CIS 333 Assignment 1:Creating and Communicating a Security Strategy

 

CIS 333 Assignment 1:Creating and Communicating a Security Strategy

 

CIS333   Assignments and Rubrics

 

Assignment 1: Creating and Communicating a Security

Strategy

 

 Draft Due Week 4, worth 40 points Final Due Week 6, worth 60 points

 

 

The specific course learning outcomes associated with this assignment are:

 

Analyze the importance of network architecture to security operations.

 

Apply information security standards to real-world implementation.

 

Communicate how problem-solving concepts are applied in a business environment.

 

Use information resources to research issues in information systems security.

 

Write clearly about network security topics using proper writing mechanics and business formats.

 

Preparation

 

1. Review the essential elements of a security strategy

 

A successful IT administration strategy requires the continuous enforcement of policies, standards, and practices (procedures) within the organization. Review these elements to see how they compare:

 

Policy             The general statements that direct the organizati communication and goals.

 

Standards     Describe the requirements of a given activity related to the policy. They are more detailed and specific than policies. In effect, standards are rules that evaluate the quality of the activity. For example, standards define the structure of the password and the numbers, letters, and special characters that must be used in order to create a password.

 

Practices       The written instructions that describe a series of steps to be followed during the performance of a given activity. Practices must support and enhance the work environment. Also referred to as procedures.

 

2. Describe the business environment

 

You are the IT professional in charge of security for a company that has recently opened within a shopping mall. Describe the current IT environment at this business. You can draw details from a company you work for now or for which you have worked in the

 

company allow cell phone email apps? Does the company allow web mail? If so, how will this affect the mobile computing policy? Describe all the details about this business environment that will be necessary to support your strategy.

 

 

CIS333   Assignments and Rubrics

 

3. Research sample policies

 

Familiarize yourself with various templates and sample policies used in the IT field. Do not just copy

 

them to yours. Use these resources to help structure your policies:

 

Information Security Policy Templates

 

Sample Data Security Policies

 

Additional Examples and Tips

 

 

Instructions

 

With the description of the business environment (the fictional company that has opened in a shopping mall) in mind and your policy review and research complete, create a new security strategy in the format of a company memo (no less than three to five pages) in which you do the following:

 

1. Describe the business environment and identify the risk and reasoning

 

discovered in your research. Be sure to identify the reasons that prompted the need to create a security policy.

 

2. Assemble a security policy

 

Assemble a security policy or policies for this business. Using the memo outline as a guide, collect industry-specific and quality best practices. In your own words, formulate your fictional cies. You may use online resources, the Strayer Library, or other industry-related resources such as the National Security Agency (NSA) and Network World. In a few brief sentences, provide specific information on how your policy will support the business’ goal.

 

3. Develop standards

 

Develop the standards that will describe the requirements of a given activity related to the policy. Standards are the in-depth details of the security policy or policies for a business.

 

4. Develop practices

 

Develop the practices that will be used to ensure the business enforces what is stated in the security policy or policies and standards.

 

Format your assignment according to the following formatting requirements:

 

This course requires use of Strayer Writing Standards (SWS). The format is different than other Strayer University courses. Please take a moment to review the SWS documentation for details. Review this resource to learn more about the important features of business writing: The One Unbreakable Rule in Business Writing.

 

You may use the provided memo outline as a guide for this assignment, or you may use your own. Get creative and be original! (You should not just copy a memo from another source.) Adapt the

company standard documents for this type of communication.

 

evaluate your submissions.

 

 

 

 

 

 

CIS333      Assignments and Rubrics

 

Note: This assignment will be run through SafeAssign plagiarism detection software and an originality report will automatically be sent to the instructor.

 

Rubric

 

Grading for this assignment will be based on answer quality, logic/organization of the memo, and language and writing skills, using the following rubric.

 

 

Points:
40 Draft/	Assignment 1: Creating and Communicating a Security Strategy
60 Final
			Meets
Criteria	Unacceptable		Minimum	Fair		Proficient		Exemplary
	Below 60% F		Expectations	70-79% C		80-89% B		90-100% A
			60-69% D
1. Describe the	Does not		Insufficiently	Partially		Satisfactorily		Thoroughly
business and	describe the		describes the	describes the		describes the		describes the
identify the risk	business and		business.	business.		business.		business.
and reasoning	does not
	submit or		The risk is	The risk is		The risk is		The risk is
Weight: 20%	incompletely		unclear and	stated but the		identified and the		clearly
	identifies the		there is not a	reasoning needs		reasoning has		identified and
	risk and		clear	more supporting		some supporting		the reasoning
	reasoning.		connection to	details.		details.		has well-
			a reason.					supported
				More details and				detail to
				a clear				connect the
				connection to				risk to the
				the risk would				reasoning.
				improve this
				section.
2. Assemble a	Does not		The policy is	The policy		The policy		The policy
security policy	submit or		missing major	includes some		includes most		includes all
or policies for	incompletely		elements and	elements and		elements and		the necessary
the business	assembles a		does not	partially		satisfactorily		elements and
	security policy		communicate	indicates how it		indicates how it		clearly
Weight: 25%	or policies for		how it would	would support		would support the		indicates how
	the business.		support the	the				it will support
			business goal.	goal, but was		but was lacking
				lacking		supporting		goal.
				supporting		details.
				details.
3. Develop	Does not		The standards	The standards		The standards		The standards
standards	submit or		are not fully	partially		satisfactorily		thoroughly
	incompletely		developed and	describe some		describe many of		describe all
Weight: 25%	develops		do not	of the		the requirements		the
	standards.		describe the	requirements of		of the activity but		requirements
			requirements	the activity but		could use more		of the activity
			of the activity.	lack the details		details.		and include
				necessary to				sound, in-
				make them				depth details.
				complete.

 

 

 

CIS333   Assignments and Rubrics

 

Points:
40 Draft/	Assignment 1: Creating and Communicating a Security Strategy
60 Final
		Meets
Criteria	Unacceptable	Minimum	Fair	Proficient	Exemplary
	Below 60% F	Expectations	70-79% C	80-89% B	90-100% A
		60-69% D
4. Develop	Does not	The practices	The practices	The practices	The practices
practices	submit or	do not include	partially	satisfactorily	thoroughly
	incompletely	enough	describe how to	address how to	address how
Weight: 25%	develops	description to	ensure the	ensure the	to ensure the
	practices.	ensure the	business can	business can	business can
		business can	enforce what is	enforce what is	enforce what
		enforce what	stated in the	stated in the	is stated in the
		is stated in the	policies and	policies and	policies and
		policies and	standards.	standards.	standards.
		standards.
			The written	The written	The written
		The written	instructions	instructions	instructions
		instructions do	include some	include many of	include all the
		not include	steps, but they	the necessary	necessary
		steps or	could be	steps, but	steps and
		enough steps	expanded to	additional steps	have well-
		to make them	make them	and details would	supporting
		complete.	complete.	improve the	details.
				instructions.
	The writing	The writing	The writing is	The writing is	The writing is
5. Clarity,	lacks clarity.	lacks some	beginning to	mostly clear and	professional
		clarity.	show clarity.	business	and clear.
writing
	Formatting is			formatting is
mechanics,
	not	Formatting is	Business	apparent.	The formatting
and business
	appropriate	not	formatting is		is excellent
formatting
	for business.	appropriate for	partially applied.	Some minor	and aligned
requirements
		business.		adjustments	with business
Weight: 5%				would improve	requirements.
				the overall

format.

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

CIS333   Assignments and Rubrics

 

Additional Examples and Tips

 

Example 1: XYZ Inc. Company-Wide Employee Password Strategy

 

Policies

 

All users must have a password.

Passwords must be changed every six months.

 

Standards

 

A password must have a minimum of six characters.

A password must have a maximum of 12 characters.

A password must contain letters, numbers, and special characters other than $.

 

Practices-Employee

 

Create a password. The UserID should be an EmployeeID already generated by HR.

Send a request to create the account to the Information Technology (IT) department.

User receives a temporary password.

Users must change their temporary password the first time they log in.

 

Example 2: Security Policy and Standards

 

Password Policy: Passwords are an important part of computer security at your organization. They often

 

data.

 

In order to define the password policy, it is important to identify the standards.

 

1. Multi-factor authentication
2. Password strength standard

 

3. Password security standards; how to keep the password secure

 

Tips and Points to Consider When Identifying Risks or Security Vulnerabilities

 

Flaws in operating systems due to constant attack by malware

Denial of services attacks

Employees data theft

User set a weak password or password that is easy to guess,  User leaves sensitive data on an unlocked, unattended computer

Organization allows sensitive data on a laptop that leaves the building Data can be accessed remotely without using proper security