This is a paper wrote for my course at WozU in cyber security. In the first part I am Sam the system administrator, I must assign roles to employees for each part of the network. Then I must explain why I chose the role I did. In part 2 I pick three topics from a list and explain each of them in a brief paragraph.
Part:1
Problem: Place the proper permissions of each member of the company. And explain why I gave the permission I did.
Employees:
- Sam, System administrator
- Robert, the lead warehouse receiver
- Jennifer, sales, and accounts payable
- Bradley, the warehouse general manager
- LuEllen, the shipper
- Buster, the shipper
- Lloyd, the purchasing agent
- Spare, for temporary help
Key:
- T = Temporary
- BP = By Position Assigned
- A = Needed for Primary Function
- N = Never
- RO = Read Only
Department | Jennifer | Buster | Bradley | Lloyd | Luellen | Robert | Spare | Sam |
Receiving | RO | RO | RO | N | RO | A | T/BP | N |
Shipping | RO | A | RO | N | A | RO | T/BP | N |
Sales | A | N | RO | RO | N | N | T/BP | N |
Accounts Payable | A | N | RO | A | N | N | T/BP | N |
Answer:
Jennifer, sales, and accounts payable. For this job they must be able to edit sales and accounts payable and might need to be able to read if an order has shipped or come in.
Buster, Shipper. For this job they must be able to access and edit shipping orders and might need to read a receiving or at some point. But we would not need access to any other department.
Bradley, GM. For this job they would need to be able to read all departments but not edit. One person being able to edit all departments is too much of a liability.
LIoyd, purchasing agent. For this job they would need to be able to edit accounts payable to buy things and read sales to know how to make buying choices.
Luellen, Shipper. For this job they must be able to access and edit shipping orders and might need to read a receiving order at some point. But we would not need access to any other department.
Robert, receiver. For this job they must be able to access and edit receiving and might need to read a shipping order at some point. But we would not need access to any other department.
Spare, Temp help. This would need only temporarily access and it would be by assigned position to limit access and time in the system.
Sam, system administrator. I would not need access to any of these departments to do my job.
Part 2:
Acceptable Use Policy (AUP):
This is a policy that is put in place to explain the proper use of company equipment. This will tell you what websites you cannot go on, or what time your workstation can and cannot be accessed, or even if you can or cannot have food and drink around the workstation. More importantly, this will outline things like no personal devices on the network, no personal hard drives connected to the computer or logging into personal email accounts. These are all noticeably big security risks and need to be stopped before they happen. User training, user training, user training, this one simple thing can stop many hacks before they start. This policy is usually signed at the time of employment.
Intellectual Property:
The protection of Intellectual property is covered under the Non-Disclosure Agreement (NDA). Once this is signed it is a legal binding document that will protect you. How this protection works is if I sign this before coming into your building, and it says I cannot tell anyone anything I see in the building. Then I turn around and tell someone you can start a lawsuit. This coupled with a patent on your project will allow you to protect the information of the project much more than without.
Disaster Recovery Plan (DRP):
This plan is put in place to help the company recover as fast as possible from a really tough situation that could be hurricane, tornado, lightning hit the building, or several other things. This document will usually outline the use of off-site facilities to recover faster, these facilities can be hot, warm, or cold sites. They need to be far enough away from the disaster to not be affected but close enough that the company transition without too much trouble. The difference in the sites are, Hot is ready to go all the equipment is up and running all data is there you can just jump to work, Warm you will have all your equipment most likely but you might need to pull backups from a cloud or an off site server, cold site has nothing the building is pretty much empty you have a lot of work to do.