WINSEM2023-24_BCSE354E_ETH_VL2023240501654_2024-02-08_Reference-Material-I.pptx

Security

1. BCSE354E - Information Security Management Dr. S K Somasundaram Assistant Professor Senior Grade 2 School of Computer Science and Engineering, Vellore Institute of Technology, Vellore – 632014 Phone No: [phone] Mail ID: [email protected] Location : PRP Block – 218D Module 5 - Managing Health and Safety

2. Contents Need For Health and Safety at Work Security Analyst’s role Emergency Situations Skills for Maintaining Health and Safety at Work

3. Need for Health and Safety at Work The main focus in occupational health is on three different objectives: The maintenance and promotion of workers’ health and working capacity The improvement of working environment and work to become conducive to safety and health Development of work organisations and working cultures in a direction which supports health and safety at work, and in doing so also promotes a positive social climate and smooth operation, and may enhance productivity of the undertakings

4. Need for Health and Safety at Work – cont … Having a healthy, safe and secure working environment is important for the following reasons: Business case - Employers are recognizing the competitive advantage that a healthy workplace can provide to them, in contrast to their competition, who would feel that a healthy and safe workplace is just a necessary cost of doing business. Global case - There is a widespread agreement among global agencies, including the WHO and the ILO that the health, safety and well-being of workers, who make up nearly half the global population, is of paramount importance. Thus, in order to comply with international standards and to have a good reputation globally, organisations in India too need to maintain a healthy, safe and secure working environment.

5. Need for Health and Safety at Work – cont …

6. Need for Health and Safety at Work – cont … Different types of breaches in health, safety and security 1. Physical hazards Are the most common hazards and are present in most workplaces at some time. Example - frayed electrical cords, unguarded machinery, exposed moving parts, constant loud noise, vibrations, working from ladders, scaffolding or heights, spills, tripping hazards. 2. Ergonomic hazards Occur when the type of work you do, your body position and/or your working conditions put a strain on your body . They are difficult to identify because you don’t immediately recognize the harm they are doing to your health. Example - poor lighting, improperly adjusted workstations and chairs, frequent lifting, repetitive or awkward movements.

7. Need for Health and Safety at Work – cont … Different types of breaches in health, safety and security Chemical hazards Are present when you are exposed to any chemical preparation (solid, liquid, or gas) in the workplace. Example , cleaning products and solvents, vapours and fumes, carbon monoxide or other gases, gasoline or other flammable materials. Biological hazards Come from working with people, animals, or infectious plant material . Example , blood or other bodily fluids, bacteria and viruses, insect bites, animal and bird droppings. Electrical Hazards As there are many equipment in the workplace that are run by electricity , which if due precautions are not taken can cause fire, electric shock, electrocution.

8. Need for Health and Safety at Work – cont … Types of health and safety hazards at a workplace Safety hazards That cause accidents that physically injure workers . Example - many tall buildings that have glass windows, require cleaners to hang from the rooftop to clean the glasses. If the rope snaps, or if there is some other mistake, it can get fatal for the cleaner. Health hazards that result in the development of some disease.

9. Understanding ‘Safety’ Accident is an unplanned and undesired occurrence, which may or may not result in injury, or damage to self, others and/or property. Main causes of accidents are: Need for Health and Safety at Work – cont…

10. Understanding ‘Safety’ Safety is freedom from accidents, injury or damage; it is a pro-active means to give protection from known dangers . A safe workplace is free of risks and hazards. Need for Health and Safety at Work – cont …

11. Understanding ‘Safety’ Hazards are the potential to cause harm (accidents, injury or damage) e.g. Naked wires Heavy equipment and machines Heat being generated in the computers, Servers, etc. Sharp edges on furniture Risks are the likelihood of harm (accidents, injury or damage) e.g. Plugging equipment with naked wires Lifting heavy equipment in a wrong posture Working in a non-temperature regulated environment with Technology that heats up Using duplicate parts in IT equipment that could pose a safety threat Need for Health and Safety at Work – cont …

12. Common Safety Hazards Some safety and health related hazards and how they can be controlled are as follows: Surfaces/Places related Hazards & Risks Equipment/items related Hazards & Risk Materials & Chemical Hazards & Risks Physical Hazards & Risks Electrical Risks Need for Health and Safety at Work – cont …

13. 1. Surfaces/Places related Hazards & Risks: Dirty, dusty and littered areas can lead to infections as well as accidents from slipping, tripping, etc. Wet/oily/soapy surfaces are can lead to accidents by slipping or falling and breaking of glassware. Working with wooden tables that have nails protruding on the surface. How to Control? Keep the work area neat and tidy Wet areas should be mopped and kept dry Handling glassware properly Precautions should be taken while dealing with surfaces with sharp or pointed edges or object protruding Need for Health and Safety at Work – cont …

14. 2. Equipment/items related Hazards & Risk: Certain equipment used in the workplace like staplers, heavy laptops and computers, etc. which if not used carefully can cause physical hurt. How to Control? Never use a tool to do a job for which it was not designed Handling the equipment properly as required Need for Health and Safety at Work – cont …

15. 3. Materials & Chemical Hazards & Risks: Cleaning chemicals used by housekeeping, kept in the washroom and housekeeping cabinets Solutions for cleaning IT equipment Pest control sprays, etc. How to Control? While using hazardous materials & chemicals ensure the following Wear gloves, avoid skin coming into contact with the chemical Keep the chemical away from eyes and nose Never mix chemicals unless particularly advised by the product manufacturer Do not ingest any chemical, if by mistake someone swallows some chemical see a doctor immediately. Need for Health and Safety at Work – cont …

16. 3. Materials & Chemical Hazards & Risks - cont : How to Control? Identify common warning signs associated with different types of hazardous materials Need for Health and Safety at Work – cont …

17. 4. Physical Hazards & Risks: Any obstruction at the entry/exits/blind turns could be dangerous in a time of emergency when people have to run in or out. Overstocked cupboards or shelves can be hazards as they can topple over anytime. Work may require lifting or moving heavy objects, which if not done properly can cause injury or aches. Need for Health and Safety at Work – cont …

18. 4. Physical Hazards & Risks - cont : How to control? Entry/exits/blind turns should be clear of obstructions/faults at all times. Cupboards and shelves should be neatly arranged, preferably supported by the wall or fixed on the floor. Warning signs should be placed if a physical hazard cannot be removed. Always try to use a machine or tool if required to lift a heavy object. If it is not possible then try to split the load and lift it in more than one turns. Can also take help. If one has to lift a heavy object, then follow right lifting practices while lifting or moving heavy objects. Need for Health and Safety at Work – cont …

19. 4. Physical Hazards & Risks - cont : Need for Health and Safety at Work – cont …

20. 4. Physical Hazards & Risks - cont : Need for Health and Safety at Work – cont …

21. 5. Electrical risks Electricity is an amazing thing when used properly, but can very easily hurt, harm and even fatally injury a person that comes in contact with it. Whenever one works with power tools or electrical circuits there is a risk of electrical hazards, especially electrical shock. Electric shock : an electrical shock is received when electrical current passes through the body. One gets an electrical shock if: • Touching a live wire and an electrical earth, or • Touching a live wire and another wire at a different voltage. Need for Health and Safety at Work – cont …

22. 5. Electrical Risks Freeing a victim from electrocution The first person to reach a shocked worker should cut off the current if this can be done quickly. If this is not possible, the victim should be removed from contact with the charged equipment. Either the equipment/wire should be pulled away or the victim. Bare hands should not be used, use a dry board, dry rope, leather belt, coat, overalls or some other non-conductor. Be sure to stand on a non-conducting surface when pulling – dry rubber slippers, dry wooden board, etc. Need for Health and Safety at Work – cont …

23. Role of a Security Analyst in maintaining health and safety at work The role and responsibilities of an Information Security Analyst related to maintaining a healthy, safe and secure working environment would be defined in the organisation’s policy on the same . Thus, he would have to ensure that he follows the rules. Example If the company policy states that all IT equipment that is more than two years old, should go for annual maintenance, then it would be the Information Security Analyst’s responsibility to ensure the same.

24. How to identify job hazards The following are the major steps to identifying and analyzing job hazards: Step 1 - Decide whether a job is to be analyzed Step 2- Break the job down into a sequence of steps Step 3- Identify the potential hazards Step 4 - Hazard Mitigation

25. How to identify job hazards – cont … Step 1 - Decide whether a job is to be analyzed, based on the following criteria: Incident frequency and severity Jobs where incidents occur frequently, or where they occur infrequently but result in disabling injuries. Potential for severe injuries or illness The consequences of the incident, hazardous conditions, or exposure to harmful substances are potentially severe. Newly established jobs Due to lack of experience in these jobs, hazards may not be evident or anticipated. Modified jobs New hazards may be associated with changes in job procedures. Infrequently performed jobs Employees may be at greater risk when undertaking nonroutine jobs, and an analysis provides a means of reviewing hazards.

26. How to identify job hazards – cont … Step 2 - Break the job down into a sequence of steps. Ensure that each step is not too specific, or too general. Steps should be kept in the correct sequence. Document using the company template. Make notes on what is done, rather than how it is done.

27. How to identify job hazards – cont … Step 3- Identify the potential hazards. Based on observations of the job, knowledge of incident and injury causes, and personal experience, list the things that could go wrong at each step . The following is a list of questions that may be used to help identify potential hazards: Can any body part get caught in or between objects? Do tools, machines, or equipment present any hazards?

28. How to identify job hazards – cont … The following is a list of questions that may be used to help identify potential hazards: Can the worker make harmful contact with moving objects? Can the worker slip, trip, or fall? Can the worker suffer strain from lifting, pushing, or pulling? Is the worker exposed to extreme heat, or cold? Is excessive noise, or vibration a problem? Is there a danger from falling objects?

29. How to identify job hazards – cont … The following is a list of questions that may be used to help identify potential hazards: Is lighting a problem? Can weather conditions affect safety? Is harmful radiation a possibility? Can contact be made with hot, toxic, or caustic substances? Are there dusts, fumes, mists, or vapors in the air?

30. How to identify job hazards – cont … Step 4 - Hazard Mitigation Upon completion of the first three steps of the job hazard analysis, determine the appropriate controls to overcome the hazards. Elimination, substitution, isolation, engineering controls, administrative controls, and personal protective clothing and equipment.

31. Responsibilities w.r.t Health and Safety at Work Complies with his organisation’s current health, safety and security policies and procedures. Reports any identified breaches in health, safety and security policies and procedures to the designated person. Identifies and corrects any hazards that he can deal with safely, competently and within the limits of your authority.

32. Responsibilities w.r.t Health and Safety at Work – cont … Reports any hazards that he is not competent to deal with to the relevant people in line with organisational procedures. Warns others who may be affected. Follows the emergency procedures promptly, calmly and efficiently. Identifies and recommends opportunities for improving health, safety and security to the designated person. Completes any health and safety records legibly and accurately.

33. Responsibilities w.r.t Health and Safety at Work – cont … Coordinates with the appropriate people for his information needs. Is reliable; gets information from reliable sources Communicates with colleagues clearly, concisely and accurately. Integrates his work effectively with others. Shares essential information on time. Takes help from the appropriate people when there are any problems in the information. Follows the company rules while analysing data.

34. Responsibilities w.r.t Health and Safety at Work – cont … Honours his commitments. If for some reason, he is unable to carry out his promises, he informs in advance and suggests alternatives. Maintains good relationships with colleagues. Sorts out problems with them, if any. Shows respect for others.

35. Responsibilities w.r.t Health and Safety at Work – cont … Follows the policies, procedures and culture of the organisation . Keeps abreast with the technological developments. Takes care of quality issues. Maintains the data in the required formats Keeps data up-to-date Provides accurate information Provides complete information Gives importance to the needs of the colleagues and responds to their feedback.

36. How and when to report hazards After developing the ability to identify hazards, the Information Security Analyst should report them to his line manager, or the person assigned the responsibility in the company policy. This should be done immediately without any delay.

37. How and when to report hazards

38. Emergency Situations A workplace emergency is an unforeseen situation that threatens your employees, customers, or the public; disrupts or shuts down your operations; or causes physical or environmental damage . Emergencies may be natural, or man-made, and include the following: Floods Hurricanes Tornadoes Fires Toxic gas releases Chemical spills Radiological accidents Explosions Civil disturbances Workplace violence resulting in bodily harm and trauma

39. An organisation’s emergency procedures and their importance The following are some guidelines for emergency procedures to be followed in case of any emergency related to health, safety and security at the workplace: Consider what might happen and how the alarm will be raised. Don’t forget night and shift working, weekends and times when the premises are closed like on holidays. Plan what to do, including how to call the emergency services. Help them by clearly marking your premises from the road. Consider drawing up a simple plan showing the location of hazardous items. If you have 25 tonnes or more of dangerous substances, you must notify the fire and rescue service and put up warning signs. Decide where to go to reach a place of safety, or to get rescue equipment. You must provide suitable forms of emergency lighting.

40. An organisation’s emergency procedures and their importance – cont … You must make sure there are enough emergency exits for everyone to escape quickly, and keep emergency doors and escape routes unobstructed and clearly marked. Nominate competent people to take control. Decide which other key people you need, such as a nominated incident controller, someone who is able to provide technical and other site-specific information if necessary, or first-aiders. Plan essential actions such as emergency plant shutdown, isolation or making processes safe. Clearly identify important items like shut-off valves and electrical isolators, etc. You must train everyone in emergency procedures. Don’t forget the needs of people with disabilities and vulnerable workers. Work should not resume after an emergency if a serious danger remains. If you have any doubts ask for assistance from the emergency services.

41. Constituents an emergency action plan A preferred method for reporting fires and other emergencies. An evacuation policy and procedure. Emergency escape procedures and route assignments, such as floor plans, workplace maps, and safe or refuge areas. Names, titles, departments, and telephone numbers of individuals both within and outside your company to contact for additional information, or explanation of duties and responsibilities under the emergency plan. Procedures for employees who remain to perform, or shut down critical plant operations, operate fire extinguishers, or perform other essential services that cannot be shut down for every emergency alarm before evacuating. Rescue and medical duties for any workers designated to perform them. Designating an assembly location and procedures to account for all employees after an evacuation.

42. Evacuation procedures for workers and visitors Define a clear chain of command and designation of the person in your business authorized to order an evacuation, or shutdown. You may want to designate an ‘evacuation warden’ to assist others in an evacuation and to account for personnel. Specific evacuation procedures, including routes and exits should be defined. Post these procedures where they are easily accessible to all employees. Procedures for assisting people with disabilities, or who do not speak the commonly used language, should be clearly defined. Designation of what, if any, employees will continue, or shut down critical operations during an evacuation. These people must be capable of recognizing when to abandon the operation and evacuate themselves. A system for accounting for personnel following an evacuation. Employees’ transportation needs for community-wide evacuations should also be considered.

43. How to summon medical assistance and emergency services Organisation’s policies and procedures need to be kept in mind. Usually, organisations have an in-house first-aid kit, or medical team to assist in medical emergency situations. Employees can follow the emergency evacuation plan and take help from the designated personnel. The following are some emergency numbers that can be used in India: Service Telephone Ambulance 102 Emergency response service for medical, police and fire emergencies. Available in Andhra Pradesh, Gujarat, Uttarakhand, Goa, Tamil Nadu, Rajasthan, Karnataka, Assam, Meghalaya, Madhya Pradesh and Uttar Pradesh 108 Local police 100 Fire service 101

44. How to use health, safety and accident reporting procedures and their importance The Information Security Analyst should be well conversant with the organisation’s policy for emergency reporting procedures. Not only he should keep an eye for potential hazards, he should report them to the line manager, or any other person designated for the same. If he fails to do so, big disasters can happen that can cause harm to the employees and the company as a whole

45. Skills for maintaining Health and Safety at Work Skills is the ability to use information, or knowledge acquired through education, or experience, to accomplish a given task . Types of skills Technical Skills - The ability to do a specific type of activity or work. Human Skills - The ability to work with people. Conceptual Skills - The ability to work with ideas, or concepts. Generic Skills - These are generic in nature that are common to most white collar jobs like reading, writing, listening and speaking. Professional Skills – These skills make a person more employable by giving the person the ability to make logical decisions and the ability to solve problems judiciously. Some examples of professional skills are decision making, planning and organising , customer centricity, problem solving, critical thinking, attention to detail, and team work.

46. Skills required to maintain a safe and healthy work environment Security Analysts need to be good at the following skill-sets to be able to maintain a healthy, safe and secure working environment. Core/ Generic Skills As an Information Security Analyst, you should be able to communicate well with colleagues, in writing. You should be able to write accurately with attention to detail. Example - making plans for the department for upgrading the safety and security systems requires writing skills. You should also be able to read instructions, guidelines, procedures and service level agreements laid down by your organisation .

47. Skills required to maintain a safe and healthy work environment – cont … Professional Skills During the course of any career, one needs to be adept at professional skills like problem solving, critical thinking, logical reasoning, etc. This is equally true for an Information Security Analyst. Decision Making Planning and Organising Customer Centricity Problem Solving Analytical Thinking Critical Thinking Attention to Detail Team Work

48. Skills required to maintain a safe and healthy work environment – cont … Technical Skills Just like technical knowledge, technical skills too are equally important for any Information Security Analyst to perform his job. Example The ability to use information technology efficiently Being able to input and extract safety data accurately Being able to validate and update safety data Being able to identify and refer anomalies in safety data Being up to date with changes, procedures and practices in your role Being able to reach agreements with colleagues; etc

49. Performance evaluation criteria for an Information Security Analyst Complies with his organisation’s current health, safety and security policies and procedures. Reports any identified breaches in health, safety and security policies and procedures to the designated person. Identifies and corrects any hazards that he can deal with safely, competently and within the limits of your authority. Reports any hazards that he is not competent to deal with to the relevant people in line with organisational procedures. Warns others who may be affected. Follows the emergency procedures promptly, calmly and efficiently. Identifies and recommends opportunities for improving health, safety and security to the designated person. Completes any health and safety records legibly and accurately. Coordinates with the appropriate people for his information needs. Is reliable; gets information from reliable sources Communicates with colleagues clearly, concisely and accurately. Integrates his work effectively with others. Shares essential information on time.

50. Performance evaluation criteria for an Information Security Analyst – cont … Takes help from the appropriate people when there are any problems in the information. Follows the company rules while analysing data. Keeps a track of the needs of the organisation . Honours his commitments. If for some reason, he is unable to carry out his promises, he informs in advance and suggests alternatives. Maintains good relationships with colleagues. Sorts out problems with them, if any. Shows respect for others. Follows the policies, procedures and culture of the organisation . Keeps abreast with the technological developments. Takes care of quality issues. Maintains the data in the required formats Keeps data up-to-date Provides accurate information Provides complete information Takes logical and practical approach to problems, keeping the constraints of the organisation in mind. Gives importance to the needs of the colleagues and responds to their feedback