Unit 7: P6, M3 & D2

Unit 7 (note this document was originally done in on a power-point presentation )

P6: Legislation to Cover for Organisational Security

Computer Misuse Act 1990 

Computer Misuse Act 1990 is an act that is designed to frame rules and control over computer crime and internet fraud. Using others ID and passwords to access ones computer is against the computer misuse act 1990, unauthorised access to commit a serious crime and unauthorised modification of a computer content are also against the misuse act, as the person who’s account has been misuse, they are not aware of this. For example using others log in to access their account and installing virus to the computer, will destroy their files on the computer.

Principles of Computer Misuse Act 1990

• Unauthorised access to computer material.
• Unauthorised access with intent to commit or facilitate commission of further offences.
• Unauthorised modification of computer material.

Computer Misuse Act has been created to protect users computer materials from unauthorised access. Companies will have computer misuse act in place to prevent unauthorised modification of computer material. 

Privacy and Compensation requirements of Data Protection Act 1984, 1998, 2000

Data protection act 1998 is a law that has been created to make sure that personal details i.e. the wages they earn are handled properly and safely. The person who’s information that have been handled, have the right to know what information of theirs has been held. For example accountants within a bank must not share details about their customer’s to others within or outside of their organisation. The person who is handling personal information must register with the DPA and obey the eight principles.

Designs and Patents Act 1988

Design and Patents act has been created to give the creators the right for them to control the way their material is being used. The creators rights cover a number of things such as copying, renting and lending copies to the public. For example YouTube users are unable to uploaded other creators content to their profile, YouTube will delete the video as the user of the profile did not have the right to upload the video. If the content has been copied and has not included the original creator, the person can bee taken to court and charged for plagiarism.   

Copyrights

Freeware: is software that is copyrighted but given away for free of charge. Even though the content is free, the creator of the software has the copyrights to the software.

Open Source: is software that is available for free and also can be modified by the users of the software. The software can also be shared to others without payment.

Shareware: some shareware software is free of charge however the creator may request that the user pays a small fee as they are regularly using the software. The user will receive service assistance and updates if they pay the fee.

M3: Ethical Decision Making in Organisation IT Security

Ethical decision making in a organisation can cause some problems as there are different views, ethics and business decisions which can often clash and can cause problems within the organisation.

Freedom of Information 

Users can present any information about themselves  or their opinions  on to the internet on various websites such as social networking, forums or job sites etc. There is many downfalls to this on the users personal information.  This is because users signing up to these sites will have to have a lot of trust on their computer systems, to keep their personal information all confidential. Within an organisation and their freedom of information against personal privacy an example of this is if the organisation choose to install CCTV for security purposes. Employees in the organisation may say that this is invading the previous.

Ethical Issues

Street maps such as Google street maps is a big ethical issue as it can provide burglars within information about certain areas, which can help them plan robbery's in areas. The information they gather can help them find ways to enter a building. Also photographing people on the street without their knowledge. Although they blur the pedestrians faces, they are also photographing children on the street without their knowledge, this can cause have a huge impact on Google as it is against the law to photograph children.

Phonebooks is another ethical issue as it provides the public with phone numbers of other people. People can use the phone numbers to prank call the residents and hocks scenarios which can scare the residents. Fraudsters can use residents phone numbers and call them pretending to be their bank, they can gain valuable information such as their card details etc.  

Permission 

Organisation which use photographs, videos or CCTV footage for business security purposes, may cause a few issues within the organisation with their employees. For example if an organisations advertises the business and uses music which they didn't have permission to use from the create, this can cause a huge impact on them as they could be fined by the creator of the soundtrack, because they used the soundtrack without informing the creator. If the organisation also uses photos of their employees for a website without asking them for permission, this will cause a lot of issues with the staff as they may not have wanted their image on the website. Their are also organisation which are also very weary on how they approach ethical issues as it is a sensitive issue with the individuals in the employee. 

D2: Evaluate the Security Policies used in an Organisation

Disaster Recovery Polices

The effectiveness of disaster recovery police has within an organisation is that it reduces the lose of data and improves the recovery of the organisation if they face a disaster.  Back ups of the systems will be completed at scheduled time which will be set up by the network technician, the back ups will be scheduled at less busy times when the network is not being used as much. This will speed the process of the back up. However it also has a negative on the network as it can decrease the speed of the data travelling through the network. Overall disaster recovery will benefit the organisation as they recovery data although it may slow down the network.

Advantages

The advantage in having disaster recovery polices in place is that it reduces loss of data. As the technicians within the organisation have backed the system up before any disaster occurred, if any data is lost during a disaster they can recover the date from the backup. This will reduce downtime as they can transfer data from one system to another  because of the backup.

Disadvantages

The disadvantage in having the policy in place is that the organisations is that it is costly for the organisation to run, as they will need to maintain the recovery system and it can also interrupt the organisations network, by slowing it down. This will make it difficult for employees in the organisation to do their work, as their system will slow down because of the reduced speed of the data transfer rate.

Updating Security Procedures and Scheduling Security Audits

Updating security procedure has an benefit and also a negative on the organisation. The benefit that this procedure has on the organisation it can be slow however once the updates have been completed the software would run quicker, the systems will be more secure and have a great impact on the network, as the latest version has been installed which will run much efficiently than the previous version. By updating they can improve the whole network overall from the speed of the data transmission and also the security.

The negative this may have on the organisation is that they may have to also upgrade the hardware so that it is compatible with the updated software. For example the software may require a larger hard drive so that the update can be improved.

Code of Conduct

They are in place to stop any problems from occurring within the organisation from users access website which contain viruses or adding bad attachments onto an email etc. By butting code of conduct in place will reduce the costs on as there will be less chances in any of equipment being damage, reducing the cost for the organisation paying for repairs of equipment.  This will reduce downtime as their will not be disruption on the network. 

The negative impact that this has on the organisation is that users may think it is not fair that they are being restricted from accessing certain areas of the network compared to others which will be able to access that area to. This will create a lot of tension between employees, as they will think that the employers of the organisation do not trust them with their systems.

Surveillance and Monitoring Policies

This policy allows the organisation to monitor what is going on within the organisation, this may cause some tension as the employees may not like being watched while they are working at all time. However this benefits the organisation, by monitoring users on the computer system they can identify and prevent any threats for happening before they appear. For example if the users is on a website which houses viruses the admin can shut down the window before anything happened. This policy is very effective as it can prevent faults from occurring on the systems or network, it can also prevent theft to equipment.

This policy is great for security within an organisation however the size of the system will be large and hard to maintain and keep updated. As the organisation will have many areas which will be watched by CCTV and also all the computer systems on the network will be monitored. The cost to maintain and update the surveillance and monitoring tools will have an affected on the organisation as they will have to pay technicians to maintain the tools .

Advantage

The advantage in having this police in place is that it can reduce any physical  threats happening to the systems, as they are being monitored by CCTV. The system can also help identify and resolve threats before or after they occur. Not only can the system prevent anything happening to their systems, the system can also protect the employers working in the organisation. For example if employees are caught ignoring their duties, stealing or threaten other employees, the employers can use the footage to prosecute  rouge employees. This shows the public that the organisation cares for their employees.

Disadvantage

The disadvantage in having this policy in place is that their could be a misunderstanding among the employees as they might feel like their employees are intruding their privacy or my feel that their employers do not trust them. Employers will need to inform their employees on why they are going to introduce this policy before hand. Another drawback in this policy is that it can be very costly for the organisation to set up the system, as they will need to install cameras, computers, and software to maintain the system. They will also need a place to store all data they collect in case they need to use the clips in future references. The organisation may also need to invest in legal advice to make sure that their systems follows the privacy rights law.

Risk Management

This helps the technicians within the organisations to deal with issues quicker and stop anything worse occurring.  This provides the technicians with information about the hardware, software and other devices on the network. The program is set up so that technician can identify issues much quicker and resolve them before getting worse.

The cost of running the program, having it installed to the system, and paying technicians to maintaining the program. These are minor negatives in having this policy in place, other than that it is a great policy to have in place.

Advantage

The advantage in having the police in place is that it can reduce downtime benefiting the organisation as they can continue to provide service to the customers. This is because the issue that has occurred is dealt within sooner and also strop anything worse occurring. The policy can also prevent possible threats happening before they occur. The threats can also help them improve their systems so that the issue doesn't occur again in the future.

Disadvantage

The disadvantage in having this police in place is that it can be very costly for the organisation, as they will need to train employees to help them manage issues properly and also maintain it so that the issue doesn't occur again. The time spent training the employees to that they execute the risk management properly.

"note you may be asked to expand on some of the points, so try to add more to the assignment. Also remember not to copy word for word, as their are now software to check for plagiarism, when marking the assignment, try to complete the assignment your own way." [I am not encouraging you to copy this piece is here for educational purposes]

Unit 7: P4 & P5

Unit 7

P4: Disaster Recovery

Disaster recovery is a procedure that is arranged in every organisation to recover damaged equipment that’s has been damaged from disasters. These disasters can be cause by natural disasters such as:

• Earthquakes
• Floods
• Terrorism
• Fire
• Sabotage
• Hacked

Countries and areas that are affected by natural disasters, the organisation within that area will have a disaster recovery procedure in place so that data and equipment are not damaged during the disaster. for example if a hurricane occurs the organisation employees could power off their equipment and also disable servers/network to prevent from further damage to the system. The organisation within that area could arrange a regular backup of their systems to prevent loss of data. If the system is hacked users of the system must be informed on what has happened and also recommend them to change their password, to prevent data being stolen off their account. For example when eBay’s website was compromised they informed all of their users to change the password.

The consequences an organisation will have for not having a disaster recovery procedure in place are that their reputation will be affected because data can be lost or because of downtime and it can also lead on to further damage to equipment. As they did not have a disaster recovery procedure in place to help them recover any damaged equipment or lost data. The impacts organisations will have are that their reputation will be affected and will also lose trust from their customers/users. This is because the organisation has not provided their customers/users with the best service. The organisations income will also be affected as they will have to pay extra for any damages to hardware and software.

Code of conduct

Code of conduct is set of rules and principles that have been placed within an organisation. They are in place for disciplinary, equality, diversity, legislation, to prevent damage to equipment/software or to prevent employees getting harmed in the organisation. Code of conduct is commonly placed in organisation/workplace, in education, military etc. anywhere you are providing service to others. They are there to safely guide the employees within the organisation for day to day decision making. For example in schools there will be code of conducts which the teachers will follow to keep the students safe and also themselves. Code and conduct can also be used on software which the employees use; they will be in place to prevent any threats to the organisations computer systems.

Before joining an organisation you will be expected to sign the code of conduct. This state’s that you will follow the code of conduct and be working safely at the workplace. As you have agreed with the terms and conditions before joining the organisation you must not break them. There will be consequences if failing to follow the code of conduct, these consequences can be fines which the employee or employer receives as they have not followed the code of conduct, as they could have put them in harm’s way, they could also be let go from the organisation because you have not followed your contract rules.

Email Usage

Email usage is when an organisation limits the uses of the users email for security reasons and also to prevent any threats to the network and the system. The users will be unable to use their email for personal use as their will be separate systems for them use for personal use. This is because if the user opens an email which stores virus, the virus could spread throughout the system and also the network affecting them and also the organisation. Organisation will also limit the size of attachments to prevent the system from getting slow during the transfer of the email.

Internet Usage

Internet usage is when the organisation limits the Internet use for the users i.e. for personal use. Organisation will have this policy in place to prevent any threats entering their network or systems and also for security reasons. The users will be unable to visit other sites that are not related to their day to day job, this is so that the users is not distracted from their work and also prevents them visiting sites that may store threats. There will be a separate computer system which the employee could use for personal use in their own time such as lunch breaks etc. The consequences for not having Internet usage policy in place are that viruses could enter the system and damage the software and hardware, which the organisation may have to buy replacements. This can lead them in to downtime which will prevent the users using the computer to do their day to day job. The organisation will lose profit as the employees are unable to work.

Organisation Security

Organisation security is a security procedures that takes place before hiring new staff. This procedure is in place for the safety of the company and also for the safety of other employees. The employer of the organisation will to a number of checks before allowing a new person to join the organisation.

There will need to be a vacancy open if anyone is to join the company. Once there is a vacancy you will be asked to hand your CV in to the organisation or may be asked to apply online or on a paper application which the organisation may provide you with, this allows the employee to see what the people are like. The employer will look through the application and see if the person is a good match to the organisation. Once the employer has chosen the right candidates, they will all be asked to come in for a interview. In the interview you will be asked to bring in a proof of identity such as a drivers licence or password etc. this is for security purpose so that it is the right person coming in for the interview.  Once the interview is over and you have successfully passed the interview you will be asked to come in and sign the contract with the organisation and also the code of conduct. These are for security purposes, so that you do not break any rules and working safely. Breaking the code of conduct you will find consequences, such as losing the job.

During the procedure of signing the contract the employer will do a background check to see if you previously hand any issues. They will do a CRB check which shows if you have a criminal convictions this covers all of you adult life, the employer may also call you previous employer to see what kind of person you are, check the list 99 or credit check. These checks are for security purposes to insure that the employer is hiring a safe person, which they can trust to work in the organisation.

Surveillance policy

Surveillance policy are in place to monitor certain areas within the organisation. Surveillance will not be included in staff rooms or break out areas or any personal places within the organisation. Surveillance can monitor areas of the organisation using a CCTV, GPS tracking of certain equipment, key logging software monitors the keys you press on the computer system or surveillance on computer systems which tracks the data passing through the computer system.

All the employees within the organisation need to be aware of the surveillance policy and also be told to sign the surveillance policy agreement which states you are aware of the surveillance policy, the management and also the union will be informed of the surveillance policy. for example at a colleges all the employees and students will be informed that there is a surveillance policy in place which monitors certain areas of the college campus.

P5: Risk Management

Separation of Duties

Within an organisation it is important that the employers separate the employee’s responsibility. The organisation will have different departments for different jobs this so that one person is not responsible for all the jobs, because having one person responsible for all the jobs will put a lot of pressure on the employee causing them to cause problems during the job. Organisation such as Microsoft will have different departments which will help the company develop their products.

Separation of duties can help the organisation keep their systems secure, as a third party security audit could take place, this is when one technician installs the security software and another technician will get to test their security to see if there are any security breaches on the system. The organisation could also have a third party security which an external company will manage the organisations security, this will benefit the organisation as the third party security is an organisation that only focuses on the security.

Disciplinary process

A disciplinary process is when in an organisation then employer gives a warning to the employee, this could be because they have  broken the rules or are not performing to the organisations standards.

The first warning a employer may give will be a verbal warning this warning will explain what the warning is for, a verbal warning will be given for minor issues that the employee has committed. The verbal warning will last for a minimum of 6 months, if within those 6 months the employee is caught breaking the rules or not performing well, they will get a seconded warning which will be a written warning. The written warning will explain what the employee has done in more detail, this warning will last up to 12 months, once the 12 months is over the warning will be cleared from their profile. The final warning will be a written and also meeting with the employer, in which they will inform the employee that they will be dismissed.  If the employee has committed something serious the employer can instantly dismiss the employee. for example if an employee working at Apple and is caught stealing their product this will lead to instant dismissal, as they have committed a crime.

Training policy (CPD)

A training policy is when the organisation provides the employee with one week of training. The training is there to help the employees work safely within the organisation and also help them develop/improve their skills. for example school teachers will have training days which help them develop their skills. CPD continuing professional development  is when the employer of the organisation tracks and documents the skills and knowledge the employee has developed while working with the organisation.

"note you may be asked to expand on some of the points, so try to add more to the assignment. Also remember not to copy word for word, as their are now software to check for plagiarism, when marking the assignment, try to complete the assignment your own way." [I am not encouraging you to copy this piece is here for educational purposes]

Unit 7: P1, P2, P3, M1, M2 & D1

Unit 7 

P1: Explain the Impact of Different Types of Threat on an Organisation

Malware Attacks

Malware is software that is designed to disrupt computer systems. It also has the ability to gather sensitive information off the user’s computer. The impact malware attacks have on a business is that details of the business could be compromised and also has the ability to restrict the employees/customer access to their account. Malware could come from emails, files or USB memory sticks, where once it’s opened or inserted the malware will then spread on to the computer system and start to disrupt the system without the users being aware of it. The consequence a user and business will have is that they could lose data, data being compromised, lose trust from customer/users and also affect their reputation, as the users will experience what a malware attacks is capable in doing. Malware attacks affect the customers, as the malware attacks have the ability to compromise the customer’s details. Malware attacks could also limit the access or not allow the customer/user access to their account; this will affect the user if they are at work and are trying to access their work. For example information business plans could be leaked and customer details.

Internal

The internal data threats to a business are deleted data, leaked data, data corruption, theft, human error, terrorism, rouge employees and email threats. All these threats could happen by the user inserting a USB memory stick to the system which could have stored malware, the malware will then spread throughout the system or employees who feel that they are not being treated fairly or getting paid enough on the job they are doing. If any of these data threats happen the consequences the business will have are that, users of the system will lose trust in the business and will also affect their reputation, as their users will inform others that the systems the business uses are not secure. The data on the organisation system could be deleted and information about organisation, customer and users could be leaked out to other business or to people who are not related to the business. For example in 2011 PlayStation Online server went down due to users PSN accounts were hacked by group of hackers. A number of the user’s credit card details were stolen and some users account was deleted.

External

The external data threats to an e commerce site are data theft, website impersonation, denial of service, redirection, defacement, delete data, phishing, Trojan, spam, human error and server failure. These threats have a huge impact on the business and also the customer as both sides are being affected by the attacks.

DOS happens when the server receives too much requests at the same time, the server cannot handle this so it crashes. Data theft happens when a group of people impersonate an e commerce website to steal customer’s information. Redirection is when the e commerce website is redirected to another website which could be storing viruses. The virus from the website could spread on to the user’s computer and cause damage their computer. These threats could happen from rival e commerce sites or from a group of people who like to cause problems.

Threats to Ecommerce Site

Ecommerce site store a lot of information on their servers about their customer’s details, these data could be compromised if malware attacks the system. The malware attacks that could happen to ecommerce sites are data theft, impersonation, DOS, redirection etc. Data theft is when customer’s information on ecommerce site is stolen. The information stolen is likely to be details about the customer’s credit card. Impersonation is when websites attackers create a mirror copy of the ecommerce site, which they use to fool the customers in to typing their login details into the impersonated website. DOS (denial of service) is when the server receives too much requests at once causing the servers to crash. This will cause the ecommerce site to crash and not allowing the customers access to their accounts or to purchase or sell items on the website. The consequences the ecommerce sites will have is that their reputation will be affected causing the ecommerce site to lose customers, ecommerce sites income will also be affected as well because of the downtime and repair. These attacks on ecommerce site can happen a number of ways. They can happen by attacks are not from the organisation who are trying to gain the information about the customers of the ecommerce sites. It could also be caused by rouge employees, who may not be treated well or are not being paid enough for the job they are doing.

Hardware

The internal threats to hardware are damage during installation, theft or natural disasters. Damage during installation is when computer components fail or is damaged during an upgrade or installation of a component. Theft can occur from within an organisation by rouge employees who may not agree with the organisation on how they are being treated. Natural disasters can happen at any time. Natural disasters are likely to occur in areas of the country that are affected by the weather a lot. For example south of Wales are affected by floods every year, so organisation there must be aware of the impacts it will cause them if they do not take action. The consequence business will have if they do not take action to these issues are that it will impact their profit, as they will need to pay for extra employees to help them with repairs.

Software

The internal threats to software are theft, technical fault and copy right software/counterfeit. These threats can occur at any time. Theft of software could involve a rouge employee or security issues where the documents and files could be stolen.

• Copy right software/counterfeit
• Theft
• Technical Fault
• Human Error 

M1: Information Security

Confidentiality - Organisation that have customer’s details must keep the information safe and secure, so that unauthorised person cannot get access to the information. The employees who deal with this data must talk about this information with anyone outside of the organisation or within. The employer will also chose who is responsible for updating the information and who can't. They can also check how often the information has been check, this helps the organisation as they can employ fewer people to deal with the information. If the information is tampered with or goes missing the employer can easily identify the employee who is responsible for it. Businesses which fail to follow the confidential rule will have be affected by this, as the employees within the business, will be free to do what they like with the information they work with. Rouge employees can use the information they gather about people to their advantage. This will also affect the person who’s personal details are be used for other things. For example if employees within banks use customers information for their benefits, will not only impact the customer and it will also have a huge impact on the bank. Their reputation of the bank will have a huge impact as they will be known by the public for employing rouge employees. Customers will not trust the bank again to store their money. 

Data integrity - Organisation need to make sure all the data they have about their customers is correct, as it can cause problems later to both the business and the customer. The organisation reputation will be affected because people will think they store wrong information about their customers. It will also affect the customer as they could be blamed for something they had nothing to do with. The organisation must clarify that the information the customers have provided them is correct. For example if banks have wrong information their customers, the customers may be charged with things they should be charged for. Organisations who do not follow the data integrity rule will be affected hugely and also the person whose information is incorrectly stored in the organisation. The incorrect information stored on the system can cause a lot of problems. for example if a hospital has the incorrect information about their patient, the doctors and nurses will not be aware of this and could provide the wrong medicine to the patient which can lead on to other issues. The organisations reputation will be affected as the public will be aware that the organisation is storing incorrect information about their customers on the system, which is causing a huge mix up.

Access to data - It is essential that organisations make sure that they have viewed who has accessed certain data on the system. They can uses this to identify who has and hasn't been accessing the data and also check how many people have viewed the data. Organisation can also use this to give certain users access to certain data on the system and identify who is using the data for the wrong reasons. Organisation can put time limits on the data to view. for example if someone within the organisation needs a part of the data, they will be allowed to view this data for a short amount of time, once they are done with it they will not be able reopen the data. Organisations who fail to follow the access to data rule will be impacted hugely. As everyone on the system will be able to view other users data. For example employees may be able to view other employee salary on the employers account as they will have access to it, they can also make changes to the system which can later cause other threats. If one of the users on the network turns the firewall off on the network unauthorised access to the network will take place. Hackers outside of the organisation will be able to see the data passing through the network, this can be information about peoples bank details or personal information on where they live etc.

Counterfeit

Counterfeit goods are illegal copies of the original item. Counterfeit goods are unsafe as they have not been approved by manufacture, that the software is safe to use. As the software is counterfeited this could lead to loss of data or downtime as the software will have security issues which potentially could lead to other problems to the system. This can affect the organisations reputation because the user will not know that the software is legitimate and can come across issues with the software, as it has not been approved by the manufacture. For example there are windows operating systems which have been counterfeited, where they have been coded differently which could store spyware and have security breaches on the software.

P2: Physical Security

Hardware

The hardware security an organisation could use are USB/Port locks, CCTV, ID cards or by limiting access points within the organisation. USB/Port locks are used to cover the ports on a computer tower. This is so that if there are any malware on the USB it does not transfer over to the computer system, where the malware could spread throughout the system causing downtime. CCTV is security camera which records and monitors areas of a room. The security team can use the CCTVs to monitor areas of the organisation that are highly limited access. For example a shop will have CCTV cameras to prevent items from the store from being stolen. ID card is an identification card which helps other employees and security identify that you are part of the organisation, without an ID card the security has the right to not allow you access to the organisation. It can be used so that only the employees can access the building and certain areas of the organisation, employees with a high level of access will be able to access areas in the organisation that are secure. For example colleges and universities will require their students to wear an ID badges so that the staff can identify the student. This is to prevent others to access the organisation. Limiting the access points is when certain areas of the organisation can be access depending on the level of access the employee has. This can be used to store data in certain areas depending on how important the data is and only allow employees access this area if they have the right level of access to it. For example colleges/university only allows their technicians to access their server rooms.

Software

The software security organisation can use are biometrics, keyfob and swipe cards. Biometrics is technology that analyses biological data to identify someone. It can be used to access certain areas of the organisation by an eye scanner, finger print, voice recognition etc. this technology will be used mainly in highly secure organisation. For example airports have now used this technology to help them identify the person instead of using their passport photo to identify them, this is now used to faster the process. A swipe card is security card that allows the person to access areas which can only accessed using a swipe card.  This can be used to limit the access to areas of the organisation that store important data. For example colleges students will need to have swipe card to access to the college without it they will not be able to access the building.

Network

The physical network securities the organisation can place on their servers are CCTV, swipe cards, ID cards, biometrics, limit access points and using shielded cables. Swipe cards will only allow people who have the card to unlock and have access certain areas of the organisation. Organisation could use swipe cards to allow only the technicians of the organisation to access the server room. For example Banks will have areas of the organisation which can only be accessed using a swipe card this is to prevent unauthorised access to the area. Organisation can also limit the access points to certain areas of the organisation, depending on the employee’s level of access. By doing this they will be able keep their server room safe, as random people/employee cannot enter that area of the organisation. For example colleges will have limited access to areas for the students, such as the server room where only the staff will be able to access the area.

   

P3: Describe how Software and Network Security can keep Systems and Data Secure

Software

The software that can be used to keep the systems and data secure are anti-virus, complex passwords and security updates. Anti-virus software will help the computer system to identify and remove any viruses on the system. This software will prevent malware or spyware to access the computer. Having a complex password will also help the organisation to keep their systems and data secure, as it will make it harder for hackers to access the system or data. For example Apple will have will have complex password to prevent data from their system being leaked or stolen. The organisation could have regular security updates which will help the system to identify new virus that have been introduced and also preventing them to enter the system. For example Microsoft always introduces a new security update to all of their users to prevent the user’s computer being attacked by viruses. Encryption is another way in which organisation could help secure their software. Encryption encodes the data so that unauthorised user cannot read or access it. By encrypting the software the users of the software will be unable to steal the software as it has been encrypted to the system.

Network

Computer network can turn on their firewall, level of access and permission. Firewall is used to prevent unauthorised access to the network or system and keep data passing through the network secure. The organisation could also enable permission where in order to access the network you will need permission from the network you are trying to access. This prevents random people access the network. Level of access is when certain areas of the organisation will have access to the only data that they only need, however the technicians will have access to all of the data. Organisations can also use encryption to secure their data passing through the network. Encryption encodes the data passing through the network, so that an unauthorised user is unable to read or open the data which is passing through the network. For example large organisation such as banks will have encryption on their network to prevent hackers from stealing people’s bank details which is passing through the network.

M2: Encryption Techniques

Encryption is a security method which encodes a message before it is being sent out. This is so that unauthorised users cannot access this information without have permission and only the authorised will have access to the information. This method is used within organisation to keep stored information/data secure and confidential. People use encryption to change plain text into an unreadable secret. Encryption doesn't only protect confidential messages but also ensures that the message has not been tampered with while it is being sent. Decryption is when the receiver receives the message and decodes the information that has been sent to them. Decryption is only done by the private key which the users has access to.

Public & Private Key are two types of encryption key. The public key uses itself and a private key. The private key is used only on the user's computer system to decrypt the message and the public is used on the users and also the users receiving the data, this is so that the two systems communicate with each other securely. The data is encrypted during the transfer of the data. In order for the system to receive encrypted data the computer system must have a public key which will be used to receive the information. The public key is sent to everyone connect to the network however they will be unable to read the information as they will also require a private key to decrypt the information. The user who will have the private key is the user in which the message is originally intended to. The encryption works by using prime numbers, this makes it very difficult for hackers to access and makes the message extremely secure.

The sender of the message encrypts the message with a symmetric key and then encrypts that key with a public key on the receiving computer, this in orders that the message is secure. Once the message is sent through the network the receiving computer the uses the private key to decrypt the message so that is can be opened. Large organisation such as banks may uses this type of encryption technique to secure their web server however it uses a slightly different approach to secure the information. It uses a digital certificate which uses unique numbers to code the message same as public and private key, this is so that the web server in organisation can trust the source the information is coming from, this source is known as a certificate authority. This sources identifies that the sender and receiver are the correct systems which the message will be transferred from and to. It then provides them both with a public key so that the message is directly sent to the receiver and not to anyone else connected on the network.

D1: Discuss Different Ways of Recovering From a Disasters

Disaster recovery is a procedure used in organisation to recover their systems from a disaster. This protects the organisation from the effects from negative events. The negative attack can include malicious attacks on their network or computer systems, equipment failure or natural disasters such as earthquakes, floods, hurricanes etc. This procedure reduces disruption to an organisation from disasters. This will benefit the organisation as they will be able to trade with their customers.

There are many types of disaster recovery procedure. Back up, system restore point and hard drive clone.

Back up is one most common method to recover information from a disaster. This method will be introduced when the network is introduced within an organisation, technicians will regularly back up data off the network to prevent any data being lost if a disaster occurs. Organisation will back up the data off the network to an external drive which will not be located in the same building as the network and computer systems. This is so that if the main building which houses the network components is damaged, the backed up data will not be as it is not in the same building. For example large organisation such as banks will have backups of all their data stored in another area from the original data.

Restore points can also be set on the computers systems, this is similar to backup however the data is not backed up on to an external device. This method is used when the computer system becomes corrupted or stopped working, where the technician can then access the start up menu and restore the system to its previous computer function or can restart the computer to its factory settings. This method is useful for a small disaster such as single computer system failing. For example technicians within schools will commonly use this method to restore their systems to its previous computer function.

Hard drive clone copies the entire hard drive from the main computer system to another hard drive. The copied data will be stored within another system, where the copied data will be used only when a disaster occurs. The data copied will be stored in a different location to where the main computer is stored.

"note you may be asked to expand on some of the points, so try to add more to the assignment. Also remember not to copy word for word, as their are now software to check for plagiarism, when marking the assignment, try to complete the assignment your own way." [I am not encouraging you to copy this piece is here for educational purposes]