Security Basics

Scenario:
You are an independent consultant who specializes in Information Technology security issues. You have been retained by the Designer Distributions Company, a mid-sized and growing consumer goods distribution company, for an assignment to assess the state of their computing environment security situation. The company's newly hired VP of IT is conducting this project because she does not have a security specialist on her staff and has learned that the company does not have a comprehensive security strategy. In fact, she suspects lack of even basic security knowledge in both the IT staff and the user community.

The company has a headquarters office building, which includes the principal data center, and a separate warehouse linked to the office by an private data network. The warehouse has a small computing facility of its own for order shipment data entry and tracking. This computer is linked to the headquarters order entry systems through the network. Additionally, there are Internet-based data links to several key suppliers used to share reorder, production and shipping schedules and status information. When potential new suppliers compete for contracts with Designer Distributions, their proposals are received and negotiated via Email.

You have been interviewing executives and staff at the company and at key suppliers and are beginning to evaluate what you have learned in preparation for preparing your report to the VP of IT.

***In preparation for interviewing the business and IT department managers at Designer Distributions Company, the VP of IT has asked you to put together a brief presentation (5-8 slides with notes) about security issues in today's IT environment for them to read. She intends for this to give them some common background information so the feedback they provide you about their security knowledge and status will be more accurate and useful.

After researching the online business and computer trade press through internet research, create a presentation showing the significant security-related issues that a company like Designer Distributions would need to address during its evaluation of its security management program. You should identify not only the most common threats to IT integrity at a company, but the offsetting security measures that would need to be evaluated. For example, if you were to include "ensuring only appropriate users read or modify confidential data," you would need to specify an assessment of the processes by which user privileges are granted, verified at application log-on, and kept current over time.