analysis of the business impact, which will identify the resources as well
as personnel. This will be needed for the maintenance of the business continuity plan in case
of any disaster (Farr & Bailey, 2019). The prime aspect of each department should be
associated with the documentation of the critical systems, the processes as well as the
business activities for the minimum recovery of the data, which is necessary for each
department for the reporting as well as safekeeping of the resources, associated within the
organization.
The next step that is associated with the development of the business continuity plan
is to adhere the objectives regarding which the plan is to be set. This includes the safety of

6SECURITY MANAGEMENT
the employees in terms of health as well as wellbeing of the employees. Moreover, this also
involves the recovery of the essential activities that might occur in the business organization.
This further adheres the safety of the company’s asset present within the network as well as
the physical environment of the organization (Noda, Hamaguchi & Yamori, 2019). The
effective communication is also a necessary step within the business continuity plan that
enhances the safety of the organization as well as of the different stakeholders associated with
it.
The next necessary step that is to be adhered by an organization is to choose a reliable
as well as efficient leader who can carry out the business continuity plan within the
organization. This leader will be responsible for the response as well as recovery efforts
regarding the direction as well as enhanced leadership of the overall business continuity plan
(Rogers & Sathyavagiswaran, 2018). In disastrous events, it is certainly necessary for a leader
to stand upfront for the recovery from such events. This will be very helpful for the
organization as well as the employees within the organization.
The last step that is undertaken in accordance to the business continuity plan is
depicted as the implementation of the employee training programs. This training program
intends to enhance the employees with the necessary training skills that are required to
maintain the disastrous events within the organization.

7SECURITY MANAGEMENT
Question 4
There are several major issues that will continue to hinder private sector security
organizations in the future. In the year 2020, explain whether you anticipate to be more
worried about the threat of economic/industrial espionage, executive protection or
competitive intelligence.
Private sector organizations are more exposed to the data or information security in
the modern times. In the modern times, it can be well stated that the security of the data will
be much more exposed to industrial espionage (Glitz & Meyersson, 2017). This term is stated
to be an illegal as well as unethical theft regarding the trade secrets related to business that
can be undertaken by the business competitors to attain the competitive global advantage.
This term can be well accompanied referred as the corporate spying that will not be very
effective or profitable for the organization that are dealing with the potential success of the
organization.
This term generally describes the covert activities that involves the theft or tampering
of the trade secrets either by removal of the data or copying the data that are confidential as
well as valuable for the organization. This may also include the terms like bribery, blackmail
as well as technological surveillance (Solberg Søilen, 2016). This will be mainly associated
with the industries such as heavy technology based industry, biotech, chemical as well as
high automobile sectors.
The industries that are thriving success in the modern times must be aware of the fact
regarding their database security so that the organization does not have any gap regarding
their security. The types of industrial espionage may be depicted as mainly of two types. The
first one being the actively searching for an organization’s intelligence matters that are
associated for the success of the organization (Albanie et al., 2019). If this data is hampered

8SECURITY MANAGEMENT
then the organization will be facing issues regarding the data security of the organization. The
second type of espionage may be depicted as the DDoS attacks that may intervene within the
data security of the servers of the organization (Heickerö, 2019). The intervention of the
malwares as well as the antivirus within the data servers must be restricted as modern day
organizations thrives to possess every data ion their network server systems through which
the data could be easily tampered by the competitive organizations.
The trends of industrial espionage will tend to affect the overall big and heavy
organizations in the modern era and to the organization s that persists in the biggest economic
countries. With the growth in the internet as well as lack in the cyber security practices it may
be well depicted that any organisation may come up with effective as well as enhanced
strategies that can provide additional security within the organization for data or information
security regarding the data present within the database of the specified organization.

9SECURITY MANAGEMENT
References
Albanie, S., Thewlis, J., Ehrhardt, S., & Henriques, J. (2019). Deep Industrial Espionage.
arXiv preprint arXiv:1904.01114.
Farr, M., & Bailey, D. (2019). Uniting business continuity management and operational risk
management. Journal of business continuity & emergency planning, 12(4), 294-300.
Glitz, A., & Meyersson, E. G. (2017). Industrial espionage and productivity.
Heickerö, R. (2019). Cyber espionage and illegitimate information retrieval. In
Multigenerational Online Behavior and Media Use: Concepts, Methodologies, Tools,
and Applications (pp. 1725-1736). IGI Global.
Jordan, K. B., Jordan, E., & Ruddell, K. (2018). Critical Energy Infrastructure Cyber
Defense-in-Depth. Resurgo, LLC Honolulu United States.
Levillain, O., Gourdin, B., & Debar, H. (2015, April). TLS record protocol: Security analysis
and defense-in-depth countermeasures for HTTPS. In Proceedings of the 10th ACM
Symposium on Information, Computer and Communications Security (pp. 225-236).
ACM.
McMurray, A., Cross, J., & Caponecchia, C. (2019). The Risk Management Profession in
Australia: Business Continuity Plan Practices. In Emergency and Disaster
Management: Concepts, Methodologies, Tools, and Applications (pp. 486-499). IGI
Global.
Noda, K., Hamaguchi, N., & Yamori, N. (2019). Results and discussion of business
consciousness survey on business continuity plan (BCP)(Japanese). Research Institute
of Economy, Trade and Industry (RIETI).

10SECURITY MANAGEMENT
Praus, F., Kastner, W., & Palensky, P. (2016). Software security requirements in building
automation. Sicherheit 2016-Sicherheit, Schutz und Zuverlässigkeit.
Rogers, C. B., & Sathyavagiswaran, L. (2018). Business Continuity Planning for the Medical
Examiner. In Multidisciplinary Medico-Legal Death Investigation (pp. 353-364).
Academic Press.
Smith, C., & Brooks, D. J. (2012). Security science: The theory and practice of security.
Butterworth-Heinemann.
Solberg Søilen, K. (2016). Economic and industrial espionage at the start of the 21st century–
Status quaestionis. Journal of Intelligence Studies in Business, 6(3), 51-64.
Song, G., Khan, F., & Yang, M. (2018). Security assessment of process facilities–Intrusion
modeling. Process Safety and Environmental Protection, 117, 639-650.
van Staalduinen, M., & Khan, F. (2015, March). A barrier based methodology to assess site
security risk. In SPE E&P Health, Safety, Security and Environmental Conference-
Americas. Society of Petroleum Engineers.
Yadav, R., Verma, R. N., & Solanki, A. K. (2019). Defense-in-Depth Approach for Early
Detection of High-Potential Advanced Persistent Attacks. In Soft Computing:
Theories and Applications (pp. 205-216). Springer, Singapore.
Zakariya, N. I., & Kahn, M. T. E. (2015). Safety, security and safeguard. Annals of Nuclear
Energy, 75, 292-302.