Introductio1
docx
keyboard_arrow_up
School
Harvard University *
*We aren’t endorsed by this school
Course
20410
Subject
Information Systems
Date
Nov 24, 2024
Type
docx
Pages
4
Uploaded by BrigadierLark2346
Introduction: This security management program is designed for Mara Investment Bank that
operates in the financial industry. The organization provides various financial services, including
banking, investment, and insurance. This program aims to ensure the confidentiality, integrity,
and availability of the organization's critical assets and data by following the 5-phase risk
management process: Plan, Protect, Detect, Respond, and Adjust.
Scope: The scope of this security management program includes all the physical and logical
boundaries of the organization. The program covers all the business processes, including
customer data management, financial transaction processing, internal communication, and IT
infrastructure management.
Goal/Objective: The goal of this security program is to establish a comprehensive security
framework that ensures the protection of critical assets, data, and infrastructure from cyber
threats. The objective is to identify potential security risks, implement appropriate controls, and
continually monitor and improve the security posture of the organization.
Asset Inventory: The following three assets need to be protected:
Customer Data: This asset includes the personal and financial information of the organization's
customers, such as name, address, account number, credit card details, and other sensitive
information, which must be kept confidential for legal reasons as well as to maintain trust
between the organization and its customers. Mara Investment Bank should ensure that all
customer data is stored securely in a centralized database with access restricted only to
authorized personnel. Additionally, encryption should be used whenever possible when
transmitting or storing sensitive customer data. Protecting this asset is critical because if it falls
into the wrong hands, it can lead to identity theft, fraudulent activities, and loss of trust from
customers. The organization must implement appropriate security controls to protect customer
data from unauthorized access, disclosure, or modification.
IT Infrastructure: This asset includes the hardware and software components that support the
organization's IT systems, such as servers, workstations, routers, firewalls, operating systems,
databases, and applications. Securing this asset is critical because if it is compromised, it can
lead to disruptions in the organization's operations, loss of data, and reputational damage. All
these elements need to be configured correctly so they can provide secure access while
maintaining performance levels acceptable for their intended use cases. Furthermore, regular
vulnerability scans should also be conducted on all IT systems in order to detect any potential
threats or vulnerabilities before they become a problem. The organization should also have
policies in place regarding user authentication methods like passwords/PINs/biometric
identification etc., physical security measures such as CCTV cameras & guards at entry points
etc., remote access regulations like VPN configurations & 2-factor authentication requirements
etc., system updates & patching processes. The organization must implement appropriate
security controls to protect its IT infrastructure from potential security threats.
Financial Transactions: This asset covers all types of financial activities conducted within the
organization's network including payments made by customers through online banking portals
or cards swiped at POS terminals or transfers from one account type into another or loans taken
out from banks using collateral provided by customers or investments made into various
stocks/bonds offered by different institutions. It is vital for organizations handling large amount
of funds digitally, to safeguard their operations through implementing robust controls such as
setting up intrusion detection mechanisms capable of detecting suspicious activity happening
across various endpoints. This should be done along with logging everything happening inside
each node for future reference if required during investigations .Moreover multi factor
authentication requirements should be enforced especially when dealing with external parties&
additionally strong encryption protocols must be implemented when transferring funds across
different locations / countries.
Risk Assessment and Risk Management Strategy: The following are the risks associated with
each asset and the risk management strategy to mitigate those risks:
1.
Customer Data: The risk associated with this asset is data theft or data loss due to a
cyber-attack or insider threat. The risk management strategy includes implementing
strong access controls, encrypting sensitive data, regularly backing up data, and
conducting regular security awareness training for employees.
2.
IT Infrastructure: The risk associated with this asset is a cyber-attack, such as malware
infection, denial of service, or unauthorized access. The risk management strategy
includes implementing a robust network security infrastructure, including firewalls,
intrusion detection and prevention systems, antivirus software, and regular vulnerability
assessments and penetration testing.
3.
Financial Transactions: The risk associated with this asset is fraud or theft due to a
compromised system or unauthorized access. The risk management strategy includes
implementing strong access controls, transaction monitoring systems, and regular
security audits to detect and prevent fraud.
Security metrics are important measures used to evaluate the effectiveness of security
controls and the overall security posture of an organization. In this security management
program, two security metrics are associated with each asset to ensure that security risks are
properly monitored and mitigated.
For the first asset, which is the customer database, the following two security metrics can be
used:
Number of successful login attempts by authorized personnel: This metric tracks the
number of successful logins to the customer database by authorized personnel, such as
customer service representatives and managers. By monitoring the number of successful
logins, the organization can ensure that access controls to the database are effective,
and there are no unauthorized login attempts that could indicate a security breach. This
metric can be used as a current metric.
Percentage of customer data backup completed: This metric tracks the percentage of
customer data that has been successfully backed up according to the organization's
backup and recovery policy. By monitoring the percentage of data backup completed,
the organization can ensure that critical customer data is protected against data loss and
can be quickly restored in case of an unexpected event. This metric can be used as a
projected metric.
For the second asset, which is the IT infrastructure, the following security metrics can be used:
Mean Time To Detect (MTTD) a cyber-attack: This metric tracks the average time it takes
for the organization to detect a cyber-attack. By monitoring the MTTD, the organization
can ensure that security controls and incident response processes are effective and
efficient. A low MTTD indicates that cyber threats are detected quickly, allowing the
organization to respond promptly and minimize the impact of the attack. This metric can
be used as a current metric.
Percentage reduction in MTTD after implementing the risk management strategy: This
metric tracks the percentage reduction in MTTD after the implementation of the risk
management strategy. By monitoring the reduction in MTTD, the organization can
measure the effectiveness of the risk management strategy and the improvement in
incident response capabilities. This metric can be used as a projected metric.
For the third asset, which is financial transactions, the following security metrics can be used:
Number of fraudulent transactions per month: This metric tracks the number of
fraudulent transactions detected in a month. By monitoring the number of fraudulent
transactions, the organization can ensure that its fraud detection and prevention
controls are effective. This metric can be used as a current metric.
Percentage reduction in fraudulent transactions after implementing the risk
management strategy: This metric tracks the percentage reduction in fraudulent
transactions after the implementation of the risk management strategy. By monitoring
the reduction in fraudulent transactions, the organization can measure the effectiveness
of the risk management strategy and the improvement in fraud detection and
prevention capabilities. This metric can be used as a projected metric.
Governance and Organizational Structure: The following is the organization chart showing the
security roles and responsibilities:
Executive Leadership:
CEO: The CEO is ultimately responsible for the security program and ensuring that it
aligns with the organization's overall goals and objectives. They set the tone for security
culture and ensure that the security program is adequately resourced.
Your preview ends here
Eager to read complete document? Join bartleby learn and gain access to the full version
- Access to all documents
- Unlimited textbook solutions
- 24/7 expert homework help
CISO (Chief Information Security Officer): The CISO is responsible for overseeing the
security program and ensuring that security policies, guidelines, and objectives are
developed, implemented, and enforced.
CFO (Chief Financial Officer): The CFO is responsible for ensuring that the security
program is adequately budgeted and funded.
Business Management:
Business Unit Managers: Business unit managers are responsible for ensuring that their
respective business units comply with security policies and guidelines. They work with
the security team to identify and assess risks and ensure that appropriate controls are in
place to mitigate those risks.
Human Resources Manager: The HR manager is responsible for ensuring that employees
receive regular security awareness training and that security policies are communicated
effectively.
Systems Management:
IT Manager: The IT manager is responsible for overseeing the implementation and
maintenance of the security infrastructure, including firewalls, antivirus software, and
intrusion detection and prevention systems.
Security Analysts: Security analysts are responsible for conducting regular vulnerability
assessments and penetration testing to identify and remediate vulnerabilities in the
organization's IT infrastructure.
Network Administrators: Network administrators are responsible for implementing and
maintaining the network infrastructure, including routers and switches, and ensuring
that appropriate security controls are in place.