suma and Kar – replies
Need help with my Computer Science question – Im studying for my class.
read below student posts and reply in each 150 words
pravee – Information security policy can be defined as a set of policies that an organization issue to make sure that all the IT users within the organization comply with the rules and regulations related to data security. In the current world, the advancement in a computer network has significantly promoted the sharing of information at a rate of about trillion bytes per milliseconds. However, most of the data is highly protected against breach by cybercriminals, and it is limited not to be shared beyond certain groups (Ifinedo, 2018). Therefore, the information security policies are enacted by organizations to enforce the security of data and minimize the distribution of data to unauthorized channels.
The information security policy is very important because it enables the protection of digital assets information technology systems of the company. In a competitive business environment, organizations strive to protect their information on production and marketing strategies to stay competitive. Leakage of such information may highly benefit its competitors and can significantly affect the business. Therefore, the policies implemented by the organization limit the workers to share any information without approval from the management or personnel in charge of the system. Policies that allow encryption of data promotes enhances the safety of data from cyber-attacks (Ifinedo, 2018). The policies also manage employee behavior within the organization as every employee adheres to comply with the customs of information safety.
In most organization, the policies fail because some workers tend to forget their computer passwords; hence they end up writing to an insecure location which may enable an unauthorized person to gain access (Alotaibi et al., 2017). Also, sometimes the employees may feel that the policies are too restrictive, and they decide to subvert the information security systems to make to ease workflow.
Organizations can increase the acceptance of these policies through the email usage policy where employees can effectively communicate legally with their coworkers without fear of information breach. Others include the internet usage policy where the management can search for market and the intranet (Chuard, 2019). The challenges associated with these methods is that information can easily be leaked by the coworkers, and it can be prone to cyber-attacks. Also, it can create a system of problematic employees where others can be bullied, the spread of false information and gossip within the organization.
vamsi tuma – What is Information Systems Security Policy?
An Information Security Policy is a codified document that outlines how an employer plans to defend its digital assets. It affords a company-wide framework for security, and is designed to outline the core tenets of an organizations digital protection program, especially:
- How safety measures will be carried out and enforced.
- How security coverage can be monitored and analyzed, and how adjustments and improvements to the policy can be made over time.
- How the corporation plans to educate employees about data security.
The roles and expectations of both IT groups and man or woman employees inside a security program. How employees ought to habits them when getting access to corporate networks and information (known as an Acceptable Use Policy, or AUP). A formal policy settlement is designed to empower protection teams and give them the authority and help wished to correctly put into effect security practices. It performs a critical function in growing a secure way of life within your organization; permitting all employees, from junior developers thru to senior administration staff, to understand their role inside digital security.
Creating an Information Security Policy
Many businesses select to adopt or adapt current off-the-shelf security policies. Whilst these policies offer a basic basis for organizational security, they will not replicate the management objectives and current practices of your organization, or the special challenges and compliance troubles determined within your industry. In order to create a policy that correct displays your own organization, its critical to advance your very own policy with these vital questions.
ligori – Policies are basically set rules adopted by an organization or government to eliminate unwanted or illegal activities inside the system, likewise, information systems security policies are set of rules or actions adopted by the organization and system architect to ensure the protection of the data. Information security policies are useful for creating a framework for information security, to detect the security compromises before it happens. Ineffective or nonexistent security policies could create a false sense of security and can create a bigger problem for the organization. We can write whatever we want in security policies involving passwords, encrypting passwords, bringing you own device rules but without enforcing these rules are nothing, these not enforcing the security policies might become an issue for any organization. Another issue with an organization is not updating the security policies from time to time.
First, a security policy must be backed and encouraged by your senior management. To implement a new policy we need all managers, HRs, and superiors to understand and ready to act on it because those are the people who going to make sure those policies are being followed. The main issue in this is getting support and agreement from all the managers, you can’t make them all agree. Additionally, we need to create procedures to support the newly created policies, like how to handle the situation if a security incident happens, How will you notify the authority. who are all exempt from this policy and why they are all excluded and how to get approval for this policy exemption. In this, we need several department approval and cooperation to create procedures to support the policies which are a tedious process. Finally, user education is important to implement newly created policies, either by seminar or online training, we need to enough information to the people who are all affected by this policy changes or addition. You don’t have any control over users is having a better understanding of the policies, even if they know about the policies they might accidentally or intentionally breach the policies. So we need constant monitoring and training for the users to fully understand the policies.
tejesh – Information security policy can be defined as a set of policies that an organization drafts to make sure all the IT users within the company should and will comply with the set of rules and regulations related to systems and data security (Bulgurcu, Cavusoglu, & Benbasat, 2010). Ensuring data security integrity and confidentiality is one of the focal tasks for every organization. Companies spend millions of dollars just to ensure privacy while protecting personal and corporate data.
It is important that the information security policy should fit in with the existing organizations culture and must be drafted accordingly. By drafting the policy, it helps the company and the employees understand the overall organizations information security posture. This helps in enabling the safe and secure operation of applications and systems in IT environment. It also helps in protecting the data as mentioned and safeguards the technology and its configurations.
Three methods the companies can adopt which can help in increase the acceptance level of policies is by providing proper training to the employees and contractors with the company, align the policies towards organizations culture as well towards employee goals and increase in communication. The company should train and educate all the employees and contractors how important the security is and provide few demos on its adverse effects and its advantages. It is important to align the security goals towards organization culture in order to avoid resistance and align it towards employee goals to motivate them and build a positive relationship towards the company and try to attain the company goals in more effective manner.
In addition to all these the company need to invest and introduce few security measures by enforcing strong authentication, unified communication, proper span blockers and anti-phishing tools.
