Developing Information Security Policy for BIGW (ISY3006 Report)

This report focuses on developing an information security policy specifically for BIGW, an Australian discount department store. The study begins with an executive summary and introduction that outline the nature of BIGW and its stakeholders. The report identifies various threats and vulnerabilities, including theft, vandalism, social media risks, phishing, data breaches, and identity theft. It outlines the steps required to develop a security plan, including threat identification, vulnerability assessment, risk reduction measures, and security policy review. The proposed security policy covers several aspects, such as document security, computer security, data encryption, data backup, access control, and incident response. The report also identifies key stakeholders like buyers, designers, competitors, suppliers, employees, and the IT department. The report emphasizes the importance of stakeholder cooperation in maintaining security and mitigating risks. Finally, the report provides a comprehensive analysis of the threats to the online business of BIGW, and offers a plan to mitigate these threats and vulnerabilities.

Running head: INFORMATION SECURITY FOR BIGW (SUPERMARKET)
INFORMATION SECURITY FOR BIGW (SUPERMARKET)
Name of the Student
Name of the Organization
Author Note

1INFORMATION SECURITY FOR BIGW (SUPERMARKET)
Executive Summary
The main aim of the study is to specially develop an information security policy for
the BIGW. All the various kinds of threats as well as vulnerabilities will be properly
identified which is going to be prevented by the security policy designed for BIGW. There is
a proper introduction which will be providing with an idea of the nature of BIGW and all the
various stakeholders of the company will be properly depicted. The defined policy will be
comprising of a number of guidelines for developing security for the organization. All the
various stakeholders must be well complying with the security policy for the prevention of
various kinds of risks as well as vulnerabilities associated with BIGW.

2INFORMATION SECURITY FOR BIGW (SUPERMARKET)
Table of Contents
Introduction................................................................................................................................3
Stakeholders...............................................................................................................................3
Steps for developing the security plan.......................................................................................4
Policy..........................................................................................................................................5
Vulnerabilities............................................................................................................................7
Threats to the online BIGW business.........................................................................................7
References................................................................................................................................10

3INFORMATION SECURITY FOR BIGW (SUPERMARKET)
Introduction
BIGW is basically a chain of various discount departmental stores of Australia and
this is basically a division of the group of Woolworths comprising of about 22000 employees
across Asia as well as Australia. BIGW is basically a social innovation which will be
comprising of the social responsibility of various individuals which have been associated
with the main aim being collecting as well as distributing goods to all the various targeted
audience. BIGW is greatly supported by proper volunteerism as well as good will of various
donors who makes their individual contribution by offering proper service as well as goods to
all the various consumers of BIGW (Pollard et al. 2014). The main aim of the study is to
provide a proper security policy for all those who is actually owning, managing as well as
working in BIGW. The security policy will be helping a lot in the reduction of various risks
of the attacks of terrorist and will even be highly limiting the huge damage which any attack
may be causing. There is a high possibility that the BIGW can be greatly involved in any kind
of terrorist incidents. Terrorism may be coming in a number of different kinds of forms
(Khattab et al. 2017). There may be a number of threats in the payment system of the
supermarket as well. All sorts of risks as well as vulnerabilities must be well identified and
hence there is a need for the security policy so that all of these threats can be minimized as
well as mitigated. There must be enough assessments of risks as well as measures for the
proper management of risks and there must be a proper co-operating safety arrangements
made in between all the various stakeholders of the BIGW (Peyton, Moseley and Battersby
2015). There must be proper training of all the staffs who have been greatly responsible for
maintaining security.

4INFORMATION SECURITY FOR BIGW (SUPERMARKET)
Stakeholders
All the various stakeholders which have been associated with the BIGW are the
buyers, designers, the company BIGW itself, competitors, suppliers, employees and IT
department. Buyers are particularly all of those who can be easily shopping on the internet
utilising the website of BIGW as well as all those who will be able to buy several products
from the supermarket directly (Gonzalez-Miranda et al. 2013). It has been observed that there
are a number of privacy as well as security issues which have been associated with the
buyers. The designers are mainly those who will be able to sell various products upon the
internet. The BIGW itself possess with the responsibility of easily informing all the various
customers regarding various kinds of full new products (Saint Ville, Hickey and Phillip
2017). Competitors are mainly those who can be able to easily search for all the sells as well
as the costs of the competitors of BIGW and with the help of them the company can be able
to greatly improve. Suppliers are mainly those who will be capable of supplying all the
various products to the customers within proper time. Employees are all those who are
present in the supermarket of BIGW capable of offering the expected service to all the
potential customers. On the other hand, the department of IT will be capable of having a
proper checking as well as maintaining the security as well as networking (Eun, Lee and Oh
2013). All the various stakeholders must be capable of performing all the various
responsibilities of them for the betterment of the company (Winter 2014). It has been also
recognized that a maximum part of the responsibility of various security measures related to
risks as well as vulnerabilities fall upon the manager of security within the specific team of
the management who will be capable of directing the particular action which will be actually
taken against any kind of security threats.

5INFORMATION SECURITY FOR BIGW (SUPERMARKET)
Steps for developing the security plan
There are some basic steps which are needed to be well followed for the management
of various kinds of risks. Firstly, all the various threats must be well identified and this is
really a very much essential step for the determination the plan for security (Crush and
Battersby 2016). Secondly, it is to be decided that what things are actually needed for the
protection as well as the identification of various kinds of vulnerabilities within BIGW. This
may be involving various employees, assets which are physical and different kinds of
procedures. Thirdly, there must be the identification of various measures for the reduction of
various kinds of risks (Desker, Caballero-Anthony and Teng 2013). Lastly, there must be the
proper reviewing of various measures of security and rehearsing of all kinds of plans of
contingency.
All the policies which are to be prepared must be well understood by all the various
stakeholders of BIGW for the proper implementation of the security policy for the company.
Policy
It has been observed that BIGW receives a number of mails as well as some other
kinds of deliveries which actually open a very much attractive way for the entry of various
kinds of attackers (Krombholz et al. 2014). There are even a number of threats to the security
of the information of BIGW and hence the policy will be developed for lowering as well as
mitigating all those risks.
 Lock away all the various documents of business during the closing of the day of
business.
 Possessing policy of clear desk out of the hours of business.
 Closing all the computers properly at the end of the day.

6INFORMATION SECURITY FOR BIGW (SUPERMARKET)
 Update of the antivirus software and the firewall of computer on the systems of
computer.
 Considering the package of encryption for all the various information which are
highly sensitive needed for protection.
 Destroying of the data whenever they will not at all be needed.
 Keeping proper backup of all the various critical information of the business in a
regular basis.
 Properly investigating in the cabinets which will be secure for all the various
equipment of IT.
 The personal information is to be kept secure by utilising SSL or Secure Sockets
Layer software for securing the transactions.
 Whenever any kind of personal information will be entirely transmitted to some other
kind of websites, it must be well protected by the utilisation of encryption of the
protocol of SSL.
 Upgrade the latest version which is often marketed as the certificate of TLS as TLS
will be utilising a much power algorithm of encryption for keeping the website of
BIGW secure.
 Respond properly as per the plan of response for all the various attacks of DDoS.
 Making sure that there is a remote deny access for the various kinds of staffs.
Restriction of various applications whenever staffs will be busy while working on
certain kinds of tasks.
 Auditing of the software programs of the site of BIGW.
 Deleting all the various kinds of unnecessary information.
 Proper monitoring on a regular basis by the IT team of management.

7INFORMATION SECURITY FOR BIGW (SUPERMARKET)
 Ensuring consent which will be informed from all the various customers before the
collection of information which will be personally identifying each and every
customers of BIGW.
 Enabling the specific two factor checking or authentication for various customers for
stop relying upon only the simple password which may be greatly vulnerable towards
all the various attackers.
Vulnerabilities
 Theft: One of the huge threats to security which may be faced by BIGW is theft. The
supermarket may be containing a number of various products which are highly
susceptible to that of theft.
 Vandalism: Whenever a number of various young people will be visiting the
supermarket of BIGW then there is a great increasing chance of vandalism (Masys
2014).
 Altercations: There is even a high chance of various kinds of altercations which may
be hugely occurring in between all the various customers.
 Unauthorized entry: Various kinds of unauthorised people can be entering the
supermarket and may be greatly posing a threat to security.
For properly addressing various threats to security, it is really very much essential to
possess a number of various security protocols which will be perfectly mentioned within the
security policy of the BIGW (Kulkarni et al. 2014).
Threats to the online BIGW business
 Social media: Social can be bringing in a number of threats to BIGW as it has been
noticed that if social media is left totally unmonitored people possess with the specific
capability of destroying various brands no matter how much highly reputed it may be

8INFORMATION SECURITY FOR BIGW (SUPERMARKET)
(Snyder et al. 2015). By the violation of the trust of the brand name with all of its
various customers, it may be greatly damaging the image of the BIGW.
 Phishing: It has been observed that very fast and out of control attacks of phishing can
be continuing towards plaguing the business of BIGW (Cosmas et al. 2017). It is
basically a kind of crime which may be involving a number of various individuals
which may be greatly posting a number of various services in a specific attempt for
tricking any specific victim into the direct disclosure of any kind of personal
information (Battersby and Peyton 2014). The often look as if it is official as well as
authentic and this really makes it very much tough to differentiate in between which is
real and which is real. It may be actually occurring in a number of forms. It may also
happen that BIGW may be greatly threatened for taking any kind of action or rather
be claimed by various fraudsters for confirming all the various personal details or the
information regarding any account.
 Data breaches: This is another threat to BIGW as it has been highly believed that
about 97% of such breaches of data is not avoidable. It has been noticed that most of
such kinds of breaches goes totally unreported as most of the companies greatly
hesitate towards admitting the reason behind keeping a lot of information regarding
all the various customers at the front or the first place. Breaches of data has been
observed to be occurring in two different phases (Mohite, Kulkarni and Sutar 2013).
The first one is the technical one which will be including gaining the direct access of
specific systems of any company for particular gathering a lot of data as well as
applications of software. The second one is the main exploitation of the entire data or
rather the utilisation of data for committing a huge fraud. Such actions may be
involving the data theft and the system hijacking. The data breach may be entirely
destroying the specific kind of relation which BIGW has on its customers.

9INFORMATION SECURITY FOR BIGW (SUPERMARKET)
 Theft of identity: This may happen whenever hacker will be able to mask the actual or
the true identity of any customer and then finally stalk all the various private
information with a number of guises. This may actually be leading towards a huge
growth of the frauds of identity (Ilves 2014).
The security policy can be very much advantageous in properly ensuring that no one
will be able to enter the mall after the main business hours and it must also be taken care of
such that they do not enter via the entrances of employees or some other kinds of
unauthorised access. There proper surveillance cameras can be helping a lot for properly
monitoring each and every activities of the supermarket. As per the security policy, proper
updates of various software as well as systems can be very much helpful towards the
prevention of various kinds of attacks (Keating 2013). A proper monitoring on a regular basis
by the IT team can even be very much beneficial for the prevention of various kinds of
threats to that of BIGW. The most essential aspect of maintaining the security policy for
BIGW is the process of hiring the perfect team for maintaining security that will be perfectly
trained for addressing all the various kinds of problems, vulnerabilities as well as threats.
After hiring all the various professionals of security which will be perfectly trained will be
actually making hugely confident that all the various potential threats as well as
vulnerabilities will be properly addressed as well as considered (Luo and Liu 2018). The
policy will be helping a lot in the minimization of various kinds of data loss and will even be
very much helpful for protecting BIGW from any kinds of malicious internal or rather
external users. It will be actually setting a number of various guidelines that will be ensuring
appropriate compliance.

10INFORMATION SECURITY FOR BIGW (SUPERMARKET)
References
Battersby, J. and Peyton, S., 2014, June. The geography of supermarkets in Cape Town:
Supermarket expansion and food access. In Urban Forum (Vol. 25, No. 2, pp. 153-164).
Springer Netherlands.
Cosmas, J., Meunier, B., Ali, K., Jawad, N., Salih, M., Meng, H.Y., Song, J., Wang, J., Tong,
M., Cao, X. and Li, X., 2017, November. 5G Internet of radio light services for supermarkets.
In 2017 14th China International Forum on Solid State Lighting: International Forum on
Wide Bandgap Semiconductors China (SSLChina: IFWS) (pp. 69-73). IEEE.
Crush, J. and Battersby, J. eds., 2016. Rapid urbanisation, urban food deserts and food
security in Africa. Cham, Switzerland: Springer.
Desker, B., Caballero-Anthony, M. and Teng, P., 2013. Thought/issues paper on ASEAN
Food Security: Towards a more comprehensive framework. ERIA Discussion Paper
Series, 20.
Eun, H., Lee, H. and Oh, H., 2013. Conditional privacy preserving security protocol for NFC
applications. IEEE Transactions on Consumer Electronics, 59(1), pp.153-160.
Gonzalez-Miranda, S., Alcarria, R., Robles, T., Morales, A., Gonzalez, I. and Montcada, E.,
2013, July. Future supermarket: overcoming food awareness challenges. In 2013 Seventh
International Conference on Innovative Mobile and Internet Services in Ubiquitous
Computing (pp. 483-488). IEEE.
Ilves, T.H., 2014. Rebooting Trust? Freedom Vs Security In Cyberspace. Hampton Roads
International Security Quarterly, p.30.
Keating, A., 2013. Food security in Australia: the logistics of vulnerability. In Food Security
in Australia (pp. 21-34). Springer, Boston, MA.

11INFORMATION SECURITY FOR BIGW (SUPERMARKET)
Khattab, A., Jeddi, Z., Amini, E. and Bayoumi, M., 2017. RFID security threats and basic
solutions. In RFID Security (pp. 27-41). Springer, Cham.
Krombholz, K., Frühwirt, P., Kieseberg, P., Kapsalis, I., Huber, M. and Weippl, E., 2014,
June. QR code security: A survey of attacks and challenges for usable security.
In International Conference on Human Aspects of Information Security, Privacy, and
Trust (pp. 79-90). Springer, Cham.
Kulkarni, G., Shelke, R., Sutar, R. and Mohite, S., 2014, February. RFID security issues &
challenges. In 2014 International Conference on Electronics and Communication Systems
(ICECS) (pp. 1-4). IEEE.
Luo, Q. and Liu, J., 2018. Wireless telematics systems in emerging intelligent and connected
vehicles: Threats and solutions. IEEE Wireless Communications, 25(6), pp.113-119.
Masys, A.J. ed., 2014. Networks and network analysis for defence and security. Springer
Science & Business Media.
Mohite, S., Kulkarni, G. and Sutar, R., 2013. RFID security issues. International Journal of
Engineering Research & Technology (IJERT), 2(9), pp.746-748.
Peyton, S., Moseley, W. and Battersby, J., 2015. Implications of supermarket expansion on
urban food security in Cape Town, South Africa. African Geographical Review, 34(1), pp.36-
54.
Pollard, C.M., Landrigan, T.J., Ellies, P.L., Kerr, D.A., Underwood Lester, M.L. and
Goodchild, S.E., 2014. Geographic factors as determinants of food security: a Western
Australian food pricing and quality study. Asia Pacific Journal of Clinical Nutrition, 23(4),
p.703.

12INFORMATION SECURITY FOR BIGW (SUPERMARKET)
Saint Ville, A.S., Hickey, G.M. and Phillip, L.E., 2017. How do stakeholder interactions
influence national food security policy in the Caribbean? The case of Saint Lucia. Food
policy, 68, pp.53-64.
Snyder, J., Ijumba, C., Tschirley, D. and Reardon, T., 2015. Local response to the rapid rise
in demand for processed and perishable foods: Results of an inventory of processed food
products in Dar es Salaam (No. 1878-2017-2142).
Winter, J.S., 2014. Surveillance in ubiquitous network societies: normative conflicts related
to the consumer in-store supermarket experience in the context of the Internet of
Things. Ethics and Information Technology, 16(1), pp.27-41.