Essay Information Security – Security Evaluation – Report Writing – Management Assignment Help

Assignment Task:

Introduction 

This is an individual assignment and requires students to conduct a security evaluation of their personal information management situation and report on the results of this evaluation. The main body of the report is expected to be around 2500 words but quality is more important than length. The intention of this review is to give you exposure to some of the issues that organisations might face when conducting such an information security review. 

As it is not feasible to give you access to a ‘normal’ organisational setting, we will use your personal situation as a simulation for the organisation. Despite this being similar to an organisational security review, it is important that you treat the situation ‘as is’ – that is you should focus on the risks that are relevant to your situation, not some pretend organisation. These risks may not be quite the same to those that organisations experience, but risks do vary significantly between differing organisations, so this should not cause too many issues with the integrity of this exercise. 

The security evaluation review for this year will focus on some key issues, including backup and recovery, access controls, protection from malware, and ensuring availability of a suitable computing environment. 

Requirements 

This assignment is intended to cover the full range of your personal situation with respect to information and its management – this will include any technology, insomuch as it relates to information processing and storage (such as home computers, laptops and home networks; and any mobile devices that you may have including smart phones, tablets, smart watches, and fitness devices; and other home-related devices as appropriate – for example, smart TVs, Google/Apple/Amazon smart home devices, and electronic locks) and any other storage media that you use to store relevant information. Where you store personal information online (in the cloud – data storage and email), you should include this in the review. There is no need with this review to include information about you that is stored by others (for example, the University keeps information on students, but this is not expected to be covered by this review). You should also avoid including work related activity in this review. 

The first step in the review is to identify all of the relevant information assets; any associated technology resources; and what these resources are used for. It is important for your report to include a description of these assets and their uses so that the reader has a context within which to situate the investigation and its findings. The nature of these assets and their use will influence the risk environment, so your overview is important for the reader to the make a judgement about the reliability of the review and its findings

In summary, your report should include the following: 

• an overview of your personal situation and the key risks areas that may be present; 

• a brief discussion of the normative model that you have used for you review. This section is mainly concerned with how you have constructed this normative model and why you have included the various controls in the model, noting the various sources you have used; 

• a summary of the tasks undertaken to conduct the review. What steps did you follow in conducting the review? What evidence did you consider in helping you form your views? What tests did you perform in order to verify the answers to key review questions? Did you use any automated tools for any of this testing? 

• the findings of your review and recommendations for improvement. You should provide a summary of the good and bad issues that arose from the review. What issues from the situation came up looking good in the review, and where was there room for improvement? What things would you realistically change in order to improve the information security environment? It is important that this section only presents a summary of the key issues from the review – the details of the evaluation of individual controls should be put in the appendix; 

• a reflection on the methodology or review approach, following your experience of applying it to your personal computing situation. This is an important part of the assignment and should not be neglected. There are details above on what should be covered in this section and a reasonable length for this section is around 500 words; 

• an appendix with the details of your review. The detailed questions and issues considered and the assessment against these issues should be included in an appendix in a table format. This material is not part of the main word count for the assignment. While this appendix is not part of the word count, this will be part of the assessment for the assignment and the marker will need access to this material to ascertain the extent of the review that you have undertaken. Without this table, there is little evidence that you have actually conducted an appropriate security evaluation! A sample row from such a table is included below.