CS562 Saudi Electronic Module 5 SLS Corporation Security Policies Paper Critical Thinking: Security Policies (50 Points) The policies that organizations p

CS562 Saudi Electronic Module 5 SLS Corporation Security Policies Paper Critical Thinking: Security Policies (50 Points)

The policies that organizations put in place are similar to laws in that they are directives for how to act properly. Like laws, policies should be impartial and fair, and are often founded on ethical and moral belief systems of the people who create them. In some cases, especially when organizations expand into foreign countries, they experience a form of culture shock when the laws of their new host country conflict with their internal policies.

Suppose that SLS Corporation has expanded its operations into your country. Setting aside any legal requirements that SLS make to its policies to conform to your local laws, does SLS have an ethical imperative to modify its policies to better meet the needs of its stakeholders and their geographical region/country?

Directions:

Your paper should be 4-5 pages in length, not including the title or reference pages.
You must include a minimum of two (2) credible sources. Use the Saudi Digital Library to find your resources.
Your paper must follow Saudi Electronic University academic writing standards and APA style guidelines, as appropriate.

There is SafeAssign Plagiarism Checker, If your score is above 25%, you will want to edit your assignment before submitting it for grading.

course name: CS562 – Enterprise Cybersecurity

Course Materials: Whitman, M. E., & Mattord, H. J. (2018). Principles of information security (6th ed.). Boston, MA: Cengage Learning. ISBN: 9781285448367

Chapter 4: Planning for Security in Principles of Information Security
INFOSEC Resources. (2018, February 6). Key elements of an information security policy. In General Security, Incident Response.
INFOSEC Resources. (2019, February 16). Top 10 security awareness training topics for your employees. Security Awareness Principles of Information Security
Sixth Edition
Chapter 4
Planning for Security
Learning Objectives
• Upon completion of this material, you should be able to
• Explain how organizations institutionalize policies, standards, and
practices.
• Discuss how organizations use education, training, and awareness
programs in support of information security.
• Analyze how organizations use contingency planning to increase
efficiency.
• Compare and contrast incident response planning, disaster
recovery planning, and business continuity planning.
Introduction
• Security programs are used to:
• to describe all the information security details related to
personnel, plans, policies, and initiatives
• An Information Security (INFOSEC) program:
• describes the organization and structure of the effort to
mitigate risks to the organizations information assets
CS562 Enterprise Cyber Security
Security Education, Training, and Awareness
Programs Overview
A SETA program is designed to:
– reduce accidental security breaches
– It traditional consists of three components:
Security Education (SE),
security Training (T), and
security Awareness (A)…Hence SETA!
Security Awareness, training, and education (SETA) programs offer two
major benefits:
– Improve employee security behavior and compliance
– Enable organizations to hold employees accountable for their
actions
CS562 Enterprise Cyber Security
Implementing SETA Programs
The goal of SETA programs is to improve security by:
– Building the knowledge required to design, implement, or
operate security programs for organizations and systems
– Developing knowledge, skills and abilities so that employees can
perform their jobs while using IT systems in secure manners
-Improving security awareness of the requirements to protect
system resources
CS562 Enterprise Cyber Security
SETA Framework Comparison
AWARENESS
TRAINING
EDUCATION
“What”
“How”
“Why”
LEVEL:
Information
Knowledge
Insight
OBJECTIVE:
Recognition
Skill
Understanding
ATTRIBUTE:
TEACHING METHOD:
TEST MEASURE:
IMPACT TIME FRAME:
Media
• Videos
• Newsletters
• Posters, etc.
Practical Instruction
• Lecture
• Case study
workshop
• Hands-on practice
Theoretical Instruction
• Discussion seminar
• Background reading
True/False
Multiple Choice
(identify learning)
Problem Solving
(apply learning)
Essay
(interpret learning)
Short-term
Intermediate
Long-term
CS562 Enterprise Cyber Security
Security Training
Security training provides detailed knowledge and hands-on instruction to
enable employees to perform their duties securely
Two ways to customize or tailor training
(1) By Functional background:
General user
Managerial user
Technical user
(2) By Skill level:
Novice
Intermediate
Advanced
CS562 Enterprise Cyber Security
Points on Training Techniques
Utilizing the wrong techniques or methods can:
• Waste employee time, Hinder transfer of knowledge
• Be a wasted expense and lead to frustrated & poorly trained
employees
Good training programs ARE ENTERTAINING AND FUN!!!
• Use best practices and innovative technologies
• Use on-site and hands-on practical training
• Often for small groups of users to not to impact productivity
• Training sessions are short and consistent, available around the clock
if online and during normal work week if face-to-face
CS562 Enterprise Cyber Security
Methods of Delivery
Training delivery methods:
• Not always focused on the desired behavior outcomes
• Other factors that must be considered are budget, scheduling, and needs of
the organization
• Types of training includes:
One-on-One
Formal Class
Computer-Based Training (CBT)
Distance Learning/Web Seminars
User Support Group
On-the-Job Training
Self-Study (Noncomputerized)
CS562 Enterprise Cyber Security
Training Staff Selection
Types/Sources of Employee training:
– In-house training using organization’s own employees (most
popular)
– Local training program (often free)
– Continuing education departments at large organizations and
educational institutions
– Professional training entities that provide specialized training
(that charge for the service)
– External training agency
CS562 Enterprise Cyber Security
Implementing Security Training (7 Steps)
The following seven-step methodology generally applies to organizations wanting to
establish training programs:
Step 1: Identify program scope, goals, and objectives
Step 2: Identify training staff
Step 3: Identify target audiences
Step 4: Motivate management and employees
Step 5: Administer the program
Step 6: Maintain the program
Step 7: Evaluate the program
CS562 Enterprise Cyber Security
Security Awareness Programs
A Security Awareness program:
• Is sadly one of least frequently implemented, but most effective
security methods available to protect resources
Security awareness programs:
• Can change organizational attitudes towards security and
protection, enhance security reporting and compliance, and limit
adverse consequences of its failure
• Remind users of the proper procedures and policies to follow
CS562 Enterprise Cyber Security
SETA Best Practices
When developing an awareness program, key items to consider are:
• Provide good information early, rather than perfect information late (Bad news
doesn’t get better with age!)
• Don’t use technical jargon, unfamiliar acronyms, etc.
• Don’t overload the users all at once
• Focus on people not technology or complicated processes
• Use every available venue to promote security
• State learning objectives and procedures clearly, and provide sufficient detail and
coverage
• Keep things light (Make training FUN!!)
• Help users understand their protection roles in InfoSec
• Take advantage of all internal resources
• Make the awareness program formal; plan and document all actions
CS562 Enterprise Cyber Security
10 Commandments of SETA Programs
1.
2.
3.
4.
5.
6.
7.
8.
9.
10.
Information security is a people issue, not a technology issue
If you want people to understand, speak their language
If people cannot see it, they will not learn it
Make your point so that you can identify it and so can they
Make training FUN, and Never lose your sense of humor
Make your point, support it, and conclude it, Make It Again!
Always let employees know how bad behavior affects them
Solve the easy things first (password strength, time, etc.)
Formalize your training methodology, structure it
Always be timely, even if it means slipping schedules to include urgent information (threats
Evolve Daily, So Should your SETA Program!)
CS562 Enterprise Cyber Security
SETA Link to Behavior
The purpose of SETA Programs are to modify any employee behavior
that endangers the security of the organization’s information or assets
Stakeholders and Management Must support the SETA program and
set the tone – or the entire program is undermined
Employees Model the behavior and Attitudes or Senior Management
CS562 Enterprise Cyber Security
Points on Awareness Techniques
Awareness can take on different forms for particular audiences
A security awareness program can use many methods to deliver its
message
Effective security awareness programs need to be designed with the
recognition that people tend to practice a tuning out process (acclimation)
So this means awareness techniques should be creative and frequently changed
CS562 Enterprise Cyber Security
Components of Security Awareness
Security awareness components include the following:
Videos
Posters and banners
Lectures and conferences
Computer-based training
Newsletters
Brochures and flyers
Trinkets (coffee cups, pens, pencils, T-shirts)
Bulletin boards
A ton of security awareness resources are available at little to no cost. Search for
free components
Others can be very expensive if purchased externally
CS562 Enterprise Cyber Security
A SETA Newsletter
Security newsletters are a cost-effective way to disseminate security
information (and they can be Fun!)
In the form of hard copy, soft copy or via e-mail
Topics are only limited by your imagination and can include threats to the
organization’s information assets, schedules for upcoming security classes,
and the addition of new security personnel
The Main Goal of the newsletter is to keep information security uppermost in
users’ minds and stimulate them to care about security
CS562 Enterprise Cyber Security
The Security Newsletter (Continued)
Newsletters topics can include:
Summaries of key policies
Summaries of key news articles
A calendar of security events, including training sessions,
presentations, and other activities
Announcements relevant to information security
Examples of “How To” perform procedures or implement policy
CS562 Enterprise Cyber Security
Security Posters as Part of SETA
Keys to a good poster series:
Varies the content
Keeps the posters updated
Uses simple, but visually interesting Posters/themes
Send a simple and clear message
Provide information on processes and procedures to follow
A poster series can be a simple and inexpensive way to focus
employees on Security – Develop a security mindset
Start with in-house development of posters then consider professional
posters
CS562 Enterprise Cyber Security
SETA Poster Examples
CS562 Enterprise Cyber Security
A “Trinket” (small inexpensive item) Program
Trinkets are generally in several categories of items:
T-shirts
Pens and pencils
Mouse pads
Hats
Coffee mugs
Plastic cups
Stickers
Something to consider: Trinkets are generally very cheap and
inexpensive, but they can be expensive to distribute in large quantities
across the organization
CS562 Enterprise Cyber Security
Sample Trinket Items
CS562 Enterprise Cyber Security
Consider Having a SETA Website
A SETA website is good for promoting information security
awareness across the organization
As with all SETA components, keep the information updated,
timely, and fresh to encourage employees to visit the site
CS562 Enterprise Cyber Security
SETA Website (Continued)
Best Practices for implementing a SETA website:
•
Research existing sites for ideas
•
Develop a SETA plan to determine the messages, procedures, and policies to
highlight
•
Have a responsive site, limit page loading time
•
Ask for and utilize user feedback
•
Assume nothing and check everything
•
Spend time promoting the site across the organization
CS562 Enterprise Cyber Security
SETA Conferences & Presentations
Consider having guest speakers on security
Host or attend SETA conferences
Participate with other industry partners on security
presentations/conferences
Link security to other organizational
days/functions/conferences/events
CS562 Enterprise Cyber Security
Consider your Organization When Designing SETA
Programs
Variables to consider when designing SETA programs:
Industry / Type of organization
Organizational culture
Size (Revenue, # of employees, types of systems)
Security personnel budget
Security capital budget
Stakeholder Support for SETA and Security
CS562 Enterprise Cyber Security
SETA in Large Organizations
Commonly SETA is the CISO’s responsibility. The CISO is responsible for
information security functions and ensuring they are adequately performed
within the organization
Deployment of full-time security personnel depends on a number of factors
such as the sensitivity of information to be protected, industry regulations
and general profitability
The larger the security budget in an organization, generally the larger the
staff to implement it!
CS562 Enterprise Cyber Security
Typical Information Security Roles
Information security positions can be classified into one of three types:
1. Those that define,
provide the policies, guidelines, and standards They’re the people who do the
consulting and the risk assessment, who develop the product and technical
architectures. These are senior people with a lot of broad knowledge, but often not
a lot of depth.
2. Those that build
Then you have the builders. They’re the real techies, who create and install security
solutions.
3. Those that administer
Finally, you have the people who operate and administrate the security tools, the
security monitoring function, and the people who continuously improve the
processes.
CS562 Enterprise Cyber Security
Common Information Security Titles
In general organizations have a number of individuals responsible for
conducting information security
Different titles may be used, but in general the job
functions/responsibilities include one of the following:
Chief Information Security Officer (CISO)
Security managers
Security administrators and analysts
Security technicians
Security staff
CS562 Enterprise Cyber Security
Module # 5 Assignment Requirements
Critical Thinking Assignment
• The policies that organizations put in place are similar to laws in that they are
directives for how to act properly. Like laws, policies should be impartial and fair,
and are often founded on ethical and moral belief systems of the people who
create them. In some cases, especially when organizations expand into foreign
countries, they experience a form of culture shock when the laws of their new
host country conflict with their internal policies.
• Suppose that SLS Corporation has expanded its operations into your country.
Setting aside any legal requirements that SLS make to its policies to conform to
your local laws, does SLS have an ethical imperative to modify its policies to
better meet the needs of its stakeholders and their geographical region/country?
CS562 Enterprise Cyber Security
Questions
Take advantage of this opportunity to seek further clarification.
CS562 Enterprise Cyber Security
This concludes our live session.
Thank you for your attendance!
Rubric Detail
A rubric lists grading criteria that instructors use to evaluate student work. Your instructor linked a rubric to this item and made it available to you. Select Grid View or List View to change the rubric’s layout.
Name: Module 03: Critical Thinking Rubric
Exit
Description: 100 points
Grid View
List View
Exceeds
Expectation
Meets Expectation
Below Expectation
Limited Evidence
Requirements
21 (21,00%) – 25 (25.00%)
Includes all of the required components, as specified in
the assignment
16 (16.00%) – 20 (20.00%)
Includes most of the required components, as specified
in the assignment
11 (11.00%) – 15 (15.00%)
Includes some of the required components, as specified
in the assignment
6 (6.00%) – 10 (10.00%)
Includes few of the required components, as specified in
the assignment.
Content
21 (21,00%) – 25 (25.00%)
Demonstrates substantial and extensive knowledge of
the materials, with no errors or major omissions.
16 (16.00%) – 20 (20.00%)
Demonstrates adequate knowledge of the materials;
may include some minor errors or omissions.
11 (11.00%) – 15 (15.00%)
Demonstrates fair knowledge of the materials and/or
includes some major errors or omissions.
6 (6.00%) – 10 (10.00%)
Fails to demonstrate knowledge of the materials and/or
includes many major errors or omissions.
Analysis
25 (25.00%) – 30 (30.00%)
Provides strong thought, insight, and analysis of
concepts and applications.
19 (19.00%) – 24 (24.00%)
Provides adequate thought, insight, and analysis of
concepts and applications.
13 (13.00%) – 18 (18.00%)
Provides poor though, insight, and analysis of concepts
and applications
7 (7.00%) – 12 (12.00%)
Provides little or no thought, insight, and analysis of
concepts and applications.
Sources
13 (13.00%) – 15 (15.00%)
Sources go above and beyond required criteria and are
well chosen to provide effective substance and
perspectives on the issue under examination
10 (10,00%) – 12 (12.00%)
Sources meet required criteria and are adequately
chosen to provide substance and perspectives on the
issue under examination.
7 (7.00%) – 9 (9.00%)
Sources meet required criteria but are poorly chosen to
provide substance and perspectives on the issue under
examination.
4 (4.00%) – 6 (6.00%)
Source selection and integration of knowledge from the
course is clearly deficient.
Demonstrates college-level proficiency in
organization, grammar and style.
5 (5.00%) – 5 (5.00%)
Project is clearly organized, well written and in proper
format as outlined in the assignment. Strong sentence
and paragraph structure, contains no errors in grammar,
spelling, APA style, or APA citations and references.
4 (4.00%) – 4 (4.00%)
Project is fairly well organized and written and is in
proper format as outlined in the assignment. Reasonably
good sentence and paragraph structure, may include a
few minor errors in grammar, spelling, APA style, or APA
citations and references
3 (3.00%) -3 (3.00%)
Project is poorly organized and written and may not
follow proper format as outlined in the assignment.
Inconsistent to inadequate sentence and paragraph
development, and/or includes numerous or major errors
in grammar, spelling, APA style or APA citations and
references
1 (1.00%) – 2 (2.00%)
Project is not organized or well written and is not in
proper format as outlined in the assignment. Poor quality
work, unacceptable in terms of grammar, spelling, APA
style, and APA citations and references.
Name: Module 03: Critical Thinking Rubric
Exit
Description: 100 points

Purchase answer to see full
attachment