The Process of Designing an Information Security Infrastructure within an Organization

Designing a security plan is vital for businesses to protect their information from internal and external threats.  To design a trusted Internet infrastructure for an organization it is vital to include all departments and look at the aspects of security that is crucial for day-to-day operations.  Security is a continuous process that needs to be monitored, maintained and continuously improved.

Security Process Steps can be broken down into four categorical processes:

1.  Assessment and Policy:  Defines “how the security needs to be implemented”.  Starts by Designing a Security Policy or reviewing security measures already in place and determine why those were not sufficient for organizational needs.  Then determine what security requirements are needed and that will fit with the organizations roles and responsibilities.   The usual answer to what needs to be protected is hardware and software.  The next objective is to implementing an Information assurance (IA) program. This will help ensure an overall corporate responsibility for security.  IA links all aspect of security from organization responsibility to individual responsibility and from the chains of authority to the auditing mechanisms.  After an IA is designed identify, the organizations must determine the operational policies and procedures that link security to their operations and strategic plans and how they plan to audit their new security measures.

2. Asset Protection: Defines “what needs to be protected”, these are the organization’s assets that would be disastrous if that attacked or stolen like proprietary information and intellectual property.

3. Monitoring and Detecting:  For security measures to be effective they must be constantly monitored, reassessed and improved if need be.  In this step organizations must determine how they will monitor security, these are just some:

• Log File: reviewing the events on routers, firewalls, databases, web servers and other network devises
• Intrusion-Detection Systems:  detects intrusions by probing into the system and watching for any unusual activity then it reports the suspicious activity in real time to the network by sounding an alarm

4. Response and Recovery:  If and when your system is attacked there must be a plan of action to get the system running as soon as possible.  A down system means loss revenues.  There are many controls that can be enacted to ensure a quick recovery these are:

• Backup:  have a duplicate of all data on the system stored in another system located outside of the organization
• Outsource: use recovery service provider like SunGard, IBM, and Strohl Systems provides storage area on a server for organizational data and also uses a program, GroundZero, that incorporates all aspect of disaster preparedness

Project Purpose	Internet Security	History of  Computer Security Since 1945	Hackers: A PowerPoint Presentation	Current News Trends
Organizatinal Security Policies and Procedures Design Process	The Internet and Security	Current Companies Participating in the Internet and Security Market	Importance of IT and IS to Internet Security	Works Cited	Home