Essays on Security Program

Internal vs. External Penetration Tests

Penetration testing is a form of practice aimed at improving the security system of an organization by testing the computer systems, web application, network, and databases to establish possibilities of an attacker exploiting the system vulnerabilities. Two types of penetration testing exist, the internal and the external testing. The external penetration testing aims at determining the possibility of a remote attacker to access the internal network by accessing specific crown jewels and servers within the system’s internal network. It exploits the external perimeter of the technology, people, and process and systems connected to the public network infrastructure. The ...

Question 1

Information is an important asset. The core goal of information security is to protect the availability, confidentiality, and integrity of the information. To build a secure organization, it is important to build a security program that protects the information assets of the organization. An important part of the security program is the risk analysis. The objective of a security program is to mitigate risks, which does not mean eliminating them but reducing them to an acceptable level. To ensure that the right kind of security controls are in place and controlling the risks effectively, it is necessary to anticipate ...

Question 1

A Security program decision enables a high-level view of the way that security is ensured for a particular resource throughout an enterprise (Kaisler et al., 2005). The solution, however, covers four dimensions of security: Physical, data, personnel as well as operational and may involve matrices as well.

Operational security

In the section of operational security, the security program promotes a development of standard operating procedures for every enterprise architecture component that supports line of business operations.

Data security

In this section of information security, the security program promotes security-conscious designs, source authentication, data access and control and content assurance.

Personnel security

In this section of ...