SECURITY MANAGEMENT PRACTICES

The current study will discuss two instances of user experiences with online banking as an example for discussion. Due to a strong need for security, online banking has increased security measures to include an access code, password, and several additional security questions required for access. Users of these online banking systems setup their account to access bank statements and conduct other banking activities. Two users discussed their experience with online banking giving insight into the level of security required to gain access. Person A discussed their experiences with online banking. When setting up their account, person A had created a username, password, was assigned an access number and answered several security questions. The next day, person A attempted to access their account but was unable to remember their access number. Person A then called the bank to request information in order to gain access into their account. Due to person As inability to remember all the information needed to access their account, person A wrote their login information on a piece of paper that was stored in a desk drawer. This action created a fatal security risk despite the efforts of the bank to secure their users information. Due to many layers of security and various information required to gain access, many other users are likely to perform the same actions as person A causing risk to their information security. A second instance of eBanking security was discussed by a user we shall identify as person B. Person B also was unable to remember their password after entering all of their information. After being unable to access their information, person B contacted the banks help desk using the information provided on the website. Later that day, person B received an email from the bank stating that they are unable to access password information due to encryption and bank security policies. Instead, the bank representative informed person B that his password was reset to the default password. The bank representative sent user B his default password and bank access number via an unencrypted email. While this allowed person B to gain access to his account, the bank representative also allowed for the possibility of a hacker to intercept that email and access person Bs account.

(Question)

1. Consider the bank develop a performance measurement program, discuss all phases involved in the program. (14 marks)