Security Managements - Study Material with Solved Assignments

Desklib offers study material with solved assignments, essays, dissertations, and more on Security Managements. The article discusses various questions related to security management, risk assessment, trust in information security management, compliance, and audit. It emphasizes the importance of trust in successful information security and the need for risk assessment to determine the content of a security policy.

Running head:SECURITY MANAGEMENTS
Security Managements
Name of the student:
Name of the university:
Author Note

1SECURITY MANAGEMENTS
Table of Contents
Solution of Question Paper1:.................................................................................................................3
1. Answer to Question number 1: “Security management is a subset of internal control. Discuss”. 3
2. Answer to question number 2: “One purpose of risk assessment is to make information security
management transparent to employees, customers, business partners and shareholders. Discuss.”. 4
3. Answer to question number 3: “Trust in information security management is promoted more
through how you do it more than what you do. Discuss”..................................................................6
Solution of Question Paper 2:................................................................................................................8
1. Answer to question number 1: “Risk assessment should always be used to determine the content
of a security policy. Discuss.”...........................................................................................................8
2. Answer to question number 2: “Audit supports policy and standards compliance but not
security. Discuss.”.............................................................................................................................9
3. Answer to question number 3: “Successful information security is impossible without trust.
Discuss.”..........................................................................................................................................10
Solution of Question paper 3:..............................................................................................................11
1. Answer to question number 1: “Information security policies encourage ownership of security.
Discuss.”..........................................................................................................................................11
2. Answer to question number 2: “Humans are the weakest link in information security defence.
Discuss.”..........................................................................................................................................12
3. Answer to question number 3: “Risk management institutionalizes risk ownership rather than
treats risk. Discuss.”........................................................................................................................14

2SECURITY MANAGEMENTS
Solution to question paper 4................................................................................................................15
Answer to Question number 3: “Audit is essential for effective security management. Discuss”..15
Answer to question 4: “Law and regulation encourage trust in an organization’s management of
information security. Discuss”.........................................................................................................16
Answer to question 5: “Compliance with security policies ensures the protection of an
organization’s information. Discuss”..............................................................................................17
Solution to question paper 5................................................................................................................19
Answer to question 1.......................................................................................................................19
Answer to question 2.......................................................................................................................20
Answer to question 3.......................................................................................................................22
References:..........................................................................................................................................24

3SECURITY MANAGEMENTS
Solution of Question Paper1:
1. Answer to Question number 1: “Security management is a subset of internal control.
Discuss”
Internal control assures profitability and efficiency of operations, a reliability of information
along with adhering to rules and different regulations. It is an integral part of daily management and
administration of companies.
The COSCO model is used to define control as a method which is affected by a board of
directors of entities, management and other personnel, developed to give reasonable assurance of
gaining objectives in various categories (Peltier, 2016). These categories include efficiency and
effectiveness of operations, dependability of financial reporting and compliance with applicable
regulations and laws. Under a smart internal control system, five layers work to support achievement
of the mission of entities.
Layers of COSCO model Discussion
Control environment It includes assignment of responsibility and
authority, commitment to competence, ethical
and integrity values and so on.
Risk assessment It involves managing change, risk analysis and
identification.
Control activities It comprises of business continuity and backups,
application change management and outsourcing.
Information and communication It includes the effectiveness of communication

4SECURITY MANAGEMENTS
and quality of information.
Monitoring It includes reporting deficiencies, separate
evaluations and ongoing monitoring.
Ineffective security management has been damaging internal control in various ways.
Ineffective security management can damage internal control in various ways. First of all, there can
be lack of power with multiple authorisations of transactions. For example, with orders having
orders above a particular dollar value like $1000, more than a single quotation can be retrieved that
can be gained reducing overall expenditure (Chang et al., 2014). Another instance can be given
regarding lack of logical and physical security. Protecting personal data and banking data are turning
out to be vital with a rise in risk of credit or identity theft. An employee or personal data have been
preferably encrypted and could be stored in secure folders.
The problem statement can be analysed in the following way. Internal security audits are
essential sources of information. It highlights areas needing attention and is not overly driven by
recommendations and findings. In many cases, security controls are proper for infrastructure and not
related directly to business. It leads internal control tea, for organisations to seek weaker security
controls under that infrastructure.
2. Answer to question number 2: “One purpose of risk assessment is to make information
security management transparent to employees, customers, business partners and
shareholders. Discuss.”
Risk assessment provides guidance and insights to develop an effective security strategy.
Apart from analyzing,organizational risk, risk analysis focuses on examining governance,

5SECURITY MANAGEMENTS
effectiveness and implementation of controls of information security. The result of the assessment is
a prioritized assessment of exposures and risks that could be addressed for better protection of
organization. Steps of risk assessment process include identification of hazards. This includes
anything that causes harm. It also helps in a decision that might be harmed and analyze risks and
undertake actions. Lastly, it makes a record of previous findings (Shameli-Sendi, Aghababaei-
Barzegar & Cheriet, 2016).
Data security is an integral part of decision making process. For instance, creating informed
decision is very challenging. This is mainly when operations of data centre and various other
primary elements of a service provider are invisible. Another example can be given about,
establishing a partnership with security management is vital to make sense of data security under
third-party solutions. With the help of transparency into service, one can develop a clearer vision of
risk management responsibilities and create a relationship of trust.
Application of transparency at every level of organisations permits leaders to communicate
with companies objectives to every staff. Moreover, through allowing every people in the company
helps in understanding clearly about how business could be run. This makes executive and boards
decide policies by transparency and accountability. Though it has neither been difficult for
organisations that are nor been customers to slide, beginning at any point is never too late (Ermakov
et al., 2014). Besides, transparency requires being appropriately established. Hence every part of that
organization would taste the see outcomes of transparent business.
The opening statement is true in many senses. As one is unaware of risks at a workplace, one
is simply putting themselves, employees, customers and full firm into danger. As it comes to
employee safety, moving above legal minimum helps to eliminate as much risk as possible to
decrease the number of safety-related incidents that are reported.

6SECURITY MANAGEMENTS
3. Answer to question number 3: “Trust in information security management is promoted
more through how you do it more than what you do. Discuss”
“Trust” is defined as the bilateral relationship. A trust relationship is important regarding
business conduction. Regarding trust, specialists must ensure that it is in a secure and safe place
where to perform and receive treatment (Soomro, Shah & Ahmed, 2016). For achieving this, every
member of employees requires supporting this work. It is done by reporting security concerns that
have been possessing and incidents that might occur.
For example importance of security management lies in the fact that it has ensured local
security managements meeting national standards. Further, it has been developing and improving
domestic security policies and provisions.
Various partnerships for security management never get success as partners are not aligned
with values and goals for an organization. This example shows the case of differing amounts. As the
business develops differences turn out to be a growing source of friction. This can be mitigated by
realizing that before entering a business relationship, prospective partners must be meeting and
articulating specific factors. This includes why they have wanted to become entrepreneurs. This also
includes determination of vision for the company along with long-term objectives.
Another example is a personality clash. Here, sharing of risks and possessing complementary
skills sets are huge advantages of business partnerships (Lowry et al., 2015). However, personalities
of partners have never been meshing sufficiently. This results in the fact that business has been
headed for trouble. All these problems can be solved by handling situations like dealing with
customers, vendors and difficulties. Moreover, they should keep in mind the differences in
personality that can benefit instead of a hindrance. This provides respect to partners, valuing
opinions and possesses a shared vision for the business.

7SECURITY MANAGEMENTS
The initial statement can be analyzed through the fact that few base levels of trusts are
needed to possess employment contracts. This is also helpful to get engaged in commercial
transactions. Moreover, beyond those minimum thresholds trust has also been playing an important
role.

8SECURITY MANAGEMENTS
Solution of Question Paper 2:
1. Answer to question number 1: “Risk assessment should always be used to determine the
content of a security policy. Discuss.”
Security policies are critical as it states how any company has been planning to secure
various physical and information technology assets of a business. They have been providing clarity
to readers while dealing with accountability activities and issues that are of crucial importance to the
company. This includes regulatory problems or requirements, legal liabilities, health and safety that
have severe outcomes.
RUSecure has been offering a set of security policies. This has been including supporting of
documentation that is ready to be customized and tailored to any particular needs. Further, they have
been offering an interactive editing activity and automated delivery toolset regarding security
policies also (Safa, Von Solms & Furnell, 2016). Another example can be given from the case of
Insight Consulting in the UK. They have been providing a training course that dealt with the
establishment of smart security policy. It has been covering the entire process from designing and
planning through deploying of maintenance and upkeep.
The risk assessment steps have been involving identification of hazards and deciding who
could be harmed. The next step is to evaluate risks and recognise precautions. Following this, the
records are to be found and then they are implemented. Lastly, the risk assessment and updating are
to be reviewed.
Content security policy is helpful in detecting and mitigating particular kind of attacks.
Example of this includes data injection attacks and cross-site scripting. The attacks are useful all the
things from stealing of data to a distribution of malware and site defacement (Flowerday &Tuyikeze,

9SECURITY MANAGEMENTS
2016). Besides, security policy content can be found out via HTTP response header like HSTS. This
has been defining an approved source of materials that could be led by contents.
The given statement can be justified by the fact that risks determined by risk assessment
contain security measures that help in reducing vulnerabilities and risks to a proper and reasonable
level to deliver data confidentiality, availability and integrity. This is to protect against reasonable
anticipated hazards and threats.
2. Answer to question number 2: “Audit supports policy and standards compliance but not
security. Discuss.”
“Compliance” is regarded as the state of being by various established specifications or
guidelines or process of becoming so. It can be defined as the encompassing effort ensuring
organisations have been abiding by a government and industry regulations.
“Security”, in Information Technology is the defence of IT assets and digital information
against external and internal, accidental and malicious threats. It includes response, prevention and
detection to threats by using IT services, software tools and security policies (Madi et al., 2016).
Compliance activities and security efforts converge roughly as policies in place, discovering
assets, defining strategies, analysing the level of compliance and remedying vulnerabilities or which
is out of respect. Here, for example, password policies comprise of relevance around internal
security rules GLBA, HIPAA, Sarbanes-Oxley and additional external mandates. Again, regarding
compliance patch policy is relevant to internal IT, NIST, HIPAA, GLBA and Sarbanes-Oxley
infrastructure management. Preferably, all these controls and procedures comprise of relevance
around activities of IT operation teams, security, compliance and audits (Jespersen et al., 2016).

10SECURITY MANAGEMENTS
Business requires compliance and security solutions transcending individual operation,
security and audit teams providing a holistic view of compliance posture and organisation risk. It has
been much more impactful for organisations to able to manage centrally every regulatory mandates
and security policies. Thus every policy is enforced efficiently, evaluated, maintained and accessed
through compliance, security and operation teams. Compliance audit comprehensively reviews
adherence of organisations towards regulatory guidelines. Thoroughness and strength of compliance
preparations are evaluated by IT, security or independent accounting consultants.
3. Answer to question number 3: “Successful information security is impossible without trust.
Discuss.”
Trust can be defined as a fiduciary relationship in which one party known as trustor provides
another party to hold property or assets(Bugiel, Heuser & Sadeghi, 2013). It is considered to be
benefit for third party which is known as beneficiary. Trust is generally used for providing legal
protection for the asset of trustor. It generally focusses on providing legal protection for the assets of
trustor so that it can save time, reduce paperwork and in some cases also reduce various kinds of
associated taxes.
Trust can be defined as a critical element for success in the fast changing world. Customers
generally buy products and services because of the built trust by the organization. It generally
focuses on building of trust both internally and externally (Chang, Kuo & Ramachandran, 2016). It
generally aims in setting of mutual goals so that stronger relationship can be built.
Security manager generally focus on organizing and overseeing of various kinds of security
operation in an organization (Ryoo et al., 2014). The ultimate goal is creating and saving the
environment where employees, visitors and property can be safe and be well protected. There are
large number of responsibilities of a security manager like:

11SECURITY MANAGEMENTS
 Development and implementation of security policies and procedures
 Proper budget for various kinds of security operation and analyzation of various kinds of
expenses.
 Planning and coordination of security events for various kinds of security operation.
 Proper reviewing of incidents and breaches.
 Investing and resolving of large number of issues.
Solution of Question paper 3:
1. Answer to question number 1: “Information security policies encourage ownership of
security. Discuss.”
Three distinct purpose of information security policy are
 Establishment of general approach to information security
 Detection and forestalling of information security like misuse of data, networks, computer
systems and various application related to it.
 Protection of reputation of organization with respect to legal and ethical kind of
responsibilities.
A security policies focus more on technical infrastructure. It has certain number of technical
infrastructure which can be used for protecting of information from unauthorized kind of access of
their employees (Chang, Kuo & Ramachandran, 2016). It is generally believed organization policies
should focus on dedication of needs of educating employees and proper protection of information
about the asset of information. It is generally believed that organizational policies should work in
such a way that it can educate employees about the way of protection of information related to
organizational assets (Ryoo et al., 2014).

12SECURITY MANAGEMENTS
Information security risk assessment is considered to be an on-going process which is in
relation to process of discovering, correcting and prevention of security problems (Ma et al., 2015).
Risk assessment is nothing but an integral part of risk management process which is designed in
such a way that it can easily provide information systems.
Risk treatment can be defined as the process of selecting and implementation of certain
methods which can be used for modifying risk. It generally inclusive of avoiding, optimizing and
retaining of risk (Li et al., 2014). The measures generally focus on selection of security measurement
which can be easily used within Information security management system of any kind of
organization. At this particular level security measurement focus on various kinds of security
function which are generally implemented technically.
Business continuity planning is nothing but development, implementation and maintaining of
policies, framework which is used for management of business disruption (Liu et al., 2013).
Business continuity plan focus on prevention, managing and recovering of various kinds of impacts.
It is noticed that business continuity plan is considered to establish cost-effective measures for
various kinds of event to occur.
From the above discussion it can be concluded that this question focus on various kinds of
information security policies. Three important policies of information security have been discussed
above in details.
2. Answer to question number 2: “Humans are the weakest link in information security
defence. Discuss.”
Various organization round the globe spend millions of dollars on cyber security and it
mainly ensures that vital data is protected from hacker’s eyes (Zhu et al., 2013). With the increase in
number of cyber threats organization should ensure that they updated with latest kind of malware

13SECURITY MANAGEMENTS
and virus protection or they have downloaded latest kind of firmware which can be used for
protecting themselves from latest kinds of attacks. There is list of factors which can be used for used
for securing IT services for any organization:
 Training and risk culture
 Controls
 Measurement provided within a purpose
 Model for operating
 Resilience
A security audit is nothing but an evaluation of security of information system of an
organization. It is generally measured by analyzing the fact that how it works well with the set of
criteria. A proper audit generally focusses on security of physical systems and environments
(Sherchan, Nepal & Paris, 2013). Security audit generally focus on analyzing compliance like
Sarbanes-Oxley act which mainly focus on fact how efficiently it can work well with information.
Various organization round the globe should work in such a way that it can ensure the
protection of data and assets. Firstly, audit scope should be decided which generally includes the
company assets which is related to information security. It is generally inclusive of computer
equipment, email, data and access related items like cards, tokens and passwords. After that past and
potential future threats related to asset must be reviewed. Proper plan should be established which is
used for maintaining various kinds of business operation which generally focus on business
operation as soon as the threats have been established (Hardwick, Anderson & Cruickshank, 2013).
This total mechanism of establishment and control of business process is known as intrusion
prevention system.

14SECURITY MANAGEMENTS
It is considered to be a well-tested method for controlling methods which can be used for
accessing various levels of security awareness of employees. Audit is mainly used for exploitation of
human factor which is generally used for testing various kinds of security controls. It is considered
to be a most important factors which makes use of methods of attacks and deficiencies related to
security awareness.
At present business need to focus on the fact that good business imperative is considered to
be an important factor for shaping the management of cyber risk (Hardwick, Anderson &
Cruickshank, 2013). It is generally considered to be an important factor maximizing benefits and
reducing various kinds of risk associated. They can easily create cyber security based on brand trust,
culture and competitive advantage.
3. Answer to question number 3: “Risk management institutionalizes risk ownership rather
than treats risk. Discuss.”
Risk assessment can be defined as the identification of hazards which can negatively affect
its impact on organization conducting business. This assessment generally helps in identifying
various kinds of business risk and providing measures, process and lastly focuses on controlling and
reducing the impact of risk on various business operations.
The five steps of risk assessment are
 Identification of hazards
 Analyzing the fact that who can harm the business.
 Accessing certain number of risk and taking proper action for it.
 Making a record of all the findings available.
 Lastly review of risk assessment

15SECURITY MANAGEMENTS
Risk treatment can be defined as method of selection and implementation of certain number
of risk which can be used for modification of risk(Sherchan, Nepal & Paris, 2013). There are certain
number of risk treatment measures like avoiding, transferring and retention of risk.
The five steps of risk treatment are
 Identification of options available
 Development of action
 Approval of action plan
 Implementation of action plan
 Lastly identification of residual risk.
Solution to question paper 4
Answer to Question number 3: “Audit is essential for effective security management. Discuss”
Security management is an effective term which is utilized for addressing the security of a
company or organization involved. The whole process by which the security of the place is
determined such that the effectiveness is increased is included in the security management practices
(Webb et al., 2014). Effective security management involves the utilization of security management
practices such that it can be efficiently adopted into the normal functioning of the system.
Audit method involves a verification process which is utilized for verifying the status of an
activity. This involves manually inspecting the various components such that it will be checked. It
involves six different steps. The first step is requesting the documents of the components. The
second step is the preparation of an audit plan. The third step involves scheduling a meeting with the
necessary personnel. The fourth step involves the conduction of the fieldwork. The fifth step

16SECURITY MANAGEMENTS
involves drafting of the report which involves giving the thoughts regarding the standards met by the
product. Lastly, a meeting is conducted for closing phase which denotes the outcome.
There are various processes of security management which is followed for making a
successful security adoption. The first method involves designing of security controls that can be
used for increasing security (Ermakov et al., 2015). The next step involves testing which tests the
various functionalities of the system. The third process is the mitigation of the security incidents
while the fourth is the security process review. In the effective security management processes, the
designing of security controls and the testing processes is utilized in the effective security
management. In addition, these processes are effective in the audit process because the process of
auditing involves analyzing the product that can be able to meet the demands of security in the
market. This is the reason why companies are conforming to audits for their products to increase
their product value.
Answer to question 4: “Law and regulation encourage trust in an organization’s management
of information security. Discuss”
There are various differences between the laws and regulations. Firstly, the laws are seemed
to be originated from the legislative assembly whereas the regulations are seemed to be originated
from the administrative assemblies. The laws are termed to be rules and policies that are to be
followed while the regulations are the extra details that are added to it. Thus, the use of regulations is
mainly done for easing the implementation of the laws. For example, the Air pollutions act can be
termed as a law whereas the need to fulfill it by various industries can be taken as a regulation.
According to the Data protection Act, there are eight different principles which are followed
by all business parties or during transactions. They state that personal information must be processed
in a lawful manner and must not be used for any other means which are not specified. It also

17SECURITY MANAGEMENTS
includes that the personal data must be accurate and must be kept updated. In addition, the
information must be kept secure and must not be shared with any other business parties (Johnson &
Nodd, 2017). According to the Data Protection Act, the information must not be shared with other
associated parties and this involves the third parties. This is being followed by all the companies and
organizations and failure to comply with them can result in penalties to be incurred.
The use of legislation policies helps in denoting trust between an organization and third party
(Miller, Levy & Swedler, 2018). This is mainly because the use of policies helps in denoting the
brand value among the market and third party organizations are always on the look put for these
companies or organizations. This increases the business transactions and thus leads to the formation
of trsut among the parties.
Thus, it can be said that the use of laws can be effective for maintaining a requirements in the
market which helps in increasing the brand value of the associated company or organization. This
also helps in protecting the best interests of the associated consumers of them and thus leads to more
business acquisition.
Answer to question 5: “Compliance with security policies ensures the protection of an
organization’s information. Discuss”
Information security policy is considered to be a list of rules within a company or
organization. These rules are to be followed by the personnel and staffs who are working there so
that an effective structure is maintained. This is also involved with the security of data and the
storage of data. A security policy must address all the necessary components which are consisted in
the security policy. The security plan must include the basic components which are overview, scope,
policy, enforcement and revision tracking. These must be included in the security policy which in
turn can be used for adopting in organizations or companies.

18SECURITY MANAGEMENTS
An Information Security Management System (ISMS) includes a sequential manner of
managing information among the system so that it stays safe. It includes the people, processes and
the systems (Agrawal, 2017). The major components of an ISMS system involve a security process,
necessary resource, personnel and management principles. These components contribute to the
normal functioning of ISMS. The reason why the use of ISMS is adopted at the center of
organizations is that it provides a level of certification to them such that they can implement,
establish, operate or review the changes in the business processes. In addition, the stakeholders
related to the organizations are also benefitted from them if a certification of ISMS is present there
(Naseer et al., 2016). In addition, the implementation of the ISMS certification also helps in handling
of the risks related to the business which in turn leads to the increase in the standards of the
company.
The involvement of policies can be used to play a different role in case of any laws or
regulations. According to the Clause 5 of ISO/IEC 27001 standard, organizations are required to
demonstrate the activities of leadership which is mainly focused on the structure of the ISMS. In
addition, these policies also require that the top level management personnel are to successfully
review the standard process.
Thus, it can be concluded that the need for ISMS is required for considering the various
attributes of an organizational aspects. This will also help in contributing to the general functioning
of the processes so that efficiency is maintained.

19SECURITY MANAGEMENTS
Solution to question paper 5
Answer to question 1
a) Information security is defined by the adoption of processes and standards that can be used
for preventing unethical access to the system. This helps in securing the network and helps in
protecting the data and information stored in a system.
The management processes which are involved with the security of the network and other
information security aspects are termed as information security management. This helps in securing
the flow of the processes and also tends to increase business efficiency.
An Information Security Management System (ISMS) consists of a logical manner of
managing various amounts of information or data among a system so that consistency among that
system is maintained.
Information security control involves various methods and processes which are used to check
the effectiveness of the processes in terms of detection and monitoring of the network or information
stored.
b) The ISO/IEC 27000 is an international standard which considers the effectiveness of the
information technology. This standard includes a standard to be followed by the companies for
addressing into the network solutions. The standard present here is used to denote the ISMS system
which is used to manage the security risks and controls of a network.
In a similar manner, the ISO/IEC 27001 is another standard which is used for information
security systems. In this standard a management system is specified to the company heads which
helps to show the specific controls and requirements for setting up the security protocol system. The

20SECURITY MANAGEMENTS
organizations that are supposed to meet the set criteria are said to have been accredited by this
standard.
Lastly, in case of the ISO/IEC 27002 standard, the best recommendations are provided for
information security controls which are being used for initiation, implementation or maintenance of
the ISMS system.
These information security solutions are required to be followed by the company head.
However, the devices that they needs to setup are not provided in the standards.
c) As both the standards always recommend the need for implementing the ISMS systems,
the necessary adoptions are also to be included in any kinds of network modifications. In case of the
company adopting any new changes, it must be complied with the ISMS and the ISO standards. This
helps the company to regain their modifications while maintaining the needed market.
Firstly, in case of the company applying for cloud solutions, the need to mitigate the risks is
required. This is a pre-requisite for the company to follow the standards so that an effective network
is established (Feng, Wang & Li, 2014). Another example is a company adopting virtualized data
centers. This presents a problem as the solutions is to be provided from the third parry providers and
the compliances are to be followed so that an effective business process is maintained.
Answer to question 2
a) Information security risk management is termed as a system which is used for the
establishment, implementation, and operation, monitoring and reviewing of information security
aspects in a company or organization.
b) There are five different steps to risk management processes. The first step is the
identification of the risk which is involved with identifying the components that makes up the risk.

21SECURITY MANAGEMENTS
The next step is analyzing the risk which is involved with making an analysis of the risk (Mayer et
al., 2016). The third step involved is evaluation of the risks where an outcome is proposed. The
fourth step involved is mitigating the risks and the last step involved is monitoring of the risks.
Figure 1: Risk management plan
(Source: Created by the author)
A quantitative risk analysis involves the analysis of the information by considering the
quantity of information. This is advantageous as it helps to consider the outcome as opposed to
various others. The disadvantage is that the quality is not considered.
c) The risk due to data regulation is not considered as an information security risk. This is
mainly involved with data regulation and protection and is not involved with breaching or hacking
and hence cannot be termed as information security risk.
AnalysisEvaluationMitigationMonitoring

22SECURITY MANAGEMENTS
Answer to question 3
a) Audit method involves the utilization of a verification process which further verifies the
status of an activity. This basically involves manual inspection of components. Firstly, the use of
audit process helps in contributing to the security management processes. Secondly, the use of audit
is utilized in complying to the security of the product so that the security management processes are
utilized.
b) An audit process is used to check the security standard so that the network is effectively
analyzed. If the standards are met, then the product is approved, else further modifications are
recommended.
In case of an internal information security audit, the necessary compliances are checked for
reviewing the network based risks and practices while the external information security audits are
concerned with the financial implications of the components (Safa, Von Solms & Furnell, 2016).
Internal audits are conducted by employees of the organizations while the external audits are
conducted by different personnel.
Even under the presence of qualified personnel, the need for external audits can be beneficial.
This removes the need for an organization to invest in their training process and thus helps to check
the quality of the process. Another reason is that this helps the company get a successful brand value
when external audit is done.
c) Penetration testing is termed as a simulated attack that is authorized by an organization in
their network. This helps in testing the effectiveness of their systems (Safa et al., 2015). The first
benefit of adopting penetration testing is that it helps in denoting the effectiveness of the company.
Another benefit is that it helps in giving a general idea about the necessary resources to be included

23SECURITY MANAGEMENTS
in the network. There are three different testing, the black box testing, white box and grey box
testing.

24SECURITY MANAGEMENTS
References:
Agrawal, V. (2017). A Comparative Study on Information Security Risk Analysis
Methods. JCP, 12(1), 57-67.
Bugiel, S., Heuser, S., & Sadeghi, A. R. (2013, August). Flexible and Fine-grained Mandatory
Access Control on Android for Diverse Security and Privacy Policies. In USENIX Security
Symposium (pp. 131-146).
Chang, S. I., Yen, D. C., Chang, I. C., & Jan, D. (2014). Internal control framework for a compliant
ERP system. Information & Management, 51(2), 187-205.
Chang, V., Kuo, Y. H., & Ramachandran, M. (2016). Cloud computing adoption framework: A
security framework for business clouds. Future Generation Computer Systems, 57, 24-41.
de Gusmão, A. P. H., e Silva, L. C., Silva, M. M., Poleto, T., & Costa, A. P. C. S. (2016).
Information security risk analysis model using fuzzy decision theory. International Journal
of Information Management, 36(1), 25-34.
Elder, R. J., Lowensohn, S., & Reck, J. L. (2015). Audit firm rotation, auditor specialization, and
audit quality in the municipal audit context. Journal of Government & Nonprofit
Accounting, 4(1), 73-100.
Ermakov, S. A., Zavorykin, A. S., Kolenbet, N. S., Ostapenko, A. G., & Kalashnikov, A. O. (2014).
Optimization of expert methods used to analyze information security risk in modern wireless
networks. Life Science Journal, 11(10), 511.

25SECURITY MANAGEMENTS
Ermakov, S. A., Zavorykin, A. S., Kolenbet, N. S., Ostapenko, A. G., & Kalashnikov, A. O. (2014).
Optimization of expert methods used to analyze information security risk in modern wireless
networks. Life Science Journal, 11(10), 511.
Feng, N., Wang, H. J., & Li, M. (2014). A security risk analysis model for information systems:
Causal relationships of risk factors and vulnerability propagation analysis. Information
sciences, 256, 57-73.
Flowerday, S. V., & Tuyikeze, T. (2016). Information security policy development and
implementation: The what, how and who. computers & security, 61, 169-183.
Hardwick, J., Anderson, A. R., & Cruickshank, D. (2013). Trust formation processes in innovative
collaborations: networking as knowledge building practices. European Journal of Innovation
Management, 16(1), 4-21.
Jespersen, A. H., Hohnen, P., & Hasle, P. (2016). Internal audits of psychosocial risks at workplaces
with certified OHS management systems. Safety Science, 84, 201-209.
Johnson, T., & Nodd, E. (2017). An Assessment of Online Consumers’ Awareness of Consumer
Rights under the UK’s E-Commerce Laws and Regulations. Canadian Journal of Applied
Science and Technology, 5(2).
Knechel, W. R. (2016). Audit quality and regulation. International Journal of Auditing, 20(3), 215-
223.
Li, Z., Ma, Z., van der Kuijp, T. J., Yuan, Z., & Huang, L. (2014). A review of soil heavy metal
pollution from mines in China: pollution and health risk assessment. Science of the total
environment, 468, 843-853.

26SECURITY MANAGEMENTS
Liu, X., Song, Q., Tang, Y., Li, W., Xu, J., Wu, J., ... & Brookes, P. C. (2013). Human health risk
assessment of heavy metals in soil–vegetable system: a multi-medium analysis. Science of
the Total Environment, 463, 530-540.
Lowry, P. B., Posey, C., Bennett, R. B. J., & Roberts, T. L. (2015). Leveraging fairness and
reactance theories to deter reactive computer abuse following enhanced organisational
information security policies: An empirical study of the influence of counterfactual reasoning
and organisational trust. Information Systems Journal, 25(3), 193-273.
Ma, S., Lee, K. H., Kim, C. H., Rhee, J., Zhang, X., & Xu, D. (2015, December). Accurate, low cost
and instrumentation-free security audit logging for windows. In Proceedings of the 31st
Annual Computer Security Applications Conference (pp. 401-410). ACM.
Madi, T., Majumdar, S., Wang, Y., Jarraya, Y., Pourzandi, M., & Wang, L. (2016, March). Auditing
security compliance of the virtualized infrastructure in the cloud: Application to openstack.
In Proceedings of the Sixth ACM Conference on Data and Application Security and
Privacy (pp. 195-206). ACM.
Mayer, N., Aubert, J., Grandry, E., & Feltus, C. (2016, November). An Integrated Conceptual Model
for Information System Security Risk Management and Enterprise Architecture Management
Based on TOGAF. In IFIP Working Conference on The Practice of Enterprise Modeling (pp.
353-361). Springer, Cham.
Miller, T. R., Levy, D. T., & Swedler, D. I. (2018). Lives saved by laws and regulations that resulted
from the Bloomberg road safety program. Accident Analysis & Prevention, 113, 131-136.
Naseer, H., Shanks, G., Ahmad, A., & Maynard, S. (2016). Enhancing Information Security Risk
Management with Security Analytics: A Dynamic Capabilities Perspective.

27SECURITY MANAGEMENTS
Peltier, T. R. (2016). Information Security Policies, Procedures, and Standards: guidelines for
effective information security management. CRC Press.
Ryoo, J., Rizvi, S., Aiken, W., & Kissell, J. (2014). Cloud security auditing: challenges and
emerging approaches. IEEE Security & Privacy, 12(6), 68-74.
Safa, N. S., Sookhak, M., Von Solms, R., Furnell, S., Ghani, N. A., & Herawan, T. (2015).
Information security conscious care behaviour formation in organizations. Computers &
Security, 53, 65-78.
Safa, N. S., Von Solms, R., & Furnell, S. (2016). Information security policy compliance model in
organizations. Computers & Security, 56, 70-82.
Safa, N. S., Von Solms, R., & Furnell, S. (2016). Information security policy compliance model in
organizations. Computers & Security, 56, 70-82.
Shameli-Sendi, A., Aghababaei-Barzegar, R., & Cheriet, M. (2016). Taxonomy of information
security risk assessment (ISRA). Computers & security, 57, 14-30.
Sherchan, W., Nepal, S., & Paris, C. (2013). A survey of trust in social networks. ACM Computing
Surveys (CSUR), 45(4), 47.
Soomro, Z. A., Shah, M. H., & Ahmed, J. (2016). Information security management needs more
holistic approach: A literature review. International Journal of Information
Management, 36(2), 215-225.
Soomro, Z. A., Shah, M. H., & Ahmed, J. (2016). Information security management needs more
holistic approach: A literature review. International Journal of Information
Management, 36(2), 215-225.

28SECURITY MANAGEMENTS
Webb, J., Ahmad, A., Maynard, S. B., & Shanks, G. (2014). A situation awareness model for
information security risk management. Computers & security, 44, 1-15.
Zhu, W., Newman, A., Miao, Q., & Hooke, A. (2013). Revisiting the mediating role of trust in
transformational leadership effects: Do different types of trust make a difference? The
Leadership Quarterly, 24(1), 94-105

29SECURITY MANAGEMENTS