A Walk in the IT Director’s Shoes
Nekole Sissle
INF 325 Telecommunications & Networking Concepts
Instructor: Karmaveer Koonjbearry
May 20, 2016

A Walk in the IT Director’s Shoes

When it comes to technology it leads to the internet. Many people can communicate with other people in various places through the internet. Companies can get many advantages by using Internet network to support their business. Therefore, companies are trying as hard as they can, and give high effort in protecting their network from attack and make sure that they have the best network security. Most people think that the threat of security attack is only come from outside the company. In fact, the attack from inside the company network is more harmful with high frequency to be happened. It is widely know now that threats from inside the company is far more dangerous than attacks from outside. These facts shows that any company must plan an implement policies to defend their network security from inside and outside intruders. These companies must find how intruders attack in order to protect their information assets. This will help make their network security more effective in blocking threats either from outside or inside the company. Within my paper I will discuss that I am the Information Technology (IT) Director for a small, growing firm and my tasked would be to develop an electronic resource security policy to deploy within my organization. I will discuss the differences between the terms implementation and policy and describe the importance of their separation. Then develop an outline of a security policy which addresses areas that are identified as problems. Then, I will identify the policy differences between users who work remotely or use wireless hotspots compared to users who work on site in a traditional office environment. Finally, I will discuss how I would implement my security policy within the organization including how employees would feel about my decision. As the Information Technology Director I would first discuss the difference the difference between a security policy and a security plan. When it comes to a security policy identifies the rules that will be followed to maintain security in a system, while a security plan details how those rules will be implemented. A security policy is generally included within a security plan. A security plan might be as simple as a verbal statement from the highest-level management that all accounts on a system must be protected by the use of a password. Or a security plan might be a thick document spelling out in great detail exactly how security will be implemented within the company’s systems. Your Information Security Plan should include all required actions for organization-wide implementation of your Information Security Policy. Although the two are closely tied, they are also separate documents. A solid Information Security Plan will typically include several phases, depending on your existing infrastructure, network / systems topology and configuration. You may need several distinct technical phases to implement the required security controls without major service disruption. Next I will discuss the difference between implementation and policy and I will describe the importance of their separation. The difference between implementation and policy is that implementation is the execution, carrying out, method, standard, and policy for doing something. In Information Technology, it ensures that all the processes within the system is operating correctly in its environment. This may include installation, configuration, user training, delivery and troubleshooting necessary changes. Implementation is a more of a conventional term which tends to imply top-down policy and is usually associated with positivist conceptions of policy and positivist research paradigms. Enactment is a more nuanced term, and attempts to get at how people interpret, accept, resist and subvert policy. When it comes to the implementation procedures it will generally document on how you are going to implement the policy and should include documents to provide proof of implementation (checklists or sign off sheets). An example on how to write a policy would be if you are cleaning the company bathrooms, you would list the details, responsibility, reason, and frequency. If you trained someone to clean the bathrooms, they read the policy and sign off that they were trained. But how would you know if they were cleaning it as often as they should. How would you prove to your superiors that this person you trained cleaned it properly? This is where the documents come into play. If your trainee signed off on a checklist (or other type), that would provide proof of implementation. Now there is accountability and a way to assess the effectiveness of your policy, training effectiveness, and even your employee. The reasons for considering separation of policy-making from implementation can broadly be characterized as responses to concerns about focus or capture. The focus argument is generally made by politicians and public managers, the capture argument by economists and academics.
Outline of Security Policy * It’s a must to keeping the security level high through the management cycle for the policy and to keep the security level high, it is necessary not only to set up the policy but also to introduce it appropriately and to evaluate and review it repeatedly. This deals with setting up the policy which deals with the introduction, operation, and the evaluation and review. * Need to start establishing the organization and system by establishing the organization and system by selecting Chief Information Security Officer and establishing the "Information Security Committee," the commitment of the organization executives to policy making and the responsibility of each member are made clear. * Implementing comprehensive measures:
Physical security: installation of proper facilities, entry/exit management, etc.
Human security: education, training, and password management, etc.
Technical security: management of networks, access control, etc.
Operation: monitoring of information systems, contingency plan, etc. * Start setting up the implementation procedures for putting into operation for actual work or in the information system, the implementation procedure has to be determined by the relevant departments and bureaus. I will now discuss the difference with a policy between users who work remotely or use wireless hotspots which work on site within my organization environment.

a. Compare the policy differences between users who work remotely or use wireless hotspots to users who work on site in a traditional office environment. b. Discuss how you would implement your security policy within the organization, including how employees would be apprised of the new policies. Be sure to explain which elements are critical for a successful implementation of your policy c. Include a minimum of five sources, one of which may be the textbook. Of these sources, three must be from the Ashford Library or from IT industry standard periodicals.

References

CDMA vs. GSM; It's Sprint and Verizon on one side, AT&T and T-Mobile on the other. (2007). Network World
CHARLAND, A., & LEROUX, B. (2011). Mobile Application Development: Web vs. Native. Communications Of The ACM, 54(5), 49-53. doi:10.1145/1941487.1941504
Stallings, W., & Case, T. (2013). Business data communications: Infrastructure, networking and security (7th ed.). Upper Saddle River, NJ: Prentice Hall. ISBN: 9780133023893