Comprehensive Cyber Security Report: Threats, Plan, and Policy

This report provides a comprehensive analysis of cyber security for organizations, addressing key aspects such as potential threats, security plans, countermeasures, information security training, and policy development. The report identifies vulnerabilities like disaster recovery, incident response, and social engineering, emphasizing the importance of data security and protection against malware, ransomware, and other attacks. It outlines a detailed security plan, including risk identification, vulnerability assessment, and incident response strategies, along with specific security countermeasures for physical, electronic, and human-related threats. Furthermore, the report highlights the necessity of information security training for staff and proposes a robust security policy to ensure organizational data integrity and operational continuity. Overall, the report offers practical insights and recommendations to strengthen an organization's cyber security posture and mitigate potential risks.

Running head: CYBER SECURITY
Cyber Security
Name of the Student
Name of the University
Author Note

1CYBER SECURITY
Executive Summary:
The aim of this report is ensuring proper security of the organizations. In the aspect of
organizational security this paper has discussed important security threats which can affect
the organization largely. From the security threats proper type of security plan has been also
presented here. Proper type of countermeasures for the identified threats has been evaluated
in this report. This report has also developed an information security training plan for the
staffs of the organization for strengthen the security of the organization more. Security
policies is important to ensure the security of the organization and in this paper
comprehensive security policy has been developed for ensuring internal security of the
organization.

2CYBER SECURITY
Table of Contents
Introduction:...............................................................................................................................3
Organizational Holdings:...........................................................................................................3
Potential Security Threats to the Organization:.........................................................................4
Security Plan for the Organization:............................................................................................4
Security Countermeasures:.........................................................................................................6
Information Security Training:..................................................................................................7
Security Policy:..........................................................................................................................8
Conclusion:................................................................................................................................8
References:...............................................................................................................................10

3CYBER SECURITY
Introduction:
The security can be considered as a freedom against any type of potential harms
which can be caused by some others (Collins 2016). The security can be required for social
groups, individual persons, ecosystems, organizations and for many more other entities which
are vulnerable in front of any unwanted changes. From the organizational perspective
security is very much important to ensure that all the functions of the organization are
executing correctly. The security of the organization is can protect the ability of the
organization to remain functional (Ahmad et al. 2018). With that security also ensures that all
the operations executing in the organization remains safe and the data of the organization
remains safe and confidential. Lastly, the security of the organization also ensures protection
of the technology assets which are currently uses by the organization. In this way security
plays an important role for the organizations.
Organizational Holdings:
In this case security of an organization need to be ensured which is currently having
near 1000 of staffs. From the analysis of the organization it has been assessed that there are
some important holdings of the organization which are currently at the risks. It has been
assessed that some key areas of the organizational holdings are in the risk. These areas
include disaster recovery and business continuity, incident respond, lack of personal
awareness of various of threats, social engineering attacks and poor type of password
security. These are the current problems in the organization which must be mitigated as soon
as possible for proper functionality of the organization. Due to this type of issues crucial and
confidential information of the organization is currently at the risk.

4CYBER SECURITY
Potential Security Threats to the Organization:
In the above section of this paper crucial deficiencies in the organization regarding the
security has been identified. As there are several of security threats it is quite obvious that
there might be some potential threats which is going to occur within the organization. The
most common threats which going to be occur in this type of cases is stealing of data form the
organisation (Li et al. 2016). It is quite obvious that when internal security of the
organization gets compromised there is a chance that important and confidential information
of the organization is compromised. In the case of software attacks the computer system of
the organization can be compromised in various of ways which includes virus and trojan
attacks (Lipton, Ostrovsky and Zikas 2016). Chances of malware attacks is also very much
higher in type of case. Also, as identified chances of social engineering attacks are also very
much higher in this type of security related issues. In the case of malware attacks,
ransomware is one of the biggest names which can easily affect the organization. These are
the main security issues which can easily affect the organization in the current context.
Security Plan for the Organization:
As it has been assessed that there are several of security related issues in the current
context, it is very much important to effectively mitigate all the current raised security related
threats. For proper mitigation of the security related threats it is important to implement a
proper security plans for the current organization. Here, the main of the security plan will
identification of the risk, threats and attacks which can occur in the organization. The security
plan for the organization will be also ensuring that the organization is safe from any kind of
risks.
In this aspect for ensuring the security of the organization first of all it is very much
important to identify the risks, threats and the potential attacks which are very much likely to

5CYBER SECURITY
occur in the organization. Thus, the overall security plan includes a brief regarding
identification of the threats. Here the security plan includes a proper type of threat analysis so
that potential sources of the threats can be identified very much easily in the organization. In
this aspect it is important to implement a proper type of security audit of the organization so
that any kind of threats in the organization can be identified easily (Li et al. 2016). In the
security audit of the organization the whole organization will be assessed against any type of
internal issues which can lead to potential threats. Risks of the organization also need to be
mitigated and security plan of the organization also must have proper way for the
identification of the risks and the mitigation of the risks. The main risks which can be faced
by this organization are the security related risks, disaster recovery related risks and incident
response related risks. For proper identification of the security related risks vulnerability
assessment is the most important step (Goel and Mehtre 2015). Thus, the security plan of the
organization must be consisting a proper type of vulnerability assessment plan for the
identification of the security related risks. Disaster recovery system may not be functional at
the time when it is required which can actually harm the continuity of the business. To
identify the disaster recovery system related risks, it must be activated and checked
periodically even though there are no natural disasters. In this way it can be ensured that the
system remain functional at the time when it is required. The incident response system also
needs to be checked certain of time to ensure its functionality.
Potential attacks need to be also identified in a proper way so that security of the
organization can be ensured and this is an important part of the security plan of the
organization. For identification of the potential attacks the current market needs to be
assessed perfectly. By this assessment it will be identified that which attack has been
performed in which type of organization and the how the attack was executed. In this way the
main attack which can be performed on this organization can be identified and proper

6CYBER SECURITY
countermeasures can be taken against this type of attacks at the right time. The main attacks
which can be performed on this organization includes ransomware attack, spoofing attack and
malware attack (Scaife et al. 2016). Thus, proper countermeasures need to be implemented
against this type of attacks.
Security Countermeasures:
While implanting the security countermeasures it is very much important to ensure
that the organization is protected from each and every aspect. For this reason, it is quite
important that the security countermeasures are implemented from physical, electronic and
the human perspective. In this way proper security of the organization can be ensured. In the
case of physical security threats natural disasters are the most common. Thus, it is important
to implement proper type of security countermeasures in this type of situations. For dealing
with this kind of situations it is important to implement a proper plan so that organization can
start its recovery from this kind of situations. While natural disaster is occurring, in most of
the cases security issue occurs regarding the data of the organization. Mostly, the data of the
organization gets lost due to the loss of data storing hardware. In this case for security of the
data it is important to create a proper backup of the data on regular basis (Chang and
Ramachandran 2015). For backup of the data organization can create their own backup centre
far from the actual location of the organization or they can simply store the data to some
third-party cloud storage provider. In this way physical security of the data can be ensured.
Implementation of the human countermeasures is also very much important for proper
security of the organization. Organizations has faces various of security related issues due to
intervention of the humans. There are several of cases that the humans have interfered into
the security of an organization. In this case hacking tops the list. In most of the cases hacking
has been done by the humans for the breaching the security of the organizations for their own

7CYBER SECURITY
personal benefits. Thus, it is important to implement a proper security countermeasure against
the hacking. The simplest way by which a hacker can easily get access to the important data
is guessing the passwords (Stajano, Jenkinson and Thorsheim 2016). The hackers able to
guess the passwords of the users due to reasons. Whether the password is too easy or the
password is not changed for log duration of time. Thus, in such type of cases proper security
countermeasures is implementing a strong password and with the strong password these
passwords must be changed after a certain period of time. Also, the different type of access
different types of passwords must be used. Also, to stop the hacking all the data must be
encrypted. In this way though the hacker will get access to the data but the data will be in an
unusable form. In this way hacking to the organization can be stopped.
While considering the electronics type of security issues the most common cases are
the virus and the malware attacks (Lévesque et al. 2018). Thus, it is important to ensure
proper security countermeasures against the virus and the malware attacks. For ensuring that
the organization is completely free from any type of virus and the malware attacks it is very
much important to implement a proper and functional anti-virus systems. The antivirus
software is capable of identifying potential malware and viruses in the systems (Kumar,
Mishra and Panda 2016). In this way malware and the viruses can be identified and removed
from the system and the security of the organization can be ensured. It is also important to
always keep updated the antivirus software for proper functionality of the antivirus system.
With that operating system also need to be updated to the latest version for mitigating any
type of malware and virus attack.
Information Security Training:
With the above security measures, it is also very much important to provide a proper
type of training to the staffs of the organisation so that they become aware about the fact of

8CYBER SECURITY
information security. Thus, it is important to develop a proper training for the staffs of the
organizations. Here in this training some important aspects need to be added so that a proper
type of training program can be created. In this training the staffs will be first trained about
the management of the data. In this data security awareness can be created among them (Tang
et al. 2016). Following that training will be also given regarding handling any type of
removable media to the organizational assets. Further training will be on the safe types of
internet habits. Training regarding social network dangers will be also shared proper training
regarding handling email scams will be also included in the training schedule. In this way
proper training can be provided to the staffs and the organization can be secured in more
perfect way.
Security Policy:
Proper security policy also needs to be implemented for a tight security in
organization. In the below section main area of the security policy is described.
 Organizational data will be accessed only through the network of the organization.
 Each and every staffs must be using a strong password for their accounts and
passwords should be changed after certain period of time.
 Thumb drives only can be used in the organizational system upon approval.
 Organizational network can not be used for personal internet browsing purposes.
 All types of access to the organizational assets can be blocked in case of any
emergency.
Conclusion:
From the above discussion it can be concluded that organizational security is very
much important for ensuring proper functionality of the organization. In the current aspects
the organization is having various of issues due to which organization need to implement a

9CYBER SECURITY
proper type of security for ensuring proper functionality of the organization. Regarding the
organizational security some important tasks has been done in this report so that security of
the organization can be ensured. Here for proper security of the organizations organizational
holdings which are in risk has been identified first. Potential security treats to the
organization also has been identified within this paper. Following that, a proper security plan
for the organization has been created and the countermeasures has been also identified. A
training and awareness plan have been prepared for proper security of the organisation. In
this way proper security of the organizations has been ensured.

10CYBER SECURITY
References:
Ahmad, A., Baskerville, R., Webb, J., Maynard, S. and Shanks, G., 2018. Organizational
Security Learning from Incident Response. ICIS 2017: Transforming Society with Digital
Innovation.
Chang, V. and Ramachandran, M., 2015. Towards achieving data security with the cloud
computing adoption framework. IEEE Transactions on Services Computing, 9(1), pp.138-
151.
Collins, A. ed., 2016. Contemporary security studies. Oxford university press.
Goel, J.N. and Mehtre, B.M., 2015. Vulnerability assessment & penetration testing as a cyber
defence technology. Procedia Computer Science, 57, pp.710-715.
Kumar, M., Mishra, B.K. and Panda, T.C., 2016. Predator-prey models on interaction
between computer worms, Trojan horse and antivirus software inside a computer
system. International Journal of Security and its Applications, 10(1), pp.173-190.
Lévesque, F.L., Chiasson, S., Somayaji, A. and Fernandez, J.M., 2018. Technological and
human factors of malware attacks: A computer security clinical trial approach. ACM
Transactions on Privacy and Security (TOPS), 21(4), p.18.
Li, T., Chen, Y., Sun, J., Jin, X. and Zhang, Y., 2016, October. ilock: Immediate and
automatic locking of mobile devices against data theft. In Proceedings of the 2016 ACM
SIGSAC Conference on Computer and Communications Security (pp. 933-944). ACM.
Li, Y., Zhang, T., Ma, Y.Y. and Zhou, C., 2016, July. Anomaly detection of user behavior for
database security audit based on OCSVM. In 2016 3rd International Conference on
Information Science and Control Engineering (ICISCE) (pp. 214-219). IEEE.

11CYBER SECURITY
Lipton, R.J., Ostrovsky, R. and Zikas, V., 2016. Provably secure virus detection: Using the
observer effect against malware. In 43rd International Colloquium on Automata, Languages,
and Programming (ICALP 2016). Schloss Dagstuhl-Leibniz-Zentrum fuer Informatik.
Scaife, N., Carter, H., Traynor, P. and Butler, K.R., 2016, June. Cryptolock (and drop it):
stopping ransomware attacks on user data. In 2016 IEEE 36th International Conference on
Distributed Computing Systems (ICDCS) (pp. 303-312). IEEE.
Stajano, F., Jenkinson, G. and Thorsheim, P., 2016. Technology and Practice of Passwords.
Springer international publishing.
Tang, M., Yu, Y., Malluhi, Q.M., Ouzzani, M. and Aref, W.G., 2016. Locationspark: A
distributed in-memory data management system for big spatial data. Proceedings of the
VLDB Endowment, 9(13), pp.1565-1568.