UNIT-V:
Information security Management & Responsibilities: Accountability - Information Security Roles and
Responsibilities, Risk Analysis, Security Metrics, Incident Response, Security visualization. (CO4)
1. Accountability - Information Security Roles and Responsibilities,
An organization has 3 key roles in its information security team:
1. Security Manager who is responsible for overseeing the entire security program. 2.
Network Security Specialist who handles network security configurations and monitoring. 3.
Compliance Officer who ensures that security policies and regulations are followed. If the
organization assigns the following number of tasks per month:
∙ Security Manager: 15 tasks
∙ Network Security Specialist: 20 tasks
∙ Compliance Officer: 10 tasks
Calculate the following:
1. The total number of tasks assigned per month to all three roles combined.
2. The percentage of tasks assigned to the Network Security Specialist out of the total number
of tasks.
Given Data:
∙ Security Manager: 15 tasks per month
∙ Network Security Specialist: 20 tasks per month
∙ Compliance Officer: 10 tasks per month
Calculations:
1. Total number of tasks assigned per month:
o Security Manager: 15 tasks
o Network Security Specialist: 20 tasks
o Compliance Officer: 10 tasks
o Total Tasks = 15 (Security Manager) + 20 (Network Security Specialist) + 10 (Compliance Officer)
o Total Tasks = 45 tasks
2. Percentage of tasks assigned to the Network Security Specialist:
o Tasks for Network Security Specialist: 20 tasks
o Total Tasks: 45 tasks
o Percentage Calculation:
o Percentage = (Tasks for Network Security Specialist/Total Tasks) × 100
o Percentage = (20/45) × 100
o Percentage≈44.44%
Summary:
∙ Total number of tasks assigned per month: 45
∙ Percentage of tasks for the Network Security Specialist: approximately 44.44%
2. Risk Analysis
Explain what a "risk" is in the context of information security, and provide a simple example.
In the context of information security, a risk is the potential for loss or damage to an organization’s information
assets due to a threat exploiting a vulnerability. It represents the likelihood and impact of a security breach or
failure.
Example: If an organization stores sensitive customer data on a server that is accessible over the internet but
lacks adequate firewall protection, the risk is that hackers might exploit this vulnerability to access and steal the
data. Here, the risk is the potential data breach due to inadequate security controls.
3. Security Metrics
A company tracks two security metrics each month:
1. Number of security incidents detected
2. Number of security incidents resolved
In a given month, the company recorded the following:
∙ Number of security incidents detected: 12
∙ Number of security incidents resolved: 9
Calculate the following:
1. The number of security incidents still unresolved at the end of the month.
2. The percentage of incidents resolved out of the total detected incidents.
Given Data:
∙ Number of security incidents detected: 12
∙ Number of security incidents resolved: 9
Calculations:
1. Number of security incidents still unresolved:
o To find the number of unresolved incidents:
o Unresolved Incidents = Number of incidents detected − Number of incidents resolved
o Unresolved Incidents = 12−9 = 3
o Number of unresolved incidents: 3
2. Percentage of incidents resolved:
o To calculate the percentage of incidents resolved:
o Percentage of Incidents Resolved = (Number of incidents resolved/Number of incidents detected) × 100
o Percentage = (9/12) × 100
o Percentage = 0.75×100 = 75%
o Percentage of incidents resolved: 75%
Summary:
∙ Number of unresolved incidents: 3
∙ Percentage of incidents resolved: 75%
4. Incident Response
Explain is an incident response plan, and why is it important for an organization.
An incident response plan is a documented strategy outlining how an organization should detect, respond to,
and recover from cybersecurity incidents. It includes procedures for identifying and managing threats,
communicating with stakeholders, and restoring normal operations.
Importance:
1. Quick Response: Ensures timely and effective action to minimize damage during a security incident.
2. Clear Roles: Defines roles and responsibilities, improving coordination and efficiency. 3. Reduced
Impact: Helps contain and mitigate the impact of incidents, reducing financial and reputational damage.
4. Regulatory Compliance: Assists in meeting legal and regulatory requirements for handling security
breaches.
5. Continuous Improvement: Provides a basis for learning from incidents to enhance future security
measures and response strategies.
5. Security visualization
Define security visualization, and why is it useful for managing security in an organization.
Security visualization refers to the use of graphical representations and visual tools to display and analyze
security data, such as network traffic, threat activity, and security incidents. It transforms complex data into
intuitive visual formats like charts, graphs, and maps.
Usefulness:
1. Enhanced Insight: Provides a clear and comprehensive view of security data, making it easier to
identify patterns, anomalies, and potential threats.
2. Faster Detection: Helps in quickly spotting suspicious activities or security breaches through visual
cues.
3. Improved Analysis: Facilitates more effective analysis and decision-making by simplifying the
interpretation of complex data.
4. Better Communication: Assists in conveying security information and incidents to stakeholders in an
understandable way.
5. Efficient Monitoring: Enhances real-time monitoring and management of security systems and
responses.
