Security Policy Development, Management, and Planning Report

This report delves into the critical aspects of security policy within the context of the World Health Organization (WHO) and its My Health Record system. The report begins by outlining the importance of information security, emphasizing the need for robust policies to protect sensitive health data. It details the role of planning in identifying threats, risks, and vulnerabilities, as well as the strategic approaches to policy development, including identification, authentication, authorization, and accountability. The report further explores resource planning, defining responsibilities, and managing the policy through monitoring, control, and updates. The document also covers risk management, risk assessment, and mitigation strategies. It emphasizes the importance of data privacy and the consequences of data breaches, providing a comprehensive overview of security management principles and practices. The report also describes risk assessment, mitigation, and the development of a risk register. The document also discusses the importance of monitoring and controlling the policy, and the penalties for violating data privacy. This report provides a comprehensive overview of security management principles and practices within the healthcare domain.

Running head: SECURITY MANAGEMENT 1
Management
Student name
Institution name
Title
Date

SYSTEM SECURITY MANAGEMENT
2
Executive summary
I bet security is a matter of concern to every individual, organization, and the government
or a country. Besides personal safety or protection from attack by terrorists, information security
is crucial. Laws have been established and implemented on safeguarding the information of an
individual or organizations. This report is dedicated to explaining some significant information
security concerns.

Running head: SECURITY MANAGEMENT 3
Table of Contents
Part I............................................................................................................................................................5
Introduction.................................................................................................................................................5
My role in the company...............................................................................................................................6
Purpose.......................................................................................................................................................6
Security policy.............................................................................................................................................6
To who and why is the policy formulated?..................................................................................................6
Role of planning security policy...................................................................................................................6
Best strategic planning of security policy....................................................................................................7
Procedures of implementing the policies....................................................................................................8
Need to explain identification.................................................................................................................8
Authentication.........................................................................................................................................8
Authorization...........................................................................................................................................8
Accountability..........................................................................................................................................8
Resources planning required for security policy..........................................................................................8
Other relevant issues to add to the plan.....................................................................................................9
Development of security policy...................................................................................................................9
Intent and rationale of system security policy.............................................................................................9
Definitions used throughout the document..............................................................................................10
Responsibility of individuals......................................................................................................................10
Scope of the policy....................................................................................................................................10
Other reasonable aspects of adding on the policy....................................................................................11
Managing a security policy........................................................................................................................11
Penalty to doctor violating data................................................................................................................11
How to monitor the policy.........................................................................................................................11
How to control the policy..........................................................................................................................11
The major outcome of the policy..............................................................................................................12
Confidentiality.......................................................................................................................................12

SYSTEM SECURITY MANAGEMENT
4
How to update the policy..........................................................................................................................12
Other reasonable aspects of management...............................................................................................12
Conclusion.................................................................................................................................................12
Risks management(part 2).........................................................................................................................13
Introduction...............................................................................................................................................13
My role in UNICEF as IT security advisory..................................................................................................14
The major risk in IT components system...................................................................................................14
Consequences of the risk...........................................................................................................................15
Inherit risk assessment..............................................................................................................................16
Risk mitigation...........................................................................................................................................16
Residual risk assessment...........................................................................................................................16
Risk register and risk assessment matrix...................................................................................................17
Risk............................................................................................................................................................17
Mitigation strategy....................................................................................................................................17
Assessment matrix....................................................................................................................................17
The rationale of conducting a risk assessment..........................................................................................18
Conclusion.................................................................................................................................................19
Reference..................................................................................................................................................20

Running head: SECURITY MANAGEMENT 5
Part I
Introduction
It is a general wish for everyone to have good health; however, this is not always the
case. Often individuals develop ill health hence need for treatment. Therapy is complex on the
fact that it starts from the research of the scenario, the disease, and the symptoms that could be
used to distinguish the condition with the other illness known to exist.
The process does not stop at drugs research; it is extended to the best method of
administration. This calls for the development of complex and even global health institutions
with the like of the World Health Organization (WHO) which is a global organization with
branches within Australia territory Barton, Tejay, Lane, and Terrell, (2016). Data and
information about WHO is recorded in My Health Record System for processing and easy
retrieval. The organization is dedicated to research on drugs and administration to ill health
persons. Information held by the organization is voluminous, yet requires a high level of privacy.
Sharing of the information must be authorized by the primary source of the data.
The need for the privacy of the information in question is demanding hence need for a
complex and robust information system that assures less data leakage to unauthorized
personnel’s. This factor makes WHO an interesting organization to explore as long as data and
information systems are concerned. This report is dedicated to the organizations’ information
system security aspect.
My role in the company
Since the year 2017 when I was absorbed by the company, I was assigned the
responsibility managing and performing data entry and processing. My role in the organization
helps the management to store the organizations in form usable in the daily activities of the
organization. It also provides a reliable retrieval platform.

SYSTEM SECURITY MANAGEMENT
6
Purpose
The objective of the organization is to provide information on global health status and provide
treatment to the affected individuals in collaboration with the local government. The process is
heavily reliant on the data available about people’s health status thus making the role of data
entry vital.
Security policy
Information on individual or group health is confidential and should be maintained private.
However, the data may be leaked either accidentally or intentionally hence violating the right
to privacy. To control the above scenario, tough policies have been formulated.
To who and why is the policy formulated?
The security policy is formulated for the system users, doctors and the general world to combat
data leakage.
Role of planning security policy
The role of planning the security policy in the information systems of the WHO
organization is to identify the pieces of information that can set back the organization in case
they fall on the wrong hands. Therapy includes identification of the threats, risk, and the
vulnerability associated with the loss of the data in discussion and the channel through which the
data may be leaked hence generating a mechanism to secure the data. The planning department
has obliged the responsibility of evaluation of cost and impact on social and economic factors
that the organization may suffer in case of the risk occurrence Bolon, Dodds, and Ward, (2016).
However, robust the system is, it is not foolproof to leakages. The information and the data in the
system are still likely to get the way out. The planning team hence, must take the burden of
initiating tracking systems of the possible leakage point of data using network switches and
CCTV cameras as well as tracking the logins used to access the system.

Running head: SECURITY MANAGEMENT 7
Best strategic planning of security policy
Security planning policy on information system entirely depends on the data items that
need to be secured. Also, the cost that may be incurred on the occurrence of the risk of data
leakage. The plan also depends on the ability of the individuals or the organization to finance the
policy on physical items and human power requirements.
The best strategic security policy recommendable to WHO is the one the organization can
finance and is acceptable by both the management and the authority of the land. The system must
have a robust mechanism to identify and classify assets of interest and equipped with a
monitoring as well as measurement and reporting features. The plan implementation must be
within the organization capacity of the budget of labor and finance. These include identity
explanation, authorization, authentication and accountability.
Procedures of implementing the policies
Need to explain identification
The doctor’s information system holds sensitive information. The individuals accessing the
system must therefore explain their identity as a strategy of keeping track of who visited the
system, and when.
Authentication
Contrary to identity explanation, authentication is the process of verifying whether the
identified user is genuine or otherwise. This is done through the use login details such as the
user name and the passwords. This bars the individuals not registered to the system from the
system access.
Authorization
This refers to the process of filtering the pieces of information that given individuals whether
they have identified themselves or have signed in to the system can access.
Accountability
Any information mess is likely to be caused by a person. Individuals who mess the information
must be held accountable of their commitments.

SYSTEM SECURITY MANAGEMENT
8
The policy must reflect the reality in the ground on the issue of the system security; in
other words, the plan must be developed on the matter at hand and no imagination Jerhotova, and
Antonini, (2015). The policy must be easy to understand; that is, it must not be meant for
professional use. Also, the policy must be enforceable and practical but also flexible to change
whenever the need may arise.
Resources planning required for security policy
The security policy to be developed and adopted heavily relies on the assets and the
resources of the organization. The individual or the panel developing the policy must have a deep
understanding of these resources and how each is secure or vulnerable to risk and threat. The
individuals in the panel must also classify the impact of the loss occurrence of each threat has in
order to identify which asset requires more security than the other.
Decision-making processes and responsibilities relating to safety and security must be
written in bold capital letters in the policy and the procedure. This is to ensure persons who are
part of the policy implementation are informed on how to react in the occurrence of any security
threat. The information also gives procedures of remedy or emergency and to whom the
individual must first report avoiding confusion Ferwerda, Herendeen, and Mousseau, (2015).
The more information is delayed before it is shared with the appropriate personnel, subjects the
system to more risk. It is, therefore, advisable to share the information without delay and with
the possible level of clarity and correctness; the reporter can look at their best.
Other relevant issues to add to the plan
The implementers of the security policy must understand there is no foolproof system in
existence. It is therefore not their failure only that can contribute to the security threat to the data

Running head: SECURITY MANAGEMENT 9
in the systems and hence should avoid short cut routs to cover up the messes. Acceptance is
urged to be the first step towards healing by philosophers. The individuals should make sure they
accept the consequences and strive to seek the remedy from the experts. The policy must also
highlight it is after reducing the impact of the risk occurrence and compacting the vulnerability
of the risk.
Development of security policy
Security policy refers to the state of being secure of the items in the system.
Intent and rationale of system security policy
The major and the likely sole intent of developing a security policy on systems is to
safeguard, protect, and recover damaged or lost data of customers, employees, clients, vendors,
and the general organization. The intent of performing all the above processes is to protect the
above-mentioned groups and individuals from harm that may be caused or result from intentional
or accidental data leakage.
Definitions used throughout the document
 Data – raw figure from the primary source.
 Security- it is the state of safety or protection from harm.
 Policy- is a course of actions proposed to the organization or the individuals of interest.
 System- it is a set of computing elements working to achieve common goals.
Responsibility of individuals
The management is responsible for ensuring the employees fulfill the requirements of the
policy as far as the security of the system is concerned Khuti, Geffin, Robinson, and Costa,

SYSTEM SECURITY MANAGEMENT
10
(2017). The system users and the customers, as well as the clients of the system, have the
responsibility of reporting any suspicious scenario ehether intentional or accidental data leakage
to the necessary personnel before things go sour.
Scope of the policy
The policy scope must include but not limited to the data in the system, the
administration and the users of the system as well as the clients, customers, vendors and the
individuals responsible to the system update and maintenance. The risk and the threat cost must
be measurable in clear measurements.
Other reasonable aspects of adding on the policy
As much as the policy strives to explain the measures and the scope of the features to be
involved in the security system, it should clearly state the repercussions on individual found
guilty of intentionally leaking the information illegally.
Managing a security policy
Advocates argue that laws exist because people are fond of practicing injustice. Information
injustices may be practiced by the doctors also.
Penalty to doctor violating data
The best penalty to impose to doctor who has violated the data of patients must be dealt with
in accordance to the law. The organization must ensure the doctor is dealt with accordingly
with by the judicial system with penalties to the illegalities ranging from dismissal from work,
serving a jail term, fine or revoking the working certificate depending with the intensity of the
mess caused.

Running head: SECURITY MANAGEMENT 11
How to monitor the policy
The management should ensure it is provided a policy monitoring system integrated with
the data system. These systems are readily available from vendors like IBM.
How to control the policy
The policy of the security system should not go beyond the scope through overestimation
of capacity. The policy must be reliable and possess a high value of integrity and measurable
features as opposed to estimates and imaginations Knowles, Prince, Hutchison, Disso, and Jones,
(2015).
The major outcome of the policy
Confidentiality
The policy application will boost the confidence of the users, customers, and the
management on the ground of high availability, reliability, and protection of data of interest from
unauthorized third party.
How to update the policy
The rules of law are not static and are subject to change with time and technology, to
change any of the clauses of the policy will call for consensus agreement in decision making of
the shareholders, administration and the customers or the clients as well as the users of the
system Sadeghi, Wachsmann, and Waidner, M. (2015).
Other reasonable aspects of management
The policy must have dedicated administrators responsible for regular monitoring and
update of the policy whenever called for.

SYSTEM SECURITY MANAGEMENT
12
Conclusion
The report is dedicated to the provision of detailed information on policymaking in
systems security, data privacy, and confidentiality. The report highlights how to plan for the
security policy, the resources required, and the person’s responsibility in the process. The report
also explains how to develop a security system and how to manage it effectively.
Risks management (part 2)
Introduction
The world at times is weird, and chances of survival are low for both the adults and
children. Children are more prone to the dangers of the world on the ground of their inability to
fight for survival.
For instance, a war outbreak causes death and injuries to both adults and children.
Children are, however, more prone since they have poor tactics of survival. They have limited
ability to secure medication and food in case of injuries as compared to the adults who have a
higher ability or the power to seek for treatment and securing food.
The above scenario is an iconic example of the matter in the ground and serves as a
general example of the calamities and how they affect both the adult and the children. It is also
definite impractical and impossible for a bed sick person to struggle to find his treatment and that
of the child in the same mess. The most likely scenario is that the adult will seek his treatment as
he watches the child die and argues he will bear another one. Other calamities that subject
children life to danger are drought and famine, earthquake, floods, and hurricanes.
All hope is not lost either Laudon, and Laudon, (2016). There have been established
strong governmental and non-governmental bodies with the agenda of helping the children and
saving them from these kinds of dangers. This includes the United Nations Children’s Fund