1. A range of current security management techniques and of how the principles of information risk assessment, incident management and information assurance methods are embodied therein;

Case Study on Incident Response & Business Continuity

THE ASSIGNMENT TASK: This is an individual assessment. Case Study ISMC Ltd is involved in designing hundreds of small electronic products. These carry a minimal intellectual property value as there are hundreds of other companies in this field designing similar products. Over the last 3 years, the company has been exploring the South American markets and is about to bid for a highly ambitious contract which will have a huge impact on the organisation.

The contract is for the Colombian government to design different cutting edge electronic products for the Colombian secret services. Up to now there has been little or no consideration of Information Security, however this will need to change significantly. Amongst the various presentations and reports that ISMC Ltd will have to make in the bidding process, there is a specific requirement by the contract awarding body that the bidders demonstrate a highly effective and sound approach towards information security. This will be demonstrated by ISMC Ltd through a report to the contract awarding body. You have been assigned by your company to review the current situation at the company, respond and prepare the initial Incident Response and Business Continuity report. You had a meeting with the IT director who provided you with the following information in relation to the Incident Response and Business Continuity situation in ISMC Ltd.

She informed you there was an attempt a year ago to draft an Incident Response and Business Continuity policy, but it was difficult to identify a member of staff or department that should be responsible for developing and maintaining it. In fact, the IT department suggested the HR department is responsible for developing the policy, while the HR department supported they don’t have the technical background to write such a policy. Therefore, the policy was never implemented. However, she reassured you for the following items:

• All corporate servers are backed up at least once a month onto external portable hard drive systems.

• Requirements are being set for data storage to be outsourced on the cloud abroad as a more efficient and cost-effective way to backup data.

• It is the responsibility of the employees to ensure that they backup data regularly.

• Staff training sessions were used to inform employees of the requirement to backup data and the consequences of losing data

• Based on the current practice data can be backed up in - Staff local machine hard disks - External drives - Company’s central storage system Task You are required to produce a report which identifies the technical problems relating to the current situation, which also highlights the best practise in relation to Incident Response and Business Continuity. You should identify 3 priority security risks in relation to the current practise; discuss the threat by providing an adequate background to each of the risks and then a solution. The background should be your interpretation of the problem. You should also research on Incident Response and Business Continuity (technical, practise, policies, procedures, standards) for you to be able to expand on the topic and recommend the good practise for ISMC Ltd. Your report should be professionally formatted and approximately 1500 words.

MODULE LEARNING OUTCOMES ASSESSED BY THIS ASSIGNMENT:

1. A range of current security management techniques and of how the principles of information risk assessment, incident management and information assurance methods are embodied therein;

2. Essential facts, concepts and principles of Security controls and IT security development and management;

3. National and international information security standards, government policies, and compliance laws to data protection.

4. Detailed knowledge and understanding of information risk assessment and security management;

5. Confidence and flexibility in security standards, managing security incidents and related IT security problems in systems development and implementation;

6. Methods of security controls, disaster recovery and business continuity management and to exercise critical evaluation of information sources;