Security professionals are tasked with protecting an organization’s data. It is important that they are cognizant of the daily threats that emerge, which could potentially harm the organization. According to Forbes in 2023, it is estimated that 560,000 new pieces of malware are detected every day and almost 340 million people have been affected by publicly reported data breaches or leaks (Brooks, 2023). With the growing increase of data and the global expansion of internet connectivity, hackers have been taking advantage of security gaps and vulnerabilities in a more exploitable attack surface. I chose the artifact on threats because it presents a variety of threats in its list, as well as categorizing the threat’s impact to data or systems based on the CIA triad. In addition, it gives a description of each threat and, in some cases, real-life examples of breaches where the specified threat exploited a vulnerability in the system.

On the topic of Policy, I chose the specified artifact because policies shape the way that we do things. While security policies are in place to protect an organization’s physical and digital assets, they also protect individual employees and the entire organization. Depending on the scope and purpose of a policy, security policies could be categorized into three types (Lutkevich, 2021):

·       Organizational policies serve as the as the master blueprint for the entire security program.

·       System-specific policies dictate security procedures for information systems or networks.

·       Issue-specific policies target specific aspects of the larger organizational policy.

For the OSI model, this artifact was chosen because it presents a visual of the seven layers along with protocols and threats at each layer. This model assists network engineers in determining what hardware and software they would need, and to understand how network components communicate across the network. It is also important to note that this model facilitates equipment manufacturers to maintain interconnectivity with other manufacturers as they define their standards and protocols.

The Research Innovation Lab artifact illustrates how the listed topics could be incorporated into a solution. In our daily professional lives, we interact with all of the presented topics and more. As a security professional, I am duty-bound to protect the organization’s assets. My main responsibility as an ISO 27001 Project Manager is to ensure that the Information Security Management System (ISMS) controls are sufficient to secure the organization’s data, documents, and other information assets. My duties include conducting policy review meetings to verify that policies are still effective and there are no gaps, conducting risk assessments to ensure that the controls in place are still effective against threats, and performing physical on-site audits to confirm that the business units are following the ISMS policies and procedures for maintaining the organization’s privacy goals. As a member of the cybersecurity team, I keep abreast with released Common Vulnerabilities and Exposures (CVEs) and use tools such as Tenable Nessus vulnerability assessment tool to scan endpoints in subnets. Throughout my profession, the OSI Model has served as a guidepost in troubleshooting network issues. As a security professional, I am expected to exhibit due care, professionalism, objectivity, and good conduct while executing my duties.

References:

Brooks, C. (2023, May 5). Cybersecurity Trends & Statistics; More Sophisticated And Persistent Threats So Far In 2023. Retrieved from Forbes.com: https://www.forbes.com/sites/chuckbrooks/2023/05/05/cybersecurity-trends--statistics-more-sophisticated-and-persistent-threats-so-far-in-2023/?sh=4ce5716d7cb6

Lutkevich, B. (2021, September). What is a Security Policy. Retrieved from Techtarget.com: https://www.techtarget.com/searchsecurity/definition/security-policy#:~:text=Why%20are%20security%20policies%20important,all%20threats%20to%20those%20assets.