Development of a Security Strategy
SEC 404 – Cyber Security

ACME, a technology services corporation of about 300 employees has recently inaugurated their new Headquarters. In an effort to establish a stable and operational IT infrastructure, the newly implement Information Technology (IT) department has requested the security team to put develop a corporate security strategy that will layout the foundation of the day-to-day operations of the organization.
An important piece of an information security strategy is mitigating risks while complying with legal, statutory, contractual, and any internal requirements. With the development of technology, the evolution of IT systems and the insider threat risk, it is critical that mitigation strategy is developed. Following the results of a risk assessment, mitigation strategies are presented to the organization’s stakeholders. Below are a few examples of mitigation strategies that can be implemented on a new organization. * Ensure to consider prevention, detection and response mechanisms. * Ensure to consider the implementation of lest permissions and least privilege concepts. * Ensure to consider layered controls so that multiple control points are established between threats and assets of the organizations. * Ensure to consider policies that guide IT security officers and employees in implementing and managing the security program.
The strategy developed will be used to define control objectives, and establishment of benchmarks and metrics. In order to be successful with the implementation, there must be a clear definition of IT security roles that will be responsible for the operation, maintenance, optimization and ensuring that the organization.
Starting a new organization is no easy task, especially when you have to develop teams and processes from the ground up. A critical part of