Critique discussion below:
Larry,
Planning, Programming, And Budgeting
The information security program management (ISPM) is a very important process as it provides oversight for the balance between compliance, security, and resources (Rogers, 2018). The company CIO, Erwin Carrington is responsible for the development, maintenance, and approval of the plan. The ISPM also states the responsibilities and roles of all individuals who have access to the related systems. There are three main portions to the ISPM, planning, programming, and budgeting. There are for basic strategies that support the goal of reducing the expected cost of cyber attacks (Davis et al., 2016, p. xx). These four strategies are: minimize exposure, neutralize attacks, increase resilience, and accelerate recovery. This paper will identify 5 risks that require a financial investment and discuss the applicability of one selected strategy.
Restarting the SETA programRed Clay Renovations CIO reported that the CISO is working to restart the companies’ security, education, training, and awareness (SETA) program. The risk of not having a cyber awareness-training requirement or strategy is risky as people are the biggest cybersecurity target. 95% of cybersecurity breaches are due to human error, this means a SETA program or process should be of the most importance (FraudWatch, 2019). The neutralize attack strategy strives to prevent as many attacks as possible and reduce the impact of the attack (Davis et al., 2016, p. xx). This strategy can be used to clarify exactly what needs to be planned. Neutralizing attacks that employees are highly susceptible to, like phishing and social engineering, allow for a basis of what needs to be done. To ensure that a SETA program is maintained and managed, it may be reasonable to establish a contract with a third party that privates the training annually. This would be considered a financial investment on people. This requires fewer technical controls.Smart DeviceRed Clay Renovations utilizes smart devices that can be accessed from a web application that doesn’t have any security beyond a username and password. This is a serious risk because these devices are installed into smart homes, with little security; these homes could be attacked easily. Utilizing the neutralize attacks strategy informs us that system management must reduce inherent risk (Davis et al., 2016, p. xx). To reduce the risks or neutralize possible attacks, we must remediate the installation process, and this can be done with official doctrine. This risk calls for a process investment. The investment could be a policy, followed by guidelines that enforce the security of smart devices and set standards for smart device security.Smart Office IT ArchitectureThe Smart Office network architecture has a few issues. One of the issues is the inefficient sever location. The servers should be placed in a proper DMZ; instead, they are placed in the path of the network and the firewall. Neutralizing the chance of an attack will require a technology investment. The CISO should implement a proper DMZ or an application-proxy gateway. The application-proxy gateway places a firewall between the server and the network and the Internet. The network firewall serves as a proxy agent that acts as an intermediary between the two hosts (Scarfone, 2010, p. xx). The second issue pertains to the wireless portion of the network. The architecture description gives little to no instruction on the connection methods of the wireless devices. The document only mentions that they are addressable to their IP address. This is a risk to the network as it may be possible for any device from inside or outside the network to attack resources. To neutralize the risk of attack, a financial process investment is called for. The development of this process would enforce guidelines for connecting to the network via wireless fidelity as well as how to ensure items are authorized.BYODWhile BYOD may save Red Clay Renovations money, it is a risk to the organization. BYOD policies allow devices that connect to the network regularly to leave the network and return. This offers the risk of malicious software being installed when the device connects to other networks. While contractors are not allowed to BYOD, regular employees are allowed to bring their devices provided the devices are required to perform their duties. This requires people and process investment. The people investment would include the training of employees who have the privilege of BYOD and instructing them of the required processes. The process investment would include the development of an authorization system for devices before they enter the facility. These together should make for a strong effort to neutralize attacks within the BYOD privileges.SummaryOverall, the budgeting for cybersecurity can be made very simple. It is apparent that the cybersecurity team can never reach 100% security, so a strong IT security program with distinct goals can prevent unnecessary spending in regards to the budget. Most of the investments that Red Clay Renovations must consider are people and process investments. This saves the organization’s finances associated with responding to cyberattacks. Neutralizing attacks pertains preventing as many attacks as possible and reducing the impact of the attack (Davis et al., 2016, p. xx). This strategy allows for the organization to look at current security options and allows for the technology to be fortified. This strategy is very powerful if implemented properly.
References
Davis, J. S., Libicki, M. C., Johnson, S. E., Watson, M., Kumar, J., & Karode, A. (2016). A Framework for Programming and Budgeting for Cybersecurity. Santa Monica, CA: Rand Corporation.
FraudWatch. (2019, March 15). What is Cyber Security Awareness Training & Why is it so Important? Retrieved from
https://fraudwatchinternational.com/security-awareness/what-is-cyber-security-awareness-training/
Rogers, B. (2018, December 12). Information Security Manager: Information Security Program Management. Retrieved from
https://www.pluralsight.com/courses/infosec-manager-information-security-program-management
Scarfone, K. (2010). Guidelines on Firewalls and Firewall Policy: Revision 1. Retrieved from DIANE Publishing website:
https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-41r1.pdf
Reply to Thread
Essay Writing Service Features
Our Experience
No matter how complex your assignment is, we can find the right professional for your specific task. Achiever Papers is an essay writing company that hires only the smartest minds to help you with your projects. Our expertise allows us to provide students with high-quality academic writing, editing & proofreading services.
Free Features
Free revision policy
$10Free bibliography & reference
$8Free title page
$8Free formatting
$8How Our Dissertation Writing Service Works
First, you will need to complete an order form. It's not difficult but, if anything is unclear, you may always chat with us so that we can guide you through it. On the order form, you will need to include some basic information concerning your order: subject, topic, number of pages, etc. We also encourage our clients to upload any relevant information or sources that will help.
Complete the order form
Once we have all the information and instructions that we need, we select the most suitable writer for your assignment. While everything seems to be clear, the writer, who has complete knowledge of the subject, may need clarification from you. It is at that point that you would receive a call or email from us.
Writer’s assignment
As soon as the writer has finished, it will be delivered both to the website and to your email address so that you will not miss it. If your deadline is close at hand, we will place a call to you to make sure that you receive the paper on time.
Completing the order and download