IT Security Controls and Countermeasures
Best practice in information security and compliance would be to be in association with a security facility to discuss the challenges that the company faces in regards to data protection, compliance and the Internet. They would also recommend ideas as to how to organize secure environments without using expensive or outdated methods. Examples of this would include: * The cloud security risk for the company. This is a technology that is sought after by many companies. It is popular because of the flexibility, pay-for-use and less hardware that needs to be used. * Security regulation compliance for companies. Being compliant with The Data Protection Act and PCI-DSS payment card regulations is difficult because it’s time consuming and expensive. * The changing of a company’s threat landscape. This is important to constantly survey for any changes to the threat landscape. Malware is one big issue; which is becoming more and more sophisticated. * Security education and training for companies is very important to the security that is necessary to reduce any human error. * ISSA5173 security standard is the brainchild of the Information Systems Security Association (ISSA-UK). This is used to combat any needs a company may face and to create new security standards for the company by looking at policies, procedures and the education of employees.
One critical step that needs to be addressed is to have a more detailed education plan. Step by step instruction as to how and why security is setup the way it is. To make sure that the employee is aware of the dangers that the company faces because of their individual actions. The company should draw-up a disclosure form for all trainees to sign that would exempt the company of any wrong doing by that individual in the event of any malicious act.
Another step would