Network and Computer Security Chapter 7, Essay Example

Formal controls provide assistance to technical controls, as they govern and address issues of integrity in application and data that may lead to high risk and cost. Likewise, in order to govern formal controls, security manager must assign jobs and responsibilities, as this allocation of duties and responsibilities will set alignment with business objectives. Formal controls are associated with management aspect that will deploy strategic security management practices.

Informal controls are associated with security awareness programs considered as the cost effective tool used to aware employees for ‘do’s and don’ts’ while accessing data or information resources. As risk environment is constantly changing, a comprehensive education and security awareness program is extremely important that will conduct periodic awareness sessions for new employees, or new technology or any relevant risk that needs to be addressed. Therefore, the security awareness program should be considered as a ‘common belief system’.

Lastly, the technical control that is not limited to authentication of a user along with assigning proper rights on an application or operating system. In order to apply confidentiality to data, encryption, hashing, encoding methods are adopted by organization. Likewise, smart card is the most popular one. Moreover, for preventing non repudiation, digital signatures are deployed by a third party certificate authority. However, the cost of technical controls must be justifiable and cannot exceed the cost of an asset and the security manager must conduct cost benefit/analysis for each control to justify its presence.

The Most Difficult Aspect

Organizing information systems is defined as the series of activities that are associated with information handling. Organizations expand their business gradually. For instance, strategic plan for any financial institution is to open a branch on every quarter of the year depending on stable revenue and defined achieved objectives. The security manager creates security strategy that must be aligned with the business strategic plan and addresses security issues