Security of Intellectual Property for PIA

This report discusses the development of a security policy and management program to protect the intellectual property of PIA. It explores the benefits of an ongoing security management process, the roles and responsibilities of different individuals, and proposed models for the program. It also highlights the implications of legal requirements and the importance of contingency planning.

Running head: SECURITY OF THE INTELLECTUAL PROPERTY FOR PIA
SECURITY OF THE INTELLECTUAL PROPERTY FOR PIA
Name of the Student
Name of the University
Author Note

1SECURITY OF THE INTELLECTUAL PROPERTY FOR PIA
Table of Contents
Part A:........................................................................................................................................2
Introduction:...............................................................................................................................2
The benefits derived from seeing Security Management as an ongoing process...................2
The development of a security policy and security management plan:..................................3
Identification and description of the functions, tasks, roles and responsibilities...................4
Various roles and responsibilities for the Security Management Program for PIA...............5
The roles of different individuals/groups would play in terms of governance in general......6
Proposed models for the development of a Security Management Program.........................7
The implications of legal and statutory requirements............................................................8
The benefits that formal approach would bring:.................................................................8
Part B:.........................................................................................................................................9
The benefits a Risk Management Plan...................................................................................9
The steps necessary to build one:...........................................................................................9
Importance of contingency planning for PIA:........................................................................9
Cost benefit analysis:............................................................................................................11
Bibliography:............................................................................................................................12
Appendix:.................................................................................................................................14
Identification of Assets:........................................................................................................14
Identification of threats/vulnerabilities:...............................................................................14

2SECURITY OF THE INTELLECTUAL PROPERTY FOR PIA
Part A:
Executive summary
The purpose of the report is to develop a proper security policy and an effective security
management program to ensure that intellectual property which is important for PIA has
proper security measures. The report defines various roles and responsibilities required for
implementing the security policy and the security management program. It is identified that
PIA has only trade secret for protecting their intellectual property, which is not applicable if it
is stolen and someone else implements the design and algorithm. Therefore, PIA should opt
for patent for their intellectual property even though it is costly, but provides enhanced
security for protecting the intellectual property and hence PIA should consider patent for their
intellectual property instead of trade secret.
Introduction:
The report discusses various issues and methods for protecting intellectual property
which is important for PIA. This report discusses about benefits of a Security management
plan and describes methods for developing a proper security management program. It also
describes Functions, tasks, roles and responsibilities that need to be defined for the Security
Management Program along The roles of different individuals/groups would play in terms of
governance in general. The report also discusses about model for developing security
management program for PIA for protecting intellectual property.
The benefits derived from seeing Security Management as an ongoing process
The advancement of Technology has significantly influenced organisational activities
and business process. Due to advancement in technology digitalization has become an
important part of organisational policy. The way data is stored, accessed and shared for

3SECURITY OF THE INTELLECTUAL PROPERTY FOR PIA
business purposes has changed significantly. Although it has increased efficiency and profit it
has various security threats as well. Hence it is important to develop proper security plan for
addressing security issues (AlHogail 2015). However, it is important to identify that hackers
and cyber-criminals are becoming smart and they are deploying new tools and techniques for
exploiting Organisational security. The type of security threats for organisations exchanging
significantly, hence it is not enough to develop security policies and security measurement for
one type of security threats because the type of security threats exchanging significantly.
Hence it is required to consider cyber security as an ongoing process. Organisations which
considered cybersecurity as an ongoing process are successful in bringing new and improved
cybersecurity measures that are consistent with cybersecurity threats (Baldwin and Henkel
2015). Hence this type of organisations is much more efficient in protecting their digital
assets due to innovation in security measurements. Therefore it is important for organisations
to consider cybersecurity as an ongoing process because it helps in protecting digital assets
including digital data that are important for business and organisational security and its
success as well. When organisations do not consider cyber security as an ongoing process
there is a lack of innovation in security techniques which compromises the overall security of
the organisation due to increased vulnerability to organisational assets which include digital
assets as well.
The development of a security policy and security management plan:
Security policy:
In order to develop an effective security policy fast, an internal audit will be
conducted for detailed security assessment within the organisation. this will help identify
what are the type of assets that Organisation deal in, what are the existing security measures
that the organisation has which assets are more vulnerable and which assets need enhanced

4SECURITY OF THE INTELLECTUAL PROPERTY FOR PIA
protection (Drahos 2016). Once this information is available, the security policy will be
developed for the organisation. This policy will include the following aspects:
 Categorising data based its sensitivity and importance to organisational security
 Defining level of access two important organisational data based on the employee
profile
 Providing techniques for protecting important organisational and business data
 Providing detailed approach regarding storing accessing and sharing data for business
purposes
 Defining actions to be taken if employees are found to be irresponsible or intentional
in exploiting organisational security
Security management plan:
Security management plan consists of security techniques and strategy for applying
this technique for enhancing digital security for the organisation. There are various benefits
of developing a proper security management plan and integrating it with organisational
security policies (Gibson 2016). Some of the benefits of developing a proper security
management plan are:
 Enhanced protection to digital assets through proper security techniques
 A structured and organised approach for dealing with various security threats
 Proper identification and mitigation techniques for security threats for enhancing
digital security for the organisation
 Identification of roles and responsibilities for protecting organisational securities
especially digital security

5SECURITY OF THE INTELLECTUAL PROPERTY FOR PIA
Identification and description of the functions, tasks, roles and responsibilities
Important functions and tasks for the security management program are the followings
(Manzini and Lazzarotti 2016):
 Threat identification: This requires identifying possible security threats that is relevant
to PIA so that it is easier to define policies and security program for protecting assets
of the organization.
 Threat sources: It is not only important to identify threat types, it is equally important
to identify threat sources as well. It is required as without identyfing the sources of
security threats, security policy and security program is not effective as it lacks
appropriate security measures due to lack of insights on sources of security threats.
Hence, in this program sources of security threats will be identified
 Threat mitigation: threats are to be mitigated appropriately according to threat
identification and threat sources
Various roles and responsibilities for the Security Management Program for PIA
IT manager roles and responsibility:
 To identify if security policy and security program is properly is properly
implemented or not
 To assist employees to identify if they have any issues regarding any terms in the
security policy and the security management program and help them to comply with
the security management requirements
 Any issues regarding the security management plan as identified by the employees
should be communicated to the higher authority and bring necessary changes so that
the security management program is effective and ensures security of the

6SECURITY OF THE INTELLECTUAL PROPERTY FOR PIA
organizational assets including the intellectual property which is of prime importance
to the company
Employees’ roles and responsibility:
 The employee should follow the classification of the information as provided in the
security policy
 In order to access to the sensitive data as identified in the security policy, permission
from the chief security officer has to be obtained
 The employee should not access the internal organisational network through personal
devices such as smartphone, tablet and laptop without permission of IT manager
 The employee should not share any kind of organisational data outside the
organisation without permission from the organisation and of any employee
deliberately does so that employee will be terminated from the company filler by legal
action if required
 The higher authority of the organization including chief security officer and IT
manager will review this policy and if required modifications will be made and the
decision of the organization in this regard needs to be followed by the employees of
the organization
The roles of different individuals/groups would play in terms of governance in general
Position in the organization Roles and responsibility
Owner of the organization To evaluate security policy
Provide approval for modification in
security policy
Define action for policy violation

7SECURITY OF THE INTELLECTUAL PROPERTY FOR PIA
IT manager To implement security policy
Identify if anyone is violating the security
policy
Implement action for policy violation with
approval from organization owner
Proposed models for the development of a Security Management Program
The security model that is considered here is the Distributed Information Security
Management Model (DISMM).
Feature of the model:
According to this model, ensuring security in an organization is not responsibility of
few people, which is a major drawback of traditional information security model, which is
followed by most of the organization. It considers that few group or a designated person
should maintain security and protect information from security vulnerabilities (Nazareth and
Choi 2015). However, this model involves each one of the organization in the security
program and defines roles and responsibilities for each of the employees and this makes is
easier to implement the security program with greater efficiency.
How this model applied to the context of PIA:
The major threat of PIA is loss or sharing of intellectual property, which include an
algorithm for implementing artificial intelligence for designing industrial applications
(Oppliger 2015). Hence, it is not enough to keep security of this highly confidential
information limited to any individual, it should define detailed roles and responsibility for
people associated with the information or people who have access to it. The security program

8SECURITY OF THE INTELLECTUAL PROPERTY FOR PIA
for PIA would consider following persons responsible for managing security of the
intellectual property:
 Employees who are involved in designing the algorithm who have access to it. Hence
directly responsible for protecting this intellectual property
 IT manager who have direct access to the information. Hence directly responsible for
protecting this intellectual property
 Finance manager not have direct access to design documentation but have access to
pricing information for the products developed by the PIA. Hence not directly
responsible for protecting this intellectual property
 Sales manager also does not have direct access to design documentation, but has
access to sales related data. Hence not directly responsible for protecting this
intellectual property
The implications of legal and statutory requirements
Company does not have any patent right now for their intellectual property. Hence if
this is stolen and applied by someone else to design same products that the company has, then
they will not be able to claim their right on this intellectual property (Peltier 2016). It is
identified that PIA has only trade secret for protecting their intellectual property. If it is stolen
and someone else implements the design and algorithm, PIA will have no right to it even
though they have developed it.
The benefits that formal approach would bring:
 Employee monitoring: It will ensure that employees are not sharing details about the
intellectual property to others. It is important as right now PIA has no patent without
which they have very less control on their intellectual property and hence it is
important to ensure the information is not shared and stolen (Peltier 2016). Hence,

9SECURITY OF THE INTELLECTUAL PROPERTY FOR PIA
employee monitoring has a significant benefit for PIA for protecting their intellectual
property
 Data encryption: Enhanced access control for ensuring that sensitive data is not easily
accessed without proper authorization (Peltier 2016). In this regard sensitive data will
be encrypted so that even after those data is accused it is not way to derive the actual
information from the data
Part B:
The benefits a Risk Management Plan
 Structured approach to risk treatment
 Protecting organizational assets from different threat categories
 Ensuring benefits from monetary aspects as well
The steps necessary to build one:
According to Safa and Von Solms (2016), following steps are required for designing a risk
management plan:
 Risk identification: risks needs to be identified with details such as type of risk, its
nature and other related information regarding the risk
 Risk prioritization: Not all risk are of same nature, neither does it have same level of
impact on organization security vulnerability. Hence, in this security program risks
are required to be prioritized for developing a comprehensive security program for
PIA
 Risk mitigation: Risk identification and prioritization is followed by risk mitigation
plan, which provides detailed description on how to exactly mitigate each risk based
on type of risk, risk sources and risk prioritization information.

10SECURITY OF THE INTELLECTUAL PROPERTY FOR PIA
 Risk management plan improvements: Risk management plan are not accurate and its
requirements and policies changes as well. In order to ensure that the security
management plan is effective, it is required to review issues and improvement scope
for the designed security plan. IT manager of PIA will conduct periodic review of the
security program.
Importance of contingency planning for PIA:
Contingency planning is an important aspect of any risk management plan and this
defines strategies and steps required in case risk management plan does not work accordingly
or as estimated while the plan is developed (Safa, Von Solms and Furnell 2016). Hence, a
having an alternative plan is always an essential consideration for proper risk management
plan.
For example, Computers, which are considered for designing algorithm and services,
might not be secured enough and thus it compromises security of the data. Hence it is
required for have contingency planning in this regard. Another example where security might
be an issues and might lead to loss of intellectual property that PIA owns is Severs and data
storage are hacked by cyber-criminals and hackers sponsored by the competitors (Zammani
and Razali 2016). If not so, Employees themselves might be involved in leaking the data and
providing to the competitors for money. Even important data such as algorithm and design
documents are lost due to corrupted hardware such as data storage. now whatever might be
the reason for the loss or theft of intellectual property, it will have a significant impact on
PIA, both in terms of financial aspect and organizational value as well. Not only that, this
will provide a significant benefit to the competitors if they got hold of those design
documents and algorithms, which PIA considers as their intellectual property.
Some of the important contingency planning for PIA include:

11SECURITY OF THE INTELLECTUAL PROPERTY FOR PIA
 Create a separate backup of the important data regarding algorithm design and protect
that with strong password so that in case of information loss, data is still available to
the company
 Encryption of data with 128 or 256 bit encryption which makes it difficult to interpret
those information from those data without proper encryption key thus minimizes
impact of loss of intellectual property
Therefore some of the significant benefits of contingency planning to PIA are:
 Minimizes impact on organizational process and those not affect the organizational
activities as well
 Ensures access to the important data even after it is stolen
 Helps in minimising financial loss as well
 Offers better control on data breach
Cost benefit analysis:
PIA should opt for patent for their intellectual property even though it is costly, but provides
enhanced security for protecting the intellectual property and hence PIA should consider
patent for their intellectual property instead of trade secret (Gibson 2016).
The estimated value of this knowledge is approximately $3million.
However to apply for patent cost between $8,000 and $15,000 is required but it enhances the
security of the intellectual property which is major concern for PIA. Without patent PIA
might save this cost, but they might lost a huge market, which they have, right now whose
worth might be millions. Hence, PIA should consider this option.

12SECURITY OF THE INTELLECTUAL PROPERTY FOR PIA
References:
AlHogail, A., 2015. Design and validation of information security culture
framework. Computers in Human Behavior, 49, pp.567-575.
Baldwin, C.Y. and Henkel, J., 2015. Modularity and intellectual property
protection. Strategic management journal, 36(11), pp.1637-1655.
Drahos, P., 2016. A philosophy of intellectual property. Routledge.
Gibson, J., 2016. Community resources: intellectual property, international trade and
protection of traditional knowledge. Routledge.
Manzini, R. and Lazzarotti, V., 2016. Intellectual property protection mechanisms in
collaborative new product development. R&D Management, 46(S2), pp.579-595.
Nazareth, D.L. and Choi, J., 2015. A system dynamics model for information security
management. Information & Management, 52(1), pp.123-134.
Oppliger, R., 2015. Quantitative risk analysis in information security management: a modern
fairy tale. IEEE Security & Privacy, 13(6), pp.18-21.
Peltier, T.R., 2016. Information Security Policies, Procedures, and Standards: guidelines for
effective information security management. Auerbach Publications.
Safa, N.S. and Von Solms, R., 2016. An information security knowledge sharing model in
organizations. Computers in Human Behavior, 57, pp.442-451.
Safa, N.S., Von Solms, R. and Furnell, S., 2016. Information security policy compliance
model in organizations. Computers & Security, 56, pp.70-82.

13SECURITY OF THE INTELLECTUAL PROPERTY FOR PIA
Zammani, M. and Razali, R., 2016. An empirical study of information security management
success factors. International Journal on Advanced Science, Engineering and Information
Technology, 6(6), pp.904-913.

14SECURITY OF THE INTELLECTUAL PROPERTY FOR PIA
Appendix:
Identification of Assets:
Category of assets Description
People employees of the PAI who are associated
with the development of the algorithm
Process The algorithm for designing services based
on artificial intelligence
Hardware Data storage for storing associated design
files that contains the algorithm
Software Industrial applications developed for clients
Identification of threats/vulnerabilities:
Threat category Description
Internal Computers are not secured enough and
affected by malicious code
External Severs and data storage are hacked
Deliberate Employees leaking the data to the competitors
for money
Accidental important design documents are lost due to
corrupted hardware

15SECURITY OF THE INTELLECTUAL PROPERTY FOR PIA
Sample risk management plan:
Threat category probability of risk Consequences of
risk
impact of risk
Internal Medium High High
External High High High
Deliberate Low High High
Accidental Low High High