IGF 2020 WS #42 Secured Organization

Description:

The outline of the session is as follows: 1. Role of Information / Cyber Security Manager. 2. Information / Cyber Security Policy. 3. Awareness Creation / Education in Information Security. 4. Information Security Audit. 1) In today’s world of abundance of information, it is always appropriate to appoint a suitable Manager to look after the function of Information / Cyber Security in the organization. That manager should have received the appropriate education / training in Information Security and possibly be a member of the relevant professional association (e.g. CISSP, CISA, CISM,…). Such a manager should receive full support from the management of the organization and on a continuous basis, say weekly submit security report to the CEO of the organization. Some of the functions of the Information / Cyber Security Manager are as follows: i.The primary responsibility of the manager should be the implementation of an adequate level of security and compliance of the organization’s standards. ii.Some specifics will be implementing the Information Security Policy, Virus Controls, Data Protection / Audit, Business Continuity Planning process, Reporting of Security incidents, IT Contingency Planning, Security education and training. iii.Promotion of the general awareness of Information Security within the organization will be encouraged. 2) Information / Cyber Security Policy manual consisting of the function of Information Security and appropriate standards will have to be developed for each member of the organization. Such a handy manual with a photograph of the CEO at the beginning of the manual and also containing responsibilities of each member of the organization will have to be developed for all staff. 3) Awareness Creation / Education in Information Security: Relevant training / education should be organized by the manager for all staff of the organization. Since Personal Computers (i.e. PCs) and other Information Technology Equipment are used in the various organizations, it will be appropriate that general awareness / education of Information Security is promoted in the organization. 4) Information Security Audit: Since the level of performance of Information / Cyber Security will have to be improved upon, it will be appropriate that on a continuous basis say quarterly, an information security audit will have to be carried out. Normal departmental audit by Internal Audit Unit or Self-Assessment audit questionnaire can be developed for the audit of the organizational controlled environment. The following are the areas where the Audit will be focused on: i. Security Policy ii. Security Organization iii. Asset Classification and Control iv. Personnel Security v. Physical and Environmental Security vi. Computer and Network Management vii. System Access Control viii. System Development & Maintenance ix. Business Continuity Planning x. Compliance Methodology: Created slides of our proposal will be delivered to our audience through using LCD Projector.