Unit 4 Assignment 1 Implementation of an Organization-Wide Security Plan
In this security plan we will need to consider all 7 IT infrastructure domains when it comes to developing access controls for the network. Access controls for our facilities will have an appropriate entry system access control that will specify which area should be locked at all times. There will be secondary locks on equipment and storage cabinets within the facility to further secure specific pieces of equipment, such as a database server. Preventing social engineering policy will specify goals for stopping social engineering that will include employee training. Access controls for systems will limit access to those employees who have a legitimate need for that resource. Strong password policy will be in effect that will require you to change it often and you will need to have uppercase, lowercase, numeric and special characters. Application access controls will provide standard testing procedures for any third party application installed in the environment for security. Access controls for data will include data encryption on all sensitive data and enforcing the principle of lowest possible access. Access control for remote access will grant access to the VPN through a two stage authentication process that includes a strong password and a token device. All of these controls will be included in our organization-wide access control plan.
Now that we know what are access controls are, we will need procedures to implement all of our policies. All procedures will include detailed authentication, account management, password management, and remote access. We will also have access determination policies and systems to restrict unauthorized access. Procedures outlining specific steps for each process will be developed and utilized. Here are a few policies we will implement: Acceptable use, password, account management, and remote polices. Each policy will have procedures in place in order to implement them. Here is an example of an AUP: First, user fills out an access request form. Then, IT receives the form and passes it to the correct authority for approval. Then, the form is reviewed and authorization is granted or denied. Next, IT implements the access rights modification. Finally, after signoff, IT files the request in the user’s file to verify access and to provide information to an audit if required.