Information Security Issues: Cryptography and Key Management Solutions

This report, prepared as a security engineer, addresses the implementation of cryptography and key management solutions within an organization. It begins by defining data criticality and exploring methods to identify the criticality of business processes, applications, and information. The report then details the rationale behind selecting specific cryptographic solutions and narrows the options down to two relevant choices. The report examines crucial aspects of information security, including the significance of cryptography in safeguarding data transmitted over the internet, and the role of encryption in protecting sensitive information. It also covers essential security measures such as strong passwords, biometric logins, and employee awareness programs. The report highlights the importance of adhering to industry standards, evaluating system vulnerabilities, and the need for robust information security policies to protect against threats like insider attacks, social engineering, and data breaches.

Running head: INFORMATION SECURITY ISSUES
1
INFORMATION SECURITY ISSUES
Student’s Name
Institutional Affiliation
Date of Submission

INFORMATION SECURITY ISSUES 2
Information Security Issues
Information is critical in every organization and for every individual. Information, when
exposed to unauthorized personnel, causes a lot of inconveniences in organizational and
individual reputation. Technological advancement in the current world is responsible for
information explosion. The high information availability and the dependence on computers
create an excellent platform to threats of information attacks. The aspects of information security
and cybersecurity have been introduced to guarantee the protection of computer systems and
information from threats. Cryptography is highly essential in this technological era. The
technology significance can be seen by many since it helps with the protection of the information
which travels over the internet. Cryptology has managed to offer security since this technological
era has been vulnerable to hackers, viruses and electronic fraud. In my opinion, cryptography
will involve the use of encryption which will offer protection to the content found on the
internet. The material will include emails, telephone calls which uses the internet as the main
medium and any transaction which may occur on the internet.
Information security ensures the integrity of information in the organization by providing
accurate information about all the activities taking within the organization. The organization
ensures the integrity of information by setting measures to hinder manipulation and loss of
information. File management practices can be used to ensure the monitoring of organization
processes to detect any errors in the organization information. Through the use of strong
passwords, facial recognition, and biometric login systems organizations can ensure
confidentiality of information. Unauthorised access is can be avoided by having an effective
information security program in the organization. The information available in the organization
guarantees successful transactions. Delay or denial of service attacks brings great losses to the

INFORMATION SECURITY ISSUES 3
organization. Information technology managers should ensure that t information security
measures are implemented to guarantee the availability of information to customers and
organization employees.
Most companies have benefited from advancement in technology because the operations
are fast and convenient. Therefore, security must be provided to the system of companies to
evade intruders from accessing critical company information. Security engineers should evaluate
the system frequently to ensure codes get developed to keep information more secure.
Cryptography assists in writing codes that align with specific projects and requires developers to
generate a sustainable system. The standards of cryptography solve most challenges encountered
by developers; thus, the standards of a company dictate the implementation plan (Suykerbuyk &
Merry, 2015). Therefore, the report addresses how implementation of cryptography and
fundamental management solutions will tackle the risks.
Information security is critical in the organization since it ensures safe operations of
applications used in the daily functioning of the organizations. Application software forms the
basis which external attacks poses a threat to organization information through malware attacks.
Information security plays a crucial role in ensuring the security of data stored in organization
devices. Through the installation of antivirus software, computer systems can be protected from
external threats and aid in day to day operation in the organization.
Method of Defining Criticality of Data
All data owners get identified because each member in the management supervises a
particular category in the business entity. Therefore, the data owner gives access or may appoint
a person to allow access to the unit in the system. Moreover, any security threats get corrected
when the data report the violations in due time. Secondly determining all custodians of the data

INFORMATION SECURITY ISSUES 4
plays an important role since the IT department is held accountable in this sector. Therefore,
their main role involves includes fulfilling security policies of the company and backing up
information. Classifying data assists in outlining the type of information shared to different
stakeholders of the company (Shin et al., 2015). After that, a risk assessment process follows
where the existing challenges get addressed, and upcoming issues get blocked by formulation of
new strategies t curb the threats. Mostly, encryption protects sensitive information by converting
plain texts into a form that is unreadable. Therefore, the developers strengthen the encryption
resulting in the safety of the data.
Each process of a business can get measured through checking if processed occur
properly. Therefore, the firm could get subjected to high environmental, financial and legal risks.
High-risk activities contribute to the functionality of business; hence, more attention is dedicated
to them. Where an individual has direct contact with the customer is critical because the
feedback from the services offered matters.
Through the implementation of information security policy, the organization ensures that
all employees in the organization know the importance of information security. It is the
responsibility of IT managers and general managers to ensure that the policy is implemented and
every employee in the organization observes the stipulated regulations. Information is the crucial
element of undertaking any transaction in the organization. All operations in the organization
depend on the availability of information CITATION Bod01 \l 1033 (Bodnar, 2001). Also, the
organization holds both its information and that of customers; hence, there is a need to ensure
customer information is secure to enhance customer loyalty.
Employee information security awareness is crucial in ensuring information security in
the organization. Insider attacks are the most severe attacks on the information in the

INFORMATION SECURITY ISSUES 5
organization. All employees must be informed about the information security practices to
maintain. Email management is one of the issues that organization employees should be guided
on the need to avoid clicking unknown links. Social engineering is trending, and all organization
employees should be aware of the various ways which social engineering can be used to make
the source of an attack.
The rationale of selection criteria
Credit cards are protected by the manufacturer since they ensure third parties cannot
acquire personal details of a holder. Payment Cards Industry Data Security Cards includes a set
of guidelines on the techniques to secure the numbers on credit and the code of service (Mullen
& Reutzel, 2019). It is important to find technologies that secure the cards without easy invasion
y third parties. Merchants must meet the requirement of having numerous options of technology
that secure the credit cards.
The mode of web security which will be used under cryptography will be through the use
of cryptographic checksums, also referred to as a hash. I have managed to use this form of web
security which will involve the assigning of a mathematical value to a file that will be verified
later on to see if there was a security breach or not. The data which is stored in the file shall be
translated into a sequence of digits which will be fixed and will refer to a hash value.
I have found that the use of cryptographic checksum has been beneficial to data which
has either been stored or is being transmitted. The second threat which I have observed will be
the breach of confidentiality. The violation of privacy due security risk will be due to the theft of
information from the web server as well as from the client, information on the configuration of
the network and data surrounding the person who communicates with the server.
Process of selecting the criteria

INFORMATION SECURITY ISSUES 6
First, it is important to understand the procedure; therefore, the main aim involves
protecting the PAN digits of a credit card. Apart from securing the name of the holder, date of
expiration and service code from unwanted inspection, only the PAN number is required for
encryption. Application layer and transparent database encryptions secure data even in
tokenisation setups (Mukherjee, 2019). The two methods of encryption are the best because they
deter information from reaching unwanted inspection of media.
Justifying the rationale for management to approve the recommendations includes
providing the risk management policy, providing an outline of technological particulars and, also
providing the implementation that will generate benefits to the operations.
The implementation plan constitutes providing an introduction, describing the scope
and objectives of the project, mentioning the schedule and risk issues that may arise (Mukherjee,
2019). Moreover, constraints and habit will be provided.
Seeking management approval
PLO Limited
Descriptive Letter to Management
For the year ended 30 June 2019
Date
The Directory Board of PLO
Dear Madam
Letter to management or the year ended 30th June 2019
This letter addresses accounting standards guided in conducting audits at the end of this
year’s financial analysis. Therefore, the policies assist in determining that financial statements
provided are not biased. The aim of the audit is to express an opinion on the statements prepared

INFORMATION SECURITY ISSUES 7
that are overseen by the directors. The letter addresses specific issues that got identified on the
audit for the year ended 30 June 2019. The report contains details of the matters and the
responses from supervisors.
We thank you for the cooperation during audits and are readily available for clarifications
on segments not well understood.
Yours faithfully
Accounts Department
Report
Table of content
General Outline of Performance 1.1
PLO Dormant Account 1.2
Audit recommendations 1.2
1.0
On the general outline performance, the audit addresses a critical issue on operations that
requires quick attention by the management. Therefore, the effort in improvement gets
showcased towards operational efficacy.
1.1
A dormant account was determined during the audits; hence, it had not been operational
over a long period. No activities have taken place in the account since 2007. It was described that
the account had been dominant since it had accomplished its purpose (Sutherland, 2017).
Therefore, the auditors provided for the accounts to get closed since it could result in confusions
during future processes. The management provided that it would reactivate the account if another
donor would agree to fund a project upcoming to the firm.

INFORMATION SECURITY ISSUES 8
Due to the various security risks which will affect the network, multiple disciplines under
cryptography and the protection of the web have matured to provide applications which help
secure the network. According to the observation made, we managed to see that most businesses,
as well as government agencies, are currently using websites in their daily lives. The Internet has
continued to expand swiftly through time. Individual access is also widespread in this
technological era. The internet has been used for the commercial reason that is, e-commerce.
However, even though internet access is quite popular these days, the Web and the internet are
quite susceptible to various security risks. A high market for web security has been increasing as
millions and millions continue to access the web and the internet. In my view, web security will
highly be beneficial since, in this day and age, internet access is growing and will continue to
grow with every passing day.
Information security and solutions
Privacy vulnerabilities are regularly reported by media and research, whereby sensitive
data leaks to the public domain. Most of these incidences occur as a result of data being
exfiltrated maliciously by specific malware. Leaks, in most cases, do not happen because of
malicious intent by the application's author but rather as a result of misconfiguration of these
particular applications or side effects that are unexpected CITATION Sip09 \l 1033 (Siponen, 2009).
The problem is that applications can have the ability to exfiltrate the private data of a user and
supply or send it out to some different server.
In order to mitigate data security risks, some policies/procedures should be implemented
to ensure data protection and continuity of business. The first policy is a restriction of
data/information access. Conventional techniques for access restriction are authentication using
passwords or tokens, and application of different authorisation profiles to different users of the

INFORMATION SECURITY ISSUES 9
system, based on their varying roles. Authentication should be supplemented with audit trails,
and valuable information can be provided by inclusive activity logs, which is used to refine the
security measures effectiveness. Computer attacks result in a different effect on the computer.
Physical attacks affect the reliability of the machine and the availability of data. The electronic
attack erases the electronic memory, upsets the software and permanently disables the electronic
components. The computer network attack interrupts the reliability of data through malicious
codes.
Technology has provided the world with a more accessible platform where they can
communicate, do business, and interact efficiently. However, as innovation propels, issues of
trust and morals are also sky-rocketing. It is thus essential to authenticate a website before
sharing personal information, which will become possible if the developers provide a means of
checking and verifying.
The cryptography behind this technology will use two types of encryption. Different
algorithms will also be applied to the encodings, which will include mathematical equations
which are rarely cracked. Asymmetric encryption will employ a separate key which will be used
for the decrypting key which usually is regarded as a private key and for the encryption key
which can be used by anyone since it is a public key. For the secure encryption, the keys should
not go lower than or higher than 2048 bit where the 2048 bit will have encryption codes that are
distinctive that add up to 617 digits.
The symmetric encryption from what I have to observe is the fact that this type of
encryption will employ just one key which will be used for the encryption and decryption of the
data. The same key will be used by both the receiver of the data as well as the sender for
communication. From what I know the typical sizes which will be used for this type of

INFORMATION SECURITY ISSUES 10
encryption will be either 256-bit key or a 128-bit key. A 128 bit will offer over ten encryption
code possibilities. In my opinion, for one to crack the 128 bit, time will be consumed heavily
since the hacker will have to try all the keys which are available to the 128 bit. Either use of the
256 bit or the 128-bit key will rely on the web server as well as the software which has been
established by the software.
Cryptography has various roles which we have identified as a security professional where
the role will be crucial in the information system. One of the roles that encryption will play will
be the authentication of the owner of the data. Through the use of the digital signatures,
authentication has been much more comfortable since the data will be encrypted or will have a
digital signature which will help with the verification of the person who signed the data. The
authorisation will be the next role under cryptography CITATION For07 \l 1033 (Forouzan, 2007).
The authentication will be used to verify the identity of the person. However, encryption will
also be beneficial since it can be used to identify whether that particular person will have the
authority to continue with the transaction. Cryptography will provide techniques which can be
used by the authorised users. Hence, falsifying information will be quite hard.

INFORMATION SECURITY ISSUES 11
References
Bodnar, G. H., & Hopwood, W. S. (2001). Accounting information Systems.
Dror, I. E., Thompson, W. C., Meissner, C. A., Kornfield, I., Krane, D., Saks, M., & Risinger, M.
(2015). Letter to the editor-context management toolbox: a linear sequential unmasking
(LSU) approach for minimising cognitive bias in forensic decision making.
Forouzan, B. A. (2007). Cryptography & network security. McGraw-Hill, Inc.
Mukherjee, S. (2019). Popular SQL Server Database Encryption Choices. arXiv preprint
arXiv:1901.03179.
Mullen, J. D., & Reutzel, W. (2019). U.S. Patent Application No. 10/169,692.
Shin, J. H., Jun, H. B., Catteneo, C., Kiritsis, D., & Xirouchakis, P. (2015). Degradation mode
and criticality analysis based on product usage data. The International Journal of
Advanced Manufacturing Technology, 78(9-12), 1727-1742.
Siponen, M., & Willison, R. (2009). Information security management standards: Problems and
solutions. Information & Management, 46(5), 267-270.
Sutherland, D. W. (2017). Independent audit report. Newsmonth, 37(3), 19.
Suykerbuyk, J., & Merry, K. D. (2015). U.S. Patent Application No. 14/061,065.