Reflection Task: Security in Practice in Your Organisation

Estimated time: 30 to 45 minutes | To complete before Week 5

Part One: Personal Reflection

This week has moved from the theoretical and analytical to the operational and practical. Before moving to Week 5, take time to reflect honestly on the following:

• Does your organisation have an incident response plan? Have you read it? Do you know what your role would be if a security incident occurred in your team tomorrow? If you do not know the answers to these questions, what will you do to find out?
• This week introduced the concept of tabletop exercises as one of the most effective ways to test incident response readiness. Has your organisation ever conducted a tabletop exercise? If so, what was your experience of it? If not, what would it take to advocate for one?
• Thinking about the cloud and mobile security considerations discussed in Step 4, how confident are you in your understanding of what cloud services your team uses and what security responsibilities your organisation retains for those services? Are there gaps in your knowledge that you should address?
• The Optus case study illustrated the reputational and regulatory consequences of inadequate crisis communication. In your own organisation, is there a communication plan for a major security incident? Do you know what you would say, to whom and when if an incident occurred in your team?

Part Two: Operational Security Review

Carry out a brief, structured review of the operational security environment in your team. Focus specifically on the areas addressed in this week’s learning:

• Incident reporting: ask two or three members of your team, informally, what they would do if they received a suspicious email or noticed that a system was behaving unexpectedly. Record the consistency and accuracy of their responses. Does everyone give the same answer? Do their answers align with what your organisation’s procedures actually specify?
• Cloud and remote working practices: identify the cloud services your team uses. For each one, consider: who has administrative access? Is access removed promptly when someone leaves? Is multi-factor authentication enabled? Is any sensitive data stored in a cloud service that has not been formally approved by the IT or security function?
• Device and access hygiene: consider how many members of your team access work systems from personal devices. Is there clear guidance from your organisation on what is permitted and what security measures are required on personal devices used for work purposes? If not, where would you go to find out?
• Former employee access: do you know how access is managed when a team member leaves? Is there a process for promptly removing access to all relevant systems, and do you have confidence that this process is followed consistently?

Part Three: One Advocacy Action

Based on your reflection and operational review, identify one security improvement that you are in a position to advocate for in your organisation. This might be advocating for a tabletop exercise, raising a concern about cloud service governance, requesting clarity on mobile device security requirements, or proposing an improvement to the offboarding process.

Note down the improvement you plan to advocate for, who you need to engage to progress it, and what outcome you are seeking. Bring this to the Week 5 discussion, along with an update on the one conversation you committed to in Week 3 and any actions you have taken following your threat and vulnerability mapping exercise.