MMT 2 Task 3.docx - MMT2 Task 3 1 Evaluation of Security...

MMT2 Task 3 1
Evaluation of Security Policies
Western Governors University
Evaluate Effectiveness of Policies in Regards to Ethics

MMT2 Task 3 2
At its most basic definition, a security policy is a policy that defines the methods and/or
processes a person, system or organization takes to ensure its own security. Security policies
attempt to regulate decisions and actions of internal employees and external users whom have
access to a company’s resources. An effective security policy should be easily understood,
readily available and detailed enough as to leave no reasonable question unanswered. The
Employer Security Policy addresses the constraints placed on the behaviors of its employees,
guests and business partners which include the use of passwords, swipe cards and restricting
access to areas of the facility based on a predefined “need to know” basis. These controls serve
as an active deterrent for individuals that may think of engaging in unethical behavior. The Data
Security Policy addresses the privacy of employees and clients and aims to secure their data from
security breaches. It addresses the use of company email, access to databases as well as paper
copy information such as company memos. This policy includes a signed employee
acknowledgement, which is a plus and something that the other two policies discussed here lack.
The Accounting Security Policy addresses the practice of data collection by the company. The
policy states that one reason for this practice is to conduct trend analysis, which are shared with
appropriate management staff to confirm acceptable use. This policy does a good job of
explaining why data collection is required but does not address the consequences of unethical use
of the data collected. AEnergy’s security policies address many areas that cover ethical use of
the company’s resources but none of the policies address unethical behavior specifically. The
Data Security Policy and Accounting Security Policy would be strengthened by adding a non-
disclosure agreement for guests and external business partners such as vendors and clients. The
Accounting Security Policy and Data Security Policy would be strengthened by addressing the
issue of unauthorized use of Personally Identifiable Information (PII) by staff members.

MMT2 Task 3 3
Potential unethical uses of company technology and/or data by internal users
1. The Employer Security Policy encourages employees to mark personal emails sent from
company accounts as “personal”. Since email can be monitored at any time, the intent of
this suggestion is to insure that emails marked as “personal” are not monitored.
However, this practice could lead to the opposite of what is intended and lead to unethical
monitoring. An email marked “personal” would stand out from the rest and make it an
easy target for monitoring by an unethical member of the staff. On the opposite end of
the spectrum, if a person were engaging in unethical business practices such as stealing or