Question

You are the new IT Manager for the Cougar Corporation, a firm of 500 employees, with 5 buildings located in three different states. Much of the information is critical to the operation of the business and contains key customer information. As the new IT Manager, one of your employees comes to you concerned with the safeguarding of the firm's information. As you investigate this issue further, you too are concerned as it does not appear many methods of safeguarding the firm's information are in place. What methods would you want to make sure are in place to help with the safeguarding of information? What role do you see firewalls, intrusion detection systems, and antivirus systems playing in promoting security?

Write up a memo to your supervisor detailing methods you would like to see implemented across the firm and the role of firewalls, intrusion detection systems, and antivirus systems in promoting better safeguarding of the firm's information.

Answer 1

To: Lonnie McDougal

From: Tina Scott

Date: Mar 24, 2019

Subject: Proposal for data privacy policy

Dear Lonnie,

USA is considered to be one of the most liberal and progressive employers in the world. Employees are given the autonomy and freedom to work, based on their instincts as well as perspectives. However, there are certain employee monitoring laws which are prevalent in the country. The most controversial law is the law which approves the employers to monitor the personal emails and messages of the employees.

Some critiques consider it as a privacy violation of the employees, others consider it as a necessary evil to maintain the security of the workplace. We can have an email privacy policy, which must respect the privacy rights of employees of the company. This will help in maintaining trust and bond between the employee and the company as well as safeguarding the firm’s data and information from any kind of unauthorized access.

The possible network security threats and ways in which they can be managed, are as follows:

• Malware attacks: The company can protect its system from malware attacks by keeping all its software and firewalls updated
• Data privacy violation: This threat can be managed by incorporating access controls in the system. The data of the clients and employees must have limited access.
• Spywares: Network protection measures can be integrated in the system to manage this threat. Network segmentation as well as use of VPN can be quite effective.

The email privacy policy of the company must include the following:

• Restricted access to the company’s data
• Various layers of approval required to get access to the company’s data
• Monitoring of employee’s workplace outbox
• Regular updation of firewalls and anti-data theft software
• Email monitoring and filtering of spams and phishing mails

Data protection measures which the company can integrate based on the 5 part model of information systems, so as to ensure comprehensive protection of company’s data and information:

• Computer Hardware: The data can be protected from unauthorized access by keeping the computer password protected and limiting the access of hard drives and external memory to the computer hardware.
• Computer Software: The data can be protected by integrating encryption algorithms in the computer software.
• Data: The data of the system must be centrally stored in dedicated data warehouse. Various layers of protection must be integrated in the data warehouse to minimize the probability of any unauthorized or malicious attack.
• Procedures: Standard operating procedures must be laid for all processes of the system. This will help in maintaining data in standard format and maintaining its overall sanctity.
• End user: Only authorized users must have access to data of the system.

To implement this data privacy policy, the following must be done:

• Meeting with various stakeholders to have an understanding of their perspective and interests from the policy
• Meeting with legal department to identify the legal adherence required by the policy
• Approval of the initial draft of policy by various stakeholders
• Submission of the final draft of policy by incorporating changes suggested by the stakeholders
• Announcement of the new policy by the HR manager
• Open house to address concerns of employees regarding the new policy
• Implementation and monitoring of the new policy

Do let me know your valuable inputs on this. Accordingly we can make the first draft of the data privacy policy of the company and send it for process owners’ acceptance.

Regards,

Tina.