Assessment of Power AI's Security Management: A BIT361 Report

Desklib provides past papers and solved assignments. This report details Power AI's security management program.

BIT361 SECURITY MANAGEMENT AND
GOVERNANCE
MAJOR ASSESSMENT
Student ID:
Student Name:

Contents
Executive Summary.........................................................................................................................4
Part A:..............................................................................................................................................5
Security Management Program at PAI: Benefits and Justifications............................................5
Power AI current security management system......................................................................5
The justification for a new structured framework for security management program of PAI 5
Benefits....................................................................................................................................5
Security Management Policy and Plan........................................................................................6
Building competencies for the task, roles, and responsibilities regarding security management
program for PAI...........................................................................................................................7
Security Management Program development model...................................................................8
Legal and Statutory Requirements...............................................................................................9
Conclusion.....................................................................................................................................10
Reference.......................................................................................................................................11

List of Figures
Figure 1: Security Management Program........................................................................................6
Figure 2: Security Management Program Model............................................................................8

Executive Summary
This report is generated for giving a clear understanding of the importance of IP security
management in a company. Part A of this report discussed the requirements, procedures, roles
and responsibilities and the importance of implementation of the security management program
and governance for Power AI, a software development company with unique power control
solutions with the use of artificial intelligence.

Part A:
Security Management Program at PAI: Benefits and Justifications
Power AI current security management system
Power AI is a company that delivers systems based on the application of artificial intelligence.
Power AI provides a wide range of power saving software solutions for controlling power
generations, storage and consumption at various industrial and business sectors as well as in
home appliances.PAI delivers unique solutions in the market for power control and has huge
revelries and competitors in the market so their unique designs needs managed security
protection. The designs of PAI are completed and developed on an onsite closed network and the
work is managed to by the employees of the IT services. The finished products are then delivered
to the sales team through an application based on cloud services for data protection. The code of
the product source and the finished products are protected by copyright laws as business secrets.
The justification for a new structured framework for security management program of
PAI
The intellectual property of PAI define its uniqueness in the market and thus any breach in the
security system for protecting the intellectual property of the company will prove to be a
significant loss to the company cost and position in the market. Loss of any copies of the source
code of the solutions PAI provide as well as any illegal copies of their product code are a threat
to the company’s intellectual property. The concepts and designs can be delivered to the
competitors that can be misused to developed similar kind of products. This can cause PAI an
estimated cost loss of about $3million and will provide cost advantages to its competitors
(Shang.et.al, 2013).
Benefits
 Will protect all the data forms from the intellectual property of PAI to all the sensitive
paper-based or digital data.

 PAI can easily respond to the evolving security risk with changing organization
environment.
 Timely information recommencement.
 Will provide a framework for securing the source code and other data of PAI in a
structured manner confined at one place.
 Will provide increased protection from cyber attacks (Halbert, 2016).
Security Management Policy and Plan
The intellectual property of Power AI is protected with cloud services for finished products and
the source code information are protected by organization copyright laws. The intellectual
property of the PAI needs a structured framework for prosecuting any theft or loss of sensitive
data of the company. The development of new management policy and plan is not an easy task to
be performed under the influence of all the departments of PAI with legal IT portion of the
company. Following are the defining steps for the security policies and management plan:
 The current security management system of PAI is studied and gaps detected to
implement the new recommendations relating from ISO/IEC 27001 confirming from the
all higher authority of PAI and other segments working in the company.
 The scope of the new recommendation is defined.
 Risk and assets are evaluated to define the loopholes in the current security management
system.
 Policies, instructions, processes, training, instructions, inputs and outputs, along with
roles and responsibilities are defined for the security management system.
 Monitoring and maintenance of the security management system.
 Lastly certificate of conformity with the standards of ISO/IEC 27001.
 Cybersecurity of intellectual property is ensured after reviewing the operational security
flaws.
 Later the data leakage can be kept in track from the social media posts of PAI and its
competitors (Peltier, 2016).

Figure 1: Security Management Program
Source: (Ins2outs, 2019)
Building competencies for the task, roles, and responsibilities regarding security
management program for PAI
The security management program for PAI needs building competencies of different professional
within PAI with individual roles and responsibilities towards accomplishing the objective of the
security management program. The foremost step in the implementation of the security
management program at PAI is informing the company about the scope of the system and the
effect of each and every employee roles and responsibilities in securing the intellectual property
of the company. Following the roles and responsibilities defined for governance of the security
management program:

 Employee: The employee involved in the IT development department needs to take care
of the source code at a personal level according to new security policies.
 IT administrator: Managing the IT security infrastructure of PAI.
 Internal Auditor: Continuous auditing the security management system to detect any
mismatching or breach in the system.
 Data Protection Officer (DPO): Responsible for protecting all the sensitive data of PAI
like source code etc.
 Top management of PAI: Directing and controlling the security measures at the top level
holding the highest responsibilities for ensuring security within the company (Rhodes-
Ousley, 2013).
Security Management Program development model
 Strategy, vision, and mission of the development of the security management program are
defined first according to the research on the current security management system of PAI
and basic architecture of the security system capabilities and requirements is provided
with IT governance.
 Protocols are defined according to the company policies and the compatibility of the
system according to the company operational environment. This is basically the
executing phase if the security system.
 A perfect security model is developed than with the establishment of the security
standard according to ISO/IEC 27001 defines the security need of PAI intellectual
properties.
 The last phase is the development of a security interface with the confirmations from the
companies' higher management (ins2outs, 2019).

Figure 2: Security Management Program Model
Source: (Wordpress, 2019)
Legal and Statutory Requirements
The framework for the security management program for PAI is according to the certification of
ISO 27001. It ensures that the business process and the control system of the company are
running along with the addressing the security threats and opportunities to PAI. ISO
27001:2013/17 risk evaluation method is followed in the security management system for PAI
that consider the Availability, Confidentiality, and Integrity (CIA) of the sensitive information's.
This approach also helps in fulfilling the requirements for the GDPR conformity. A.A.A
(Authentication, Authorization, and accountability) are focus area regarding the development of
the security management program for PAI that ensures the data security at specific user levels
(Lopes and Oliveira, 2016).

Conclusion
This report is based on the development of the security management program for Power AI. Part
A of this report highlighted the key importance of implementing IP security system for PAI
along with the development procedures with defined rules and responsibilities towards the new
security management and governance program.

Reference
Halbert, D., 2016. Intellectual property theft and national security: Agendas and
assumptions. The Information Society, 32(4), pp.256-268.
ins2outs, 2019, How to implement an Information Security Management System. [Online].
Available at: https://ins2outs.com/implement-information-security-management-system/
Lopes, I. and Oliveira, P., 2016. The architecture of information security policies: a content
analysis. In New advances in information systems and technologies (pp. 493-502). Springer,
Cham.
Peltier, T.R., 2016. Information Security Policies, Procedures, and Standards: guidelines for
effective information security management. Auerbach Publications.
Rhodes-Ousley, M., 2013. Information security: the complete reference. McGraw Hill
Education.
Shang, W., Ding, Q., Marianantoni, A., Burke, J. and Zhang, L., 2014. Securing building
management systems using named data networking. IEEE Network, 28(3), pp.50-56.