In-Depth Analysis of IT Security, Risk, and Security Policies

This report provides a comprehensive assessment of IT security risks, explores security information, reviews organizational IT security mechanisms, and emphasizes the importance of organizational security. It delves into various aspects such as unauthenticated system access, unauthorized data removal, physical asset destruction, business combination strategies, backup restoration, testing procedures, and audits. The report also evaluates network security information including NAT, DMZ, firewalls, and network performance enhancements like RAID, standby systems, and dual LAN configurations. Furthermore, it discusses data security measures such as asset management, image differentiation, SAN services, data center replication, virtualization, secure transport protocols, secure MPLS routing, and remote access methods. Security vulnerabilities, log management, honeypots, and data mining algorithms are also addressed. The report concludes by highlighting mechanisms to control organizational IT security, including network change management, audit control, disaster recovery plans, and adherence to standards like the Computer Misuse Act and ISO 3001, emphasizing the responsibilities of staff and the importance of physical security.

Running Head: IT SECURITY
IT SECURITY
Name of the Student
Name of the University
Author Note

1
IT SECURITY
Table of Contents
Introduction......................................................................................................................................4
L 01: Assess Risk to Information Technology Security..................................................................5
Risk..........................................................................................................................................5
Unauthenticated system...........................................................................................................5
Unauthorized removal or computing of data...........................................................................6
Destruction of the physical assets or environment..................................................................7
Organizational Security...............................................................................................................7
Business combination..............................................................................................................7
Backup Restoration..................................................................................................................8
Testing procedure....................................................................................................................8
Audit........................................................................................................................................8
Overview of object oriented database......................................................................................9
L 02: Security Information..............................................................................................................9
Network Security Information.....................................................................................................9
Evaluation of NAT..................................................................................................................9
Evaluation of DMZ................................................................................................................10
Evaluation of FWs.................................................................................................................10
Network Performance................................................................................................................10
RAID......................................................................................................................................10
Standby..................................................................................................................................11
Dual LAN..............................................................................................................................12
Data Security.............................................................................................................................12
Asset Management.................................................................................................................12
Image differentiation.............................................................................................................13
SAN Services.........................................................................................................................13
Data Center................................................................................................................................13
Replica Data Centre...............................................................................................................13
Virtualization.........................................................................................................................13

2
IT SECURITY
Secure transport protocol.......................................................................................................14
Secure MPLS routing............................................................................................................14
Remote access method...........................................................................................................14
Security Vulnerability................................................................................................................15
Log.........................................................................................................................................15
Honeypot................................................................................................................................15
Data mining algorithm...........................................................................................................15
L 03: Review IT security...............................................................................................................16
Mechanism to control organizational IT security......................................................................16
Network change management................................................................................................16
Audit Control.........................................................................................................................16
Disaster recovery plan...........................................................................................................16
Potential loss of data..............................................................................................................17
Intellectual property: hardware and software........................................................................17
Probability of occurrence.......................................................................................................17
Staff responsibilities..............................................................................................................18
Computer Misuse Act; ISO 3001 standards..........................................................................18
Security Regulation...................................................................................................................18
Physical security types...........................................................................................................18
Responsibility Assignment Matrix............................................................................................19
L 04: Organizational Security........................................................................................................21
Security Policies........................................................................................................................21
System Access.......................................................................................................................21
Access to internet...................................................................................................................21
Access to email......................................................................................................................21
Internet Browser....................................................................................................................22
Use of Software.....................................................................................................................22
3rd party access.......................................................................................................................22
Business Continuity...............................................................................................................23
Security Assessment..................................................................................................................23
Security policies of ISO/IEC 17799:2005 Information Technology.....................................23

3
IT SECURITY
Informing Colleagues regarding their responsibilities of security........................................24
Enterprise risk management......................................................................................................24
Recommendations......................................................................................................................24
Conclusion.....................................................................................................................................25
References......................................................................................................................................26

4
IT SECURITY
Introduction
The technology of information technology has been ever evolving since the last decade.
This evolving nature of the technology has forced many benefits for the users of the platform of
the information technology for the purpose of communication and server maintenance. With the
benefits, that the users enjoy the disadvantage of using the I formation technology comes in
disguise in terms of security and privacy of the data that are store in the data base of the
computing system that makes use of the platform of information technology (Scully, 2014). A
hefty amount of information is stored in the cumber space in today’s society. This is because
people across the globe can easily gain access to the data that are stored in the cyberspace.
Before the 20th century gathering information about a particular topic was very difficult as the
data were not present in the universal platform of the cyberspace. People used to g through
books and magazine and the history books in order to gain authenticated and authorized data
about the servers that the user wants to gain knowledge regarding a particular topic. In today’s
society the required information can be gained without performing any kind of tedious job by
just accessing the platform of information technology for the searching of the data. People can
also storing of data that are private in nature. The major issue of the cyber space lies to the point
that the platform that the cyberspace proved is not much robust in nature. This ensures the fact
that the imposters can gain access to the data that are stored in the cyberspace without any proper
kind of authentication processing of the data. The data that are stored in the platform of the
information technology ensures the fact that there are many barriers to the unauthenticated
access to the data. Despite this barriers it fails to stop the imposters to gain access to the data
which are stored in the database of the cyberspace (Szwed and Skrzyński, 2014). This acts to the
cyber crime that is caused by the cyber criminal to gain the personalized data in order to earn

5
IT SECURITY
profit from the data. Another motive that strongly affects the imposters to gain unauthenticated
access to the data of genuine clients is that the imposters can track the users of the account and
stalk the genuine user and harm eh client who has been using the data base that is dependent on
the platform of the information technology. This report will discuss about the assessment of risk
in case of information technology security. This report will also discuss about the security
solutions of the information technology system. This report will further provide a review of the
mechanism that is undergone for the organization of the information technology security. This
report will further delve unto the fact of essentiality of the organizational security in order to
keep the data of the organization protected that is stored in the platform of the Information
technology (Oltsik, 2014).
L 01: Assess Risk to Information Technology Security
Risk
Unauthenticated system
This aspect of using the computing system by the imposter that are not authorized to
them acts as the major threat to the client in the terms f security. This aspect takes into
consideration the fact that the cyber criminal gets the access of the computing system that the
genuine client has been using in order to gain the access to the data that the client has been
performing the task. The cyber criminal gains the data regarding the desired project from the
computing system of the genuine client. On gaining this unauthorized access the imposter
modulate the data that are stored in the computing system leading to the fact that the genuine
client fails to deliver the project on which the client was performing with accuracy (Fennelly,
2016). This leads to eh decreasing of the efficiency of the client. Another motive of the imposter

6
IT SECURITY
is that the cyber criminal gains the access to the data and the transfer the data to his own
computing system. This ensures the fact that the imposer can now act on behalf of the genuine
client in an unauthenticated manner and destroy the goodwill of the client. The imposter can also
make money from the data that they collect from the computing system of the clients who has
been using the platform of the data base of the information technology.
Unauthorized removal or computing of data
The imposters who has been gaining access to the computing system of the client has the
initial motive of gaining access to the data. The data that are stored in the computing system are
copied from the computing system of the genuine client. This aspect takes into consideration the
fact that imposters who are trying to gain the access of the computing system gets the access to
the computing system taking into consideration the fact that the firewall r the security measures
that are used in networking system are not up to the mark or the software that is being used is not
the latest version available n the market. This fact ensures that the data that are stored in the
computing system can be copied by the imposters and made use of the data in unauthenticated
way. This also ensures that on getting the access to the data, the imposters can also modulate the
same data in order to create a conflict among the clients and the data storage organization. The
aspect also leads to the cause that the data that are stored in the computing system are copied
from that computing system which leads to the fact that the imposter acts as the original owner
of the data (Barkley, 2016). The imposter can also dictate the terms to the authenticated owner of
the data and blackmail the client for paying huge amount of money to refrain the data from the
imposters.

7
IT SECURITY
Destruction of the physical assets or environment
The major concern in the case of cyber attack is that the destruction of the data that are
stored in the database cyberspace. The data that are stored in the cyberspace are the liability of
the users as the accounting information of the genuine clients are stored in the processing of the
database of the cyberspace. The imposters make use of methods that are illegal to gain access to
the assets of the client in order to destroy the possessions of the clients. The security of the assets
are at stake due to the factor that the lack of robustness of the infrastructure of the database that
frames the cyberspace. The assets that are present in the database of the infrastructure of the
cyberspace are not as robust as the infrastructure should have been which leads to the fact that
the assets of the clients are not very well protected and the security of the physical assets of the
clients is at stake due to the increasing potentials of the imposters (Van Tilborg, and Jajodia,
2014).
Organizational Security
Business combination
The best way to make the computing system robust s by combining the business
organization against the cyber crimes that has been happening in corporate sector of the
industry. This is done by the means of the outsourcing the information technology framework
among the companies that are collaborated to sustain the cyber attack that possess threat to the
database of the organization. The data that are stored in the database of the organization after the
installation of the robust framework frame work as it helped the database to gain the robustness
of the cyberspace of the company.

8
IT SECURITY
Backup Restoration
The data that are stored in the infrastructure of the database are not always well secured
which leads to the fact that the imposters can gain access to the data and modulate the same. In
order to get rid of this problem the major technological terminology that is taken into
consideration is the processing of keeping a back up for the data (Aston, 2017). This takes into
consideration the fact that the backup methodology helps in the fact of restoring the data that gets
lost in the cyber attack that is possessed by the cyber criminals. The fact that the backup keeps
the record of the data that might get lost in the working of the data processing.
Testing procedure
The testing procedure that of the security of the database of the cyberspace is the most
important fact of the data security aspect of the organization. This aspect takes into consideration
the fact that the proper testing of the framework of the database takes into consideration the fact
that the proper testing of the database requires the proper testing of the robustness of the database
(Wang, Yu, 2016). This will ensure the fact that the data that is stored in the database of the
platform of information technology is tested to its limits in order to prevent the imposters to gain
the unauthenticated access to the system.
Audit
The auditing of the task plays a major role in the processing of the expenses that will be
required for the maintenance of the security of the database (Perlman, Kaufman and Speciner,
2016). This audit expenses that are made includes the expense of outsourcing of the
infrastructure of the database. This auditing is performed in order to perform the processing of
the data that are stored in eh database of the organization.

9
IT SECURITY
Overview of object oriented database
The ma feature acts to be the object orientation of the database. The database that is being
used for the performing the data storage of the organization takes into consideration the platform
that is built with the help of the object oriented programming language which helps in the proper
functioning of the data base of the organization (Mearsheimer, 2016). This feature ensures the
efficiency of the database is maintained with proper advancement of the infrastructural progress
in the data string of the organization. The organization takes into consideration the fact that the
data base that are built with the help of the object based programming language is more efficient
in nature. This acts to be the major reason for the database to serve the proficiency of the
organization who has been deploying the strategy.
L 02: Security Information
Network Security Information
Evaluation of NAT
NAT is abbreviated as the Network Address Translation. The main function f NAT is to
translate the IP address of the computing system to the IP address that is completely associated
with the IP address of the local networking system (Wang, Y., Fakhry, R. and Anderl, R., 2017).
The router to connect the computers with the local internet connection uses the IP address that is
generated by the local networking system. The router is not only connected to the computing
systems but also connected to the DSL modems that are associated with the networking system.
The dial-up modem also acts as one of the most fundamental appliance that is connected to the
router of the system. in case of the other networking systems trying to access the data from the
networking system that us connected to the computing system with a particular IP address the IP

10
IT SECURITY
address indicates the trial of the accessing of the networking system. The extra level of security
is added t the networking system with the help of the installation of the firewall.
Evaluation of DMZ
DMZ is abbreviated as Demilitarized Zone. This layer acts as the medieval layer between
the computing network and the intranet layer of the public networking system. This channel
sensors the act that the data that is transferred is transact-ted safely. The host of the DMZ can be
either a single host or a dual host operating system. The main purpose of the DMZ is to ensure
the fact that the access to the intranet networking from the external sites are prohibited in order
access of the external interference in the networking of the system. This is done by separating the
networking system of the intranet from the host LAN in order to maintain the security of the
database (Ahson and Ilyas, 2017).
Evaluation of FWs
FWs are abbreviated as Free Web Space of the framework of the organization. This will
ensure the fact that the website hosting is free and the advertisements are supported in the free
webs pacing of the subscribed website. This ensures the fact that the web hosting does not make
the complete usage of the advertisement that are being attached to the web hosting in order to
maintain the proficiency of the web hosting service.
Network Performance
RAID
RAID is broadly classified in five broad categories namely: -

11
IT SECURITY
 RAID 0: The main purpose of RAID 0 is to strip data across two or more drivers. The
parity is not supported in this form of the compliance. The major advantage is that this
form provides good read and write acceptance but does not support the data redundancy.
 RAID 0+1: the main purpose of RAID 1 is to mirror data from two or more drivers. The
main advantage of the RAID 1 is that it supports multiple porting of the data which leads
to the enhancement of the security of the data base (Mearsheimer, 2016).
 RAID 1+0: Is a mirrored set in a striped set. RAID 0+1 creates a striped set from a series
of mirrored drives. The main advantage of this networking system is that all the ports are
in use which accepts the fact that the efficiency of the data security increases.
 RAID 3: the main functioning is to strip the byte-level with a dedicated parity disk. This
acts to be a unique feature in this system. The major disadvantage of this system is that
the parity disk is the minor bottleneck and must be written every single time the data is
updated.
 RAID 4: the main function is the stripping of the data using the measure of the block-
level stripping attribute. This kind of system has a dedicated parity disk. The major
advantage of this system is that the access of the data is improved with the block-level
stripping (Line and Moe, 2015)
 .
Standby
Standby is a mode that acts as the procedural functioning of the computing system. This
mode keeps the computing system readily available for the functioning of the networking
system. The system can be used whenever required when the system is in standby mode by
rescuing the access to the networking system (Crampton, 2015). The shortcomings are