Security Rules And Regulations

Businesses today face the ever evolving technological changes that are required to maintain network security and data privacy while complying with applicable legalities. As an information security manager for a large sporting goods store I am responsible for protecting the organization’s computers, networks and data against threats and security breaches, attacks by cyber-criminals and computer viruses. The details of the job of an information security manager is to evaluate the organization’s security measures to include firewalls, passwords, logins, malware, antivirus, along with any weak points that may make the information systems vulnerable to attack.

Our organization focuses on an array of data to include health records of health screenings,

According to Bahadur “These requirements may also govern our processes or ability to collect information, pursue investigations, monitor networks, and any number of activities that we might wish to execute as part of our appointed roles.” (pg. 90) The Privacy Act of 1974 is one of the first regulations created to help protect the collection, use and transfer of PII (personally identifiable information). Due to advances in technology privacy issues have become more urgent. With that more and more rules and regulations have been implemented. Some of the rules and regulations that our company needs to be in compliance with

Physical security controls consist of Deterrent, Detective, and Preventive. As far as Deterrents go our objective is to discourage anyone who may seek to violate or threaten internal or external security controls. Physical deterrents could be signs showing video cameras, or violators will be prosecuted, well-lit areas or stringent access controls to include heavily fortified areas along with security personnel. Other means of physical security include employee badges, biometrics, keypad access, intruder alarms, and fire suppression systems. As far as policies and regulations go, an organization could inform employees and customers that a violation could result in being fired or disciplined along with a fine and or criminal prosecution. The detection part of physical security could also consist of video cameras in addition to other physical intrusion detection systems. Preventive measures include RFID for inventory and theft prevention. Technology security can be broken down into Network Security, Operating System Security and Application Security. Network Security risks can be minimized with proper network security design. Per Andreas “network segmentation can prevent unauthorized network traffic or attacks from reaching portions of the network to which we would prefer to prevent access, as well as making the job of monitoring network traffic considerably easier.” Pg. 153