Security Plan and Training Program for Information Security

This report presents a comprehensive security plan and training program developed for an organization facing information security challenges. The report begins with an introduction outlining the need for a security plan and the responsibilities of a security team. It then identifies organizational holdings at risk, including outdated technical systems and employees' lack of security awareness, leading to vulnerabilities such as weak passwords and potential data breaches. The report also describes potential security threats, including data breaches due to poor password security and social engineering attacks. The core of the report focuses on a security plan and countermeasures, including a data loss protection plan, employee education on strong password practices, and the implementation of updated firewalls and antivirus software. The report aims to provide a holistic approach to securing the organization's data and information assets, and also includes a detailed training program for employees to enhance their understanding of security protocols and threat mitigation.

Running head: SECURITY PLAN AND TRAINING PROGRAM
SECURITY PLAN AND TRAINING PROGRAM
Name of the Student
Name of the University
Author note

SECURITY PLAN AND TRAINING PROGRAM
Table of Contents
Introduction: 3
Discussion: 4
Identify and describe the organizational holdings at risk: 4
Identify and describe the potential security threats to the organization: 5
Security plan and counter measure for managing the threats: 7
Comprehensive information security training and awareness program for the staff
personnel of the organization: 8
Conclusion: 9
References: 11

SECURITY PLAN AND TRAINING PROGRAM
Abstract
The objective 9of the assignmnet is to convey and denmeonstrate the awreness of
current industry in the filekd of informatio security. The report evaluates the security plab for
the organziation given in the case study. The report will idebtify te threats and the eisks that
are existing tin the organiztaion inrasyructure where maximumm of tge employees doesnot
follow securitry measures. The repoet will draw security guidelines. It will aklso develop a
training programme for the employees pf te opragnizatio ntha will help them to know about
the vulnerabilities and how to avoid such condition.

SECURITY PLAN AND TRAINING PROGRAM
Introduction:
The report aims in developing a security plan for the organization for recognizing the
threats in the present scenario as well as the future aspects where the threats may occur in the
work place. The report revolves around the scenario where the team has been given the
responsibility to the security team for providing protection to the information holdings of the
organization. The security team has been appointed for the purpose of identifying the threats,
outlining the security based guidelines from the attacks that are deliberate in nature and also
the accidental threats. According to the recent news the management team responsible for the
security of the data of the organization has collected the reports claiming that there is a
deficiency in security in the vital areas like the incident response teams, the areas that are
responsible for the recovery from the disaster. The situation has also aroused due to the lack
of the awareness within the employees of the organization which also comprises of the key
factor which is the maintenance of the passwords for the systems. The technical systems that
were used in the organization needed a well service as the maintenance of the database and
the document were very low. This needs the security plan implementation by the team that
has been appointed.
A security plan is the format that describes the approach along with the
responsibilities and the required resources for the purpose of management of the security
risks. The security plan is associated with the reviewing the level of the security based risks
that are present in the several sectors in the operations of the working organization and it also
helps in initiating the mitigation process of the identified risks (Soomro, Shah and Ahmed
2016). This describes the need of the security plan which states that the vulnerable condition
of the organization needs the implementation of the revised security programs so as to
develop more secured environment in the organization.

SECURITY PLAN AND TRAINING PROGRAM
Discussion:
Identify and describe the organizational holdings at risk:
The organization is situated in a separate building which had 1000 staffs working in
the organization. The problem with the organization is that the technical systems or the
technical environment of the organization has long been updated and there is a least
maintenance of the systems. The employees of the organizations are not well trained about
the consequences of the security issues that are arising due to them. The security problem
arising are mainly as it comprises of the matter that they are not using secured password
blocking systems. The employees are still securing their databases with low protected and
week form of passwords. Over this, the organization did not take any initiative in a long time
for introducing or strengthening the security of the password related issues. There are cases
of deliberate and as well as accidental threats in the organizations (Fransen, Smulders and
Kerkdijk 2015). The deliberate threats are the intentional threats which could have been
avoided by maintaining certain steps or protocols so as to achieve stable condition in the
organizations. The organization is holding a high risk in the area of the security of the
credentials of the employees of the organization. The information holdings of the
organization are considered to be the greatest asset for the organization in respect to the
security measures of the organization. There are around 1000 employees working in the
organization. Each worker is assigned with their own systems where they are able to activate
and access the server network of the organization. The systems are not updated, the firewall
has expired and this creates a scope for the malware based attacks to be more effective on the
network, putting the company’s business on risk. The systems are unprotected and all kind of
transaction related data are not secured in the network of the organization (Whelan 2017).
The information or the data of the customers of the organization are also the prime asset or
can be known as the organizational holdings that are put on risk due to the low secured

SECURITY PLAN AND TRAINING PROGRAM
environment in the organization. The problems that are faced by the organization can be
identified as the data loss, security breaches and the ransomware attacks or the malicious
attacks done by the hackers. All kind of problems mainly depend on the data and information
of the company (Soomro, Shah and Ahmed 2016). The data can be for the customers as well
as the employees that are working for the organization. Securing the data is the prime concern
that needs to be focused by the new security implementation team.
Identify and describe the potential security threats to the organization:
The organization posses and practices a very week form of security measure towards
the threats to the organization. The employees of the organization are not aware of the
security planning and procedures. They are unaware of the vulnerabilities that can occur due
to the activities that are done on the network of the organization by them. The organization
has failed in training their employees about the possible risks that can occur due to such
activities (Modarres 2016). There is a high need of security plan and training for the
employee for organization so as to secure the network of the company and save the company
from the future vulnerabilities.
According to the recent information gathered from the department of the security
management, the organization is lacking the security implementation in many parts of the
organization. The potential security threats have been identified and evaluated for the
organization (Sennewald and Baillie 2015). The security team that has been appointed by the
organization has evaluated the potential security risks that are affecting the operations of the
organization.
The potential risks that are identified are as follows:
 Data breaches due to poor password security: Setting poor or weak passwords
in the system or in the network access of the organization by the employees is

SECURITY PLAN AND TRAINING PROGRAM
considered as one of the most common challenges faced by the enterprises in the
field of security blunders. The problem has been faced in almost all kind of
enterprises since the introduction of the information technologies in all kind of
business organizations. This is considered as one of the most vital point or reason
behind the cyber attacks that causes interruption in the business process of the
organizations (Fielder et al. 2016). It can be observed that most of the web
applications on which the employees are working for meeting the business
requirements are developed in such way that they come with default passwords set
for the sake of opening the software and utilizing it.
The developers have always advised to change or reset the password that has been
given initially. But most of the people working in the organization are not
following the basic instructions and continue to work with their initial passwords
without changing or resetting with a new password. Guessing the passwords or by
using the process of ransom ware attacks is the most common ways that is utilized
by the attackers or the hackers for gaining access to the network server of the
organization and hence they are successful in implementing bugs in the network
server so that the whole work process slows down (Safa, Von Solms and Furnell
2016). The attackers can also be able to handle the credentials of the user and gain
access to the private information of the user which results in gaining the access to
the private details of the organization which may result in severe consequences.
 Loss due to social engineering attacks: the social engineering attacks are
considered to be one of the most critical and potential security threat to the
organizations. The terms social engineering attacks are referred to the attacks that
are generally known as the malicious attacks or the activities (Safa et al. 2015).
The attacks utilize psychological based manipulation by which they trick the

SECURITY PLAN AND TRAINING PROGRAM
employees of the organization generally by sending spam messages and malicious
links. Once the employees access the links the attackers gains the access to their
portal site or the server site (Tsohou et al. 2015). These are the prime reason for
the attacks happening on the server site of the organization which leads to the loss
of employee and customer data of the organization creating a loss to the business
of the organization.
Security plan and counter measure for managing the threats:
The man objective of implementing the Security plan in an enterprise is to provide an
integrated view of the security based threats and their risks on the organization. The objective
for the security plan is to plan safety against the vulnerabilities against the threats or the risks
which are the attacks that are harming the business infrastructure of the organization. The
security plan helps in providing the integrated view of the requirement that are needed by the
organization. It helps in classifying the threats or senses the possible risks in the organization
infrastructure (Javaid et al. 2016). After sensing the possible risks, it helps in developing the
aid that can be provided to the system after the attack and helps in controlling when it is
necessary. This also develops the security strategies according to the timeline for the
organization.
The Security team hired for the protection of the information holdings of the business
organization develops the security plan. The security plan are as follows:
 Developing the comprehensive form of data loss Protection Plan will help the
organization and the security management team to deceive the action and also
prevent the scene of paralyzed operation during the attack or data breach attack.
The security plan efforts will help the employees of the organization to believe
within the organization that they are anticipated in taking further measures for

SECURITY PLAN AND TRAINING PROGRAM
addressing the threats (Downer and Bhattacharya 2015). This also heeds the
proper ttrraini8ng or period classes for the employees to demonstrate them the
needs of then security plan and how to work with the same.
 Educating the Employees of the organization for proper handling and using of
stronger passwords. The password issue has been brought to notice by the security
team as it has been on e of the main reason for the loss of the employee data ion
the organization. The proper training provided trio the employees of the
organization will ensure the safety of the organization data as it will create an
immense problem to the attackers to dismantle the network of the organization
and spread malicious codes in the networks (McIlwraith 2016).
 Providing updated version of firewalls and ant viruses in the systems of the
employees and also in the sever side of the organization is one of the key step for
providing security to the organization. The more number of attacks on the server
of the organization has brought the business process of the organizational stake.
For avoiding such critical condition using or implementing new updated software
and firewall or antivirus will help the organization to remain on their position.
Comprehensive information security training and awareness program for the
staff personnel of the organization:
The organization has appointed the security that is responsible for maintaining as well
as developing the counter measures that will help the organization to maintain the security of
the organization in respected to the matter of providing security to the network of the
organization. The security awareness program is a way to let the organization people know
about the malicious activities that targets the system of the organization and can bring on the
system of the organization for a huge less. It is important for the organization people be
aware about the types of the attacks or the things that allow the attacks to happen. The staffs

SECURITY PLAN AND TRAINING PROGRAM
of the organization rarely have any kind of information about the phishing attacks or the
password changing policy or the firewall maintenance (Ahmad, Maynard and Shanks 2015).
The program will help them to be aware of such things that are necessary for the successful
operation of their Business process.
The most important security training topics will comprise of the following entities:
 Information training. The training will enablet5he employees to know about
the importance of data they posses and the data they are dealing with or the
customer data.
 Information security training or attacks on data. The training will enable the
employees to gain the knowledge on the matter of the risks that are prevailing
on the data. The loss of data and the reasons for the loss (Cavusoglu et al.
2015). They will be trained on the subjects like the attacks or the phishing
attacks and how they are initiated due to the careless attitude of the employees
themselves.
 Password protection training. The main issue with the organization employees
is the factor that the employees are not maintaining the passwords or are not
changing the old passwords which are creating a critical situation for them.
The training will let them know about the vulnerabilities that causes due to the
password issue (Ghernaouti-Helie 2016). They will be shared the knowledge
of changing and setting strong password so that malicious attacks cannot ruin
their work infrastructure.
Conclusion:
The report concludes that the data loss in any organization can create a massive
downfall in the business structure of the organization. The risk that can be identified here are

SECURITY PLAN AND TRAINING PROGRAM
the virus attack risks, attacks by the denial of service, data loss, destruction in the systems of
the organization. The intentional attacks are considered as the crime.teh report also concludes
that the security measures that have been taken by the security officials from the management
are vital for creating sustainability within the organization and securing them for, different
vulnerabilities. The security countermeasures will help the organization employees to gain
more knowledge on the risks and threats and will hence help them to stay aware as well as the
organization leads to stay aware about the fact of network security.

SECURITY PLAN AND TRAINING PROGRAM
References:
Ahmad, A., Maynard, S.B. and Shanks, G., 2015. A case analysis of information systems and
security incident responses. International Journal of Information Management, 35(6),
pp.717-723.
Cavusoglu, H., Cavusoglu, H., Son, J.Y. and Benbasat, I., 2015. Institutional pressures in
security management: Direct and indirect influences on organizational investment in
information security control resources. Information & Management, 52(4), pp.385-400.
Downer, K. and Bhattacharya, M., 2015, December. BYOD security: A new business
challenge. In 2015 IEEE International Conference on Smart City/SocialCom/SustainCom
(SmartCity) (pp. 1128-1133). IEEE.
Fielder, A., Panaousis, E., Malacaria, P., Hankin, C. and Smeraldi, F., 2016. Decision support
approaches for cyber security investment. Decision Support Systems, 86, pp.13-23.
Fransen, F., Smulders, A. and Kerkdijk, R., 2015. Cyber security information exchange to
gain insight into the effects of cyber threats and incidents. e &iElektrotechnik und
Informationstechnik, 132(2), pp.106-112.
Ghernaouti-Helie, S., 2016. Cyber Power: Crime, Conflict and Security in Cyberspace. EPFL
Press.
Javaid, A., Niyaz, Q., Sun, W. and Alam, M., 2016, May. A deep learning approach for
network intrusion detection system. In Proceedings of the 9th EAI International Conference
on Bio-inspired Information and Communications Technologies (formerly BIONETICS) (pp.
21-26). ICST (Institute for Computer Sciences, Social-Informatics and Telecommunications
Engineering).