TNE80009: Risk Analysis and Security Program Implementation Project

This project report details the development and implementation of a security program for a small-sized manufacturer of wireless communication devices. It begins with a risk analysis using the Delphi method to identify major security threats, focusing on vulnerabilities in wireless networking, mobility of devices, and potential for physical attacks. The report outlines five key risks, including detrimental impacts of conscious actions, problems in stable income, delays in tasks, cost overruns, and lack of time for continuous development. Security policies are then developed to address these risks, focusing on unauthorized access, confidentiality, integrity, and availability, with measures such as user authentication, access control, cryptography, firewalls, and VPNs. Finally, the report specifies how each policy will be implemented, detailing the technologies and procedures to be deployed, including periodic reviews, expert cyber security risk analysis, and maturity-based risk analysis against cyber threats. The program emphasizes data-driven risk analysis, prioritizing areas that maximize the security budget and ensuring stakeholder confidence.

Running head: DEVELOPMENT AND IMPLEMENTATION OF SECURITY PROGRAM
Development and implementation of security program
Name of the student:
Name of the university:
Author Note

1DEVELOPMENT AND IMPLEMENTATION OF SECURITY PROGRAM
Executive summary
The company chosen in the following discussion is a small-sized manufacturer of wireless
communication devices, who security program is needed to be created. This should reduce future
risks of various attacks. These risks are analyzed through Delphi method. The securities policies are
further investigated in the report along with methods in which they can be implemented are also
demonstrated.

2DEVELOPMENT AND IMPLEMENTATION OF SECURITY PROGRAM
Table of Contents
1. Introduction:......................................................................................................................................3
2. Risk analysis:.....................................................................................................................................3
3. Security programm:...........................................................................................................................7
4. Implementation of security program:..............................................................................................11
5. Summary:.........................................................................................................................................15
6. Recommendations:..........................................................................................................................16
7. References:......................................................................................................................................18

3DEVELOPMENT AND IMPLEMENTATION OF SECURITY PROGRAM
1. Introduction:
The current business chosen in this study is a small-sized manufacturer of wireless
communication devices. They are mainly used for IoT or Internet Of Things communications.
Further, the organization has been operating a factory situated about 20 km away from Eastern
suburbs and small research lab. Both of them have been co-located under a University within eastern
suburbs.
The company needs to create a security program. This is intended to decrease the further
risks of those kinds of attacks. However, addressing those problems has been important and hence
the company has been needed to address the risks at the initial phase. This is also regarded as a
multi-phase project.
The following report identifies those security risks faced by the organization using Delphi.
Then the security policies are addressed and then it is specified how every policy can be
implemented.
2. Risk analysis:
The environmental uncertainties and keeping competitive intensity of projects in minds, the
project managers of the current organization has been facing various challenges. For effectively
controlling the challenges the risk management has been introduced. This has been one the new
strategies to enhance and strengthens effectives of the project (Chang 2016). For reducing the risks
and different kinds of offset losses of it, risk management is developed. Further, all of them has been
specific place.

4DEVELOPMENT AND IMPLEMENTATION OF SECURITY PROGRAM
Figure 1: “Wireless security Risk factors”
(Source: Bouzon et al. 2016, pp.182-197)
In the current scenario the top five risks are listed below.
 Detrimental impacts of various activities across the conscious action in predicting the reverse
effects and various plans to avoid it.
 Problems in stable income and earnings for creating the acceptable level of revenue through
limiting loss of earnings and cash flows that gets originated from various unforeseen losses.
 Non-stop activities and high delay of tasks
 The costs have been above certain level and the restricting the organization to develop.
 Lack of time allocated for development of continuous development and growth.
For mitigating the above risks the Delphi method has been useful. This includes the
successful consensus gaining of the way some of the experts have been arguing about any particular
project. It is an iterative method that has been collecting anonymous judgment of various experts.

5DEVELOPMENT AND IMPLEMENTATION OF SECURITY PROGRAM
In Delphi method has been used for decision-making and forecasting that has been provided by
experts that are expressed in terms of different absolute numbers. However, it has been far away
from real world, long-term forecasts and decision making. Here, the possibility of uncertainty and
coping with various fuzzy sets are present (Stockwell et al. 2016). This is because the decisions are
undertaken keeping the qualification of the experts in mind. Hence, it has been better to use fuzzy
sets through fuzzy numbers for predicting different long-term decisions in dealing with actual world
scenario. This has been instead of definite and particular numbers of fuzzy numbers for describing
the data to be used. In this way, the needed form of natural language whether low, medium or high
are investigated by experts. Hence, the fuzzy Delphi method has come into play.
In the current case study, the Fuzzy Delphi method is helpful. It has been including the
following steps.
 The different experts chosen and described under the problem domain.
 Preparing the questionnaire and sending that to various experts.
 Getting opinions of experts and then analyzing them.
In this stage, various questionnaires has been sent to different members of every expert group
and further the success rate retrieved with each of the components has been providing corrective
opinions that are concluded. As per the linguistic variables and questionnaire is defined under the
questionnaire, mean phase of every element is measured (Modrak and Bosun 2014). Further, various
fuzzy numbers can also be used regarding information description. This are included instead of
average specific analysis and is conducted in the basis of fuzzy mean.
It must be kept in mind that the conventional Delphi method has been always suffering from
various expert opinions of low convergences, possibility and high execution costs. This has been
regarding the opinions that the organizers has been filtering out specific expert opinions. The above

6DEVELOPMENT AND IMPLEMENTATION OF SECURITY PROGRAM
suggested method of conventional Delphi and fuzzy theory has been helpful to develop the
ambiguity and vagueness of the method. Here, the membership’s degree has been used for
establishing the membership function of every participant (Kauko and Palmroos 2014). Here, the
maximum and minimum values of expert opinions has been taken as the two terminal points of the
“triangular fuzzy” numbers. Further, it has included geometric mean that is considered as the
membership degree of the fuzzy numbers. This has been helpful to derive various statistically
unbiased impacts. Moreover, the geometric mean has been considered as the membership degree of
various fuzzy numbers for deriving statistically unbiased impact and doing away with the effect of
the extreme values. The method has been creating more effective impact of selecting the criteria.
Here it has featured the benefits of simplicity and the expert opinions have been encompassed in one
investigation (Ameyaw et al. 2016).
The organization must understand the contrasting view between Fuzzy Delphi methods from
the conventional one. Here both the processes are expected to gather group decision of various
expert opinions. This method has been needed to undertake various investigations for achieving
consistency of various expert opinions. However, the fuzzy method has been needed just one single
investigation and every opinions are been covered (Lee et al. 2016). Previously the experts has been
forced and needed to change the opinions for meeting the mean values of every expert opinion. As
the opinions ate modified, this gets excluded. In this way it has been possible that important data get
lost. However, the latest Delphi method gas been respecting the initial opinions of the experts. It has
provided distinct membership degree for every possible consensus. The previous has needed notable
time to gather the opinions of experts. There, the cost has been high, and the fuzziness of the process
cannot be excluded (Hsueh 2015). However, the Delphi method to be used in the current case study
has possessed the weaknesses mentioned above.

7DEVELOPMENT AND IMPLEMENTATION OF SECURITY PROGRAM
Thus the primary benefit of the fuzzy Delphi method for gathering group decision has been
ling that every expert opinion should be integrated and considered for achieving consensus of
different group decisions. Besides, the various fuzzy elements of human thinking, subjective and
uncertain messages are also introduced. Further, it has been reducing the consumption and
investigation of time and cost.
3. Security programm:
This segment discusses the policy statements addressing threats that are demonstrated above.
The risk program of the current organization has been objective. Hence a data driven risk analysis is
needed for the risk management strategy. There are three distinct levels available. The experts must
be working on understanding the risks as compared to various threat scenario and patterns of attacks
identified by the above Delphi method (Cherry and Jacob 2016). The organization must develop a
plan that should prioritizing problem of the areas that has been getting the most out of the security
budget. Moreover, important business leaders and stakeholders must have the confidence the
security strategy. Thus they must be confident to keep the company protected.

8DEVELOPMENT AND IMPLEMENTATION OF SECURITY PROGRAM
Figure 2: “Security policies in terms of attacks, requirements and measures”
(Source: Fang et al. 2014, pp.1596-1605)
As the biggest risks are identified, the organization can plan as per the needs. They can be
helpful with various periodic reviews for verifying controls that they have been working with and
seek potential weaknesses within the security strategy. Further, expert cyber security risk analysis
with diagnostic methods is to be done creating from years of various legacy technologies (Greenberg
2017). It also consists of insights from the data derived from the Delphi method that must highlight
the threat patterns leading to real data breaches. Moreover, there must be direct mapping of the most
common framework of cyber-risk management framework. This must be helpful to understand the
risk levels around the likely scenarios.
The levels of protections have been helpful. Here, the threat profiles and necessities of
security have not been specific. The solution has been designed to meet those requirements through
utilizing various industry-specific data for defending against the threats that has mattered the most.

9DEVELOPMENT AND IMPLEMENTATION OF SECURITY PROGRAM
The “risk-rating” must be done through evaluation of risk-reducing the controls effectively and
simply. The reviews of the external security controls from the most common security threats must be
identified (Hammer 2015). A quarterly diagnostic score must be generated. Further extra guidance
must be provided to decrease cyber risk that must be referring to attack patterns identified in Delphi.
The security program must be including maturity-based and comprehensive risk analysis
against the important cyber threats. The external and internal security controls must be reviewed
against the wide number of cyber threats. A quarterly cyber security risk analysis must be done
against primary security controls (Kavanagh and Johnson 2017). This must include
recommendations for reducing the risks. The controls against the primary controls must be compared
and controlled against primary control frameworks and various industry peers.
The security analysis must be including customizable activities for analyzing risk levels on
the basis of the methodology. The internal, external, security controls must be reviewed. A monthly
adaptive risk score must be provided and the risk-reducing controls must be selected and examined.
The position must rate against the primary control systems and peers of industry. This is dependent
on the scoring method of Delphi. This should be based on the methodology of maturity and
particular risk-scoring (Laudon and Laudon 2016). A strong defense must be created with data and
insight. The cyber risk security programs are helpful to defend the risks better. This is done through
managing those risks in a more deliberate manner. This is helpful for the organization to move on.
Further, the origination must undertake simple intuition for risk models on the basis of evidence. The
organization must be helpful to understand the risk, then prioritize remediation efforts and then use
proactive measures of security. Then subjective risk scoring must be conducted on the basis of
evidence-based scoring. The threat intelligence must be converted from the Delphi method to real
risk assessment (Li et al. 2014). This is helpful to better understand and guard the threats. Next a

10DEVELOPMENT AND IMPLEMENTATION OF SECURITY PROGRAM
fragmented view must be developed towards a wider one. Here, the security can be fragmented with
various technologies and vendors who have been working independently. Visibility must be
provided around the network. This must be consolidating controlling of security services and
products to react more efficiently to the attacks.
This security program consists of an advantage. This is helpful to get a better place to
manage risks in terms of various factors. The first one is global visibility. The company’s network
must provide various insights of current attacks and threats. Further, there should be deep expertise
where some of the most high-profile global breaches must be investigated every year. Next there
should be security intelligence and people must know the ways in which the attackers ha been
working and the things they actually needs (Peltier 2016).
Besides, the organization can utilize encryption over their wireless network. The information must
be encrypted over the wireless network. Hence, the nearby attacks must understand the
communications. Here, the encryption has been scrambling information sent to the code. In this way
it has not been accessible to other people. The modern routers have been offering WPA2. This is the
strongest wireless encryption available widely. This must be used to protect the data. Apart from this
the organization must limit the access to the network (Ross 2017). They must permit particular
devices for accessing the wireless network. They have the mechanism to permit the devices with
specific MAC or “Media Access Control”. They must address the access to that network. As the
organization needs to deliver free Wi-Fi for the users, they must set up the public network. This must
be distinct from the network for the business devices.

11DEVELOPMENT AND IMPLEMENTATION OF SECURITY PROGRAM
4. Implementation of security program:
Specifying every policy:
The good security policy must set the primary rules for the information security at the current
business. The rules have been highly mandatory and should be seen around the company. As the
security requirements have been varying from one company to another, the security policy must be
done in the same way (Stair and Reynolds 2017). Hence it has been important that those security
policies must be done according to the necessities and the business policies and goals of the
companies. This must be supported by every employees and it has been enforceable. The security
policy has been very huge level, technology neutral and technology specific. The security policy can
be divided into three primary kinds. They are program level, issue-specific and system specific
policy.
System specific policy:
Here, the system specific policy has been focusing on various policy issues that the
management has decided for the particular system. Here, it has been addressing only a single system.
The issue specific and program level policy has been addressing policy from a wide level. It has
been encompassing the complete organization.
Organizational policy:
Further, there has been choice to develop specific kind of policy depending on the
requirements of the organization. Besides, the most vital aspect has been that the policy has been
meeting the direction. This can be utilized on the basis to make various other lower levels of
decisions (Stark 2015).