Information System Network example essay topic

MEMORANDUM To: Information Manager Office (ATTN: Mr. Black) August 18, 2003 FROM: Operations (ATTN: Theodore Robinson) DATE: August 18, 2003 SUBJECT: REPORT PROPOSAL TO FAMILIARIZE PERSONNEL WITH THECOMPANY'S COMPUTER SYSTEM AND LAN This report is in response to the various security and maintenance problem this company has experience over years. I propose to study the problem and develop a baseline defense in handling procedures for personnel using computers and the local area network (LAN). My proposal, written for Information Management Office and staff, will cover these areas: 1. An assessment of the problem and the need for this report 2.

The proposed plan is covered in phases outlining an approach to better the company ability to maintain a trouble free network. 3. Interviews of personnel in the Information Technology field and the likely benefits of adopting this proposal. All recommendations for improvement will be based on the collected evidence in my report. I will be happy to further discuss this proposal with you at anytime. TABLE OF CONTENTS Introduction...

2 Proposed Plan... 3 Conclusion and Recommendation... 4 Proposed Checklist... 6 Bibliography... 8 I. Introduction: Statement of Problem. In 2003, the company experienced a major increase of problems with the Local Area Network (LAN).

The LAN downtime has double from previous years. There's also an increase of maintenance problem with computers systems this includes hardware and software. Some user's have acquired the authority to load there own software on their system, this has attributed to some user's purchasing or borrowing software from unimproved sources and loading them on to their systems. If these actions continue it may cause irreversible damage to our information system. This is causing this unit thousandth of dollars per month.

Objective. This proposal examines the computer and LAN problems from the viewpoint of new and old employees, the tier one and tier two information system managers. It then offers a plan to make the system more secure against hackers. In addition, it recommends ways to improve the computer and system maintenance making it a more secure environment for the entire company. Sources.

The data is compiled from a company wide-interview questionnaire, interviews with employees; email inquiries to companies similar to 1st Battalion Engineers, the internet, and over six years of observations of military information system networks. Details of the Problem. This subsection examines the severity and causes of security and maintenance problems on the LAN. Severity. Since 2001, the company has experienced a continuous increase of computer system problems. Personnel are allowed too many privileges with their assigned computers and the local area network, and the use of unapproved software, which only compounds this problem.

We experienced four major system problems in the past year that led to the entire LAN being in-operable. Many users lack the know-how to operate their system. Upon in-processing employees are presented with numerous passwords that they tend to write down on paper and attached to their desk or computer this represents a major security flaw to any company that processes classified information. Causes. The following were specific concerns noted by the Information System Manager, technicians, and the employer (in descending order of importance): 1. New employees loading unauthorized software on the company systems.

2. Passwords not being safe-guarded 3. Hardware added to the system without the approval 4. Users leaving terminals unattended without logging off. 5. Users not conducting virus scans on software and data files before loading them on to their assigned computer Most maintenance and security problems are occurred due to lack of guidance.

Personnel assigned to the company are unaware of the many variables that effect one of the company's primary forms of communication, both external and internal. Needs The lack of guidance for use of computers and the LAN is contributing to the requirement for excessive maintenance of the company's hardware, software and LAN. By addressing this problem immediately, we can prevent hackers from interdicting the company LAN, set a baseline for the company information security plan, and alleviate unscheduled maintenance on network infrastructure. Scope The proposed plan includes a detailed assessment of the methods, costs and materials, personnel requirements, feasibility, and expected results. II.

Body Proposed Plan. 1. Phases of the Plan: a. Informing all employees, on the Proper Use of Computers and LAN: First, the Information Management Officer (IMO) must inform users of the maintenance and security problems. We will demonstrate the staff interest by sending out an email to all employees and posting information on the bulletin board. In an effort to give employees a better understanding of why the checklist is being implemented, we will post some of the mishaps that have occurred. b.

Upgrading Computers and our Intranet: Prior to distribution of the checklist, the Computer and Network Technician should allot a weekend to concentrate on the task at hand; making sure all computers and the LAN have current security updates and required software as directed by CERT. c. Enforcing the In-processing Checklist: Enforcing the In-processing Checklist is an essential long- term element of this plan. No employee with longevity invested in the company is likely to follow all the rules all the time-unless the rules are enforced. 1). First, you request signs be made by the Army's Graphics department.

The posters should be colorful and should outline key points taken from the in-processing checklist. 2). Next, through email, computer users can be reminded about proper use of their computers and should be encourage to perform anti-virus updates daily. To ensure everyone is adhering to policy, the IMO should run daily scans to identify personnel that aren't performing proper procedures as outlined in the In-processing checklist. Those who refuse to comply will have their privileges revoked and will only be allowed to operate their computer system in a stand-alone mode only. 3).

Last but not least, ensure all personnel in the company understand each statement outlined on the checklist. Employees should be briefed by the unit information and security managers regarding the importance of the checklist and how it ties into the network system. Cost and Material. The major cost would be incurred for the information manager and technicians payment of overtime. Additional work is required to ensure everyone system is in compliance's with the proper hardware and software, and individual computers are free of unauthorized equipment. The estimated cost for overtime is $4000.

Feasibility. On July 27, 2003, I interviewed five technicians and four information managers. I inquired about their methods for coping with new personnel and the use of company computer systems. Among the personnel interviewed, all agreed a checklist was a great idea for informing personnel on proper use of the system. This method of informing our personnel coupled with a slight upgrade in our network system will ensure all employees have a solid secured foundation to operate from. Benefits.

The checklist will keep all users informed of proper procedures while working on the company's network and add an extra measure of protection to the company information assets. If everyone follows the prevention checklist it, in contrast to previous years maintenance problems, viruses released onto the network, and unauthorized software and hardware, the company will save over $30,000. CONCLUSION AND RECOMMENDATION In conclusion, I emphasize the importance of keeping the computers within the company and the network secure. Ensuring everyone understands and does their part in relation to the outlined security measures is paramount to this company's success. Although the proposed checklist is not a stand-alone answer to our system problems, it's a crucial step in the implementation of the company's security plan.

Aside from the intangible question of image, close inspection of the proposed plan will prove successful if you take the recommend steps and -- - most importantly -- -if daily enforcement of checklist becomes a part of the in-processing procedures. PROPOSED CHECKLIST (Draft) Computer User's Agreement As a user of 1st Battalion Engineer's Computer Network System, I acknowledge my responsibility to conform to the following requirements and conditions as established by the network Designated Approving Authority. I hereby acknowledge a job related need for the logon password associated with the use rid listed below. Initial next to each statement after reading.

If any questions arise, ask your designated computer security managers. 1. I understand that failure to sign this acknowledgment will result in denial of access to the network 2. I understand that the network (s) which I am authorized user access processes sensitive information and that I have been granted user access authorization due to my need-to-know and clearance level. I acknowledge that I will not introduce or process unofficial data onto the company information systems unless authorized by competent authority 3. I understand the need to protect my password.

I will NOT share my password and / or account with anybody 4. I understand I should not store my password anywhere (posted under keyboards, left in desk drawers, programmed into function keys, part of batch run, etc). 5. I understand that I am responsible for all actions taken under my account. I will NOT attempt to gain access or "hack" the network or any connected information system or network, or attempt to gain access to data for which I am not specifically authorized. 6.

I understand my responsibility to appropriately protect all output generated under my account (to include printed output, magnetic tapes, floppy disks, diskettes, and downloaded hard disk files) and to properly label all media 7. I understand my responsibility to report any / all information system or network problems to the system administrator. I will NOT install / modify /remove any hardware or software without the express authorization of the system administrator 8. I acknowledge my responsibility to use the information system / network only for official use only 9. I understand that I am not to leave my terminal signed on and unattended. When leaving the terminal area, I will properly log off the system.

10. I acknowledge my responsibility NOT to introduce any software or hardware not acquired through official channels. I also acknowledge my responsibility to virus scan all software and data files for viruses before loading them to my PC, or uploading a file to the host (this includes any files received via EMAIL). 11. I acknowledge my responsibility to comply with federal, state, DOD, Army and 1st Battalion Engineers policies and (where applicable) all copyright laws.

12. I understand my responsibility to backup the data on the computer.

Bibliography

Benson, Anthony, Title XI Manager, 1st Battalion Engineer, Interview by author, Fort Jackson, South Carolina, 23 July 2003 Nettrour, Michael, Information Manager, 1st Battalion Engineer, Interview by author, Fort Jackson, South Carolina, 23 July 2003 Moore, Benson T, System Technician, 1st Battalion Chemical, interview by author, Fort Jackson, South Carolina, 25 July 2003 Internetworking design Basic [cited 10 Apr 2002] available at web "Incident Reporting Procedures" [cited 9 Oct 2001] available at web IncidentReportingGuide 3.
doc Entrust-"Internet Security 101 Basic Internet Security" available at web "Checklist: Assess Your Risk" [ cited 2 April 2002] available at web Ken.
Bigelow's Virus Troubleshooting Pocket Reference " New York: McGraw-Hill Publishing, 2000.
Bigelow, Stephen J. "Bigelow's Drive & Memory Troubleshooting Pocket Reference" New York: McGraw-Hill Publishing, 2000.
Whitten Jeffrey and Lonnie Bentley, Systems Analysis and Design Methods, New York: McGraw-Hill Publishing, 2001.