ITC596-IT Risk Management

Regional Gardens Case Study

Regional Gardens Ltd is a company that runs a number of related gardening enterprises. It has a large display garden that it opens for public inspection a number of times a year. The company also owns the Regional Gardens Nursery which sells plants and garden supplies to the public. The company also owns Regional Garden Planners, which is a small company that provides garden advice, design and consultancy services.

The company has a small data centre at its main site in Bathurst where the company’s servers and data storage is located.

The company has some 65 staff, who include management, administrative staff, nursery and Regional Garden Planners staff. The company has a range of different types of relatively old personal computers, which run mainly run Windows 7 Enterprise, to connect to the company data centre. The company also has 3 MacBook laptops running OS X.

The company does not have a clear patching and update policy. As a result most servers and desktop machine are patched on an ad-hoc basis and as time, and operations, permit.

The company has a small number of systems administration staff that are responsible for the management of the server infrastructure. But effective administration is somewhat hampered by the fact that the administrative passwords are generally well-known across the company. Company employees enjoy free, open, unrestricted access to the Internet, but realistically they only need to access certain websites on the Internet. Company management would like there to minimise the cost of accessing web resources.

Tasks:

You have been employed by Regional Gardens as their first ever Chief Information Officer (CIO). You have been tasked by the Board to conduct a review of the company’s risks and start to deploy security policies to protect their data and resources.

1.Write a policy to preserve the integrity of Regional Garden’s data. In your policy you must: 

a.Define the intent and rationale of the policy,

b.Define the scope of the policy i.e. who and what it effects,

c.Define the responsibilities of individuals affected by the policy, including those responsible for enforcing the policy, as well as those who are affected by the policy, 

d.Include the mandatory requirements for the rules or actions that you think are reasonable to place into this policy to meet its intent and rationale,

e.Include any exemptions that you think are reasonable to place into this policy to meet its intent and rationale,

f.Define any terms which are used throughout the policy in a Glossary.