Develop and Implement Policy: A Case Study of Widget Enterprises

Running Head: WIDGET ENTERPRISES 1
Develop and Implement Policy: A Case Study of Widget Enterprises
By
University Affiliation
Date

WIDGET ENTERPRISES 2
WIDGET ENTERPRISES: CYBER INCIDENT RESPONSE POLICY
Purpose and Background
The role of this document is to enumerate the widget’s approach to the management of
Information Security (IS) incidents. An information security incident is the loss or compromise
of the widget’s information through deliberate or accidental acts.
Scope
This document will cover the responsibilities of management and staff in identifying, reporting
and managing information security incidents.
Key Assets
The following are the assets that are vulnerable to information security incidents.
ASSET DESCRIPTION AND RISK PROTECTION
ATTRIBUTES
Windows
Server
Provides email and file storage Unauthorized modification/
availability
NAS Provides backup Unauthorized modification/
availability
Laptops Used for daily task and to store company
information and working tools.
unauthorized
access/availability
Network
Infrastructure
Network switch and wireless access Availability

WIDGET ENTERPRISES 3
Company
information
Clients and staff information held by the
organization
Unauthorized access
Threat Environment and Incident Types
Threat Environment
Threat Description and Risk
Cyber Crime Masquerading, snooping, ransomware attack, financial crimes.
Groups motivated
issues
Denial of service attack, eavesdropping, website defacement, and
defamation
State-sponsored
hacker
Snooping, spoofing
Reporting Procedures and Responsibilities
Key roles and responsibilities
The responsibilities of management in managing cybersecurity are as shown below.
WHO Responsibility
All Staff To familiarize with reporting procedures and to report any known or
suspected information security incident.
Office Manager To manage the security incidents
Business owner Updating reporting procedures, training staff, ensure appropriate follow-

WIDGET ENTERPRISES 4
up actions are taken and manage recovery from ransom attack.
Reporting Procedures and Immediate Actions
The staff should follow the following procedure in handling security incidents; first, report it to
the office manager. Second, restart the computer and see if the problem will be resolved. Third,
if one has access to email services, notify all the staff about the incident via email. Fourth,
change the password if possible. Five, install and run an antivirus if possible. If all that does not
work the staff should take their laptops to the office manager so that the manager can rectify the
problem.
Incident Response
Assessment and Response procedure
After receiving the laptop from the staff the office manager shall perform the following tasks.
First, run a backup on the server to the NAS and then isolate the NAS and the server from the
network. Secondly, notify all the staff not affected to immediately backup their data to the AWS
bucket on the following URL: https://aws.Widget.customerprivatedata.bucket. Third, the
manager shall direct all the staff to change their passwords, install and run antivirus. If they
encounter any problem they should contact the manager. Fourth, loss assessment in which case
the office manager shall compile a report for the business owner advising the owner accordingly.
Six, if the demand of a ransom is made the owner will make a decision as to whether it will be
paid.
Stakeholder Notification/ Reporting Obligations