Subscribe innovateiTzone for more
DAY4: Cyber security
DI-325
Topic:
Planning and policy
Cyber security planning and policy play a crucial role in ensuring the protection of an
organization's digital assets. Without proper security planning, organizations become
vulnerable to cyber threats, data breaches, and financial losses. Security planning provides a
roadmap, whereas security policies define a set of rules to maintain secure operations.
Cyber Security Planning
Cyber security planning refers to adopting a structured approach to safeguard digital systems,
networks, and data from unauthorized access, cyber-attacks, and breaches. The goal is to help
organizations effectively counter security threats.
Key Stages of Cyber Security Planning
1. Risk Assessment
o Identifying possible threats and vulnerabilities.
o Determining which assets require the highest level of protection.
o Example: Analyzing fraudsters' attack methods to secure an online banking
system.
2. Security Policy Development
o Establishing rules for data protection, access control, and user behavior.
o Ensuring compliance with regulations.
o Example: An IT company enforces a policy that prohibits employees from
using unauthorized USB drives.
3. Implementation of Security Measures
o Deploying firewalls, encryption, access controls, and authentication methods.
o Managing software updates and patches.
Subscribe innovateiTzone for more
o Example: An e-commerce website uses SSL encryption to protect customers'
sensitive data.
4. Incident Response Planning
o Defining step-by-step procedures in case of a cyber attack.
o Minimizing disruptions and losses.
o Example: A company prepares an emergency plan to activate alternative
servers in case of a DDoS attack.
5. Monitoring and Updates
o Regularly assessing security measures and policies.
o Conducting penetration testing and security audits.
o Example: A bank tests its cyber security protocols every month to detect
emerging threats.
Cyber Security Policy
A cyber security policy is a set of rules that define how an organization protects its digital
assets. These policies establish responsibilities, security protocols, and best practices for
users.
Major Types of Cyber Security Policies
1. Access Control Policy
o Defining who can access specific data.
o Implementing role-based access control (RBAC) and multi-factor
authentication (MFA).
o Example: A hospital allows only doctors to access patient records.
2. Password Policy
o Setting rules for password length, complexity, and expiration.
o Encouraging the use of password managers and prohibiting password sharing.
o Example: A university enforces strong password requirements for faculty and
students.
3. Data Protection Policy
o Encrypting and securely storing sensitive data.
o Establishing a backup management system.
o Example: An IT company stores client information in an encrypted format.
4. Network Security Policy
o Utilizing firewalls, VPNs, and secure Wi-Fi networks.
o Implementing intrusion detection and prevention systems.
o Example: An office restricts unauthorized devices from connecting to its Wi-
Fi network.
5. Incident Response Policy
o Outlining structured responses to cyber threats.
o Setting up reporting and mitigation procedures.
Subscribe innovateiTzone for more
o Example: An e-commerce company maintains an emergency response team
to prevent customer data leaks in case of an attack.
6. Acceptable Use Policy (AUP)
o Regulating the proper use of company resources (email, internet, software).
o Restricting unauthorized applications and high-risk websites.
o Example: An IT company prohibits employees from installing unauthorized
software.
7. Remote Work Security Policy
o Providing security guidelines for employees working remotely.
o Encouraging VPN usage and avoiding unsecured networks.
o Example: A company mandates that remote workers use only secured
company devices.
8. Bring Your Own Device (BYOD) Policy
o Establishing security rules for personal devices accessing company data.
o Requiring device encryption and security software installation.
o Example: A software firm ensures employees install security software on
their personal laptops.
Key Elements of a Strong Cyber Security
Strategy
1. Risk Assessment
Identifying internal and external threats.
Determining the impact of potential security breaches.
Example: A bank analyzes new online fraud techniques to improve fraud prevention.
2. Authentication and Authorization
Verifying user identity through passwords, biometrics, and MFA.
Ensuring only authorized users access sensitive data.
Example: An online shopping platform allows transactions only for registered users.
3. Data Protection and Encryption
Encrypting sensitive data for protection.
Implementing data loss prevention (DLP) techniques.
Example: A financial institution stores customer transactions in an encrypted format.
4. Incident Response Plan
Developing a roadmap for cyber attack response.
Implementing monitoring, containment, and recovery procedures.
Subscribe innovateiTzone for more
Example: A telecom company activates an auto-alert system when its servers face an
attack.
5. Security Awareness and Training
Educating employees on phishing, social engineering, and malware threats.
Conducting security drills and workshops.
Example: A government agency provides annual cyber security awareness training to
its staff.
