Risks of small Business
Reply one
A general perception among many people is that small business are faced with fewer risks in terms of information security. But in contrast, small businesses are at high risk of collapsing if they are hit by a data breach or any other cyber-attack. I agree with your argument that ready ID requires a more advanced security program despite its small size. A lack of experience in handling security situations increases the vulnerability of small businesses. Since growth is a driving force for many businesses, business growth should be aligned with advanced security measures. Your program provides procedures for ensuring that information security policies keep up with the pace of business growth. Involving all departments in the upgrade process ensures that no employee is left behind. The second strength portrayed by the program is the emphasis on building awareness training. Through awareness training, employees develop cultures that help foster the effectiveness of other information security policies.
One area that requires a slight improvement is in the evaluation and assessment process. You should have a specific timeframe for assessment processes. The interval between assessment procedures should be short because technology is in constant improvement and so do hackers advance technologies for attacking computer networks. Secondly, the deployment of the recovery strategy should not wait until the end of the year. It can be deployed at the same time with the other policies since security incidences can occur at any time. Leaving behind recovery strategies may expose the company to uncertainty in case a security incident happens.
Reply two
The maturity model suggested in the paper gives the security program additional strength. As you have highlighted in the design section, the maturity model will provide speed and clarity to the program design. Make late decisions increases the consequences experienced in case of a security incident. Acting faster helps avoid or reduce the impacts of security incidences. Thus, the maturity model will truly serve to fasten the process of making decisions about the development and implementation of information security policies. As you have stated, training employees about the new security policies will be instrumental in ensuring that the existing culture will be changed. Since the majority of employees have worked in the company for long, it may be hard to introduce a new security culture. But through training and awareness policies, the company can achieve culture change.
The recommended camera system needs some improvement. Apart from covering the parking lot and entrances, the cameras may also cover the corridors so that unauthorized access to specific rooms within the premises can be monitored easily. I think that the security team should be decentralized rather than having them as a department located in one office location. Having all employees work as a team ensures that issues can be discovered easily. The training and awareness policies can serve to equip all employees with techniques for following security measures. The company should not rely on the IT department staff to discover security issues. The entire workforce needs to be responsible for the security of information systems.