Scribd Logo
Upload

Welcome to Scribd!

  • 10 views

    CYB 260 Project Three SLA Requirement Recommendations Sumer Piggush

    Uploaded by

    Sumer Lynch Piggush

    Copyright:

    © All Rights Reserved
    Download as DOCX, PDF, TXT or read online from Scribd

    CYB 260 Project Three SLA Requirement Recommendations Sumer Piggush

    Uploaded by

    Sumer Lynch Piggush
    10 views3 pages

    Copyright

    © © All Rights Reserved

    Available Formats

    DOCX, PDF, TXT or read online from Scribd

    Did you find this document useful?

    Is this content inappropriate?

    Copyright:

    © All Rights Reserved
    Download as DOCX, PDF, TXT or read online from Scribd
    Download as docx, pdf, or txt
    10 views3 pages

    CYB 260 Project Three SLA Requirement Recommendations Sumer Piggush

    Uploaded by

    Sumer Lynch Piggush

    Copyright:

    © All Rights Reserved
    Download as DOCX, PDF, TXT or read online from Scribd
    Download as docx, pdf, or txt
    of 3

    I.

    Selected Sub-Controls:

    A. Control One: Controlled Use of Administrative Privileges

     Control Type: Procedure

     Justification: Implementing a procedure for controlled use of administrative privileges

    aligns with the requirement to restrict access across the network. By establishing clear

    guidelines on who can have administrative access and under what circumstances, we

    mitigate the risk of unauthorized access and potential internal or external attacks. This

    procedure ensures that administrative privileges are limited to essential personnel,

    reducing the likelihood of abuse or credential theft.

    B. Control Two: Controlled Access Based on Need to Know

     Control Type: Standard

     Justification: Enforcing a standard for controlled access based on the principle of need-to-

    know aligns with the requirement to restrict physical access and data handling. By

    standardizing the process of determining access rights according to job roles and data

    sensitivity, we ensure consistency and effectiveness in protecting sensitive information.

    This standard includes measures such as non-disclosure agreements, security clearances,

    and access control lists to enforce the principle of least privilege.

    II. Necessity for a Training Program:

    A training program is essential to address the specific social engineering threat outlined in the
    Service Level Agreement, particularly focusing on email phishing attacks. Social engineering

    tactics exploit human vulnerabilities, making employees the first line of defense against such

    threats. Without adequate training, employees may inadvertently fall victim to phishing emails,

    leading to data breaches and compromising customer information.

    III. Expected Outcomes of the Training Program:

    The training program aims to achieve the following outcomes:

     Increased Awareness: Employees will be equipped with the knowledge and skills to

    recognize phishing red flags and suspicious emails.

     Improved Response: Employees will understand how to respond appropriately to

    phishing attempts, including reporting suspicious emails and refraining from clicking on

    malicious links or attachments.

     Reduced Risk: By actively engaging in security awareness training and applying best

    practices, employees will contribute to a reduction in successful social engineering

    attacks, thereby minimizing the risk of data breaches and protecting customer

    information.

     Cultural Shift: Over time, the training program will foster a security-conscious culture

    within the organization, where cybersecurity awareness becomes ingrained in everyday

    practices.

     Continuous Improvement: Regular training sessions and simulated phishing exercises

    will enable ongoing learning and refinement of employees' security awareness, ensuring

    adaptability to evolving threats.


    References

    Anders, L. (2023, September 7). How to Train Employees on Phishing Awareness: A Step-by-

    Step Guide. Hook Security. https://www.hooksecurity.co/blog/how-to-train-employees-

    on-phishing-awareness

    Cardella, J. (2017, March 24). The CIS Critical Security Controls Explained - Control 4:

    Controlled Use of Administrative Privilege. Rapid.

    https://www.rapid7.com/blog/post/2017/03/24/the-cis-critical-security-controls-

    explained-control-5-controlled-use-of-administrative-privilege/

    Lynch, P. (2019, June 22). CIS Critical Security Control #14: Controlled Access Based on the

    Need to Know. Anchor Technologies, Inc. https://www.anchortechnologies.com/blog/cis-

    critical-security-control-14-controlled-access-based-on-the-need-to-know/

    You might also like