Read full document

Unit 5 Assignment 1

Page 1 of 4
Unit 5 Assignment 1: Implementing Comprehensive Human Resources Risk Management Plan Human Resources Risk Mitigation:
Objective • Human resources policies and practices should reduce the human risk factors in information technology (IT) security and information access controls. Decrease the risk of theft, fraud or misuse of information facilities by employees, contractors and third-party users. Scope • the organization’s human resources policies, taken as a whole, should extend to all the persons within and external to the organization that do (or may) use information or information processing facilities.  This could include: * tailoring requirements to be suitable for particular roles within the organization for which persons are considered; * ensuring that persons fully understand the security responsibilities and liabilities of their role(s); * ensuring awareness of information security threats and concerns, and the necessary steps to mitigate those threats; and * Providing all persons to support organizational privacy and security policies in the course of their normal work, through appropriate training and awareness programs that reduce human error; and ensuring that persons exit the organization, or change employment responsibilities within the organization, in an orderly manner. Roles and responsibilities • Security roles and responsibilities of employees, contractors and third-party users should be defined and documented in accordance with the organization's information privacy and security policies.  This could include: * To act in accordance with the organization's policies, including execution of all processes or activities particular to the individual's role(s); * To protect all information assets from unauthorized access, use, modification, disclosure, destruction or interference; * To report security events, potential events, or other risks to the organization and its assets * Assignment of responsibility to individuals for actions...
Unit 5 Assignment 1: Implementing Comprehensive Human Resources Risk
Management Plan
Human Resources Risk Mitigation:
Objective • Human resources policies and practices should reduce the human risk factors in
information technology (IT) security and information access controls. Decrease the risk of theft,
fraud or misuse of information facilities by employees, contractors and third-party users.
Scope • the organization’s human resources policies, taken as a whole, should extend to all the
persons within and external to the organization that do (or may) use information or information
processing facilities. This could include:
* tailoring requirements to be suitable for particular roles within the organization for which
persons are considered;
* ensuring that persons fully understand the security responsibilities and liabilities of their
role(s);
* ensuring awareness of information security threats and concerns, and the necessary steps to
mitigate those threats; and
* Providing all persons to support organizational privacy and security policies in the course of
their normal work, through appropriate training and awareness programs that reduce human
error; and ensuring that persons exit the organization, or change employment responsibilities
within the organization, in an orderly manner.
Roles and responsibilities • Security roles and responsibilities of employees, contractors and
third-party users should be defined and documented in accordance with the
organization's information privacy and security policies. This could include:
* To act in accordance with the organization's policies, including execution of all processes or
activities particular to the individual's role(s);
* To protect all information assets from unauthorized access, use, modification, disclosure,
destruction or interference;
* To report security events, potential events, or other risks to the organization and its assets
* Assignment of responsibility to individuals for actions taken or, where appropriate,
responsibility for actions not taken, along with appropriate sanctions formal.
Procedures and policies
To be implementing in any IT domain controls by the organization.
* Proper password security
* Properly managing log files
* Easily accessible network flow diagrams
* Secure firewall rule sets
* Handle security incidents
* Secure data classifications
* Limited employee access dangerous websites
Policies that will accepted by the organization and needs to be implementing ASAP.
Acceptable Use Policy | | Password Policy |
Backup Policy | | Network Access Policy |
Incident Response Policy | | Remote Access Policy |
Virtual Private Network (VPN) Policy | | Guest Access Policy |