Assignment
Discussion: Potential Risks (1 or less 1 page)
Your organization is considering a new project that would involve developing a Human Resource Management System. The proposed system would allow employees to access and maintain their personal and tax-related information. The main benefits of the system would be a reduction in human resources personnel and more accurate information.
Identify five potential risks for this project. Make sure that you list both positive and negative risks. Provide a detailed description of each risk and propose strategies for addressing each risk
Assignment: Course Project 1: Risk Management Plan (two page)
As you learn about information security, it is important that you put what you learn to practice. An information security manager should be able to put together an information security plan. The information security plan establishes and states the policies governing IT standards and practices. These policies define the organization's objectives for managing operations and controlling activities, and represent the plans or protocols for achieving and maintaining internal control over information systems as well as compliance with the requirements imposed. In general, an information security plan covers several security areas such as access control, security policies, risk management, business continuity, etc.
Starting with this module, and for the next few modules, you will create a component of an information security plan each week. At the end of this project, you will combine those components to create your completed information security plan. The plan is:
• Module 3: Risk Management Plan
• Module 4: Security Policy Plan
• Module 5: Access Control Policy
• Module 7: Physical Security Policy
• Module 8: Implementation Plan and Complete Information Security Plan
You are expected to use the assigned text and conduct research to be able to respond effectively to your weekly deliverables. You may use the Information Security Plan Template (.docx) to assist with completing each component of the plan. Additionally, separate templates will be provided for each component.
You will create a Risk Management Plan based on the following case:
You are an information systems security manager in a small airport and you were asked to conduct a security threat risk assessment for the airport's web site and applications' infrastructure. The airport has apparent weaknesses in its system of controls. Your predecessor did not have a security management plan in place because he was not sure which threats to address and in what order because he did not have a good handle on the information systems assets nor their value. You were asked to create a Security Threat Risk Assessment Plan. Use the Risk Management Template (.docx) to create your Risk Management Plan. The template is already populated with a lot of information to help you. Modify the template as appropriate for your project. Make sure to include the following in your plan:
1. A list of assets and their values. Describe the assets within the scope of your assessment. (Asset, category, value, controls in place, etc.). Your table should include at minimum 6 assets.
2. A Threat Assessment Table (Assets/Likelihood/Gravity)
3. Recommendations based on your findings. (High Risk Areas)
Assignment: Course Project 2: Security Policy (two page)
In the last module, you started working on your project by producing a risk management plan as part of your security plan for this course. In this module, you will produce another key component of your security plan, the security policy plan.
Again, using the airport case we have established in module three, using what you have learned in this module, and using the Web for examples of technology-specific security policies, create a security policy applicable to your airport project. You can use the Information Security Policy Template (.docx) as a guide or modify it as applicable to write your Security Policy plan.
Assignment: Course Project 3: Access Control Policy
In this module, you will produce another key component of your security plan, the Access Control Policy.
Using the airport case we have established in module three, using what you have learned in this module, and using the Web for examples of Access Control Policies, create an Access Control Policy applicable to your airport project. You may use the Access Control Template (.docx) as a guide or modify it as applicable to write your Access Control Policy.
Assignment: Course Project 4: Physical Security Policy(two page)
In this module, you will produce another key component of your security plan, the Physical Security Policy.
Using the airport case we have established in module three, using what you have learned in this module, and using the Web for examples of Physical Security Policies, create a Physical Security Policy applicable to your airport project. You may use the Physical Access Policy template (.docx) as a guide or modify it as applicable to write your Physical Security Policy.
Assignment: Course Project 5 ( two page)
In this module, you will complete your Security Implementation Plan and Compile all components from previous modules to create your completed Information Security Plan.
Using the airport case we have established in module three, using what you have learned in this module, and using the Web for examples of Security Implementation Plans, create a Security Implementation plan applicable to your airport project. You may use the Implementation Plan Template 1 (.docx) and Template 2 (.docx) as a guide or modify them as applicable to write your Security Implementation Plan.
Once you have completed the Implementation Plan, combine the following elements to create your completed Information Security Plan:
• Module 3: Risk Management Plan
• Module 4: Security Policy Plan
• Module 5: Access Control Policy
• Module 7: Physical Security Policy
• Module 8: Implementation Plan.