Security Awareness Report:
An
individual
assessment in the form of a business report.
Using the organisation, context and risk profile documented in Continuous Assessment 1 (attached as Continuous assessment 1 word file), write a report detailing the approach you would take to designing, developing and implementing an effective security awareness program for this organisation, based on the following scenario:
Your organisation has identified that its people are their best line of defence against the rising threat of cyber-attacks.
As the Cyber Security Manager, you have been tasked with developing an ongoing program of security awareness. The key objective is to change the behaviour of all employees to be aware of the various cyber threats and know how to take appropriate action to protect, detect and respond to security incidents.
Recent security incidents within the organisation have been traced back to human error and have given rise to the following security events:
1. Phishing email which resulted in the loss of credentials of a sensitive system.
2. Ransomware infection which resulted in business disruption to a key business unit.
3. Data breach of personally identifiable information which resulted in a data breach notification to impacted individuals (per the Australian Privacy Act).
In addition to documenting a broad-based program of security awareness, you will need to research and analyse
one
of these threats and discuss cost-effective awareness measures to mitigate against them, given the context of your organisation.
Finally, as future investment in cyber security is dependent on demonstrating the effectiveness of the security awareness program, you have also been asked to research and document an effective approach to measuring the effectiveness of the overall program.
Note: Any assumptions made about the nature of the existing IT controls at the organisation should be documented in the report.
The report should be written in a professional business language, aimed at the senior leadership/Executive team of your organisation and cover the following areas:
· Executive Summary (including business context)
· Security Awareness Needs Assessment
· Security Awareness Strategy and Plan
· Methods for Delivery of Security Awareness
· Threat Discussion (as chosen above)
· Security Awareness Measures and Metrics
Your report should be 3,000 words (+/-10%) in length. You will need to concentrate on delivering a concise report while ensuring that all relevant topics are covered with consideration of the intended audience.
All references and readings must be cited in the report's bibliography.
Note: The Executive Summary should briefly summarise the
key actions / recommendations
arising from the report. It is not a summary the different sections or approach contained within the report.
The intent of an Exec Summary is so that corporate Executives (with v. little time on their hands) can quickly become acqua.
Security Awareness Report An individual assessment in the.docx
1. Security Awareness Report:
An
individual
assessment in the form of a business report.
Using the organisation, context and risk profile documented in
Continuous Assessment 1 (attached as Continuous assessment 1
word file), write a report detailing the approach you would take
to designing, developing and implementing an effective security
awareness program for this organisation, based on the following
scenario:
Your organisation has identified that its people are their best
line of defence against the rising threat of cyber-attacks.
As the Cyber Security Manager, you have been tasked with
developing an ongoing program of security awareness. The key
objective is to change the behaviour of all employees to be
aware of the various cyber threats and know how to take
appropriate action to protect, detect and respond to security
incidents.
Recent security incidents within the organisation have been
traced back to human error and have given rise to the following
security events:
1. Phishing email which resulted in the loss of credentials of a
sensitive system.
2. Ransomware infection which resulted in business disruption
2. to a key business unit.
3. Data breach of personally identifiable information which
resulted in a data breach notification to impacted individuals
(per the Australian Privacy Act).
In addition to documenting a broad-based program of security
awareness, you will need to research and analyse
one
of these threats and discuss cost-effective awareness measures
to mitigate against them, given the context of your organisation.
Finally, as future investment in cyber security is dependent on
demonstrating the effectiveness of the security awareness
program, you have also been asked to research and document an
effective approach to measuring the effectiveness of the overall
program.
Note: Any assumptions made about the nature of the existing IT
controls at the organisation should be documented in the report.
The report should be written in a professional business
language, aimed at the senior leadership/Executive team of your
organisation and cover the following areas:
· Executive Summary (including business context)
· Security Awareness Needs Assessment
· Security Awareness Strategy and Plan
· Methods for Delivery of Security Awareness
3. · Threat Discussion (as chosen above)
· Security Awareness Measures and Metrics
Your report should be 3,000 words (+/-10%) in length. You will
need to concentrate on delivering a concise report while
ensuring that all relevant topics are covered with consideration
of the intended audience.
All references and readings must be cited in the report's
bibliography.
Note: The Executive Summary should briefly summarise the
key actions / recommendations
arising from the report. It is not a summary the different
sections or approach contained within the report.
The intent of an Exec Summary is so that corporate Executives
(with v. little time on their hands) can quickly become
acquainted with a large body of material without having to read
the whole report.
