Security Plan and Training Program Report for ICT205, T219 at KOI

This report provides a comprehensive security plan and training program, addressing various aspects of cybersecurity within an organization. It begins with an introduction to information security and its importance, followed by a discussion of security risks, including vulnerabilities, lack of security policies, and threats such as natural disasters, system failures, and human error. The report then delves into security countermeasures for common attacks like phishing, malware, and weak passwords. It emphasizes the significance of employee training in cybersecurity awareness, covering topics like phishing and spam prevention, acceptable use policies, and device management. Furthermore, the report outlines the components of a security policy, including its purpose, scope, objectives, and authorization controls. The conclusion highlights the importance of incident response, business continuity, and disaster recovery, while also acknowledging the organization's vulnerability to social engineering and poor password security.

Running head: SECURITY PLAN AND TRAINING PROGRAM
SECURITY PLAN AND TRAINING PROGRAM
Name of the Student
Name of the University
Author Note:

1SECURITY PLAN AND TRAINING PROGRAM
Executive Summary
An Information Technology (IT) policy aims to identify certain number of rules and procedure
which is needed for using IT assets and resources of an organization. It is a policy model suitable
for organization culture that guides certain rules and procedure that are driven from employee
approach. An effective IT policy is considered to be a unique document for an organization
which analyses how people see and value the information. This particular organization can
enhance its security by analysing some fundamental strategy like making use of licensed copies
of software. This particular copies have minimum chance of virus in them as they limit the
access to both system and files in them.

2SECURITY PLAN AND TRAINING PROGRAM
Table of Contents
Introduction..........................................................................................................................3
Discussion............................................................................................................................3
Security Plan....................................................................................................................3
Security Countermeasures...............................................................................................5
Training............................................................................................................................7
Security Policy.................................................................................................................8
Conclusion...........................................................................................................................9
References..........................................................................................................................11

3SECURITY PLAN AND TRAINING PROGRAM
Introduction
Information security is completely changing the face of the whole world. Information
technology has not connected the whole world to a single platform. In addition, it is helping the
integration of traditional societies into the current society. Information security aims to result in
new security and ethical issues (Bada, Sasse and Nurse 2019). Data security is a huge a domain
which aims to protect the overall integrity of system within the network. It focus on protecting a
system from any kind of internal and external threat. Security plan aims to create proper
guidelines so that they can ensure the safety of the organization from any risk. It might come into
picture as a result of changing technology and their business needs. For protecting the vital
resources that require major risk of storage facilities. It is very much important for organization
for ensuring their current state (Aldawood, and Skinner 2019). Security planning is required for
protecting public health and safety. Security is considered to be complex which combines a
number of factors. All the given factors are required to be there for ensuring safety of the
organization.
In the coming pages of the report, a proper security plan has been provided for this
organization. In addition, security countermeasures and training to employees has been discussed
in the report.
Discussion
Security Plan
Cybersecurity is all about complete understanding, managing, controlling and managing
various kind of risk for the critical asset of the organization. Some of the common security risks
with this organization are

4SECURITY PLAN AND TRAINING PROGRAM
Failure to cover the basis of cyber-security: Some of the common vulnerabilities and
exploits used by attackers reveal fundamental of cyber-security measures (Miranda 2018).
Cyber-criminals makes use of a huge number of vulnerabilities for hacking into the organization
system.
Lack of Cyber-security Policy: Security Standards are found to be compulsory for any
business. At present, cybercriminals are targeting finance or technical sectors (Bada, Von Solms
and Agrafiotis 2019). As a result of an increase in overall number of security breach has lead the
management to be completely aware of everything.
Confusion of compliance with cyber-security: Business has to deal with another kind of
risk that is the confusion in between compliance and cyber-security policy (Croasdell, Elste and
Hill 2018). There is need of ensuring compliance with the organization rules which is not
equivalent with the cyber-attack.
Threat can be defined as anything which can easily exploit the vulnerability for any kind
of security breach. Some of the common threats in an organization are
Natural Disaster: Different natural disaster like flood, hurricanes, fire, and earthquake
can bring much destruction in comparison to the hacker. In this situation, organization will not
only lose data but also the server and application.
System failure: The chances of system failure merely depends on the quality of system.
For new and high-quality equipment, there are many chances that the system failure is much very
low (Alshaikh et al. 2018). If the equipment is found to be old or of no-name vendor then the
overall chances of failure are much more.
Human Interface: This particular threat is much high in organization irrespective of the
business of the organization. If an employee of organization accidentally deletes vital files, clicks

5SECURITY PLAN AND TRAINING PROGRAM
on malware links and bring physical damages to the equipment (Conteh and Schmick 2016).
There is need for back of information data which is inclusive of system setting and ACL
information.
Some of the common security attacks on an organization are
Malware: It merely refers to different kinds of harmful software like virus and
ransomware. As soon as the malware enters into the system it can easily take full control of the
system. An attacker can make use of list of methods for getting malware into the target system.
Phishing attack: In this attack, an attacker aim to send an email which appears to be
from trusted source. The email will either have an attachment or link to open (Peccoud et al.
2018). By clicking on the malicious attachment, user will install the malware to the system.
SQL Injection attack: SQL can be expanded as Structured Query language which is a
well-known programming language used for communicating with the database. Most of the
server aims to store data for both website and services.
Cross-site Scripting: In this SQL injection attack, an attacker merely goes after any
vulnerable website for data storage like user credential and sensitive data. If the attacker targets
the website user directly, they will merely go for cross-scripting attack (Al-Janabi and Al-
Shourbaji 2016). The most common method of attack is injection of malicious code for common
script which can run automatically.
Security Countermeasures
Phishing attack: It is a high tech scam that makes use of email for deceiving the user to
disclose personal information (Christopher, Choo and Dehghantanha 2017). In this attack,
personal information and organization information is put to risk. Some of the countermeasures of
phishing attack are

6SECURITY PLAN AND TRAINING PROGRAM
 Looking for phishing and spear phishing attack.
 Deletion of suspicious emails.
 Reporting of any problem for potential incidents
 Proper configuration of Intrusion detection system for blocking the malicious domain.
 There is need of ensuring that anti-virus software is updated.
Malicious Code: It is the software which aims to damage or even creates any unwanted
behaviour (Jin et al. 2018). There are large number of countermeasure which should be taken for
guarding against the malicious code like
 E-mail surfing in plain text
 Opening email attachment safely
 Scanning all the attachment before opening any email.
 Deleting emails from unknown sender
Weak and Default Password: Use of weak and default password aims to create certain
vulnerabilities which are easily exploitable. There is a list of countermeasures which should be
taken for guarding the password compromising.
 Making a combination of letter and special characters.
 Changing password at per the policy of the organization.
 Not saving password or login details on browser.
Outdate Software: It merely aims to provide certain number of vulnerabilities and
opportunities for gaining access to the information system (Vaughn Jr and Morris 2016). There
are large number of countermeasures for this
 Complying with certain measures within the organization which includes technology
control plan.

7SECURITY PLAN AND TRAINING PROGRAM
 Carrying out system audit on regular basis
 Not completely depending on firewall for protect against different kind of attack.
 Disconnecting system in case of severe attack.
Running a parallel method for reducing system failure: Parallel run can be defined as a
method which is used for transferring in between old system and target system within the
organization. For reducing the overall risk, both the old and new system need to run
simultaneously for the given period of time (Al-Daeef, Basir and Saudi 2017). If all the criteria
for new system is met then the old system is completely disabled. Using this method,
information can be easily retrieved after system failure.
Training
Security awareness training merely starts when the organization understands that their
employee is considered to be weakest cyber-security link. Training merely provides employee
with complete understanding about current cyber threats. In addition, it prepares enterprise
employee for cyber-attacks and threats. Preparing the staff members for cyber-attacks is
considered to be important process for the organization (Anwar et al. 2017). Cyber-security
awareness is required as it provides addressing drawbacks and consequences for it. Security
awareness culture is considered to be very much important for an organization. Employees need
to be trained so that they can look out for scam emails and messages which will help in
preventing cyber-attacks. Attacks on business mail mainly comprise of organization by having
details from different recipients. It can be in the form of fraudulent mail which is sent from
someone which can be HR department of the organization (Newhouse et al. 2017). By the help
of phishing and spam training, employees can be more aware of thing which they are looking for
any suspicious thing.

8SECURITY PLAN AND TRAINING PROGRAM
Acceptable use policy is found to be effective in workplace. Employees of an
organization need to teach their staff members so that they are used to make use of safe and
secure method for reducing risk. As soon as the policy is kept in place it is important for re-
establishing it with the team members. It merely requires lot of trust and support from the line
manager. Confidence is very much comfortable for reporting to certain number of breaches. If
the employees are made to feel comfortable about this incident then they will become much
receptive for coming to forward (Ali and Awad 2018). It ultimately result in blameless work
culture so that employees can feel confident and prepared. In addition to this, employees should
be given proper device management so that they can be completely aware of new software
updates. In addition, two popular methods that are remote access and Wi-Fi training are two
popular methods which can be adapted for training. By using a virtual private network,
employees who are working remotely can make use of VPN for all associated activities
(Croasdell, Elste and Hill 2018). Wi-Fi network needs to be password protected and certain
feature of strong security setting is merely advised to an employee. It is achieved by making use
of tablets and smartphone which should be opted for smartphone and tablets.
Security Policy
Information Security Policy can be defined as a set of rules which are enacted by an
organization. It merely ensures that all the users in the IT structure lie within the organization
domain (Alshaikh et al. 2018). It is merely achieved for security data which is stored in the
boundaries of the organization.
Purpose of the Policy
 For creating a general approach to information security.

9SECURITY PLAN AND TRAINING PROGRAM
 To protect the overall reputation of the organization considering legal and ethical
responsibilities.
 Observing the rights of the customer.
Scope
 Information security policy should address all the required data, system, programs and
other infrastructure.
Information Security Objectives
 Information security merely focus on three main objectives that are confidentiality,
integrity and availability.
Authorization and access control policy
 In general, the security policy comes up with hierarchical pattern. It focus on the fact that
internal staff are not bound to share any information.
 Both application and database service will have restricted application that corresponds to
the business owners.
Data Support and Operation
 The general system regulation is merely responsible for data protection that is latest
firewall and updated anti-virus protection.
Conclusion
The above page help us in concluding the point that this report is all about security plan
and training program. In the report, a complete detail has been provided about the how
organization can attain security. Also, it address certain number of solution so that they can
safeguard the organization. Identification has been done with respect to the level of awareness
that is provided to user. A proper security plan has been developed in the report. The present

10SECURITY PLAN AND TRAINING PROGRAM
security management has come to the point that organization lacks in some domain like incident
response, business continuity and disaster recovery. In addition, the organization is easily
exposed to social engineering attacks and poor password security. Disaster recovery is known to
be a part of security as authorities aim to protect data from any natural or manmade attacks.
Organization require to enhance the overall security by analysing strategies that is used in
software that are licensed copy. In some system, the virus can be installed by reducing the
complete access to system and required files. Proper password and access code can easily
provide security at this particular level. It will merely prevent the complete access to the system.
If the organization information is completely exposed to risk then use of information security
will result in small faction of risk.

11SECURITY PLAN AND TRAINING PROGRAM
References
Al-Daeef, M.M., Basir, N. and Saudi, M.M., 2017. Security awareness training: A review.
In Proceedings of the World Congress on Engineering (Vol. 1, pp. 5-7).
Aldawood, H. and Skinner, G., 2019. Reviewing Cyber Security Social Engineering Training
and Awareness Programs—Pitfalls and Ongoing Issues. Future Internet, 11(3), p.73.
Ali, B. and Awad, A., 2018. Cyber and physical security vulnerability assessment for IoT-based
smart homes. Sensors, 18(3), p.817.
Al-Janabi, S. and Al-Shourbaji, I., 2016. A study of cyber security awareness in educational
environment in the middle east. Journal of Information & Knowledge Management, 15(01),
p.1650007.
Alshaikh, M., Maynard, S.B., Ahmad, A. and Chang, S., 2018. An exploratory study of current
information security training and awareness practices in organizations.
Anwar, M., He, W., Ash, I., Yuan, X., Li, L. and Xu, L., 2017. Gender difference and employees'
cybersecurity behaviors. Computers in Human Behavior, 69, pp.437-443.
Bada, M., Sasse, A.M. and Nurse, J.R., 2019. Cyber security awareness campaigns: Why do they
fail to change behaviour?. arXiv preprint arXiv:1901.02672.
Bada, M., Von Solms, B. and Agrafiotis, I., 2019. Reviewing national cybersecurity awareness in
Africa: an empirical study.
Christopher, L., Choo, K.K. and Dehghantanha, A., 2017. Honeypots for employee information
security awareness and education training: a conceptual EASY training model. In Contemporary
Digital Forensic Investigations of Cloud and Mobile Applications (pp. 111-129). Syngress.