Cybersecurity Report: Security Plan and Training Program

This report presents a detailed cybersecurity plan and training program designed for a Cyber Cafe. It begins with an executive summary highlighting the importance of cybersecurity in the IT-driven world and then proceeds to introduce the case study and its context. The report identifies various cyber threats like computer viruses, social engineering, phishing, ransomware, and email-based attacks. It then outlines a comprehensive security plan that includes security countermeasures such as Acceptable Use Policy (AUP), Access Control Policy (ACP), Incident Response (IR) Policy, Remote Access Policy, Email/Communication Policy, and Backup and Recovery Policy. The report emphasizes the need for staff training to raise awareness about cyber threats and provides insights into the role of a robust security policy. The report concludes by summarizing the key findings and advocating for the adoption of the proposed security measures to protect the Cyber Cafe from potential cyberattacks and data breaches.

1/19/2020
Running Head: CYBERSECURITY 0
Cybersecurity
Report
Student name

CYBERSECURITY 1
Executive Summary
In most industries, Information Technology (IT) has used for managing different operations
in a better way. It is helpful in the improvement of the performance and productivity of the
companies as well. This report will provide the introduction of cybersecurity for a firm.
Moreover, it will provide a security plan for Cyber Café in which it will discuss about the
risks and threats. It will provide the reason behind various issues in security. It will find
various solutions to those issues. This report will discuss about the security countermeasures
and training for the firm. It will explain the role of security policy for the company in the
later section of this report.

CYBERSECURITY 2
Table of Contents
Introduction................................................................................................................................2
Security Plan..............................................................................................................................2
Computer viruses:..................................................................................................................3
Social engineering:.................................................................................................................3
Phishing:.................................................................................................................................3
Ransomware:..........................................................................................................................3
Emails:....................................................................................................................................3
Security Countermeasures...........................................................................................................4
Acceptable Use Policy (AUP):...............................................................................................4
Access Control Policy (ACP):...............................................................................................4
Incident Response (IR) Policy:..............................................................................................4
Remote Access Policy:...........................................................................................................4
Email/Communication Policy:...............................................................................................5
Backup and Recovery Policy:................................................................................................5
Training......................................................................................................................................5
Security Policy...........................................................................................................................6
Conclusion..................................................................................................................................6
References..................................................................................................................................7

CYBERSECURITY 3
Introduction
In many industries, data and information has used for managing business functions. Data is
the base of many business functions and activities. It is helpful in the decision making as
well. Cybersecurity is a basic need of a firm in the present era, as most of the operations have
handled using IT-systems. In addition, cybersecurity is necessary to avoid risks and threats
(Von Solms & Van Niekerk, 2013). Thus, it is compulsory for all the firms to secure their
systems and business functions from different types of risks and threats, such as cyber-
attacks, cybercrime, and many more. This report will design a security plan for the Cyber
Café. It will include identifying risks and threats attacks of the firm. In this report, it will
provide solutions to different identify risks and threats of the firm, which can damage the
reputation of the firm. This report will include training, which will base on awareness for
staff members. This report will discuss about the security policy and its importance for the
company as well.
Security Plan
There are many risks in the market because of using IT-systems, as it has provided many
benefits to the firm. In the case Cyber Café (CC), it has provided different online services
including the Internet, telephone calls, and others. It is necessary to develop a security plan
and policy to secure their services and systems, as there are many malicious programs and
viruses, which can damage their systems as well as other financial data. Moreover, the CC
has faced a critical situation because of the lack of security policy. It is a necessary thing to
develop and implement security policies for an online service. However, firms must follow
the code of ethics in the use of IT-systems (ACSC, 2017).
In addition, the law enforcement agencies have shut down the CC for two days for
investigating because of a lack of security policies. It makes a huge impact on their image in
the market place. Thus, it is so necessary to develop security policies for their IT-assets. In
case of such issues, CC can avoid the investigation using a proper security policy and
framework. The CC can use mitigation strategies, which have provided by the government
agencies for all the firms that are using IT-system (ACSC, 2019).
Moreover, the CC has worked at three different locations, which are having different timing
and hardware. Thus, it is compulsory to develop a security policy and plan. Based on the

CYBERSECURITY 4
hardware and software of the CC. it should require a proper security policy and IT-systems to
secure all the things (Andrijcic & Horowitz, 2016).
The café should consider these risks and threats in their security policy and risk register to
avoid various things, which are not good for their business and reparation, which areas:
Computer viruses:
There are many malicious programs, which can damage the data and information of a
computer system, which is important for a user as well as others. It is necessary to secure all
the end-users and network from viruses using firewalls and antivirus software. CC should use
a firewall for their network and computer systems. It will secure their data and access rights
as well. It is a basic process to stay safe using security policies (Arlitsch & Edelman, 2014).
Social engineering:
The firm should aware their staff members and users for security policies and use of the
computer systems. Social engineering is a process in which hackers can access the system of
a firm without permission using personal details of their employees and users. Thus, all the
staff member should know that never share their personal credentials with anyone to secure
the whole system. It is a responsibility of the firm to aware of the new ways of cyber-attacks
(Bendovschi, 2015).
Phishing:
There are many suspicious and malicious websites, which are looking like original websites.
Thus, the user has provided their personal data and download free software, which has
included malware in them. Those programs are sharing data of that system to other users
without permission. Thus, it is necessary to avoid such types of practices using security
policies (Bhagat, 2012).
Ransomware:
It is a difficult process to avoid ransomware from a firm, as it can occur because of the poor
security of a network and computer system. As per the case study, CC has used internet
connection from a small company, which is not having any security rules and regulations,
which is a huge issue in front of the company as well. Thus, monitoring is necessary for
network and internet connection to avoid ransomware (Chang, 2017).

CYBERSECURITY 5
Emails:
Email is a common tool to send messages in this era. Thus, it is necessary to secure emails
using encryption and decryption techniques. In addition, hackers send malicious programs in
an email. Therefore, it is necessary to scan each mail before opening it in the browser as well
as download any matter form it (Datameer, 2018).
Security Countermeasures
CC must implement security policies for avoiding such types of risks and threats, which can
create a huge issue in front of the company. It is necessary to implement cybersecurity in a
firm (Dutton, 2017). The company must develop and implement these security policies to
avoid big issues on their premises, which areas:
Acceptable Use Policy (AUP):
The company should apply this policy to secure their computer systems and network. It is
necessary to secure the data and information of a firm, which is the basic need for the security
of a firm. Data is an important asset of a firm. Thus, it is necessary to monitor all the
processes and activities of the network. Besides, cybersecurity can reduce fear from cyber-
attacks (Klemash, 2018).
Access Control Policy (ACP):
It is necessary to secure access on the Internet and other IT-assets, such as computer systems,
networks and other things to secure all the data and information from external threats.
Moreover, most of the people can use their authenticated ID and passwords for accessing the
IT-systems. It should be properly recorded by the firm. Email access should be secure in a
firm (Levin, 2019).
Incident Response (IR) Policy:
There are many suspicious activities that happened in a network, which must be monitor by
the company. It is the best way to know about any incident in their initial stage to overcome
the damages of data and other things. It is a responsible way to avoid risks and threats of a
company, cybersecurity strategy is necessary to prevent IT-assets for many threats (Porup,
2017).
Remote Access Policy:
Many systems are accessible from remote locations that are an issue in the firm. In addition,
there is some basic need for remote access, but it should be protected using firewalls and

CYBERSECURITY 6
IDS/IPS systems. It will secure all the connections of the CC. additionally, cybersecurity is a
basic need for a firm (Quiocho, 2018).
Email/Communication Policy:
Email is a common way of communication. Thus, it is necessary to secure an internet
connection and network to avoid malware and viruses from emails. CC has faced a big issue
because of threat mail has sent from their location. Therefore, it is necessary to make a proper
record of access to internet services. It will better to identify the person, who send this mail.
Moreover, Cisco has provided mitigation strategies for firms (Stilgherrian, 2018).
Backup and Recovery Policy:
Many times, data has lost because of viruses and ransomware. Thus, it will be a better
solution to creating and backup up all the data and information in the data centre or cloud
storage. It is the best way to avoid critical situations. CC can recover their data from backup
storage for business continuity. Moreover, it should connect with all three locations. It is the
biggest threat for the company, as most of the companies have faced issues in the execution
of policies. Thus, it is necessary to update policies time-to-time (Zadelhoff, 2016).
Training
Many users are not aware about the cyber-threats and cyber-attacks. Thus, it is necessary to
provide training and rules and regulations for accessing the internet and other services. In
addition, basic training is necessary to use such types of systems, such as the internet,
computer systems, and other assets. Moreover, people can manage their services using rules
and regulations of national and international consortium (Andrijcic & Horowitz, 2016).
Moreover, users should provide their original identity to the manager of the café, which is for
the identification of systems and their access to the internet. Besides, there is much other
software to identify access to the internet and monitoring all the activities. Training is
necessary to avoid basic risks and threats of the company because of a lack of knowledge,
such as phishing, social engineering, and many others (Von Solms & Van Niekerk, 2013).
Moreover, rules and regulations should be provided to each user in their primes as per the
government regulations. It is good practice to avoid risks and threats. Moreover, it will be
better for the company, as it will develop trust between the company and its users. There are
many benefits of security policies for CC. however, it requires a small cost to provide
training and security policy generation (Stilgherrian, 2018).

CYBERSECURITY 7
Security Policy
There are many advantages of security policies in a firm, as it has provided legal rights to
avoid risks and threats. Moreover, security policies have used to avoid risks and threats. In
addition, security policies have used for controlling and managing different IT-assets
including internet access and other things. Moreover, CC can avoid all those risks and threats
using security policies. Besides, the hacker has used new programs to hack systems (Porup,
2017).
Thus, it is necessary to monitor suspicious activities using the network and server monitoring
tools and techniques. It will provide more security for the company. Cybersecurity is a
complete package to secure all the things in a proper manner. In addition, most of the IT
firms have used ISO frameworks for security and risk analysis, such as ISO 27001, ISO
31000, and many others (Porup, 2017).
Moreover, training is a necessary part of a system, which has used IT-systems, such as
internet access, emails, data transfer, and many others. Ultimately, CC must adopt security
policies for managing their risks and threats, which can be occurred because of the
vulnerabilities of the firm. It can be a huge issue for their image in the market. Thus, firewalls
and IDS systems have used for security and training should be provided to all the employees
to secure all the processes (Datameer, 2018).
Conclusion
In conclusion, Cyber Café should adopt those security policies to avoid the risks and threats
because of a lack of security policies. Moreover, malware and viruses can avoid using
antiviruses and firewall systems. In addition, the company must implement security policies
of all the users and staff members to prevent their systems from any malicious activity in the
future. This report has analysed the case study and it has provided security plans and policies
to avoid risks and threats. It has provided solutions to all the risks and threats of the firm.
Finally, CC should improve its hardware and software to prevent their data and information.
Emerging technologies will provide better opportunism in the future.

CYBERSECURITY 8
References
ACSC, 2017. Australian Cyber Security Centre. [Online]
Available at: https://www.acsc.gov.au/publications/ACSC_Threat_Report_2017.pdf
[Accessed 12 December 2018].
ACSC, 2019. Strategies to Mitigate Cyber Security Incidents. [Online]
Available at: https://acsc.gov.au/infosec/mitigationstrategies.htm
[Accessed 3 September 2019].
Andrijcic, E. & Horowitz, B., 2016. A Macro‐Economic Framework for Evaluation of Cyber
Security Risks Related to Protection of Intellectual Property. Risk analysis, 26(4), pp. 907-
923.
Arlitsch, K. & Edelman, A., 2014. Staying safe: Cyber security for people and organizations.
Journal of Library Administration, 54(1), pp. 46-56.
Bendovschi, A., 2015. Cyber-attacks–trends, patterns and security countermeasures.
Procedia Economics and Finance, Volume 28, pp. 24-31.
Bhagat, . B. C., 2012. Cloud computing governance, cyber security, risk, and compliance
business rules system and method. U. S., Patent No. 13/016,999.
Chang, L. Y., 2017. Cybercrime and Cyber security in ASEAN. In Comparative Criminology
in Asia, pp. 135-148.
Datameer, 2018. Challenges to Cyber Security & How Big Data Analytics Can Help.
[Online]
Available at: https://www.datameer.com/blog/challenges-to-cyber-security-and-how-big-
data-analytics-can-help/
[Accessed 3 May 2019].
Dutton, J., 2017. three-pillars-of-cyber-security. [Online]
Available at: https://www.itgovernance.co.uk/blog/three-pillars-of-cyber-security
Klemash, S., 2018. As cybersecurity threats grow, boards examine the options for overseeing
the risks. [Online]
Available at: https://www.ey.com/en_gl/board-matters/how-boards-can-prepare-for-the-next-
cybersecurity-threat

CYBERSECURITY 9
Levin, A. K., 2019. Email Is the Biggest Threat to Business, So Why Is Everyone Using It?.
[Online]
Available at: https://www.inc.com/adam-levin/email-is-biggest-threat-to-business-so-why-is-
everyone-using-it.html
[Accessed 22 January 2020].
Porup, J., 2017. What is cyber security? How to build a cyber security strategy. [Online]
Available at: https://www.csoonline.com/article/3242690/what-is-cyber-security-how-to-
build-a-cyber-security-strategy.html
[Accessed 1 September 2019].
Quiocho, C., 2018. Why Cybersecurity Is Becoming A Top-Priority Investment. [Online]
Available at: https://www.forbes.com/sites/theyec/2018/08/31/why-cybersecurity-is-
becoming-a-top-priority-investment/#851a14811f32
Stilgherrian, 2018. CISOs given cyber leadership role in Australia's new Information
Security Manual. [Online]
Available at: https://www.zdnet.com/article/cisos-given-cyber-leadership-role-in-australias-
new-information-security-manual/
[Accessed 22 January 2020].
Von Solms, R. & Van Niekerk, J., 2013. From information security to cyber security.
computers & security, Volume 38, pp. 97-102.
Zadelhoff, M. v., 2016. The Biggest Cybersecurity Threats Are Inside Your Company.
[Online]
Available at: https://hbr.org/2016/09/the-biggest-cybersecurity-threats-are-inside-your-
company
[Accessed 22 Jaunary 2020].