Student Name Security

Student Name

Qualification Pearson BTEC Higher National Diploma In Computing

Academic Year 2025-2026

Unit Number and Name Unit 5: Security

Unit Lecturer Ms. Rizwana Zulfiqar

Assignment Title Managing Network Security for an Organisation

Type of Assignment Business Report

Issue Date 03/11/2025

Submission Date 19/12/2025

1
Student Name Security

TABLE OF CONTENT
Discussing types of security risks to organisations 3
Assessing organisational security procedures 8
Analysing the benefits of implementing network monitoring systems 14
Discussing the potential impact to IT security of incorrect configuration of firewall 16
policies and third- party VPNs
Discussing how implementing a DMZ, static IP and NAT improves network security using 19
an example for each.
Proposing a Method to Assess and Treat IT Security Risks 23
Evaluation of Physical and Virtual Security Measures to Keep IT Secure Physical Security 26
Measures
Reviewing risk assessment procedures in an organization. 30
Data Protection Processes and Regulations Applicable to Wargrave College 32
Summary of an Appropriate Risk Management Standard and Its Application in IT Security 35
Analysis of the Potential Consequences for Organisational Security Arising from an IT 36
Security
Recommending how IT security can be aligned with an organizational policy, detailing the 38
security impact of any misalignment.
Designing a suitable security policy for the organisation, including the main components 40
of the organisational disaster recovery plan.
Roles of Stakeholders in Implementing Security Audits at Wargrave College 48
Justifying the security plan developed giving reasons for the elements selected. 50
Evaluation of the Suitability of Tools Used in the Organizational Policy 52

As a Junior Network Security Specialist at Phaeton Security Solutions (PSS), I have been
assigned to investigate a severe cybersecurity incident that occurred at Wargrave College, part of
the Dowding Federation of sixth-form colleges. The college recently suffered a catastrophic
ransomware attack, which resulted in the complete loss of all data, including personal, academic,
2
Student Name Security

and operational information. From my assessment, the root causes included outdated Windows
8.1 systems, weak backup procedures, unsecured servers, and the use of freeware VPN software.
My current objective is to identify and evaluate the security risks that contributed to the breach,
in order to design a robust, ISO-compliant security framework and policy that can prevent future
incidents while supporting normal college operations.

Discussing types of security risks to organisations

Ransomware Attacks
One of the most critical risks for Wargrave College is ransomware, a malicious program that
encrypts files and demands payment to restore access. In this case, the ransomware was triggered
when a teacher downloaded a malicious file from a compromised website while off the college
VPN. Once connected to the network, the malware spread
quickly across unprotected servers and backup drives,
leading to total data loss (Jnguyen, 2023).

As I analyzed the situation, I found that poor patch

management and a lack of network segmentation allowed
the infection to spread unchecked. This incident
highlights how a single endpoint compromise can
paralyze an entire organization and emphasizes the need
for multi-layered defense, endpoint protection, and offline backups.

Phishing and Email-Based Threats

A significant threat comes from phishing, where cybercriminals send misleading emails or
messages that persuade users to disclose their credentials or install malicious attachments.
Wargrave College is heavily dependent on email communication among teachers, students, and
staff, making it a particularly attractive target for
these types of attacks. It is very likely that the
ransomware incident started from a phishing
scheme.

Many staff members lack training in identifying

suspicious emails, and the current email filtering
3
Student Name Security

and security awareness initiatives are insufficient. As a network security expert, I understand that
effectively preventing phishing involves both technical measures (like spam filters and link
scanning) and ongoing training for staff to cultivate a culture of security awareness.

Malware and Viruses

In addition to ransomware, the college faces a variety of malware threats, such as trojans, worms,
and spyware. These risks have the potential to infiltrate systems, compromise confidential data,
and reduce network performance. Since Wargrave continues to operate on outdated systems like
Windows 8.1, the vulnerabilities
present in these software versions
provide easy access points for
malware. (What Is Malware? |
Examples & Prevention Tips, n.d.)

During my evaluation, I noted the

lack of enterprise-level antivirus solutions and centralized monitoring. This situation suggests that
malware could remain undetected for prolonged periods. To rectify this, I recommend
implementing automated patch management, endpoint detection and response (EDR), and a
centralized security information and event management (SIEM) system to swiftly identify and
contain future infections.

Data Loss and Weak Backup Practices

Data loss poses a significant risk that has already impacted Wargrave College severely. At
present, the college conducts weekly backups to a single NAS drive, which is situated within the
same network environment as the production servers. This method creates a single point of
failure, when the ransomware struck, it encrypted the
NAS, rendering all backups ineffective (Chhabra,
2025).

Consequently, this led to total and irretrievable data

loss. In my role, I need to ensure that future backup
strategies adhere to the 3-2-1 rule: maintaining three
copies of data on two different types of media, with

4
Student Name Security

one kept offsite or in the cloud. Establishing automated daily backups, offline storage, and
recovery testing would significantly mitigate this risk going forward.

Unpatched and Outdated Systems

(Medium, 2024)

Another serious issue I discovered was the continued use of Windows 8.1 systems, which are no
longer supported by Microsoft. These outdated machines lack critical security updates and are
vulnerable to known exploits. Attackers can easily use publicly available tools to exploit
unpatched vulnerabilities and gain unauthorized access.

As part of my assessment, I would recommend a comprehensive patch management policy,

ensuring that all systems are updated regularly, and legacy hardware or software is phased out.
Upgrading to Windows 11 with enterprise-grade security features would be a key step toward
compliance with ISO/IEC 27001 standards.

Weak Access Controls and Password Policies

5
Student Name Security

(Sucuri, 2024)
Poor access control is another area of concern. Many staff members share accounts or have
unnecessary administrative privileges, which increases the risk of accidental or malicious misuse.
Additionally, there is no enforcement of Multi-Factor Authentication (MFA) for VPN or email
access. If an attacker obtains credentials through phishing, they can easily log in without being
detected. I would introduce role-based access control (RBAC) and MFA for all staff and
administrators, ensuring that users only have access to the systems they genuinely need for their
roles.

Insecure Remote Access and VPN Vulnerabilities

Wargrave College’s use of a freeware VPN poses a significant risk. Free VPN solutions often
lack encryption strength,
monitoring, and proper
authentication features. The
ransomware incident originated
from a non-VPN connection, but
weak remote access infrastructure
still increases exposure. For a
college that relies on remote
learning and lesson delivery,
secure VPN access is essential. My recommendation would be to deploy a commercial,
enterprise-grade VPN with centralized authentication and logging, ensuring all remote
connections are encrypted and monitored for unusual activity.

6
Student Name Security

Insider Threats (Accidental or Malicious)

As I examined the breach, it became
clear that insider threats, whether
accidental or intentional, play a major
role in cybersecurity incidents. The
teacher who downloaded the infected
file did not act maliciously but
demonstrated a lack of security
awareness. Without proper training,
even well-intentioned employees can
cause severe damage. To reduce this
risk, I would introduce mandatory cybersecurity awareness training, least-privilege policies, and
clear reporting procedures so staff can recognize and report suspicious activity before it escalates.
(Insiderthreats, 2025)

Physical Security Weaknesses

During my site review, I learned that all servers are stored in an unsecured
IT technicians’ office. This is a serious physical vulnerability, anyone with
access to that room could tamper with servers, disconnect drives, or install
malicious USB devices. Physical and environmental controls are essential
for protecting digital assets. I would recommend relocating the servers to a
locked, monitored server room with restricted access, CCTV, and environmental safeguards such
as fire suppression and temperature control (Nicaise, 2023).

Network Design and Segmentation Issues

Wargrave’s network appears to lack proper
segmentation between student devices, staff
endpoints, and critical servers. This flat network
structure allows malware to move freely
between systems once inside. In the
ransomware incident, this lack of segmentation
enabled the malware to spread from a single
teacher’s laptop to the college’s core servers
and backups. To prevent this, I plan to design a segmented network architecture with separate
7
Student Name Security

VLANs for different user groups, firewall rules, and intrusion detection systems to limit the
spread of potential threats (Dashlane, 2024).

Regulatory and Compliance Risks

As an educational institution, Wargrave College handles sensitive personal data protected under
UK GDPR and Data Protection Act 2018. The total data loss caused by the ransomware attack
represents a major compliance failure. In my report, I must highlight that failure to protect data or
maintain backups can lead to legal penalties and reputational harm. Implementing data protection
impact assessments (DPIAs), encryption, and secure data retention policies will be crucial for
ensuring future compliance and restoring trust among stakeholders.

From my professional assessment as a Junior Network Security Specialist, Wargrave College is

exposed to multiple overlapping IT security risks, including ransomware, phishing, malware, data
loss, legacy systems, weak access controls, insecure VPNs, insider threats, and poor physical
security. The recent ransomware attack illustrates how these risks can interact, starting with a
phishing or malware incident and escalating due to weak segmentation and inadequate backups.

My next steps will be to develop an ISO-compliant risk assessment framework and a new
security policy that strengthens every layer of defense, from user awareness to technical controls,
ensuring that Wargrave College can continue to operate safely, securely, and in full compliance
with modern security standards.

Assessing organisational security procedures

Current Security Measures in Place

Based on the Acceptable Use Policy and IT environment, Wargrave College already has several
organisational security procedures in place:
1. Physical Access Controls
●​ Locked IT labs: Students can only access computer labs at supervised times.
●​ Swipe card access: Staff and students use ID cards to enter certain areas of the campus.
2. Technical Controls
●​ Virus scanners for USB drives: The policy mentions preventing corruption or
destruction of files, implying the presence of AV protection on endpoints.

8
Student Name Security

●​ Network monitoring for misuse: The policy allows the college to monitor network and
email usage for “security and/or network management reasons.”
3. User Access and Behavioural Controls
●​ Strict Acceptable Use Policy (AUP): Clearly outlines forbidden behaviours such as
accessing offensive material, using VPNs to bypass controls, connecting unauthorised
devices, and attempting unauthorised access.
●​ Email and internet usage rules: Restrictions on viewing, creating, or sending harmful or
copyrighted content.
●​ Consequences for misuse: The policy allows temporary or permanent withdrawal of
service if rules are violated.
Although these measures demonstrate an effort to maintain a secure digital environment, they are
mostly policy-based and rely heavily on user compliance rather than robust technical
enforcement.

Physical Security Procedures

Wargrave College already has some basic
physical security measures in place, such as
keeping IT labs locked when not in use and
requiring swipe card access for certain areas of
the campus. These measures ensure that general
computer access is somewhat restricted and that
students cannot freely enter IT facilities without
authorisation. However, during my assessment, I identified several weaknesses. Most
importantly, Annexe A does not mention whether the college has a secure and locked server
room. Without controlled access to servers and networking equipment, anyone with physical
access could potentially damage hardware, steal data, or disrupt operations. There is also no
mention of CCTV coverage or access logs for sensitive areas, which would be vital for
investigating physical security incidents.

To improve this, the college should implement a dedicated, locked, and monitored server room
that only authorised IT staff can access. Installing CCTV cameras in IT corridors and server areas
would strengthen monitoring and deterrence. Additionally, implementing detailed access logs
through swipe card systems would allow the IT department to track who enters secure spaces and

9
Student Name Security

at what time. These improvements would

significantly reduce the risk of unauthorised
physical access.

Network and Firewall Security

The Acceptable Use Policy indicates that the
college may monitor network use for security and management, suggesting some level of
oversight. However, the policy makes no reference to firewall standards, intrusion detection
systems, advanced filtering, or protection against external threats. This is a major concern, as
weak firewall configurations or outdated hardware can leave the college exposed to cyberattacks,
malware infections, and unauthorised external access. There is also no evidence of segmented
networks, meaning student devices may share the same network as staff or sensitive systems,
increasing the risk of internal breaches (GeeksforGeeks, 2025).

To address these weaknesses, Wargrave College should upgrade its perimeter security by
deploying next-generation firewalls with deep packet inspection, intrusion detection and
prevention (IDS/IPS), and malware filtering capabilities. The network should also be segmented
into VLANs separating student usage from administrative and server networks to minimise
cross-contamination risks. Regular firewall audits, rule reviews, and vulnerability scans should be
conducted to ensure the system remains protected against emerging threats. These enhancements
would greatly strengthen the college’s network security posture.

Remote Access, VPN Use, and

Encryption
The AUP only references VPNs in
terms of banning their unauthorised use
by students to bypass restrictions.
However, it does not outline whether the college provides a secure, official VPN for staff or
whether data is encrypted when accessed off-site. This creates several vulnerabilities. Staff who
need to access sensitive files remotely might be forced to rely on insecure methods, potentially
exposing internal data to interception. Moreover, without official VPN controls, the network
lacks encrypted communication channels for legitimate remote access (All You Need to Know
About VPN and Remote Access - CERTStation Blog, 2020).

10
Student Name Security

To improve this area, Wargrave College should introduce a secure, college-managed VPN service
for staff members who need remote access. This VPN should enforce strong encryption standards
such as AES-256 and require multi-factor authentication. Clear guidelines should be added to the
AUP explaining when and how staff are allowed to use remote systems. The college should also
block unauthorised VPN and proxy applications at the firewall level to prevent students from
circumventing restrictions. Implementing these changes will ensure remote access is secure and
centrally controlled.

Network Oversight and Record Keeping

(Whtsupgold, 2022)
Although the policy speaks to the general observation of email and internet usage, it does not
specify whether the college utilizes real-time monitoring tools, automated alerts, or defined log
retention policies. Without sufficient monitoring approaches, suspicious activities, such as
multiple login attempts, irregular bandwidth usage, or unauthorized access attempts, might not be
detected. Furthermore, the lack of centralized logging complicates the process of investigating
incidents, making it slow and inefficient.

Improvements in this area should focus on the adoption of a SIEM (Security Information and
Event Management) system aimed at collecting, storing, and analyzing logs from servers,
firewalls, and endpoints. It is crucial to configure real-time alerts for suspicious activities, like
port scanning, failed login attempts, or unusual data transfers. The college should also establish a
clear log retention policy, ensuring that important security logs are securely maintained for an

11
Student Name Security

appropriate period, such as 6–12 months. These improvements

would greatly enhance the IT team's awareness of network
activities and assist in the timely identification of potential
threats.
Access Control and Authentication
While the AUP warns users not to share login credentials, it
does not outline any formal access control procedures such as password complexity requirements,
multi-factor authentication, or regular account reviews. Weak or reused passwords significantly
increase the risk of unauthorised access. Similarly, without account auditing, old student or staff
accounts may remain active even after individuals leave the college, creating unnecessary
openings for attackers (SecurePass, n.d.).

To improve access security, Wargrave College should enforce strong password policies, such as
requiring passphrases, minimum length rules, and periodic password changes. Multi-factor
authentication should be enabled for staff accounts and any system containing sensitive student
information. The IT department should also implement regular user account audits to ensure
unused or expired accounts are removed promptly.
These improvements would reduce unauthorised
access risks and ensure proper control over user
privileges.

Backup, Recovery, and Continuity Planning

The current AUP does not reference any backup
routines or disaster recovery procedures, meaning
it is unclear whether the college regularly backs up
data or tests recovery capabilities. Without reliable
backups, hardware failures, cyberattacks, or accidental deletions could cause permanent loss of
student work, administrative data, and teaching materials. Additionally, the absence of a disaster
recovery plan could leave the college unable to restore services in the event of a major outage
(Pak, 2024).

To strengthen resilience, Wargrave College should implement automated daily backups of all key
systems and store them both onsite and in a secure cloud environment. Backup procedures should
be tested at least twice per year to ensure that data can be restored quickly and accurately. A
12
Student Name Security

documented disaster recovery plan should be created, outlining recovery time objectives (RTOs)
and responsibilities for each department. This will ensure the college can continue operating
smoothly after an unexpected incident.

(Kumar, 2025)

Patch Management and System Updates

No part of Annexe A mentions updating systems, patching vulnerabilities, or managing software
versions. Without a proper patch management strategy, devices and servers may remain
vulnerable to known exploits. Unpatched systems are one of the most common ways attackers
gain access to networks, making this a major organisational risk.

The college should adopt a structured patch management process that includes weekly automated
updates for endpoints, monthly vulnerability scanning, and quarterly patch reviews. Unsupported
or outdated software should be removed from systems, and a centralised update server could be
used to ensure consistency across devices. These improvements would significantly reduce
vulnerabilities and strengthen the overall security of college systems.

Overall, Wargrave College has established a clear Acceptable Use Policy that outlines expected
behaviour, but many essential organisational security procedures are missing, outdated, or not
technically enforced. By addressing weaknesses in physical security, network protection,
monitoring, staff training, access control, backups, and patch management, the college can build a
13
Student Name Security

far stronger security posture. Implementing these improvements will not only reduce the risk of
cyberattacks but also help protect students, staff, and critical college systems.

Analysing the benefits of implementing network monitoring systems

(Network, 2020)
In my examination of the security vulnerabilities at Wargrave College following the ransomware
incident, one of the crucial enhancements I identified is the establishment of a comprehensive
network monitoring system. Network monitoring systems are tools that constantly observe,
analyze, and report on network activity in real-time. Their goal is to help recognize unusual
behavioral patterns, detect early indications of cyberattacks, assess the health and performance of
devices, and ensure the network stays secure and functional. Some commonly utilized tools in the
industry include SolarWinds Network Performance Monitor, Nagios XI, Wireshark, and
ManageEngine OpManager. While the operation of each tool varies, they all fulfill the same
fundamental purpose, providing constant visibility into network activities, a feature currently
lacking at Wargrave College.
14
Student Name Security

One significant advantage of network monitoring for Wargrave College is the prompt detection of
malware and ransomware. In the recent incident, the malicious software went unnoticed due to
the absence of real-time monitoring or alert mechanisms at the college. An effective monitoring
setup would have captured suspicious activities such as unusual file modifications, abnormal
traffic directed to unknown IP addresses, or a sudden increase in network usage from a specific
user’s device. Alerts could have been generated immediately, enabling the IT team to isolate the
compromised system prior to the ransomware propagating throughout the network and encrypting
all data. This early-warning functionality could have averted or significantly diminished the
impact of the attack.

Another significant advantage lies in the safeguarding of sensitive information pertaining to

students, staff, and the college administration. Wargrave College manages personal information,
academic records, financial data, and communication logs. Network monitoring tools aid in
detecting attempts to access restricted zones, unauthorized data transfers, and suspicious login
activities. For instance, if a compromised staff account attempted to download large volumes of
student data, monitoring tools would rapidly flag this activity. This would assist the college in
adhering to data protection obligations under the UK GDPR and ensure the confidentiality,
integrity, and availability of critical data.

Network monitoring additionally enhances network performance and reliability, which is

particularly vital for a college reliant on stable online systems for remote education. Monitoring
systems identify bandwidth strains, overloaded servers, malfunctioning devices, and improperly
configured network equipment. By detecting these issues promptly, the IT team can resolve them
quickly before they hinder online classes, email services, or access to the Student Information
System. This guarantees that both staff and students face fewer interruptions and enjoy smoother
daily operations.

Moreover, monitoring systems facilitate quicker incident response and improved troubleshooting.
In the absence of monitoring, IT personnel must manually investigate the root of an issue, a
process that can extend for hours or even days. With real-time analytical dashboards and
historical records, the team can accurately determine the origin of a problem, which device was
impacted, and the extent of its spread. This allows Wargrave College to restore services much
more swiftly and averts minor issues from escalating into major outages.
15
Student Name Security

Additionally, monitoring systems assist the college in planning resources and future upgrades. By
examining long-term patterns in network utilization, the IT department can discern when server
upgrades are necessary, when additional storage is needed, or during what times of day demand is
highest. This promotes more informed budgeting, which is especially crucial for Wargrave
College that operates under a limited annual IT budget.

Lastly, network monitoring significantly enhances overall organizational security by providing

visibility, accountability, and control. Rather than responding to problems after they arise, the
college can adopt a proactive stance towards cybersecurity. Real-time monitoring reinforces the
entire security framework by bolstering intrusion detection, policy enforcement, compliance
assessments, and data protection.

Discussing the potential impact to IT security of incorrect configuration of

firewall policies and third- party VPNs

IT security solutions are tools and technologies used to protect an organisation’s network, data,
and systems from cyber threats. These include firewalls, antivirus software, intrusion detection
and prevention systems (IDS/IPS), encryption systems, multi-factor authentication (MFA), secure
VPNs, and access control mechanisms. When properly configured, these solutions create multiple
layers of defence that prevent malware, block unauthorised users, and ensure that sensitive
information is kept secure.

However, when these tools are configured incorrectly or left with default settings, they can
become ineffective and even introduce new vulnerabilities. Common security solutions such as
firewalls, endpoint antivirus, IDS/IPS, and access control systems rely heavily on accurate
configuration to function correctly. For example, an antivirus system requires regular updates to
detect new threats, while access control systems require correct permissions to prevent users from
accessing confidential files.

Misconfigurations, such as overly permissive rules, outdated signatures, or incomplete access

restrictions, create gaps in the security structure, making it easier for attackers to bypass
protections. In the case of Wargrave College, outdated systems and weak security policies meant

16
Student Name Security

that the existing solutions were not operating at the level necessary to prevent a sophisticated
ransomware attack.

Misconfigured Firewall Settings

(What Is a Firewall? [Definition & Explanation], n.d.)

A firewall serves as a security mechanism that screens both incoming and outgoing network
traffic based on established rules. It functions as a digital barrier between a secure internal
network (like the college's servers, student information, and staff systems) and outside networks
such as the internet. When set up correctly, firewalls can block harmful traffic, prevent
unauthorized access attempts, and assist in stopping the spread of malware throughout the
network. However, if the firewall rules are set up incorrectly, such as permitting unnecessary
open ports, neglecting to block suspicious traffic, or utilizing weak default settings, the firewall
loses its effectiveness.

Incorrect firewall configuration introduces serious risks. Overly permissive rules may allow
attackers to connect directly to internal systems, while missing rules may fail to detect malicious
downloads or prevent known ransomware communication channels. A poorly configured firewall
can also allow students or external actors to bypass access restrictions, access confidential data,
or overload the network.

In Wargrave College’s case, the firewall was described as “simple”, which strongly suggests
weak filtering policies, outdated rule sets, and limited intrusion detection capabilities. This
17
Student Name Security

misconfiguration likely contributed to the attack because the firewall did not block the malicious
file the teacher downloaded or detect the ransomware communicating with its
command-and-control server once it activated. As a result, the malware was able to spread freely
across the college network, encrypting HR data, student information, attendance systems, and
email services.

Misconfigured Third-Party VPNs

(Thirdparty, 2024)
A Virtual Private Network (VPN) is a secure channel for communication that encrypts online
data, allowing for confidential remote access to internal systems. Organizations commonly use
VPNs for employees who are telecommuting or accessing systems while off-site. A
well-configured VPN ensures strong encryption, verifies user identities, limits access, and secures
connection points. However, if a VPN is set up incorrectly, such as by using weak encryption
methods, allowing all traffic (split tunneling), default passwords, or granting users excessive
permissions, it creates a serious security risk.

Incorrect configuration of third-party VPNs can lead to unauthorised access, data interception, or
the spread of malware from external devices into the college network. In Wargrave College’s
case, the staff relied on freeware third-party VPN software, which is highly unsuitable for an
educational organisation with sensitive data. Free VPN tools often have poor encryption
standards, lack monitoring features, and may even store or sell connection data.

Additionally, the teacher who downloaded the malicious file did so while not connected to the
VPN, meaning their device lacked the necessary protections and traffic filtering. Once they later
18
Student Name Security

connected to the college network, possibly through the insecure freeware VPN, the ransomware
activated and spread into the internal systems without any checks. This demonstrates how an
incorrectly configured or poorly chosen VPN can allow harmful traffic to enter the network and
compromise all connected devices.

In summary, misconfigured firewalls and poorly managed third-party VPN solutions create major
vulnerabilities that attackers can easily exploit. In the case of Wargrave College, the lack of
strong firewall rules and reliance on unsecured VPN software were two key factors that allowed
the ransomware to penetrate the system and cause catastrophic data loss. Ensuring that both
firewalls and VPNs are properly configured, regularly updated, and monitored is essential for
maintaining strong network protection. Implementing secure, enterprise-grade VPNs and
advanced firewall configurations would significantly improve the college’s defence posture and
reduce the likelihood of future cyber incidents.

Discussing how implementing a DMZ, static IP and NAT improves network

security using an example for each.

Organizations implement various network features to safeguard their data, systems, and users
from cyber threats. Three key features that enhance security in an educational setting like
Wargrave College are the DMZ (Demilitarized Zone), Static IP Addressing, and NAT (Network
Address Translation). Each technology serves a distinct purpose in regulating access, concealing
internal systems, and minimizing the effect of attacks. When used together, they establish a
robust multi-layered defense system that ensures the safety of staff and student information.

DMZ (Demilitarized Zone)

19
Student Name Security

(Okta, 2023)

A DMZ is a dedicated, isolated segment of the network positioned between the internal network
and the public internet. It is safeguarded by two firewalls, one located between the internet and
the DMZ, and another between the DMZ and the internal network. The main objective of a DMZ
is to host services that are accessible to the public, such as websites, email servers, or online
portals, without granting them direct access to the internal systems that contain sensitive
information.

The DMZ restricts the extent of interaction that external users can have with internal resources.
Only specific and controlled connections are permitted, and any malicious activity is contained
within the DMZ rather than spreading throughout the main network.

How it enhances security:

The introduction of a DMZ notably enhances security by establishing a buffer area. If a publicly
accessible server within the DMZ is compromised, the attacker is confined to that zone. They
cannot directly access sensitive systems like the college database, student information system, or
internal file servers. This setup isolates attacks and obstructs lateral movement.

Moreover, the DMZ enables the college to implement more stringent security monitoring, such as
logging, intrusion detection, and traffic analysis, on all systems located within the zone. It serves
20
Student Name Security

as an initial alert layer where suspicious activities can be identified before they enter the internal
network.

Example:
If Wargrave College operates its online admissions portal or learning management system (LMS)
on a public server, placing it within a DMZ ensures that even if attackers take advantage of a
vulnerability in the web application, they cannot access internal data like exam records, staff
payroll information, or student personal details. The breach remains contained within the DMZ,
allowing IT staff to respond without significant damage occurring.

Static IP

(IPXO, 2025)
A static IP is a permanent, unchanging IP address assigned to a device. Unlike dynamic IPs that
change each time a device connects, static IPs stay the same. They are mainly used for devices
that require stable connectivity and consistent identification, such as servers, firewalls, routers,
printers, or CCTV systems. Static IPs also allow tighter security controls because they enable
network administrators to define fixed rules around which device can access which resource.

How it improves security:

21
Student Name Security

Static IPs improve security by enabling precise access control. Because the IP addresses do not
change, the firewall and security systems can be configured to permit or block traffic based on
known, trusted devices. For example, only devices with specific static IPs might be allowed to
connect to the database server.
Static IPs also help with:
- Auditing and monitoring – logs become much clearer when devices always have the same IP.
- Preventing impersonation – attackers cannot easily pretend to be a server if the identity is
fixed.
- Ensuring reliability for security tools – systems like VPNs, email servers, and authentication
servers work more safely and consistently with static IPs.

Example:
Wargrave College’s main file server, which stores confidential student work, staff documents, and
exam papers, should have a static IP. The firewall can then be programmed to allow access only
from authorised staff computers or from specific campus locations. If a student tries to connect to
the server or an unknown device appears on the network, the firewall will automatically block the
request because it does not match the trusted IP list. This prevents data leakage and unauthorised
access.
NAT (Network Address Translation)

(NAT, 2025)
NAT is a method employed by routers to convert numerous internal private IP addresses into a
singular public IP address when connecting to the internet. Within the college network, devices
are assigned private IP addresses that are inaccessible from the outside. When these devices
access the internet, the NAT router substitutes their private IPs with one public IP, concealing the

22
Student Name Security

internal network's configuration. Various types of NAT exist, but they all fulfill the same role of
managing connections and obscuring internal IP addresses.

Enhancing security:
NAT greatly enhances security by obscuring internal devices from external access. Since private
IP addresses cannot be seen on the internet, malicious actors cannot directly target student
laptops, staff computers, printers, or internal servers. They can only view the college’s single
public IP address.
This minimizes the attack surface and guards against:
●​ External scans of internal devices
●​ Direct hacking attempts or connection solicitations
●​ Mapping out the internal network

Moreover, NAT mandates that all outgoing traffic passes through a single regulated gateway,
enabling the college to implement content filtering, logging, intrusion detection, and firewall
policies more efficiently.

Example:
If a hacker tries to probe Wargrave College’s network from the internet, NAT hinders their ability
to uncover any internal devices. Rather than detecting countless student and staff devices, they
only see the college’s public IP. This complicates the attacker’s task of identifying vulnerable
devices, outdated systems, or unsecured equipment to exploit.

23
Student Name Security

Proposing a Method to Assess and Treat IT Security Risks

Using ISO 27005 Risk Management Cycle

(Researchgate, 2022)
Identify Risks
In the first stage of the ISO 27005 risk management cycle, I would begin by identifying all the
critical assets within Wargrave College’s IT environment. These assets include sensitive student
records, staff information, payroll data, the college website, network hardware, servers, and even

24
Student Name Security

human elements such as staff and students who interact with the systems daily. Once the assets
are identified, the next step is recognising the threats that could impact them.

For Wargrave College, these threats may include malware attacks, phishing attempts targeting
staff, ransomware infections, insider threats from untrained personnel, and social engineering
attacks. After listing threats, I would identify vulnerabilities that make the college more
susceptible to these risks, such as outdated software, weak firewall configurations, poor VPN
setup, weak passwords, unpatched systems, and the absence of staff cybersecurity training. This
step helps us understand exactly what can go wrong and why certain areas become high-risk.

Assess Risks
After pinpointing possible risks, I would assess them to grasp their probability and effect. By
utilizing a risk matrix, I can classify each risk as low, medium, or high according to how likely it
is to arise and how severe the fallout would be if it materializes. For instance, a vulnerable
firewall in conjunction with ongoing external threats would be regarded as having a high
likelihood and high impact, thus marking it as a critical risk.

Conversely, a slightly outdated application operating on an isolated system may be categorized as

having low likelihood and low impact. The assessment also considers financial repercussions
(like costs related to recovering from ransomware), operational effects (such as system downtime
or interrupted classes), and legal ramifications (possible GDPR breaches from exposed student
data). This procedure aids Wargrave College in obtaining a realistic view of which risks pose the
most significant threat and require urgent attention.

Assess and Prioritize Risks

After analyzing the risks, the subsequent step is to assess and prioritize them. During this phase, I
would evaluate the risk levels outlined in the matrix and decide which risks should be tackled
first based on their severity. High-risk concerns, like improperly configured firewalls, insufficient
VPN security, or outdated servers, are prioritized, as they hold the potential for significant data
breaches or operational interruptions.
Medium risks can be addressed after resolving the critical ones, while low risks are left for
ongoing monitoring. This prioritization enables Wargrave College to utilize resources efficiently,
ensuring that time, budget, and security measures are directed where they are most critical. It also
brings clarity and organization to the overall cybersecurity plan.
25
Student Name Security

Address Risks
In the addressing phase, I would choose a suitable approach for managing each identified risk.
There are four main treatment strategies outlined in ISO 27005. The first is mitigation, which
involves lessening the risk by implementing new security measures such as updating firewall
settings, applying patches, encrypting sensitive information, or enhancing VPN configurations.
The second approach is acceptance, wherein the college consents to endure a low-level risk as it
does not significantly jeopardize operations.

The third option is risk transfer, such as acquiring cyber insurance or delegating security
functions to a managed security provider. The fourth strategy is avoidance, which entails
completely ceasing the risky operation; for example, halting the use of outdated and unsupported
software. Each risk would be allocated one of these treatments based on its priority and the
resources accessible to Wargrave College.

Continuously Monitor and Evaluate

The concluding stage of the ISO 27005 cycle involves ongoing monitoring and evaluation of the
security risks and the effectiveness of the implemented treatments. As a junior network security
specialist, I would routinely review logs, network traffic, firewall notifications, and VPN activity
to confirm that the controls in place are functioning as intended.

Over time, new threats may emerge, previously existing vulnerabilities may resurface, and new
systems might be introduced, all of which necessitate updates to the risk assessment. Regular
evaluations help ensure that Wargrave College’s risk management practices stay in sync with
evolving cybersecurity trends, new technologies, and revised regulatory requirements. This
ongoing cycle guarantees that the college’s security stance remains robust and resilient.

Risk Matrix – Wargrave College

Likelihood Scale
●​ 1 = Low (unlikely to occur)
●​ 2 = Medium (could occur occasionally)
26
Student Name Security

●​ 3 = High (likely to occur frequently)

Impact Scale
●​ 1 = Low (minor inconvenience, no data loss)
●​ 2 = Medium (service disruption, some data exposure)
●​ 3 = High (major data breach, legal or financial damage)

Evaluation of Physical and Virtual Security Measures to Keep IT Secure

Physical Security Measures

CCTV
CCTV is a video surveillance system used to monitor and record activity around sensitive areas
such as IT labs, server rooms, and entry points. It is highly effective because it acts as both a
deterrent and an investigative tool. Staff can review footage to identify unauthorised access
attempts or suspicious behaviour, which helps to reduce theft and physical
tampering. CCTV also supports incident response by providing visual
evidence.

27
Student Name Security

However, CCTV has limitations. Cameras must be monitored consistently or reviewed manually,
meaning threats may still go unnoticed in real time. Blind spots or poor-quality cameras can also
reduce effectiveness, and CCTV does not physically prevent an intruder from entering, it only
records the event. Additionally, CCTV systems can be expensive to maintain and require secure
storage for recordings.

Access Control (ID Cards, Biometrics)

Access control ensures that only authorised staff or students can enter restricted areas using ID
cards, key fobs, or biometric scanners. This is effective because it reduces the likelihood of
unauthorised individuals accessing critical IT infrastructure. Biometrics such as fingerprints or
facial recognition provide an even higher level of accuracy, preventing
shared or stolen identity credentials from being used.

However, access control systems also come with limitations. ID cards

can be lost, stolen, or shared, which compromises security. Biometric
systems, while more secure, are expensive and can raise privacy
concerns. Additionally, access control only restricts entry but does not
stop tailgating, where an unauthorised person follows an authorised user through the door without
detection.

Locked Server Rooms

Locking server rooms ensures that only authorised IT personnel can physically access servers,
switches, and data storage equipment. This measure is extremely effective at protecting critical
systems from tampering, theft, or accidental damage. Strong locks,
reinforced doors, and restricted access logs significantly reduce physical
risks to core IT infrastructure.

The limitation is that locked rooms still rely on human behaviour, people
may forget to lock the door or leave it open during maintenance. If physical keys are used, they
can be copied or stolen. Additionally, locked rooms do not prevent insider threats if an authorised
individual intentionally misuses their access.

Environmental Controls

28
Student Name Security

Environmental controls, such as cooling systems, fire suppression, humidity sensors, and
uninterruptible power supplies (UPS), protect IT equipment from physical
damage caused by environmental factors. These measures are effective because
they maintain optimal operating conditions for servers and networking devices,
reducing downtime and preventing hardware failure.

However, environmental controls can be costly to install and require ongoing maintenance. They
also do not stop unauthorised human access or digital threats. If the sensors or systems
malfunction, the college may be unaware until damage has already occurred, making monitoring
essential.

Virtual Security Measures

1. Firewalls
A firewall is a virtual barrier that filters incoming and outgoing network
traffic based on predefined security rules. It is highly effective at blocking
unauthorised access, malware, and suspicious connections. Firewalls are
essential for preventing external attackers from reaching internal systems.
Despite their effectiveness, firewalls rely heavily on correct configuration.
As seen in many real-world breaches, weak or outdated firewall rules can leave networks
exposed. Firewalls also cannot stop insider threats or attacks that bypass the network perimeter,
such as phishing or infected USBs.

2. Antivirus / Anti-Malware
Antivirus software detects, blocks, and removes malicious software on
computers. It is highly effective against known viruses, ransomware, and
trojans, especially when signature databases are updated regularly. It helps
maintain the integrity and availability of systems by preventing
malware-related damage.

Its limitation is that it cannot always detect zero-day threats or sophisticated malware that uses
encryption or polymorphic techniques. Antivirus software also only protects individual devices
and cannot defend the entire network by itself. Human behaviour, such as opening malicious
links, may still bypass antivirus protection.

29
Student Name Security

3. Encryption
Encryption is a method of converting data into unreadable code,
ensuring that only authorised users with a decryption key can access
it. It is highly effective at protecting sensitive data such as student
records or staff information, even if a device is stolen or intercepted
over the network.

The limitation of encryption is that it must be implemented consistently across all systems. If
encryption keys are weak or poorly stored, attackers can still gain access. Encryption also does
not prevent attacks; it only protects data after a breach occurs. Performance issues may appear on
older devices when encrypting large files.

4. Multi-Factor Authentication (MFA)

MFA strengthens identity verification by requiring users to
provide two or more authentication factors, such as
passwords, mobile codes, or biometrics. MFA is highly
effective at preventing unauthorised logins, even if a
password is compromised. It significantly reduces risks
from phishing, brute-force attacks, and credential theft.

However, MFA depends on user cooperation and the availability of secondary devices. Lost
phones, network issues, or email delays can block legitimate users from accessing systems. MFA
also does not protect against threats that occur after login, such as insider misuse.

5. Virtual Private Networks (VPNs)

A VPN creates an encrypted tunnel for secure communication between a
user and the network, preventing attackers from intercepting data. This is
effective for remote staff access or secure connections to cloud services.

Despite this, VPN security heavily relies on correct configuration. Weak encryption protocols,
shared credentials, or poorly maintained third-party VPNs can introduce new security gaps
instead of closing them. VPNs can also decrease network performance and become a single point
of failure if the service is compromised.

30
Student Name Security

Both physical and virtual security measures play a critical role in protecting an organisation like
Wargrave College. Physical measures such as CCTV, locked server rooms, and access control
help secure buildings, equipment, and infrastructure from tampering or theft. Virtual security
measures such as firewalls, encryption, antivirus, MFA, and VPNs protect the college from cyber
threats, data breaches, and unauthorised access.

Although each measure has its own strengths and limitations, the most effective protection comes
from combining both physical and virtual security controls. This layered, defence-in-depth
approach ensures that even if one security measure fails, others remain in place to protect the
college’s systems, data, and users.

Reviewing risk assessment procedures in an organization.

The current risk assessment procedure used by

Wargrave College, as shown in Annexe B, follows a
basic qualitative risk assessment approach. The
procedure identifies risks by linking key IT assets
(such as computer lab PCs, staff laptops, file servers,
and the network) with potential threats that could affect
them. Each identified risk is then assessed using three
main criteria: probability, impact, and risk level, which are combined to determine an overall
priority rating. These priority ratings are categorised into three levels, ranging from low priority
to critical risks requiring immediate action.

Risk Identification Process

Risks at Wargrave College are identified by examining how different IT assets could be affected
by common security threats. The assessment focuses primarily on technical threats such as
viruses, data deletion, copyright breaches, and denial-of-service attacks. This indicates that the
procedure relies on asset-threat mapping rather than a broader organisational view. However,
there is little evidence that human, procedural, or environmental risks (such as staff behaviour,
misconfigurations, or physical security weaknesses) are systematically considered during the
identification stage.

31
Student Name Security

Method of Prioritization and Risk Rating

A likelihood (probability) scale and an effect scale are used to rate dangers after they are
recognized. The risk level (e.g., low, medium, high, or extreme) that results from the
combination of these two factors establishes the assessment priority. Three tiers make up the
priority system: Priority 1 for low risks, Priority 2 for medium risks, and Priority 3 for significant
threats. This method aids decision-makers in determining which risks need to be addressed right
away and which can wait, particularly in situations where funding is limited.

Monitoring and Review of Risks

The risk assessment document does not clearly indicate how risks are monitored or reviewed over
time. There is no reference to review dates, update cycles, or triggers for reassessment following
incidents or system changes. This suggests that risk monitoring may be informal or reactive
rather than continuous. Without regular reviews, the assessment risks becoming outdated,
particularly given the rapidly changing nature of cybersecurity threats in educational
environments.

Roles and Responsibilities in Risk Assessment

Annexe B does not explicitly state who is responsible for carrying out the risk assessment,
approving risk ratings, or ensuring treatments are implemented. This lack of role definition
suggests that responsibility may fall informally on the IT department or senior staff without a
clearly assigned risk owner. The absence of named roles reduces accountability and increases the
risk that high-priority issues may not be addressed promptly or consistently.

Tools, Procedures, and Records Employed

The process seems to depend on a handwritten risk assessment table, which was probably made
with a spreadsheet or simple document format. Although this approach is straightforward and
easy to comprehend, it is devoid of threat intelligence inputs, automation, and real-time data
integration. The accuracy and breadth of the assessment are limited because there is no proof that
risk registers, network monitoring data, vulnerability scanners, or incident reports were used to
influence risk assessments.

Strengths of the Current Procedure

32
Student Name Security

One strength of Wargrave College’s risk assessment procedure is its structured format, which
clearly links assets, threats, likelihood, and impact. The use of priority levels also supports
decision-making by helping management focus on the most serious risks first. Additionally, the
procedure shows awareness of common IT threats relevant to an educational environment,
demonstrating a foundational understanding of risk management principles.

Weaknesses and Limitations of the Procedure

Despite its structure, the procedure has several weaknesses. It is narrow in scope, focusing mainly
on technical threats while overlooking human, physical, and organisational risks. The lack of
documented review processes, unclear ownership, and absence of formal risk treatment plans
significantly reduce its effectiveness. Furthermore, the procedure does not align fully with
recognised standards such as ISO/IEC 27005, as it lacks continuous monitoring, formal
evaluation criteria, and documented risk responses.

Assessment of Currency and Completeness

Overall, the current risk assessment procedure at Wargrave College appears to be outdated and
incomplete. It does not reflect modern cybersecurity challenges such as ransomware, cloud
services, remote access risks, or staff awareness issues. While it provides a starting point for
understanding IT risks, it requires significant improvement to become a comprehensive,
up-to-date, and standards-aligned risk management process capable of preventing incidents like
the recent ransomware attack.

Data Protection Processes and Regulations Applicable to Wargrave College

(steps, 2025)
●​ Applicable Data Protection Regulations
33
Student Name Security

Wargrave College, as a UK-based educational institution, is legally required to comply with the
UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. These
regulations govern how personal data relating to students, staff, parents, and other stakeholders
must be collected, processed, stored, and protected. In addition, as part of the education sector,
the college must follow guidance issued for safeguarding young people, which places an even
higher responsibility on protecting sensitive student information such as attendance records,
academic performance, safeguarding notes, and contact details.

●​ Data Collection Processes

Under data protection regulations, Wargrave College must ensure that personal data is collected
lawfully, fairly, and transparently. This means the college should only collect data that is
necessary for specific educational and administrative purposes, such as enrolment, assessment,
payroll, and communication. Students and staff must be informed about what data is being
collected, why it is needed, how long it will be kept, and who it may be shared with. Collecting
excessive or irrelevant data would breach the principle of data minimisation.

●​ Data Storage and Security Controls

Once collected, personal data must be stored securely to prevent unauthorised access, loss, or
damage. At Wargrave College, this includes storing student data on the Student Information
System (SIS) and staff data on HR servers. Data protection regulations require the use of
technical and organisational security measures, such as access controls, encryption, secure
servers, and regular backups. Given the previous ransomware incident, it is clear that stronger
storage protections and backup strategies are essential to meet legal expectations.

●​ Access Control and Data Usage

Access to personal data must be strictly controlled on a need-to-know basis. Staff should only be
able to access data that is necessary for their role, such as teachers accessing student academic
records but not HR payroll information. Role-based access control, strong authentication, and
audit logs should be implemented to ensure accountability. Misuse of access privileges would be
considered a breach of data protection principles and could lead to disciplinary action.

●​ Data Sharing and Disclosure

Wargrave College must ensure that personal data is only shared with authorised third parties, such
as examination boards, local authorities, or government agencies, where there is a legal basis to
34
Student Name Security

do so. Any data sharing must be documented and governed by data-sharing agreements that
define responsibilities and security requirements. Sharing personal data without proper
authorisation or safeguards would constitute a data breach under UK GDPR.
●​ Data Retention and Secure Disposal
Data protection regulations require that personal data is not kept longer than necessary. Wargrave
College must follow defined data retention schedules for different types of data, such as student
records, exam results, and staff employment details. When data is no longer required, it must be
securely disposed of through methods such as secure deletion, data wiping, or physical
destruction of storage media. Improper disposal can lead to data exposure and regulatory
penalties.

●​ Responsibilities of Staff Under Data Protection Law

All staff at Wargrave College have a legal responsibility to protect personal data and comply with
data protection policies. This includes following acceptable use policies, using strong passwords,
reporting suspected data breaches promptly, and completing data protection training. Senior
management and IT staff have additional responsibilities, such as implementing appropriate
security controls, monitoring compliance, and ensuring incident response procedures are in place.

●​ Maintaining Compliance
Compliance with data protection regulations is maintained through a combination of policies,
training, technical controls, and regular audits. Wargrave College should conduct periodic data
protection impact assessments (DPIAs), review access rights, and test backup and recovery
systems. Monitoring systems and incident logs also help demonstrate compliance and support
investigations if an issue occurs.

●​ Consequences of Non-Compliance
If Wargrave College fails to comply with data protection regulations, the consequences can be
severe. These include financial penalties, enforcement actions by the Information
Commissioner’s Office (ICO), legal claims from affected individuals, and reputational damage.
In the education sector, non-compliance can also lead to loss of trust from students, parents, and
regulatory bodies, as well as increased scrutiny from oversight authorities.

35
Student Name Security

Summary of an Appropriate Risk Management Standard and Its Application

in IT Security

An international standard that offers recommendations for information security risk management
is ISO/IEC 27005. It assists organizations in recognizing, analysing, assessing, and managing
risks that may compromise the availability, confidentiality, and integrity of information assets.
The standard is extensively used in a variety of industries, including education, to handle IT
security risks in an organized and uniform way. It is designed to be in line with ISO/IEC 27001.

●​ Key Principles of ISO/IEC 27005

The standard is based on a continuous risk management cycle.
-​ Risk identification, where information assets, threats, and vulnerabilities are recognised.
-​ Risk analysis, which assesses the likelihood and potential impact of each risk.
-​ Risk evaluation stage prioritises risks based on their severity and determines which risks
require treatment.
-​ Risk treatment involves selecting appropriate actions such as mitigation, avoidance, transfer,
or acceptance.
-​ Monitoring and review ensure that risks and controls are regularly reassessed as systems,
threats, and business requirements change.

●​ Application of ISO/IEC 27005 in IT Security

In IT security, ISO/IEC 27005 is applied to protect digital assets such as networks, servers,
databases, user accounts, and cloud services. It provides a framework for assessing cyber threats
including malware, ransomware, data breaches, and misconfigurations. The standard ensures that
security controls are not applied randomly, but instead are chosen based on risk severity, business
impact, and organisational priorities. This risk-based approach improves decision-making and
resource allocation.

●​ Applying ISO/IEC 27005 at Wargrave College

Wargrave College could apply ISO/IEC 27005 by first creating a complete inventory of its IT
assets, including student systems, staff laptops, servers, and network infrastructure. Risks would

36
Student Name Security

then be assessed using likelihood and impact ratings similar to those already used, but in a more
structured and consistent manner. The college could prioritise critical risks such as ransomware
and network attacks, while lower risks could be monitored or accepted. Regular reviews would
ensure that new threats, such as remote access vulnerabilities, are addressed promptly.

●​ Improvements Provided by the Standard

Adopting ISO/IEC 27005 would significantly improve Wargrave College’s existing risk
management practices. It would introduce clearer ownership of risks, better documentation, and
consistent evaluation criteria. The standard also promotes continuous monitoring rather than
one-time assessments, reducing the likelihood of outdated risk registers. Overall, it strengthens
the college’s ability to prevent incidents and respond effectively when security issues arise.

●​ Suitability of ISO/IEC 27005 for Wargrave College

ISO/IEC 27005 is particularly suitable for Wargrave College because it is scalable, flexible, and
does not require complex technical systems to implement. It can be adapted to the college’s
budget and operational needs while still providing a recognised and trusted framework. Most
importantly, it aligns well with the college’s need to protect sensitive student and staff data while
maintaining uninterrupted educational services.

Analysis of the Potential Consequences for Organisational Security Arising

from an IT Security

IT security audits usually expose vulnerabilities within an organisation’s technical controls,

policies, and user behaviors. For Wargrave College, an audit is likely to uncover deficiencies such
as outdated software, insecure firewall and VPN settings, inadequate access control management,
limited monitoring, and a lack of staff awareness regarding security. Audits also highlight
compliance shortcomings, such as insufficient data protection practices or incomplete
documentation, which may remain unnoticed during routine operations yet present significant
long-term risks.

If the vulnerabilities uncovered in an audit are left unaddressed, they can severely compromise
the college’s overall security stance. Technical flaws might permit unauthorized access to internal
systems, resulting in malware infiltrations, ransomware incidents, or data corruption. Gaps in

37
Student Name Security

policy and procedure can lead to inconsistent security measures across various departments,
raising the chances of human errors and insider threats. Over time, these vulnerabilities create
multiple attack vectors that may be exploited concurrently.

From an operational standpoint, unresolved security vulnerabilities can lead to system outages,
hindering educational activities, learning platforms, and administrative functions. For instance,
compromised servers or network issues can block access to online classes, email services, or
student records. This directly impacts staff efficiency, student educational experiences, and
safeguarding responsibilities, especially in a setting that heavily depends on digital systems.

Neglecting to act on audit discoveries can incur substantial financial liabilities. These may
encompass costs linked to incident management, data restoration, system recovery, and urgent
consultancy services. Moreover, penalties under data protection regulations, heightened insurance
costs, and possible legal actions from affected parties can severely strain the college’s financial
resources. On the other hand, addressing audit concerns proactively is typically more
cost-efficient than reacting to a major security breach.

Security breaches stemming from disregarded audit results can inflict considerable harm to the
college's reputation. For Wargrave College, a data leak involving student or staff data would
diminish trust among parents, students, regulators, and associated organisations. Damage to
reputation can also invite increased oversight from regulatory authorities and undermine the
college’s reputation within the education sector. Legal ramifications might involve investigations
by the Information Commissioner’s Office (ICO) and required corrective measures.

Not all audit results possess equal urgency. High-risk problems like exposed network services,
weak firewalls, or unsecured remote access must be dealt with swiftly due to their potential to
initiate catastrophic events. Medium-risk issues necessitate targeted remediation, while low-risk
concerns should still be monitored and assessed. Overlooking critical vulnerabilities greatly
heightens the chances of experiencing repeated incidents, like the ransomware attack previously
faced by Wargrave College.

In conclusion, an IT security audit offers essential insights into an organisation’s vulnerabilities,

but its advantages are only attained if the recommendations are acted upon. For Wargrave
College, neglecting to remedy identified problems would leave the institution open to recurring
38
Student Name Security

attacks, operational interruptions, financial setbacks, and enduring reputational harm. Promptly
addressing audit recommendations enhances security resilience and fosters safer, more
dependable educational operations.

Recommending how IT security can be aligned with an organizational policy,

detailing the security impact of any misalignment.

(policies, 2025)
Wargrave College’s organisational policies, including its Acceptable Use Policy and data
protection obligations, demand that IT systems are used responsibly, securely, and in compliance
with UK law. At a high level, the policy expects the protection of student and staff data,
prevention of unauthorised access, continuity of teaching and administrative operations, and
accountability for misuse of IT resources. The policy also assumes that technical controls such as
access restrictions, monitoring, and secure system configurations are in place to support these
expectations.

Despite clear policy expectations, several areas of IT security at Wargrave College are not fully
aligned. Technical controls do not adequately enforce policy rules, as seen in weak firewall and
VPN configurations that fail to restrict access effectively. The policy discourages unsafe
behaviour, yet there is limited technical prevention against phishing, malware downloads, or
insecure remote access. Additionally, the lack of continuous network monitoring means that
policy breaches and suspicious activity may go undetected. This misalignment shows a gap
between what the policy requires and what the IT systems actually enforce.

39
Student Name Security

To bring IT security into alignment, Wargrave College should implement stronger technical
controls that directly support policy requirements. This includes deploying properly configured
enterprise firewalls, secure VPN solutions with multi-factor authentication, and network
monitoring systems to detect policy violations. Access controls should be role-based to ensure
users only access data relevant to their responsibilities. Regular security awareness training
should also be introduced to reinforce policy expectations and reduce human error.

Justification for the Recommendations

These actions are necessary because organisational policies alone cannot prevent security
incidents without technical enforcement. Firewalls and VPN controls ensure that network access
rules stated in policy are applied in practice. Monitoring systems provide visibility and
accountability, enabling the college to detect breaches early and demonstrate compliance.
Training ensures that staff and students understand their responsibilities, reducing the likelihood
of accidental policy violations. Together, these measures transform policy from a written
document into an actively enforced security framework.

When IT security is not aligned with organisational policy, the college becomes significantly
more vulnerable to cyber threats. Misalignment increases the likelihood of data breaches,
malware infections, and unauthorised access, as policies are not technically enforced. It also leads
to inconsistent security practices across departments, making incident response more difficult.
From a compliance perspective, failure to enforce policy requirements may result in breaches of
data protection regulations, exposing the college to legal penalties and reputational damage.

In conclusion, aligning IT security controls with organisational policy is essential for maintaining
a secure and compliant environment at Wargrave College. Without alignment, policies lose their
effectiveness, leaving systems exposed and users unprotected. By implementing strong technical
controls, improving monitoring, and reinforcing staff responsibilities, the college can reduce risk,
ensure compliance, and support safe, uninterrupted educational operations. This alignment is
critical to preventing future incidents and strengthening organisational resilience.

40
Student Name Security

Designing a suitable security policy for the organisation, including the main
components of the organisational disaster recovery plan.

Part A: Security Policy/Plan

A security policy is a structured, organization-wide guideline that specifies how to safeguard

information systems, networks, and data from both internal and external security risks. For
Wargrave College, having a clear security policy is crucial because of the significant amount of
sensitive information it handles each day, such as student personal details, academic records, staff
employment information, and financial data. In the absence of a cohesive policy, security
measures may be implemented inconsistently, which raises the chances of security breaches, data
loss, or disruptions to systems.

This security policy aims to protect the confidentiality of sensitive information by blocking
unauthorized access, maintain the integrity of systems and data by shielding them from
unauthorized alterations, and ensure availability so that teaching, learning, and administrative
functions remain operational. Furthermore, the policy promotes adherence to legal and regulatory
obligations, including data protection laws and standards specific to the education sector. It
delineates explicit rules, clarifies responsibilities, and establishes acceptable practices for all
users accessing Wargrave College’s IT resources.

The primary areas addressed by this policy include access control, password and authentication
management, network security, physical security, appropriate use of IT systems, and data
41
Student Name Security

protection. Collectively, these areas create a multi-layered security strategy that mitigates risk and
enhances the overall security framework of the college.
1. Access Control Policy
Rule:
At Wargrave College, access to IT systems, applications, networks, and data must be regulated
through a role-based access control (RBAC) framework. Users are granted access solely based on
their job roles or academic requirements, ensuring they can only access the systems and
information necessary for their work or studies.

Why the Rule Exists:

This policy is designed to mitigate the risk of unauthorized access, unintentional data leaks, and
insider threats. By limiting access rights, the possible harm from compromised accounts is
reduced, as attackers cannot freely navigate through various systems. It also enhances
accountability, as actions taken by users can be specifically associated with individual roles and
persons.

Who Must Follow It:

This access control policy must be followed by all individuals, including faculty, administrative
staff, students, contractors, and third-party service providers who access Wargrave College
systems.

2. Password and Authentication Policy

Rule:
All user accounts must use strong passwords that meet defined complexity requirements,
including a minimum length and the incorporation of both uppercase and lowercase letters,
numbers, and special characters. Passwords must be updated frequently and cannot be reused.
Multi-factor authentication (MFA) is mandatory for remote access, accounts with elevated
permissions, and access to sensitive systems.

Why the Rule Exists:

Password-based attacks, such as brute-force attempts, credential stuffing, and phishing, are
among the main contributors to security breaches. Adopting strong password practices along with
MFA significantly reduces the likelihood of account compromise

42
Student Name Security

Who Must Follow It:​

All system users, including students, teaching staff, administrative staff, and IT administrators,
are required to follow the password and authentication policy.
3. Network Security Policy
Rule:
Wargrave College must deploy and maintain properly configured firewalls, secure VPN
connections, intrusion prevention mechanisms, and network segmentation. Only authorised and
compliant devices may connect to the college network, and unauthorised software installations
are strictly prohibited.

Why the Rule Exists:

Network-based attacks such as malware infections, ransomware, and unauthorised access often
exploit weak or poorly configured network controls. Effective network security reduces the attack
surface, protects internal systems from external threats, and limits lateral movement if a breach
occurs.

Who Must Follow It:

IT administrators are responsible for implementing and maintaining network security controls,
while all users must comply with network usage rules and security guidelines.

4. Physical Security Policy

Rule:
All critical infrastructure, including server rooms, networking equipment, and backup systems,
must be physically secured using locked doors, access control mechanisms, and surveillance
systems such as CCTV. Access to these areas must be restricted to authorised personnel only.

Why the Rule Exists:

Physical security breaches can result in severe consequences, including theft of equipment,
sabotage, or direct access to sensitive data. Physical access often allows attackers to bypass
technical security controls entirely, making physical protection a critical component of overall IT
security.

Who Must Follow It:

43
Student Name Security

IT staff, facilities management, and any authorised personnel granted physical access to secure
areas must comply with this policy.

5. Acceptable Use Policy (AUP)

Rule:
Wargrave College IT systems, including computers, networks, and internet access, must be used
solely for authorised educational and administrative purposes. Activities such as illegal
downloading, accessing inappropriate content, installing unauthorised software, or misusing
college resources are strictly prohibited.

Why the Rule Exists:

Misuse of IT systems increases the risk of malware infections, legal liabilities, and reputational
damage. An effective AUP promotes responsible behaviour, reduces exposure to cyber threats,
and ensures systems remain reliable and available for legitimate use.

Who Must Follow It:

All students, academic staff, and administrative staff using Wargrave College IT resources are
required to adhere to the Acceptable Use Policy.

6. Data Protection Policy

Rule:
Personal and sensitive data must be collected lawfully, processed fairly, stored securely, accessed
only by authorised individuals, and disposed of securely when no longer required. Encryption
must be used where appropriate, and data sharing must follow approved procedures.

Why the Rule Exists:

Educational institutions handle large volumes of personal data, making them attractive targets for
cyberattacks. Strong data protection practices reduce the risk of data breaches, protect
individuals’ privacy, and ensure compliance with data protection regulations.

Who Must Follow It:

All staff members who collect, process, store, or manage personal or sensitive data are
responsible for complying with the data protection policy.
44
Student Name Security

Part B: Disaster Recovery Plan (DRP)

(DRP, 2023)
A Disaster Recovery Plan (DRP) is a formal framework that explains how an organisation
prepares for, responds to, and recovers from unexpected events that disrupt IT systems and data
availability. In the context of Wargrave College, potential disruptions may arise from cyber
incidents such as ransomware attacks, technical failures of hardware or software, electrical
outages, or physical emergencies including fires and flooding. As the college depends heavily on
digital platforms for education delivery, communication, and administration, extended system
outages could result in serious operational delays, academic disruption, and damage to the
institution’s reputation.

The main purpose of the Disaster Recovery Plan is to limit service downtime, prevent significant
data loss, and enable the swift restoration of essential systems. The plan helps ensure the
continuity of learning, safeguards confidential information relating to students and staff, and
provides a structured and coordinated response during emergency situations. By maintaining a
well-defined DRP, Wargrave College can manage incidents more effectively, reduce uncertainty
during crises, and restore normal services within the shortest possible timeframe.
45
Student Name Security

1. Identification of Critical Systems and Data

Recognising and categorising critical systems and data is a key component of effective disaster
recovery planning, as it allows recovery activities to be prioritised. At Wargrave College,
essential systems include servers that store academic and operational files, student management
systems holding personal and academic data, virtual learning environments used for teaching and
assessment, staff email and communication services, and the underlying network infrastructure
that enables connectivity across the campus.

If any of these systems were to become unavailable or compromised, teaching activities could be
interrupted, administrative functions delayed, and the organisation exposed to compliance and
data protection risks. By identifying these assets as critical, the college ensures that they receive
the highest priority for backup, protection, and recovery, thereby minimising the overall impact of
disruptive incidents.

2. Backup Procedures
Reliable backup processes are vital to ensuring that data and systems can be recovered after an
incident. Wargrave College should adopt a planned backup strategy that includes daily
incremental backups to record recent changes and weekly full backups to maintain complete
copies of systems and data. These backups should encompass all priority systems, databases, and
user-generated content.

To reduce risk, backup data should be stored using a combination of local storage for rapid
recovery and off-site or cloud-based solutions to protect against physical threats such as fire or
flooding. Encryption should be applied to all backup data to prevent unauthorised access,
particularly for off-site storage. Additionally, routine testing of backups is essential to confirm
that data can be restored successfully. Without regular testing, backups may prove unreliable
during an actual recovery scenario.

3. Disaster Recovery Process

When a disaster occurs, Wargrave College must follow a clearly defined and systematic recovery
procedure. The initial phase involves detecting and containing the incident, during which IT
personnel identify the issue, isolate affected systems, and prevent further damage, particularly in

46
Student Name Security

the case of cyber threats. Following containment, an impact assessment should be conducted to
determine the extent of disruption and identify affected systems.

Subsequently, systems should be restored in order of priority, starting with those that are critical
to teaching and administration. Recovery should be carried out using verified backups to ensure
system integrity and prevent recurring issues. Once restoration is complete, comprehensive
testing must be performed to confirm that systems are functioning correctly. Throughout the
recovery process, transparent communication with senior management, staff, and students is
essential to provide updates on progress, service availability, and any temporary arrangements.

4. Roles and Responsibilities During Recovery

Assigning clear roles and responsibilities is essential for an organised and efficient disaster
recovery effort. At Wargrave College, the IT Manager is responsible for overseeing and
coordinating recovery activities, including making decisions about system priorities and resource
allocation. IT support staff are tasked with executing technical recovery actions such as restoring
data, validating backups, and testing systems.

Senior leadership is responsible for monitoring the recovery process, authorising major decisions,
and managing communication with internal and external stakeholders, including parents,
regulators, and third-party service providers where required. Staff and students also play a role by
following guidance issued during the recovery phase, such as using alternative systems and
reporting post-recovery issues. Defined responsibilities ensure that recovery actions are carried
out smoothly and effectively.

By maintaining a robust security policy alongside a comprehensive Disaster Recovery Plan,

Wargrave College can significantly reduce the consequences of cyber incidents and system
failures. While the security policy focuses on prevention and control measures, the DRP ensures
preparedness, effective response, and timely recovery. Together, these documents support
regulatory compliance, protect sensitive information, and ensure continuity of academic and
administrative services. This combined approach enhances the college’s resilience and
strengthens its ability to withstand both digital and physical threats.

47
Student Name Security

48
Student Name Security

49
Student Name Security

Roles of Stakeholders in Implementing Security Audits at Wargrave College

A security audit is a formal process used to examine how effectively an organisation protects its
information systems, digital assets, and data. At Wargrave College, carrying out a security audit
is not the responsibility of a single department but a shared effort involving several stakeholder
groups. Each stakeholder contributes specific knowledge and actions that help identify
vulnerabilities, collect reliable evidence, and ensure compliance with security requirements.
When these stakeholders work together, audits become more effective and lead to measurable
improvements in the college’s overall security arrangements.

Senior Leadership
Senior leaders, such as the Principal and senior IT executives, provide oversight and direction for
security audit activities. Their role involves approving audit schedules, allocating funding, and
ensuring that audits support legal obligations and institutional goals. Their involvement is
essential because audits require authority and enforcement power to drive change. Senior
leadership approves security policies, reviews audit findings, and ensures that weaknesses
identified during audits are addressed through corrective measures. Their actions demonstrate
organisational commitment to security and encourage compliance across all departments.

IT Infrastructure and Systems Administrators

IT administrators are directly responsible for supporting audits with technical evidence. Their
duties include providing access to system logs, network configurations, security settings, user
access records, and backup documentation. They play a vital role because of their technical
expertise and detailed understanding of how systems operate in practice. By explaining system
architecture and maintenance processes, IT administrators enable auditors to identify
vulnerabilities such as incorrect configurations, outdated software, or weak access controls,
including those linked to previous security incidents at the college.

Teaching and Academic Personnel

Teaching staff contribute to security audits by explaining how digital tools and systems are used
during daily academic activities. Their responsibilities include following security guidance,
reporting suspicious emails or system behaviour, and participating in audit interviews or
questionnaires. This role is important because many security risks originate from human
behaviour rather than technical failures. By sharing their experiences, academic staff help
50
Student Name Security

auditors assess user awareness levels, identify behavioural risks, and evaluate whether existing
training and policies are effective.

Students
Students interact with the college’s digital environment on a daily basis and therefore have a
supporting role in security audits. Their responsibility is to use systems in accordance with the
Acceptable Use Policy and cooperate with audit-related feedback requests. Students are
significant stakeholders because unsafe browsing habits, unauthorised software usage, or policy
breaches can expose systems to cyber threats. Input from students allows auditors to identify gaps
in policy enforcement and highlight areas where further guidance or controls may be required.

Independent External Auditors

External auditors provide a neutral and professional evaluation of the college’s security practices.
Their responsibility is to assess policies, systems, and controls against recognised security
standards and regulatory requirements. Their importance lies in their independence, which
ensures an unbiased review of existing practices. External auditors collect evidence, identify
weaknesses, and produce formal reports that assist senior management in making informed
decisions about risk treatment and security improvement priorities.

Technical Support and Helpdesk Teams

Technical support staff contribute practical insight into the organisation’s day-to-day security
challenges. Their responsibilities include documenting recurring incidents, identifying common
user errors, and reporting frequent system faults encountered through support requests. Their role
is important because they often detect early signs of security weaknesses before they escalate into
serious incidents. Their observations help auditors assess how effectively the organisation
identifies, responds to, and resolves security-related issues.

Collaboration Between Stakeholders

Cooperation amongst all stakeholder groups is essential for a successful security audit. Senior
executives set responsibility, IT departments offer technical proof, employees and students
discuss actual usage patterns, and outside auditors do unbiased analysis of results. This
cooperative method guarantees precise risk identification, effective evidence collection, and
consistent enforcement of compliance requirements. Wargrave College may make sure that audit

51
Student Name Security

results result in workable and long-lasting security improvements rather than just unresolved
recommendations by sharing responsibility and communicating effectively.

Justifying the security plan developed giving reasons for the elements selected.

The proposed security plan for Wargrave College has been designed in response to the recent
ransomware attack and the weaknesses identified in existing systems, policies, and procedures.
Each element of the plan has been selected to address specific risks, support day-to-day
operations such as remote learning, and ensure compliance with legal and regulatory
requirements. The plan combines physical security controls, virtual security controls, and
organisational policy elements to provide layered protection and reduce the likelihood and impact
of future security incidents.

1. Justification of Physical Security Measures

Even the strongest digital protections can be bypassed if physical access to critical systems is not
controlled. Therefore, measures such as CCTV, controlled access systems, and secure server
rooms are essential. At Wargrave College, servers were initially kept in an unprotected IT office,
which increased the risk of theft, tampering, or accidental damage.

Implementing restricted access cards and locking server rooms ensures that only authorised IT
personnel can access core infrastructure. This approach significantly reduces risks such as data
theft, deliberate sabotage, and unintentional outages. By safeguarding essential systems that
support both administrative functions and teaching activities, these controls meet operational and
safety requirements. Additionally, they assist in regulatory compliance by protecting sensitive
personal data stored on physical devices.

CCTV monitoring further enhances security by providing both a deterrent and a method for
recording incidents. Unlike relying solely on trust or manual supervision, surveillance cameras
offer accountability and help in investigations, making them an effective and cost-efficient
solution suitable for an educational environment.

2. Justification of Virtual Security Measures

Digital security controls are central to the college’s security strategy because most contemporary
threats, such as the ransomware attack previously experienced, occur online. A combination of
52
Student Name Security

firewalls, antivirus software, encryption, multi-factor authentication (MFA), and secure VPNs has
been selected to provide layered protection against these threats. A correctly configured firewall
is critical for managing incoming and outgoing network traffic. The prior weak firewall setup
allowed malicious activity to spread freely across systems. Strengthened firewall rules reduce the
likelihood of unauthorised access and limit malware propagation, supporting both network
security and operational continuity.

Antivirus and anti-malware programs are vital because they offer real-time detection of known
threats, particularly from email attachments or downloads. Unlike relying solely on user
vigilance, these tools automatically block malicious files, reducing the likelihood of human error
leading to infection. Encryption is essential for safeguarding sensitive student and staff
information, both while it is stored and during transmission. Even if systems are breached,
encrypted data remains inaccessible to attackers.

This measure directly supports compliance with data protection laws and privacy regulations.
MFA and a managed, secure VPN replace insecure third-party solutions. MFA greatly lowers the
risk of account compromise, while a properly configured VPN provides secure remote access for
staff conducting online teaching. Together, these measures maintain strong security without
disrupting usability, ensuring that digital learning can continue safely and efficiently.

3. Justification of Policy Elements

Technical controls alone are not sufficient without strong organisational policies. Therefore,
acceptable use policies, password policies, access control rules, and staff training programmes
were included in the security plan. A strengthened Acceptable Use Policy (AUP) is necessary to
clearly define acceptable and unacceptable behaviour. This reduces risks related to misuse,
copyright breaches, and unsafe downloads. It also supports legal compliance and ensures
consistent enforcement across staff and students.

The password and authentication policy is justified because weak passwords are a common cause
of security breaches. Enforcing complexity requirements and regular updates reduces the risk of
unauthorised access and meets both security best practice and audit requirements. Security
awareness and training were included because the ransomware incident was triggered by a staff
member downloading a malicious file. Training reduces human-based risks by helping users
recognise phishing attempts, unsafe websites, and suspicious activity. Compared to technical
53
Student Name Security

controls alone, trained users act as an additional layer of defence, supporting long-term risk
reduction.

Each element of the proposed security plan has been deliberately selected to address specific
weaknesses identified at Wargrave College. Physical controls protect infrastructure, virtual
controls prevent and detect cyber threats, and policy elements manage user behaviour and
compliance. Together, these measures reduce security risks, support uninterrupted teaching and
learning, and ensure the college meets its operational, legal, and safety obligations. This balanced
and layered approach makes the security plan both practical and appropriate for Wargrave
College’s environment and risk profile.

Evaluation of the Suitability of Tools Used in the Organizational Policy

Network Monitoring Tools

Tools such as SolarWinds, Nagios, and PRTG are essential for continuously observing network
activity at Wargrave College. They provide real-time insights into traffic patterns and alert IT
staff to unusual behaviour, such as attempts at unauthorised access or the spread of malware.
Their main strengths are early detection of anomalies, performance monitoring, and detailed log
generation to support audits and regulatory compliance.

However, these tools can be expensive to implement and require skilled personnel to analyse the
data effectively. For a college with around 2,000 students and 65 staff, professional monitoring
solutions are highly appropriate, allowing IT teams to manage security threats proactively while
maintaining smooth operations for on-site and remote learning. In comparison to free or basic
monitoring systems, professional tools offer automated alerts, advanced reporting, and integration
with other security platforms, making them far more effective for a medium-sized educational
institution handling sensitive information.

Firewalls
Firewalls serve as a critical barrier against unauthorised network traffic. At Wargrave College,
they are essential to prevent malicious activity and to separate networks to reduce the risk of
malware moving between staff and student systems. Firewalls provide strong traffic filtering,
enforce security policies, and support network segmentation. Their effectiveness depends on

54
Student Name Security

proper configuration; misconfigurations, such as those in the previous security incident, can
create vulnerabilities. Hardware-based firewalls with management features are more suitable than
free or software-only options because they allow better control, scalability, and policy
enforcement, protecting sensitive data and ensuring continuity of teaching and administrative
operations.

Backup Software
Backup solutions are vital to protect critical data, including student records, staff emails, and
learning resources, from deletion, ransomware, or hardware failures. Automated backup software
allows scheduling of regular backups, secure storage, encryption, and off-site or cloud-based
copies. Its limitations include costs and the need for periodic restoration testing to ensure data can
be reliably recovered. Compared to manual or simple NAS backups, professional backup tools
reduce human error, improve recovery speed, and enhance operational resilience. These features
make them highly suitable for ensuring continuity and compliance with data protection standards.

Audit Tools
Audit tools, including log analysers and compliance checkers, are designed to examine system
configurations, monitor adherence to policies, and detect deviations. At Wargrave College, these
tools allow IT staff and auditors to systematically review permissions, network settings, and
policy compliance. Benefits include structured evidence collection, identification of
misconfigurations, and early detection of compliance gaps. Limitations involve the need for
technical expertise and occasional false positives. Automated audit tools are more efficient and
accurate than manual auditing, enabling timely risk mitigation and ensuring policies such as
password rules and acceptable use guidelines are consistently followed.

Antivirus and Anti-Malware Software

Antivirus and anti-malware applications protect devices from ransomware, malware, and other
malicious threats. Following a ransomware incident, it is clear that Wargrave College requires
robust endpoint protection for both students and staff. Key benefits include real-time detection,
automatic updates, and centralised management across multiple devices. Challenges include
reduced protection against unknown threats and potential performance issues on older hardware.
Enterprise-grade solutions are preferred over free versions because they offer centralised
administration, reporting, and simplified deployment across all endpoints, ensuring sensitive data
is secured while maintaining smooth operation.
55
Student Name Security

Authentication Systems / Multi-Factor Authentication (MFA)

MFA adds a critical layer of security beyond passwords by requiring additional verification
during login. At Wargrave College, MFA replaces previous insecure VPN systems, significantly
reducing the risk of account compromise. Its benefits include stronger protection against
unauthorised access, particularly for remote learning and administrative systems. Limitations
include potential user inconvenience and the need for initial setup and guidance. MFA is highly
suitable because it safeguards sensitive information, supports operational continuity, and offers
superior protection compared to password-only methods, especially against phishing and
account-targeted attacks.

The suite of tools chosen for Wargrave College, including network monitoring, firewalls, backup
solutions, audit tools, antivirus software, and MFA, is highly appropriate for the institution’s
needs. Each tool addresses specific risks and operational requirements, while collectively forming
a layered security strategy that protects against both technical and human vulnerabilities. While
minor limitations exist for individual tools, using them together ensures robust protection,
compliance with legal requirements, and uninterrupted operations. Compared to basic or free
alternatives, professional-grade solutions provide greater reliability, efficiency, and scalability,
making them ideal for a medium-sized educational institution with multiple users and sensitive
data.

56
Student Name Security

Reference List
1.​ Chhabra, S. (2025) Data backup strategies and ransomware resilience. Available at:​
[Link]
2.​ Dashlane (2024) Network segmentation: What it is and why it matters. Available at:​
[Link]
3.​ GeeksforGeeks (2025) Firewall security and network protection. Available at:​
[Link]
4.​ Kumar, A. (2025) Patch management best practices for organisations. Available at:​
[Link]
ment/
5.​ Medium (2024) Why outdated operating systems are a security risk. Available at:​
[Link]
6.​ Nicaise, R. (2023) Physical security controls in information systems. Available at:​
[Link]
7.​ Pak, J. (2024) Disaster recovery planning for IT systems. Available at:​
[Link]
8.​ SecurePass (n.d.) Password policy and access control explained. Available at:​
[Link]
9.​ Sucuri (2024) Access control vulnerabilities and mitigation. Available at:​
[Link]
10.​WhatIsMyIPAddress (2024) Static IP addresses explained. Available at:​
[Link]
11.​Insider Threats (2025) Understanding insider threat risks. Available at:​
[Link]
12.​CERTStation (2020) VPN and remote access security fundamentals. Available at:​
[Link]
13.​Microsoft (2024) Windows lifecycle and end-of-support risks. Available at:​
[Link]
14.​ICO (2023) Guide to the UK GDPR. Available at:​
[Link]

57
Student Name Security

15.​ISO (2022) ISO/IEC 27001 Information security management systems. Available at:​
[Link]
16.​ISO (2023) ISO/IEC 27005 Information security risk management. Available at:​
[Link]
17.​SolarWinds (2023) Benefits of network monitoring systems. Available at:​
[Link]
18.​Nagios (2024) Network monitoring and intrusion detection. Available at:​
[Link]
19.​IBM (2024) What is ransomware?. Available at:​
[Link]
20.​Cisco (2023) What is a DMZ in network security?. Available at:​
[Link]
21.​Cloudflare (2024) What is NAT (Network Address Translation)?. Available at:​
[Link]
22.​Kaspersky (2023) Malware types and prevention. Available at:​
[Link]
23.​TechTarget (2024) Security Information and Event Management (SIEM). Available at:​
[Link]
24.​OWASP (2023) Top security misconfigurations. Available at:​
[Link]
25.​NIST (2022) Cybersecurity framework overview. Available at:​
[Link]

58