Information Security Awareness in an Organization

Information is considered lifeblood of a successful and profitable business and employees of the organization work as veins to pass this information through. Confidentiality, Availability and Integrity of information are then directly related with employee’s behavior towards information. Most kentico software development companies think information security is a technical issue and do not consider involvement of employees in ensuring continuous security of the information. Organizations may have components of information security awareness program but without proper management of the needed resources, they will not be able to complete it properly and continue to be successful. Identifying and bringing together all available components to develop an effective information security awareness program can be a difficult and overwhelming task.

Brief about Information Security Awareness

Information Security is the protection of information in opposition to fault, disclosure and manipulation. 

It is commonly accepted that the majority of the security violations are due to human interaction rather than technology fault. Yet, companies depend and grant a lot of consideration to technology and usually forget participation of human beings in the system. Usually organizations use best of the best products and technology for the protection of information and infrastructure. They ignore human’s contribution and role in securing organization assets. Actually kentico companies in India make this mistake and relate information security with the products and technology although it is a process which needs human interaction and involvement. There is no such thing as 100% security but we try to maximize its level through an awareness program and human involvement in the process. 

A simple definition of the three security pillars is as follows. If anyone of them is missing then it’s a flaw and is against the information security measures.

Confidentiality: It means only authorized people can see information e.g. you are the only one authorized to see your bank statement.

Integrity: It ensures that information has not been changed either in transit or while in storage. It means only authorized people can change the information e.g. you can see bank statement but not authorized to change it according to your wishes.

Availability: It means information is available when and where it is needed e.g. you can get money from ATM machine when you want to buy things.

Information Security Awareness is user’s education and awareness to handle information security threats and minimize their impact. Awareness program basically focuses attention on information security issues like confidentiality, integrity and availability. It highlights the importance of these factors, their role in business and finally concentrates on how to behave with them in a confident way.

“Awareness is not training. The purpose of awareness presentations is simply to focus attention on security. Awareness presentations are intended to allow individuals to recognize IT security concerns and respond accordingly.”

Information Security awareness is a method used to educate people in the organization such as a kentico cms company. It highlights the importance of information, threats to that information and staff’s contribution in implementing policies and procedures for the protection of information. Awareness program is an attempt to change the behavior of employees towards systems and processes in the organization. It teaches what needs to be protected, against whom and how.

Information Security Awareness is a Business Need

In today’s business environment most of the companies rely on electronically exchanged information. It is a requirement of all the departments to produce and pass information across different departments in a quick and secure manner to support their business decisions. Information plays an important role in making decisions. Therefore kentico companies in India and even the government departments have different classification of data based on its importance and use. 

Business success depends upon continuity of operations and information provided to the business processes by information systems. The growth, excellence and efficiency of the business could be damaged due to the threats and misuse of information. Therefore, awareness program basically helps, set measures and educate users on how to behave and get benefit out of information without jeopardizing its confidentiality, integrity and availability. 

The employees are the primary users of the information. A lack of awareness and mishandling of information could expose this information to competitors or get corrupted. If this information is freely available the following could be some of the impacts on the company and its business functions:

• The information available easily can be used by competitors to design strategies and launch new products with more features

• The company’s credibility can be affected from this disclosure

• Customer confidence can be lost

• Help competitors to gain more share in the market

• Suppliers and partner would be conscious to deal with the company

• Non compliance to government and industry laws and standards

• Employees will lose trust and will look for other opportunities

In today’s competitive business environment to have a good reputation in the market and legal compliance is a major concern. Suppliers, partners and even clients ask proof of information security before making any transaction. They want to make sure that all the information given to the company will be protected and will be used only for the purpose it is provided. 

Therefore need of successful and responsible organization is to have well written security polices and procedure, run information security awareness program on a continuous basis and be conscious in protecting its information assets. Implementing a strong information security awareness program can be a very effective method to protect critical business secrets and it will help employees to understand:

• Why they need to take information security seriously

• What they gain from active participation and support

• How a secure environment helps them complete their assigned tasks

Information Security Awareness Goals and Objectives

As we all know people are the weakest link in the chain and are the source of many information security breaches within the organization. Before demanding information security, employees should be conveyed the importance of a kentico software development company’s information and criticality. An educated and aware user is the foundation of a secure and reliable business environment. 

Dealing with information security threats and incidents is not a technology issue but people’s behavior. It is a critical factor to have a successful and effective information security program that will modify the behavior of employee’s dealing and interacting with company’s policies and procedures. 

Usually IT or Security department is considered responsible for the security of information assets. It is a misconception which has to be communicated among employees that the IT department is not the only one responsible but Information security is everyone’s responsibility. Information Security is everyone’s responsibility and at any level of the hierarchy.

Information security awareness program helps in minimizing the cost of security incidents, helps accelerate the development of new application systems, and helps assure the consistent implementation of controls across an organization’s information systems.

The primary and foremost objective of any awareness program is to educate users on their responsibility to protect the confidentiality, availability and integrity of their organization's information.

One of the objectives of an awareness program is to convey simple, clear and presentable message in a format that is easily understood by the audience.

The awareness program’s objective is that users understand not only how to protect the organization’s information, but why it is important to protect that information.

Awareness program’s goal is to get users attention on information security policies and increase awareness level on all security controls and practices in the organization such as a kentico cms company.

One of the goals is to create a security culture across the organization and keep on reminding employees about its importance and their contribution in that.

“Continuous improvement should always be the theme for security awareness and training initiatives, as this is one area where “you can never do enough.””

Summarizing, information security is a behavior and attitude rather than a technology issue. The only thing which can change is the behavior and thinking of the staff through awareness and education. People join organizations with their own beliefs, values, culture and principles. Information security awareness program facilitates those people to understand and take on the organization’s culture, values and ethics. 

This article describes the importance and the association of employees with information security awareness program, and motivational factor to attract employees to be responsive to this program. This is required and is the responsibility of all members in the organization such as a kentico cms company to protect the information assets.

An information security awareness program is a vital need within any organization that wishes to ensure privacy, security, authenticity, effectiveness and availability of information assets. The success of awareness program depends upon management’s consent and continuous support for a kentico company in India.

Bibliography

• https://www.pcisecuritystandards.org/documents/PCI_DSS_V1.0_Best_Practices_for_Implementing_Security_Awareness_Program.pdf
• http://www.deertech.com/e-news/march2013_1.html
• http://en.wikipedia.org/wiki/Security_awareness
• http://www.giac.org/paper/gsec/4340/organization-everyones-responsibility-information-security-awareness/107113

Courtesy: Sanika Taori

How to Choose the Best Web Content Management System - Part 2

From the Developer’s Perspective:  Important Capabilities for Your Web CMS

While marketing decision makers are focused on the content management system capabilities that help optimize the customer experience, developers and IT decision makers should evaluate solutions based on the underlying infrastructure, development tools, and other features and capabilities that ensure performance, flexibility, scalability and ease of use for developers.

Here’s a checklist of critical aspects for developers and IT to consider when evaluating a new web CMS:

• Developer productivity: Look for a CMS that streamlines development and maintenance with easy-tousle tools, controls, and capabilities. Your web CMS should enable you to work with the tools you’re already familiar with, such as Microsoft Visual Studio, to make the best use of existing skills.
• Roles and administration: A good web CMS will provide a sophisticated permission management system that allows you to grant rights to users, groups, and roles for ease of administration and control. 
• Integration: Look for a solution that includes pre-built integration with leading enterprise software, including the ability to connect to databases and web services without complex programming.
• Design flexibility/customization: The web CMS should be flexible and easily customizable, with tools that let designers create and update site experiences without coding. 
• Security: In addition to a permission management system for granting rights to users, groups, and roles, your web CMS should also support external authentication and authorization systems like Active Directory without requiring extensive coding and integration efforts. 
• Scalability and performance: It’s essential to understand the performance and scalability implications of any web CMS you’re considering. To keep maintenance and ownership costs low, choose a solution that will let you deploy multiple websites on a single system. And for greater scalability, choose a web content management system that can leverage the cloud infrastructure to rapidly deploy and scale servers to handle increased website traffic and enter new markets—without requiring additional investments in hardware.
• Support for responsive design and mobile devices: Look for native support for multi-device output, with features such as device previews to enable optimization of content, site layouts, and renderings. The web CMS should automatically detect the visitor’s device type and serve optimized content for that device.
• Multisite and multilingual support: Select a web CMS that supports any number of domains mapping to different web properties, as well as flexible sharing of content and code between sites. Ensure that the solution enables many-to-many language support to avoid creation of extensive new data structures when supporting different languages. 
• Technical support and training:  Evaluate the breadth and depth of the vendor’s support and training offerings to make sure they deliver the level of support and education your organization has come to expect.

A Roadmap for Choosing Your CMS

Once you have your own list of important marketing and technical capabilities for a new web CMS, then you can create a short list of potential solutions that meet your needs. Once you have a short list, you’ll need to put one or more web CMSs to the test to see which one bests suits your organization’s needs.

The following best practices provide some guidance on how to gather hands-on experience, third-party objective information, and product know-how to inform your decision. Think of it as a roadmap for choosing your new web Content management system:     

1. Bring marketing and IT together: The entire team, including marketing, content editors, developers, and designers should participate in comprehensive demonstrations. While the initial meeting includes the entire team, allow different groups ample time to have their own sessions with the CMS vendor where they can ask questions, at their level, that address their business or technical requirements.
2. Try it before you buy it: Request that the CMS vendor install a clean/out-of-the-box version of its product for your development team. Demo systems are highly configured and don’t necessarily give you a clear view of the complexity of the product. With a clean installation, your organization can see how easy or difficult it is to get started.
3. See it in action: Ask the web CMS vendor to build a simple website from scratch for your development team. This will reveal what functionality ships with the product, as distinct from customizations that may have been included in the demo system.
4. Attend vendor training: Strongly consider sending your developers to the web CMS vendor’s technical training class. They will gain a clearer perspective of the product’s capabilities and shortcomings, potentially saving your organization significant time and money in the long run.
5. Tap the developer community: Determine if there is a vibrant developer community around the content management system companies you’re considering and then tap into it for further insight into the product.   
6. Talk to other customers: Ask the vendor for references of customers in your industry. Speak with those customers to gain insight into real-life experiences with the product.  

Article Summary:

We’ve come a long way since the days when a content management system (CMS) was simply a way to manage and update the content on your website. Today, a web CMS is just one type of technology you need to consistently deliver an excellent customer experience. While your web CMS is a crucial component, today you must look at it as part of a larger customer experience management capability.

Why the shift? It all starts with the connected, empowered customer who brings greater expectations and preferences about how and when he or she wishes to engage with a brand.  Today’s customers expect a seamless, multichannel experience that anticipates their needs and wants. Companies that deliver this type of experience are building trust and loyalty that result in top- and bottom-line improvements including:  greater return on marketing investment, increased conversions, higher revenues, and greater lifetime customer value.

How to Choose the Best Web Content Management System - Part 1

Choosing a Web CMS is about more than Content Management

To achieve these business outcomes, companies are embracing the discipline of customer experience management and investing in the technology that enables it. A customer experience management platform lets you drive consistency in the experiences that your customers have with your brand. And that’s where a web content management system company comes in. A web CMS helps you achieve that consistency and deliver great web experiences. The rest of the customer experience management solution helps you deliver that content and consistency in other channels such as email and social.

Because your web CMS must interoperate seamlessly with the components of customer experience management, the CMS decision shouldn’t be made in a vacuum. This paper highlights the criteria – both from the marketers’ and the IT/developers’ perspective – that today’s organizations should consider when selecting a new web CMS as part of a broader customer experience management strategy.

The New Requirements for Today’s Web CMS 

One of the hallmarks of customer experience management is delivering a consistent experience across all touch points. That’s difficult to achieve if your content management capabilities are isolated in a siloes system. Instead, your web CMS needs to integrate and interoperate as part of a centralized platform for customer experience management.

A customer experience management platform unifies channels, campaigns, visitor information, and performance measurement into one integrated marketing toolset. The web content management system company serves as the core of the platform, enabling you to create, manage, and deliver the most relevant content for each interaction based on centralized customer intelligence. And because of this prominent role in delivering and managing an excellent multichannel customer experience, your web CMS must be much more robust, scalable, and flexible than ever before.

It’s also important to ensure your web CMS can seamlessly integrate with core systems such as your customer relationship management (CRM) software, ad-serving software, video streaming application, and any other system that would benefit from sharing customer data across the enterprise. Centralizing and sharing customer data enables sophisticated personalization and targeting to deliver a more tailored, relevant experience, which improves customer engagement.

Now that we’ve set the context for the importance of the web CMS for customer experience management, let’s take a closer look at the requirements you’ll want to consider when choosing the best web CMS for your organization.

From the Marketer’s Perspective:  Important Capabilities for Your Web CMS

Today’s marketers require a web CMS which offers far more than simply managing content. Ensuring an excellent customer experience calls for a set of capabilities that range from enabling you to deliver powerful interactive features to engage customers on your website, to collecting and utilizing customer behaviour for personalized interactions, to displaying content optimized for mobile devices.

The following criteria take these and other requirements into consideration and can be used as a starting point for the marketing team’s evaluation of a potential new web CMS:  

• Easy-to-use interface: This remains a must-have for any web content management system companies in India. An intuitive, easy-to-use interface enables both marketers and content editors to add and edit online content quickly without having to know HTML. Casual users should be able to complete routine workflow tasks quickly and easily, while power users can utilize a more robust interface and set of functionality.
• Single view of the customer: Look for a web CMS that collects and utilizes visitor information to personalize the experience. The web CMS should capture information and insights about customers and prospects and combine this information with customer intelligence from other systems such as your customer relationship management (CRM) system for a single, comprehensive view of the customer.  
• Email and automation: The web CMS should integrate email campaign management, testing, and optimization to maximize campaign and site performance, drive higher conversion rates, and improve marketing return on investment. Look for marketing automation capabilities that help you eliminate repetitive tasks and streamline your marketing efforts around everything from email campaigns to landing pages, lead scoring, segmentation and profiling, and testing and optimization.  
• Real-time personalization and targeting: With a single view of the customer, your web CMS should be able to automatically sense and adapt to customer behaviour to offer the most relevant content and interactions.  Look for features such as native content profiling to help capture insight into customer needs and interests. 
• Search engine optimization (SEO): The web CMS should integrate SEO with the publishing process so that keyword-rich content and metadata, search-friendly URLs, and other SEO tactics are consistently and automatically implemented.
• Multilingual support and translation: If your organization has or will have international sites, multilingual and translation support should be on your requirements list. The web CMS should natively support content and websites in multiple languages as well as provide content editing tools that “speak” the major global languages your local, in-country marketing teams use. Also look for a web CMS that easily integrates with professional translation services to streamline the process of translating and publishing multilingual content.  
• Social media support: Any web content management system you choose should include a strong social media component, enabling you to easily create branded communities as well as deliver a seamless experience with third-party social networks. The right CMS should make it easy to establish—and maintain—a dialogue with your customers through blogs, forums, polls, and integration with social media sites such as Facebook and Twitter. 
• Mobile device support: Your web CMS should serve up a consistent, compelling experience on virtually any device. Look for a solution that automatically detects the visitor’s device type and optimizes the content for the specific device without having to re-render the site for each variation.
• Multichannel support: Insist on a web CMS that delivers multichannel support and integration including web, mobile, email, and social. The right CMS should enable you to view all your channels as a single experience and a seamless conversation with the customer, letting you orchestrate, monitor, and measure customer interactions across channels. 
• Flexibility to connect with other business applications: Insist on the ability to easily integrate any and all of your line-of-business applications such as customer databases and CRM and ERP systems. Look for prebuilt integration with leading enterprise software packages. You should also look for the ability to connect to databases and web services without complex programming. 
• Adaptive to future experience and site design improvements: Pick a web CMS that allows you to change design and experience elements without IT effort. You’ll want to be able to update page layouts, add pages, and alter designs all without coding. 

eCommerce & Content Management: More Important than Ever

Introduction:

It feels old-fashioned to write the word "e-Commerce,” but the reality is that billions of dollars in business has moved to the Web. While some people may still be shell-shocked by the dot.com fallout, a significant part of business process happens using the Internet as infrastructure. And while the better-known retail e-Commerce ventures (amazon.com, ebay.com) and e-Commerce solution providers are perhaps the biggest players in some people’s minds, they actually make up a small piece of the e-Commerce pie; far more e-Commerce is done between businesses. 

The electronic messages themselves—purchase orders, invoices, and quotes— represent some of the “content” of e-Commerce given by content management system company. Such messages, and the security and transaction apparatus applicable to them, are challenging pieces to the e-Commerce puzzle. The transaction itself, though, is just one step in a lengthy process that begins with a prospective customer researching some kind of requirement, and continues through the marketing and selling process, the transaction itself, follow-on customer support, customer relationship management, and, later, up-selling and cross-selling.

Gilbane Report readers will know the next point to be made, and that is that content is closely tied to all of these processes, and so content management plays a fundamental role in Internet-based commerce. We have worked closely with many large companies that have been automating how content is used in design, manufacturing, sales and marketing, logistics, and customer support. These are areas of intense focus for many companies now, and the platforms and systems to support content management are growing more powerful and more functional all the time.

It is, of course, obvious why content management is fundamental to e-Commerce: Commerce involves intensive communication at all phases of the process, and e-Commerce solution provider requires that much of the communication happen automatically and online. When the products are complex, the content is correspondingly voluminous and complex, increasing the benefits of content management technology.

In fact, the challenge of content management is even more complex. Content management supports all kinds of business processes—research and development, design, manufacturing, marketing and sales, customer support, maintenance, and supplies. There is an important leverage point at the nexus of business processes and the content that supports these processes because of the intimate relationship between content and business process at all points in the buying and selling process, and others have tried to articulate this in various ways. Forrester terms this transactional content, and Gilbane Report colleagues Mary LaPlante and Bill Zoellick have offered a helpful definition:

"Transactional content can be defined as shared information that drives business-to-business processes. It is the content that flows through the commerce chain, initiating and automating processes such as procurement, order management, supply chain planning, and product support. Transactional content is shared in the sense that it is exchanged among partners, suppliers, customers and distributors who each can contribute to it."

Transactional Content Management Challenges:

Because of these constraints, the content management market continues to broaden, and the offerings continue to widen. There are many tiers in the Web content management marketplace:

• Enterprise solutions, examples of which include Vignette, Documentum, Interwoven, and Stellent.
• Mid-level solutions, examples of which include Red Dot and Percussion.
• Small business solutions, examples of which include offerings from Microsoft, Ektron, and others.
• Open source solutions, examples of which cover the wide range of markets.
• Hosted solutions such as those from Atomz and CrownPeak.

Many manufacturing companies are small and mid-sized businesses whose technology needs span both information technology and the process technology for their core business. Because of this, not every small company can develop its own sophisticated Web presence. As a result, industrial search engines such as ThomasNet, GlobalSpec, and Kellysearch have emerged to fill an important market need. 

Conclusion:

The manufacturing marketplace is a large and active marketplace that is driven by e-Commerce solution providers where content management has a vital role to play. However, many manufacturing companies are small- and medium-sized businesses, where IT is only one kind of investment competing for capital. 

Because of these structural constraints, content management is not always the highest priority for these companies, even though they clearly need, at minimum, Web content management to support marketing and sales efforts. Moreover, many of the content management offerings are priced well beyond what these companies would be willing to spend. The enterprise solutions really are only for the biggest organizations, and even companies that sell mid-market content management solutions will tell you that they are selling to the Global 2000. This leaves many companies—indeed, most manufacturing companies—out of the target market for many content management technologies.

Article Summary:

The main driver behind EAI (Enterprise Application Integration) when it emerged in the mid-nineties was the need to integrate content and transactions for e-Commerce. The revolutionary benefits of e-Commerce that were promised assumed that back-office marketing, product data, inventory, and transaction systems were all integrated and kept up-to-date, but the industry’s dirty little secret was that such integration either didn’t exist, or was extremely fragile and unreliable. When e-Commerce actually worked like it was supposed to, it was almost prohibitively expensive.

Web Content Management System - Part 2

Security Concerns And Precautionary Measures:

As we have shown, a WCMS is an application built on top of existing web technology by web development companies. Like other web applications, a WCMS is subject to the same security threats and operation process vulnerabilities as other web applications. In this section, we discuss the common security concerns and ways they can be mitigated.

Security Concerns 

Given that a WCMS is a software application, it is prone to bugs just like any other program. Vulnerabilities have been found in WCMS. As one example, a vulnerability called “absolute path traversal vulnerability” was found in the open source product OpenCms in 2006. This flaw would allow remote authenticated users to download arbitrary files3. 

Another security concern lies with protection of authentication credentials when accessing a WCMS. Many WCMS products are designed primarily to solve the content management problem of websites rather than building a secure product. Some WCMS products do not provide adequate protection for logins and passwords for example, and these passwords— including the administrator password—are sent as plain text over the network.  

Similarly, as part of the publishing/uploading process, a WCMS might use file transfer protocols such as FTP to transfer files from the WCMS data storage server to the web server. FTP is not a secure protocol in the sense that authentication credentials and passwords are sent as plain text over the network. In addition, because publishing is an automatic process from the WCMS to the production web server, FTP credentials might be hard-coded in certain configuration files. Usually a hard-coded login password like this will not be changed regularly. As a result, any leakage of this password could allow someone illegally access to web content on the production web server. 

If the WCMS includes other modules, individual subsystems may have their own bugs and introduce their own vulnerabilities to the WCMS. For example, if the WCMS has an email module, it might be prone to the same common threats faced by email server such as email spoofing. On top of this, the backend database server of the WCMS may have its own vulnerabilities as well.

Precautionary Measures

There are a number of precautionary measures that should be done proactively to mitigate the security threats identified above:

1. Follow best practices by applying the latest security patches to all web server software. Any alerts or warnings about vulnerabilities on the WCMS product being used should be addressed immediately, especially if the WCMS can be accessed directly from the Internet. Any patch management process should also address additional WCMS modules, including email subsystems, backend database servers, JAVA runtime environments, and so on.
2. A strict password policy should be defined. This should include a minimum password length, initial assignments to personnel, restricted words and formats, and a limited password life cycle.
3. Logins and passwords sent over the Internet should be protected by SSL / TLS, so that attackers can’t sniff them over the network. In general, access to administration pages should be further controlled and these should not be open to Internet access.
4. When publishing any web content from the WCMS to the production web server, file transfer programs such as FTP should be replaced by a Secure Shell (or SSH) that protects transmission channels by encrypting data. Some SSH implementations also support a feature that controls which IP addresses are allowed to connect to the destination server. 
5. To enforce data security, many WCMS implementations have built-in access control whereby groups of users are segregated into editor and administrator (approver) roles. These roles and their corresponding access rights should be clearly defined and reviewed periodically. 
6. A good WCMS should keep an audit trail, logging all editing and approval activities. These audit trails should be retained for a period commensurate with their usefulness, and should be secured so they cannot be modified and can only be read by authorized persons.

Conclusion:

While a good WCMS can facilitate businesses to better control their web content developed by web development companies, making it more responsive in today’s dynamic business environment, end-users should also be aware of the possible security impact on the enterprise.

Article Summary:

A Web Content Management System (WCMS) is a web application that facilitates a group of users, usually from different departments in an enterprise, to collaboratively maintain and organize the content of a website in an effective manner. Over the past few years, web content management systems have grown in importance as more and more organizations communicate and publish their information via the web. Like other web based applications, WCMS’s applications are exposed to the same set of common security threats found in any network and web-based operation or process. In this paper, we will outline the common security concerns of WCMS, and provide a number precautionary consideration.

Web Content Management System - Part 1

Web Content Management System:

Since the dot-com boom of the late 1990s, corporate websites have become commonplace for almost any type of company, large or small, across the globe. Almost every enterprise these days needs a website to communicate with customers, partners, shareholders, and so on, providing up-to-date information on the enterprise, its products and services. Increasingly, commercial activities and order transactions are conducted on enterprise websites. These can be developed by web development companies.

The Classic Approach to Web Content Updating:

Building and setting up a website is not a one-time project. Different departments in the enterprise will have areas of content they need to add to and update. Plus, websites have to be maintained and updated on a regular basis due to the dynamic nature of modern business.

In the early days of website maintenance, the task of uploading and updating site content usually fell to the IT department. One method for uploading web content to the server was to use file transfer programs such as FTP (file transfer protocol). Another common approach was to create an upload function within a Web interface allowing different content owners to select appropriate files and upload them via HTTP. Both methods are common, and still used by web hosting companies and small & medium enterprises (SMEs).

Problems With the Classical Approach:

Traditionally, technical staff would have to assist a content editor who needs to update a site by translating the content into a suitable web page format (i.e. HTML) and uploading it to the web server on their behalf. This iterative process often led to delays in publishing, and is obviously not an efficient process given the high mutual dependence required between the content provider and the technician.  

Managing the website updating process is another problems with older approach. Sometimes a web page may consist of several content areas that require input and material from several different enterprise departments. When more than one person is able to update web pages simultaneously, the problem of logging and tracing “who has amended what” and “what the latest version of a page is” becomes serious.  

Web Content Management Evolution:

The Web Content Management Systems (WCMS) that have appeared more recently are designed to tackle these problems, and make it easier to collaboratively update a website which is developed by web development companies. A WCMS is a web application that facilitates a group of collaborative users, usually from different departments across an enterprise, to maintain and organize web content in an effective and manageable way. Web content can include text, images, audio and video. A modern WCMS can also include workflow features so that the creating, storing, and updating of web pages, along with approval sub-procedures, can be streamlined.  In addition, features such as versioning, check-in/check-out auditing, and so on are useful for managing and tracking the updating of web pages.

Impact And Business Trends With WCMS:

Commercial WCMS products have the following benefits:

1. Quicker response times: making new web content such as marketing materials available on the web is much quicker because content owners can update materials to a website directly, without the need to assign such tasks to technical personnel;
2. More efficient workflows: requests for changes and updates to a site are simplified under a WCMS framework. Users across different departments can add and apply changes to web content with a pre-defined and agreed upon workflow process.
3. Improved security: under a WCMS framework, content is only published after approval by designated supervisors or managers. This reduces the chance of publishing material by mistake, which is usually due to human error. In addition, most WCMS systems provide audit trails of publishing activities all of which help maintain accountability;
4. Other benefits include improved version tracking, integration with translation servers, and consistency of page presentation through the use of common page layouts and controlled templates.

Web content management has grown in importance over the past few years, and commercial as well as open source WCMS products are now available on the market.

The Common Components Of WCMS:

Many WCMS are programmed in languages such as Java and PHP by web development companies, and run on a web server. In addition to the web server, WCMS may also contain additional components such as workflow engines, search engines, and email integration modules.  

Web content and data is normally stored in data repositories or databases such as MySQL (open source) or Oracle (commercial). This could include text and graphic material to be published. Older versions of web pages from a particular site under management may also be stored in the database. 

Generally, draft web pages are not uploaded directly to the production web server. Instead, users keep copies of draft pages offline until they are approved for publication. Then, once approved and signed-off, a file transfer program runs automatically, uploading and linking in the final pages on the production web server. 

A WCMS is essentially a web application supported by a backend database, with other features such as search engine, and perhaps integration with a translation engine. The general security threats applicable to web applications, such as cross-site scripting, injection flaws and/or malicious file execution, can all be applied to a WCMS.  

For the purposes of accountability, users normally need to be authenticated before they can access the WCMS. In some situations, users authenticate via an intermediate server called a reverse proxy server, instead of connecting directly to the WCMS server. In addition, content duties are segregated by dividing users into two groups—content editors and content administrators—where only content administrators have final publishing authority. The role of technical personnel would be in building web page templates and maintaining the consistency of web page layouts and a common look-and-feel.

Generally, data and content sent to a web server is considered public information. If it is necessary to store sensitive information on WCMS servers, appropriate data encryption and authentication measures should be put in place.

Use of personal safety equipment and facilities at work

It is evident that work related hazards and risks needs to be identified in order to establish the necessary precautionary measures. A risk assessment could prove to be a valuable tool in this regard. It could basically be described as a careful examination of what, related to the work activities of an organization like application development company, could course harm to people or damage to property.

The regulation also stipulates that where it is not practicable to safeguard the condition or situation, the employer or user of machinery, shall take steps to reduce the risk as much as is practicable.

Please note that the main aim should be to firstly remove or secondly mitigating the risk associated with the exposure to a particular hazard. If the hazard or risk cannot be removed, the next potion would be to apply appropriate steps or measures to mitigate it.

PPE should be used when it has been determined that its use will lessen the likelihood of occupational injury and/or illness and when other protection methods are not available.

PPE is used to reduce or minimize the exposure or contact to injurious physical, chemical, ergonomic, or biological agents. PPE basically creates a barrier against workplace hazards in software development companies.

A hazard cannot be eliminated by PPE, but the risk of injury can be reduced. For example, wearing hearing protection reduces the likelihood of hearing damage when the ear plugs or muffs are appropriate for the kind of noise exposure and they are used properly. However, hearing protection does not eliminate the noise.

Engineering controls, administrative controls, and good work practices are always preferred instead of personal protective equipment (PPE) as methods to protect workers against workplace hazards. PPE must always be regarded as a ‘‘last resort’’ to protect against risks to safety and health.

There are a number of reasons why PPE must be considered as a ‘‘last resort’’:

• PPE only protects the person wearing it, whereas measures controlling the risk at source protect everyone in the workplace.
• Theoretical maximum levels of protection are difficult to achieve and the actual level of protection is difficult to assess. Effective protection is only achieved by selecting suitable PPE and if it is correctly fitted, maintained and used.
• PPE may restrict the wearer to some extent by limiting mobility or visibility, or by requiring additional weight to be carried, thus creating additional risk.

Information and training could for example include:

• the level of risk(s) involved
• the reason why the PPE is needed (the potential risks to health and safety caused by exposure)
• precautions to be taken by the employees of software development companies to protect themselves against the health risks associated with the exposure, including the wearing and use
• potential sources of exposure
• the content and scope of applicable regulations
• the operation (including demonstration), performance and limitations of the equipment
• correct use (how to fit and wear PPE, how to adjust it for maximum protection and storage)
• correct storage
• any testing or medical surveillance requirements before use
• any user maintenance that can be carried out (e.g. hygiene/cleaning procedures)
• factors that can affect the performance of the equipment (e.g. how to care for it, working conditions, personal factors, defects and damage)
• how to recognize defects in PPE, and arrangements for reporting them
• where to obtain new PPE if it needs to be replaced

PPE must be properly maintained in custom software development companies, it is important to make sure the equipment continues to provide the degree of protection for which it is designed. Maintenance should include inspection, care, cleaning, repair, and proper storage. Manufacturer’s instructions (including recommended replacement periods and shelf life) could prove to be valuable in this regard.

Security Policy Development Process

Introduction:

A security policy should be concise and easy to understand so that everyone can follow the guidance set forth in it. In its basic form, a security policy is a document that describes an organization’s security requirements. A security policy specifies what should be done, not how; nor does it specify technologies or specific solutions. The security policy of application development companies defines a specific set of intentions and conditions that will help protect an organization’s assets and its ability to conduct business. It is important to plan an approach to policy development that is consistent, repeatable, and straightforward.

A top-down approach to security policy development provides the security practitioner with a roadmap for successful, consistent policy production. The policy developer must take the time to understand the organization’s regulatory landscape, business objectives, and risk management concerns, including the corporation’s general policy statements. As a precursor to policy development, a requirements mapping effort may be required in order to incorporate industry-specific regulation. Chapter 3 covered several of the various regulations as well as best practice frameworks that security policy developers may need to incorporate into their policies.

A security policy lays down specific expectations for management, technical staff, and employees. A clear and well-documented security policy will determine what action an application development company takes when a security violation is encountered. In the absence of clear policy, organizations put themselves at risk and often flounder in responding to a violation.

• For Managers, a security policy identifies the expectations of senior management about roles, responsibilities, and actions that should be taken by management with regard to security controls.
• For Technical Staff, a security policy clarifies which security controls should be used on the network, in the physical facilities, and on computer systems.
• For All Employees, a security policy describes how they should conduct themselves when using the computer systems, e-mail, phones, and voice mail.

A security policy is effectively a contract between the business and the users of its information systems. A common approach to ensuring that all parties are aware of the organization’s security policy is to require employees to sign an acknowledgement document. Human Resources should keep a copy of the security policy documentation on file in a place where every employee can easily find it.

Security Policy Development:

When developing a security policy of software development companies for the first time, one useful approach is to focus on the why, who, where, and what during the policy development process:

1. Why should the policy address these particular concerns? (Purpose)
2. Who should the policy address? (Responsibilities)
3. Where the policy should be applied? (Scope)
4. What should the policy contain? (Content)

Phased Approach If you approach security policy development in the following phases, the work will be more manageable:

1. Requirements gathering

• Regulatory requirements (industry specific)
• Advisory requirements (best practices)
• Informative requirements (organization specific)

     2.  Project definition and proposal based on requirements

     3.  Policy development

     4.  Review and approval

     5.  Publication and distribution

     6.  Ongoing maintenance (and revision)

After the security policy is approved, standards and procedures must be developed in order to ensure a smooth implementation. This will require the policy developer in software development companies to work closely with the technical staff to develop standards and procedures relating to computers, applications, and networks.

Article Summary:

A security policy is the essential foundation for an effective and comprehensive security program. A good security policy should be a high-level, brief, formalized statement of the security practices that management expects employees and other stakeholders to follow.

Information Security Professionals : Roles and Responsibilities

Introduction:

The senior technology officer is typically the Chief Information Officer (CIO), although other positions like vice president of information, VP of information technology, and VP of systems may be used. The CIO is mainly responsible for advising the chief executive officer, president, or company owner on the strategic planning that affects the management of information in the organization like software development company. The CIO transcribes the strategic plans of the organization as a whole into strategic information strategy for the information systems or data processing division of the organization. Once this is accomplished, CIOs work with junior managers to develop tactical and operational plans for the different department and to enable planning and management of the systems that support the organization.

The Chief Information Security Officer (CISO) has primary responsibility for the assessment, management, and implementation of information security in the organization. The CISO may also be referred to as the manager for IT security, the security administrator, or a similar title. The CISO usually reports directly to the CIO, although in larger organizations like software development companies in India it is not uncommon for one or more layers of management to exist between the two. However, the recommendations of the CISO to the CIO must be given equal, if not greater, priority than other technology and information-related proposals. The placement of the CISO and supporting security staff in organizational hierarchies is the subject of current debate across the industry.

Information Security Project Team:

The information security project team should consist of a number of individuals who are experienced in one or multiple facets of the required technical and nontechnical areas. Many of the same skills needed to manage and implement security are also needed to design it. Members of the security project team fill the following roles:

• Champion: A senior executive who promotes the project and ensures its support, both financially and administratively, at the highest levels of the organization.
• Team Leader: A project manager, who may be a departmental line manager or staff unit manager, who understands project management, personnel management, and information security technical requirements.
• Security Policy Developers: People who understand the organizational culture, existing policies, and requirements for developing and implementing successful policies.
• Risk Assessment Specialists: People who understand financial risk assessment techniques, the value of organizational assets, and the security methods to be used.
• Security Professionals: Dedicated, trained, and well-educated specialists in all aspects of information security from both a technical and nontechnical standpoint.
• Systems Administrators: People with the primary responsibility for administering the systems that house the information used by the organization.
• End Users: Those whom the new system will most directly affect. Ideally, a selection of users from various departments, levels, and degrees of technical knowledge assist the team in focusing on the application of realistic controls applied in ways that do not disrupt the essential business activities they seek to safeguard.

Data Responsibilities:

The three types of data ownership and their respective responsibilities in organizations like web development companies in India are outlined below:

1. Data Owners: Those responsible for the security and use of a particular set of information. They are usually members of senior management and could be CIOs. The data owners usually determine the level of data classification (discussed later), as well as the changes to that classification required by organizational change. The data owners work with subordinate managers to oversee the day-to-day administration of the data.
2. Data Custodians: Working directly with data owners, data custodians are responsible for the storage, maintenance, and protection of the information. Depending on the size of the organization, this may be a dedicated position, such as the CISO, or it may be an additional responsibility of a systems administrator or other technology manager. The duties of a data custodian often include overseeing data storage and backups, implementing the specific procedures and policies laid out in the security policies and plans, and reporting to the data owner. 
3. Data Users: End users who work with the information to perform their assigned roles supporting the mission of the organization. Everyone in the organization is responsible for the security of data, so data users are included here as individuals with an information security role.

Conclusion:

AS Information Security is best initiated from the top down. Senior management is the key component and the vital force for a successful implementation of an information security program. But administrative support is also essential to developing and executing specific security policies and procedures, and technical expertise is of course essential to implementing the details of the information security program in organizations like application development companies.

Article Summary:

Information security is best initiated from the top down. Security Professionals and the Organization like software development companies It takes a wide range of professionals to support a diverse information security program. These article describes the typical information security responsibilities of various professional roles in an organization.

Internal Control Framework - Part 2

Components and Principles:

The Framework sets out seventeen principles representing the fundamental concepts associated with each component. Because these principles are drawn directly from the components, an entity can achieve effective internal control by applying all principles. All principles apply to operations, reporting, and compliance objectives of software companies in India. The principles supporting the components of internal control are listed below:

Control Environment

1.  Board Oversight: An executive board structure exists that demonstrates independence from management and exercises oversight for the development and performance of internal control
2. Integrity and Ethical Values:  Standards of ethical behaviour exist and processes are in place to encourage staff to fulfil their duties with integrity.
3. Structure, Authorities and Responsibilities: An organizational structure, including reporting relationships and assignment of responsibility and delegation of authorities, is defined and clearly communicated and the related policies are established in support of the Organization’s objectives.   
4. Human Resources Policies and Practices: Policies and procedures are in place to attract, develop and retain talents in support of the Organization’s objectives including policies and practices for managing performance.     
5. Accountability:   Policies and procedures are in place to hold individuals accountable for their internal control responsibilities, including delegation of authority. 
6. Strategic Direction:  The strategic direction and priorities of the Organization are established and form the basis for the development of assessing risks and operational effectiveness.

Risk Assessment

1. Specifying Objectives: Objectives are specified with sufficient clarity to enable the   identification and assessment of risks relating to objectives.
2. Risk Identification: Risks to the achievement of objectives across the Organization are identified and analysed as a basis for determining how they should be managed, whether to accept, avoid, reduce, or share the risk.   
3. Risk Assessment: The risks to the achievement of its objectives are assessed, including the potential for fraud or other misconduct or breach of rules.  
4. Risk Response: Once the potential significance of the risk has been assessed management considers how the risk should be managed. 

Control Activities

1. Selection and Development of Control Activities: Control activities that contribute to the management of risks to acceptable levels are selected and developed taking into consideration the operational environment.
2. General Control Activities over Technology: General control activities using information technology are selected, developed or assessed to support the achievement of the Organization’s objectives.
3. Policies and Procedures: Control activities include the development and use of policies that establish what is expected or required, and procedures that put the policies into action.  They are built into business processes and day-to-day activities. Compliance and the consequences of non-compliance are also contained within each policies and/or procedure. 

Information and Communication 

1. Information and Reporting: Relevant and quality information is obtained or generated to support the functioning of internal controls, decision making and oversight.  
2. Internal Communication: An efficient and effective system of internal communication exists to ensure that individual staff members have the information they require to carry out their duties, and to support the functioning of internal control.    
3. External Communication: An efficient and effective system of external communication exists to ensure 1) necessary externally-sourced information is received; and 2) that external stakeholders, such as contributors, NGOs, Member States, governing bodies, donors and technical partners are provided with necessary relevant and quality information in response to requirements and expectations.    

Monitoring Activities

1. On-going or Separate Monitoring: On-going and/or separate reviews are selected, developed and performed to ascertain that each of the components of internal control that are built into the business process are functioning effectively.  
2. Reporting Internal Control Deficiencies: Deficiencies in the operation of internal control are systematically evaluated and reported to those parties responsible for taking corrective action.  Appropriate corrective action is taken in a timely manner to address the reported deficiencies. 

Roles and Responsibilities:

Everyone in an organization has responsibility for internal control.

Management:

The chief executive officer is ultimately responsible and should assume "ownership" of the system. More than any other individual, the chief executive sets the "tone at the top" that affects integrity and ethics and other factors of a positive control environment. In a large company, the chief executive fulfils this duty by providing leadership and direction to senior managers of software companies in India and reviewing the way they're controlling the business. Senior managers, in turn, assign responsibility for establishment of more specific internal control policies and procedures to personnel responsible for the unit's functions. In a smaller entity, the influence of the chief executive, often an owner-manager, is usually more direct. In any event, in a cascading responsibility, a manager is effectively a chief executive of his or her sphere of responsibility. Of particular significance are financial officers and their staffs, whose control activities cut across, as well as up and down, the operating and other units of an enterprise.

Board of Directors:

Management is accountable to the board of directors, which provides governance, guidance and oversight. Effective board members are objective, capable and inquisitive. They also have a knowledge of the entity's activities and environment, and commit the time necessary to fulfil their board responsibilities. Management may be in a position to override controls and ignore or stifle communications from subordinates, enabling a dishonest management which intentionally misrepresents results to cover its tracks. A strong, active board, particularly when coupled with effective upward communications channels and capable financial, legal and internal audit functions, is often best able to identify and correct such a problem.

Internal Auditors:

Internal auditors play an important role in evaluating the effectiveness of control systems, and contribute to ongoing effectiveness. Because of organizational position and authority in an entity, an internal audit function often plays a significant monitoring role.

Other Personnel:

Internal control is, to some degree, the responsibility of everyone in soft and therefore should be an explicit or implicit part of everyone's job description. Virtually all employees produce information used in the internal control system or take other actions needed to effect control. Also, all personnel should be responsible for communicating upward problems in operations, noncompliance with the code of conduct, or other policy violations or illegal actions.

Conclusion:

This article helps to understand the direct relationship between objectives, which are what an entity strives to achieve, components, which represent what is required to achieve the objectives, and the organizational structure of the entity (the operating units, legal entities, and other). Here, the five components are also evaluated through principles and recommended points of focus. The article further highlights on the roles and responsibilities of the interested parties using internal control-integrated framework and which also focuses on internal governance and limitations of internal control framework.

Article Summary:

These article gives brief introduction about Internal Control—Integrated Framework that helps entities to achieve their goals and objectives and, to sustain and improve the performance at operational level by changing business and operating environments, mitigating risks to acceptable levels, and supporting sound decision making at higher level.