Milestone 2: Organizational Policies

Introduction

For Milestone 2, we will focus on the development of security policies. To prepare for this Milestone, begin by reviewing the following resources:

  1. Coastal Carolina University - Office of Information Technology Services - Information Security
  2. IBM. What is the NIST Cybersecurity Framework?
  3. NIST Special Publication 3101: NIST Cybersecurity Framework 2.0: Quick-Start Guide for Creating and Using Organizational Profiles
  4. NIST Special Publication 1299: NIST Cybersecurity Framework 2.0: Resource & Overview Guide

Requirements

Your team will conduct research and prepare a written milestone report that covers the following topics:

  1. Provide an overview of the NIST Cybersecurity Framework. Explain the purpose, the resources available, the focus/audience, and the various parts of the framework. Be sure to include the six functions of the CSF 2.0.
  2. Summarize CCU's information security policies.
  3. Compare the SC Division of Information Security policies (below) with the NIST standards. In what ways are the policies harmonious with the NIST standards, and in what ways do they conflict?
  4. Specifically evaluate the conflicts between the NIST SP800-63B-4 Authentication & Authenticator Management guidelines (section 3.1) and the password change policies utilized by the State of South Carolina and Coastal Carolina University. Refer to the SCDIS Information Security Policy - Access Control (section 1.6) policy and to the passwords section on the Student Computing Services - Information Security Awareness page.
  5. Consider the State of South Carolina's Mobile Security Policy and the Coastal Carolina University Multi-Factor Authentication policy. A CCU employee (who is also, by definition, a state employee) might be asked to install an authenticator application on a personal cell phone in order to use MFA. If an employee doesn't have a smartphone, the employee could install and use an authenticator application on someone else's phone instead. How does CCU's implementation of MFA align with or conflict with the State of South Carolina's Mobile Security Policy?
  6. Make recommendations to harmonize CCU's information security policies with the relevant NIST guidelines. Identify situations in which harmonization with the NIST guidelines would conflict with SCDIS policies.

Organization

  1. A title page that includes the report title and the names of all team members, with the team leader for this milestone listed first and indicated as such (for example, John Smith (Team Leader)).
  2. A brief introduction section that provides an overview of your work.
  3. One or more sections of narrative text that covers the above list of topics.
  4. A brief conclusion section that summarizes major points.
  5. A References section that lists all references cited. Please remember that there should be at least 1 inline citation for each work listed in the References section!
  6. A final page detailing the contributions of each team member (including the leader) to the final report. Contributions should be listed as bullet points under each person's name.

Formatting

The paper should be formatted as follows:

  1. Use a 12 point font.
  2. Double-space the text.
  3. Use 1 inch margins with a standard US letter (8.5 x 11 inch) page size.
  4. For the title and section headings, use the formatting tools provided in your word processing software to select "title" or "heading" format. Do NOT manually change the font size or font style/weight to make a heading or title. Using the word processing software’s defined styles for headings and titles helps make the resulting PDF file more accessible to people with disabilities.

The length of the middle part of the paper, excluding the title page, references, and contributions pages, should be:

References

For your references:

  1. Try to cite at least 1 article published in an academic journal or conference proceedings.
  2. Do NOT cite Wikipedia articles directly. Instead, look up the references in the Wikipedia articles and cite those references.
  3. You MAY cite any of the works (including mine) that I provide in the Starting Points section, below.
  4. You may use ANY citation format you prefer, as long as each cited reference has some kind of inline citation and each reference listed at the end contains enough information to find the original source. Popular citation formats include APA, IEEE, ACM, Springer Lecture Notes in Computer Science, etc. MLA and Turabian (University of Chicago Style) are also acceptable, although they aren’t as widely used in the computing disciplines. The important things with citation styles are to be consistent and to ensure that each source listed in the References section has at least one inline citation somewhere in the text.
  5. If you use Artificial Intelligence (AI) tools as part of your research, cite the AI tools used. These citations are in addition to the required number of references for the paper.
  6. If you use AI tools to assist with the writing, include additional references for the AI tool(s) used. You can simply include a sentence at the end of the paper stating which AI tools were used and include inline citations to those tools. Note that AI tool citations are in addition to the minimum number of required references.

The minimum number of required references (exclusive of AI tools) is:

IMPORTANT: If you use AI tools to facilitate your work, please remember that you (the humans) are ultimately responsible for the content of the paper. Verify the output of all AI algorithms!

Team Leader

One person should be designated as the team leader for this milestone. Team leaders must rotate between milestones so that each person serves as team leader at least one time. It is up to each team to determine who will serve as leader for each individual milestone.

In general, the Team Leader should NOT be doing most of the research for the milestone. Instead, the team leader should:

  1. Manage the team, ensuring that everyone is communicating and is on track. Report any issues to the professor immediately. Convey any questions or requests for clarification to the professor in a timely manner.
  2. Compile and join the narrative text written by the team members, ensuring that it flows together in a single document.
  3. Write the introduction and conclusion sections.
  4. Combine the references found by the other team members and format them into the chosen reference style in the References section. (Again, any citation style as fine – just be consistent.)
  5. Ensure that each reference in the References section has at least one inline citation elsewhere in the paper.
  6. Check that all inline citations are using the same format (it doesn’t matter which format, as long as they are consistent).
  7. Proofread the paper and fix spelling and grammar issues.
  8. Export the completed report into PDF format.
  9. Share the completed document with the team and communicate to be sure no additional changes are needed.
  10. Submit the final PDF document before the milestone submission closes. Note that I have set Moodle to allow updating your submission, so you can share the document by submitting it. Each team member should be able to download the submission to complete the previous step. If changes are needed, simply resubmit an updated PDF.

Other Team Members

Non-leader team members should:

  1. Conduct the research to obtain the required number of sources.
  2. Write a substantial portion of the narrative section of the paper, citing the sources found.
  3. Communicate with each other and with the team leader to ensure that the work is completed in a timely manner. Remember that the team leader needs time to compile the final document.
  4. Record and document individual contributions to the team effort.
  5. Read the final report before the assignment submission closes.
  6. Verify that the milestone report has been submitted.

I have based the length requirements for the paper on the assumption of 7 pages of writing and 5 sources per regular team member, plus a half-page introduction and a half-page conclusion written by the Team Leader. That said, teams are free to divide the workload differently, as long as each person is making a substantial and roughly equal contribution according to the above guidelines.

Starting Points

The following resources (which you may cite in your paper) can help you get started on this Milestone:

Submission

Once the report is complete, the Team Leader should export it into PDF format and upload it as the submission for this milestone. Only the Team Leader needs to submit the final report, although another team member can submit in the event of an emergency involving the Team Leader. That said, everyone in the team should read the final report and double-check that their individual contributions are listed correctly at the end. Also, each team member should verify that the Team Leader has uploaded the final PDF before the assignment closing date in Moodle.

ABET Assessment

This activity supports the following ABET program SLOs: