CSCC ISSP Policy on Internet Access and Information Security Essay

ISSP Policy on {Issue} for {Case Organization}, {Your Name}
ISSP on {Issue} for {Case Organization}
In this section the student should write a complete ISSP on the topic provided, using the outline
below, as described in the text to serve as an example the organization can follow in writing the
other ISSPs (typically 5-10 pages).. Be sure to format your final policy the same as the template (text
.25” indented, 12 point Times New Roman, lines 1.5 spaced, paragraphs with 6 point space after).
Everything in italics should be replaced or deleted before submitting your assignment
1. STATEMENT OF PURPOSE
The ISSP should begin with a clear statement of purpose that outlines the scope and applicability of
the policy. It should address the following questions: What purpose does this policy serve? Who is
responsible and accountable for policy implementation? What technologies and issues does the
policy document address?
a. Scope and Applicability
b. Definition of Technology Addressed
c. Responsibilities
2. AUTHORIZED USES
This section of the policy statement explains who can use the technology governed by the policy and
for what purposes. This section defines “fair and responsible use” of equipment and other
organizational assets, and it addresses key legal issues, such as protection of personal information
and privacy. The policy makes any use for any purpose not explicitly identified a misuse of
equipment.
a. User Access
b. Fair and Responsible Use
1
ISSP Policy on {Issue} for {Case Organization}, {Your Name}
c. Protection of Privacy
3. PROHIBITED USES
While the previous section specifies what the issue or technology can be used for, this section
outlines what it cannot be used for. Unless a particular use is clearly prohibited, the organization
cannot penalize employees for it. In some organizations, that which is not permitted is prohibited; in
others, that which is not prohibited is permitted. In either case, be sure to state clearly the
assumptions and then spell out the exceptions.
a. Disruptive Use or Misuse
b. Criminal Use
c. Offensive or Harassing Materials
d. Copyrighted, Licensed, or Other Intellectual Property
e. Other Restrictions
4. SYSTEMS MANAGEMENT
This section focuses on the users’ responsibilities with regard systems and data management. A
company may want to issue specific rules regarding the use of e-mail and electronic documents, and
storage of those documents, as well as guidelines about authorized employer monitoring and the
physical and electronic security of e-mail and other electronic documents. This should also address
retention policies, and the minimum and maximum times certain files may be retained and how, in
accordance with relevant laws, regulations and guidelines. The Systems Management section should
specify users’ and systems administrators’ responsibilities, so that all parties know what they are
accountable for.
2
ISSP Policy on {Issue} for {Case Organization}, {Your Name}
a. Management of Stored Materials
b. Employer Monitoring
c. Virus Protection
d. Physical Security
e. Encryption
5. VIOLATIONS OF POLICY
This section specifies the penalties and repercussions of violating the usage and systems
management policies. Penalties should be laid out for each violation. This section should also
provide instructions on how to report observed or suspected violations, either openly or
anonymously, because some employees may fear that powerful individuals in the organization could
retaliate against someone who reports violations. Anonymous submissions are often the only way to
convince individual users to report the unauthorized activities of other, more influential employees.
a. Procedures for Reporting Violations
b. Penalties for Violations
6. POLICY REVIEW AND MODIFICATION
Every policy should contain procedures and a timetable for periodic review. This section should
outline a specific methodology for the review and modification of the ISSP, so as to ensure that users
always have guidelines that reflect the organization’s current technologies and needs.
a. Scheduled Review of Policy
3
ISSP Policy on {Issue} for {Case Organization}, {Your Name}
b. Procedures for Modification
7. LIMITATIONS OF LIABILITY
The final section offers a general statement of liability or a set of disclaimers. If an individual
employee is caught conducting illegal activities with organizational equipment or assets,
management does not want the organization to be held liable. In other words, if employees violate a
company policy or any law using company technologies, the company will not protect them and the
company is not liable for their actions, assuming that the violation is not known or sanctioned by
management.
a. Statements of Liability
b. Other Disclaimers
REFERENCES
Here you should describe all references and support documents used in the creation of this project in
APA format. Note any document, graphic, table etc. used from an outside source must contain an in-text
citation, as well as a reference here.
4
Billingsley-Boscovitch Business Supplies, Inc. (B3SI)
MISSION STATEMENT
Billingsley-Boscovitch Business Supplies, Inc. (B3SI) strives to provides its customers with the
high quality business and technology supplies, equipment, furnishing and advice need to enable
our customers to maximize their business operations.
Values Statement
It is our intent to provide the highest degrees of dedication, quality and integrity, reflected in
our services and our products. We are committee to building life-long partnerships with our
customers and our employees. We strive to provide our products and services with a
dedication to the highest degree of integrity and quality, with customer satisfaction and the
development of long-term professional relationships with our customers. We value our
employees that build pride and strive to creating a strong positive working environment and
company spirit.
B3SI is a local office supply store established in 1979 after its co-founders William Billingsley
and Alexander Boscovitch met in college. Upon graduation, each earning their business
degrees with honors, the duo decided to establish a local store which would sell office supplies
to many of the north Atlantis companies, building a strong customer based with a high degree
of customer support and satisfaction. Today, even in the face of corporate office supply giants,
their dedication to serving their customers has allowed the company to grow to 5 regional
stores, with a corporate headquarters serving as the central shipping and receiving hub, and a
fleet of 20 delivery trucks.
Recently (in 2015) both Mr. Billingsley, Senior and Mr. Boscovitch retired from the business
leaving William Billingsley II (a.k.a. Junior) in charge of the business. Junior has an MBA and a
BSBA in Entrepreneurship, with a minor in IT from the Atlantis University of Technology.
Junior’s first order of business was to update the almost obsolete IT infrastructure and
telephony systems in all stores and the corporate headquarters. His next task is to improve the
information security of the corporate headquarters.
Executive Staff
The current CEO, William Billingsley, Jr. oversees all operations at corporate headquarters and
all 5 regional stores. The managers of the regional stores actually report to the COO, who
reports to the CEO.
The current CFO, James McNathy, oversees all financial operations at corporate headquarters
and all 5 regional stores. The Senior Accountant reports directly to the CFO.
The Current COO, Grace Williams, oversees all corporate and branch operations, including
sales, procurements and distribution. The managers of all 5 stores report to the COO, as does
the Managers of Purchasing, Sales, Distribution, HR and IT.
Corporate Organization Chart
William Billingsley, Jr.
CEO
Grace Williams
COO
LOCAL BRANCH
MANAGER
Melinda Hixon
Mgr, HR
Thomas Harden
Mgr, Sales
Wendy Binder
HR Admin Asst.
Marie LeFleur
Senior Exec Asst.
Pantoja Martina
Mgr, Purchasing
Vicki Webb
Mgr, Distribution
Rachel Xieng
CFO
Cecilia Thompson
Manager IT
Samuel Prout
Senior Accountant
Constance Beignet
Sales Rep
Suzie Xiao
Purchasing Rep
Margarito
Fletcher
Distribution Rep
Vincent Disalvo
IT Tech – Networks
Donna Massey
Accountant-GL
Debbie Sims
Sales Rep
Okekula M’buta
Purchasing Rep
Tina Mann
Distribution Rep
Penny Dodd
IT Tech – Systems
Su Lee
Accountant-AP
Barry Zubler
Sales Admin Asst.
Jesse Eckerd
Accountant
x1253
Angela Fowler
Dist. Admin Asst
Jeffrey Kruse
Accountant-AR
Corporate Headquarters Physical Plant
B3SI Corporate Headquarters Floor Plan
Office
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
Occupant
Foyer
Reception
Workroom
Executive Assistant
CEO
COO
Conference Room
CFO
Purchasing Rep
Purchasing Rep
Manager, Purchasing
Purchasing Admin Assistant
HR Admin Assistant
Manager, HR
Sales Rep
Sales Rep
Office
116
117
118
119
120
121
122
123
124
125
126
127
128
129
*
Occupant
Manager, Sales
Sales Admin Assistant
Distribution Rep
Distribution Rep
Manager, Distribution
Distribution Admin Asst
Accountant – General Ledger
Accountant – Accounts Receivable
Senior Accountant
Accountant – Accounts Payable
Manager, IT
Data Center/Server Room
IT Tech – Systems & Servers
IT Tech – Networking
Data Center specifications in
separate table
B3SI Data Center/Server Room (Room 127)
Two full-height (42U), floor-standing racks inside the center currently each hold a 3000VA UPS
and 6-8 rackmount servers (described below), plus switches for the 1GbE Cat6-backbone
network and several shelves of routers, wireless controllers, spare drives and so on. The room is
independently climate controlled and on its own 9000VA UPS that also powers half a dozen
office systems and switches around the floor in case of a power outage.
Current server applications installed and running as infrastructure:
Unless otherwise specified, all servers are Dell PowerEdge R6xx Rack-mounted servers.
Rack 1:
1. Windows 2012 Server A – Active Directory Service, AD SQL DB, Primary Domain Name
Service and DNS SQL DB
2. Windows 2012 Server B – Exchange 2013 email server and Email DB
3. Windows 2012 Server C – Traverse Accounting Software and Accounting SQL DB
4. Windows 2012 Server D – Traverse Distribution Software and Distribution SQL DB
5. Windows 2012 Server E – Traverse ERP Software and ERP SQL DB
6. Dell Storage NX 3xxx 1 – Network Attached Storage (NAS) #1 – Runs Windows 2012 R2 –
multi-terabyte data backup capability for Rack 1 servers’ databases. In CC|IRM this is
referred to as a “Disk Array”.
7. Dell Switch A
8. APC UPS A
Rack 2:
1. Windows 2012 Server F – Office 365 Server and Office DB (contains Office 365 files and
images) – web-based office productivity software used on employee systems.
2. Windows 2012 Server G – Internet Information Server #1 for Intranet support – stores
own web and document data. Used for internal forums, wiki’s and policy document
management.
3. Windows 2012 Server H – Optimum HRIS and HRIS DB
4. Windows 2012 Server I – Internet Information Server #2 used with Forefront TMG and
IIS-FTMGDB – used to provide web filtering and proxy services – has own Intranet DB.
5. Windows 2012 Server J – SupportIT and SIT DB – used by IT department to manage
systems configuration, updates, and helpdesk tickets.
6. Dell Storage NX 3xxx 2 – Network Attached Storage (NAS) #2 – Runs Windows 2012 R2 –
multi-terabyte data backup capability used as an onsite daily backup for all Rack 2
servers’ databases. In CC|IRM this is referred to as a “Disk Array”.
7. Dell Switch B
8. APC UPS B
All Servers (including both NAS) are backed up weekly to a Cloud-based backup service
(iDrive.com which provides a deep educational discount). In CC|IRM this is referred to as
“Software-as-a-Service”.
All PCs and office files backed up weekly to SAN#1.
All data and databases backed up daily to SAN#2.
Traverse Accounting Software provides the following applications:
• General Ledger
• Accounts Payable
• Accounts Receivable
• Payroll (Employee Distributions)
• Banking
• Bank Reconciliation
• Fixed Assets
Traverse Distribution Software provides the following applications:
• Inventory
• Bill of Materials/Kitting
• Purchase Order
• Sales Order
• Warehouse Management
• Requirements Planning
Traverse ERP Software provides the following applications:
• Web Portals (Ecommerce site)
•
Customer Relationship Management
Optimum HRIS provides the following applications
• Payroll Management (exports to Traverse for Payroll processing)
• Human Resources
• Time & Attendance (exports to Traverse for Payroll processing)
Current B3SI does not have any formal information security policies, plans or staff.

Purchase answer to see full
attachment