1. The company I work for is a federal forensics lab for a major metropolitan area. The organization deals with many different investigations dealing with all types of computer crimes. Therefore the organization must have a very robust operations security because the criminals have extensive resources and are very savvy in computer techniques that might enable them to access the evidence if not protected properly. Also, the other possibility of high level corporate embezzlement where employees may be approached by individuals who may bribe them into tampering or destroying incriminating evidence.
2. The organization is a 24 hour a day operation, so many security controls need to be put in place to protect the assets and evidence located in the facility. Operations security focuses on the processes, personnel and technology and is needed to protect assets from threats during normal use. These controls are: -Preventative controls -Detective controls -Corrective controls -Deterrent controls -Application controls -Transaction controls
The three most common controls are Physical, Administrative, and Technical (Johnson, 2011).
The first step when hiring employees would be a pre employment screening to eliminate anyone who could possibly be a risk. The next step in personnel would be employ principle of least privilege. If they do not have a need to access the evidence to do their job, they should not have access. Separation of duties is another personnel control to ensure no one person can control a whole process to compromise anything of value in the organization. Job duty rotation and forced vacation is another control to ensure that no one is hiding anything. Finally executing independent checks on performance allows an outsider to verify the job is being done properly (Breithaupt, 2006).
3. The roles of the organization would start at