Scenario: Your organization has formed a task force to do an audit on the security of its systems. This can be the organization you currently work for, have worked for, or are just very familiar with. It may also be an “imaginary” organization. After performing the security audit, the task force will prepare a report to be presented to the upper management (C-suite) of the company. Therefore, this will be a “business format” paper and quite detailed. So just keep in mind that this is a report that would be presented in a meeting to upper management.
Format: There are several areas that must be covered in this proposal, so let take a look at these areas.
1. You must explain the fundamentals of the operating system examined, i.e. hardware, network, software, etc.
2. You will explain the level of security of these systems at the time the audit was done. In other words, what did the task force find? Were there security issues in the hardware? Were there security issues in the software?
3. You will explain the structure of the method of storage types that the organization utilizes. Do they store everything on HDDs or SSDs, etc. You will need to explain how each method of storage functions (Remember you are presenting to upper management and they do not know how these things work).
4. You will examine how the OS controls the storage activities, whether utilizing magnetic disk type storage, SSDs type storage, and what RAID configuration they use – if they use RAID.
5. Once all of this has been addressed and explained, you will move on to a section of recommendations for improvements.
6. You will address recommendations for any changes in software … what changes or additions need to be made and why.
7. You will address recommendations for any changes in hardware … what change needs to be made and why.
8. You will address recommendations for any policy changes … what change needs to be made and why. Does the organization have a security policy – does it well cover the use of the organization’s systems – does it clearly state the ramifications of not following the security policy?
9. You will then address any recommendation with regard to employee training. Does the organization currently provide employee training specifically addressing security? Does the training cover software and hardware procedures, i.e. are the employees limited as to what they can download, are the limited as to what hardware devices they can bring into the company, like thumb drives, etc. What changes need to be made to the employee training?
10. Include a summary recommending a particular storage type for the company. Explain why this is the storage type the company should utilize and why it would be the most advantageous, remembering that this is addressing security issues, not speed, cost, etc.
This may sound like a very complex assignment – and it actually is. Therefore, I am doing a couple of things that I hope will be helpful to you in completing this assignment. NOTE: For those who are watching the recording and listing takeaways for the credit this will be Takeaway 2. Firstly, I highly recommend simple following the steps listed above – marking each one off when you have completed that part of the report. In this manner, you will not be as likely to “skip” an area. I am also posting an Exemplary Proposal. I will include this Exemplary Proposal in the Announcement concerning the recording of this live session. You will be able to download it. Now, this is simply to present a good format for the report – not to illustrate content. I am not stating that the detail or information in this proposal is deserving of a grade of 100 – simply illustrating what the format of the report should be,
1) Intro
2) Explain fundamentals of OS examined
3) Explain level of security of systems at time of audit (what did task force find)
4) Explain method of storage types being used
5) Explain how OS controls the storage activities
6) Move on to section for recommendations
7) Recommendations for software
8) Recommendations for hardware
9) Recommendation for policy changes
10) Recommendations for employee training
11) Recommendation for specific storage type and why