SECURITY POLICIES

Question 0

Prevention of deliberate misuse?

Answer 0

1. Methods of controlling access to computer rooms
2. Establish firewalls - external hacking, unauthorised access
3. Install proxy servers e.g. Controls what user can do on a network- block or allow access to certain web pages
4. Methods of securing integrity of transmitted data e.g. Encryption methods including private and public keys
5. Methods of physical protection of hardware and software
6. Security of document filing systems e.g. Shrewd unwanted documents, don’t leave documents out for unauthorised to see

Question 1

Prevention of accidental misuse?

Answer 1

1. Backup + recovery procedures ( Incase of fire/ flood)
2. RAID system - redundant array of inexpensive disc
3. Grandfather, father, son systems
4. Backups of storage media

Question 2

What operational procedures could the company implement to prevent misuse?

Answer 2

1. Screening potential employees
2. Establish disaster recovery programme - everybody knows exactly what to do
3. Define procedures for downloading - use of floppy discs, personal back up procedures
4. Routines for distributing updated virus information + virus scanning procedures
5. Set up auditing procedures -detection misuse

Question 3

What are the factors the company should take into account when designing a security policy?

Answer 3

1. The physical security - security guards, alarms, security cameras, biometric systems, key, codes
2. Audit trails for detection - keeps records of all activities carried out by each user e.g no of doc printed, times and dates of logging on + off we pages visited + downloaded
3. System access - establishing procedures for accessing data e.g. Log on procedures, firewalls
4. Personnel administration e.g. Ensuring all staff respect security issues and aware of disciplinary procedure - train staff
5. Operational procedures e.g. Disaster planning + dealing with threats from viruses

Question 4

What are the factors that a company will consider when deciding how much to invest in security in order to reduce risk?

Answer 4

1. Identify potential risks e.g. Viruses, theft, fire, sabotage
2. Likelihood of risk occurring e.g. On scale of 1-5, 1 being highest 5 the lowest, chance of viruses is highly likely and chances of terrorism highly unlikely
3. Identify short + long term consequences of the threat e.g (short term) *loss of income * bad reputation * legal action taken * staff have to resolve situation (long term) * extra costs * possibility of bankruptcy * difficult to gain customers again
4. How well equipt is the company to deal with threat e.g. Create disaster recovery plan

Question 5

Describe the use of user accounts and logs as a way of ensuring the confidentiality of customer records

Answer 5

• auditing keeps record of who has done what on the network

- allocation of passwords - managing user accounts by allocation of access levels to users

Question 6

Explain factors the company should take into account when designing its security policy?

Answer 6

Physical security - involves protecting hardware and software using physical rather than software methods either to restrict access to the computer equipment or the storage medium (locks, guards, biometric methods)

Prevention of misuse using logical (software) methods - user ids, passwords, levels of access

Operational procedures including disaster recovery planning and dealing with threats from viruses, back up, updating antivirus

Staff code of conduct e.g downloading from the Internet

Question 7

Describe in detail factors an organisation needs to consider when producing a risk analysis?

Answer 7

Identify potential risks e.g viruses, fire, natural damage, hacking, systems failure, fraud

Likelihood of risk occurring - some things such as power cut are inevitable but explosions much less likely, managers have to assess e likelihood of each risk occurring and put in the necessary security

Short term and long term consequences of threat - resources (staff equipment etc) need to be directed towards recovering the data, may have to pay compensation, financial loss due to loss of business through not being able to take orders

How well equipped is the company to deal with threat (what procedures are in place) - has to be reviewed periodically because of changing needs - disaster recovery programme - back up strategy

Question 8

Explain with reasons what should be included in a disaster recovery plan

Answer 8

1. Cost - set up a budget for it, what backup medium should be used?, tape or disc / raid systems depending upon the speed or money available to recover the data, hardware can be replaces how much money have they got, software can be re-installed (or debugged by the programming department
2. Risk - what problems could occur? Likelihood of them occurring e.g. Are they going to get an earthquake in uk, on site or off site depending upon costs and the likelihood of the risk occurring and the criticality of the data
3. Data - no business can afford to loose its data, backups of all data should be regularly made, is means that the worst case scenario is that the business has to go back to the situation of the last back up and carry on from there. Back ups may take a long time - often tape streamed at night
4. Hardware/software/communications - the total or partial loss of computing equipment or software, the complete or partial loss of telecommunications equipment or services. The complete or partial loss of the premises housing the it equipment

Question 9

Explain why the practise should have a security policy and give two examples of what this should contain, other than user accounts and logs

Answer 9

DPA puts an onus on the practise to keep this information secure because of its potential for misuse.

Rules on passwords
Access rights
Firewalls

Question 10

Describe ways in which an employee can misuse the organisations ict facilities and give two possible penalties for misuse

Answer 10

• introduction of viruses by downloading games, not scanning portable media
• misuse by employees of the ict facilities e.g. Using telecommunications for own purposes e.g phone calls, emails
• blackmail, computer fraud or selling to other organisations
• distribution of material that is racially or sexually offensive e.g circulating offensive images over the organisations network
• informal (verbal) warnings
• written warnings
• dismissal

Question 11

Describe in detail factors the college should take into account when deciding how to develop, control and minimise risk to data?

Answer 11

Identify potential threats
Likelihood of risk occurring
Short and long term consequences of the threat
How well equipped is the college to deal with threat
How much money the college has

Question 12

Identify a problem that could arise if steps are not taken to minimise risk, discuss its possible impact and describe in detail a suitable strategy to overcome it

Answer 12

Example problem; staff unaware of who actually is I’m college this could be very dangerous if there is a fire or looking for an at risk pupil
Steps ; have a back up system which staff could have emergency access to lookup information

Other points : disaster recovery system, e,ploy a RAID system

Question 13

Discuss in detail the potential threats to data and the possible consequences of accidental or deliberate destruction of data. Illustrate your answer with distinctly different examples in each case

Answer 13

Threats;
Terrorism
Natural disasters
Sabotage
Fire
Theft

Consequences
Loss of business and income
Loss of reputation
Legal action

Question 14

Methods which could be used to prevent the deliberate destruction or misuse of data

Answer 14

Methods for controlling access to computer rooms
Methods if securing integrity of transmitted data e.g encryption
Methods including private and public keys
Call back procedures for remote access
Establish firewalls
Use virus scanners
Proxy servers
Password systems