Assessment of the Security of My Company's Computer System

Identify at least 3-5 potential information security risks that the lab may be exposed to and propose counter measures for addressing those risks. Identify security technology and products that could be used to protect the lab environment from these risks. Use

Companies should develop a control that requires that routine vulnerability assessment of their customer facing web sites, network infrastructure, and associated systems (such as database systems). Vulnerability assessment can help identify potential weaknesses to systems and also provide a sort of feedback to the organization’s IT department on their current operational policy and security posture. The cost of performing a routine vulnerability assessment is considerably less than that of an actual data breach.

If the management team wants a list of issues which can be regulated with additional security measures then I would recommend a vulnerability assessment. If the management team wants to determine the effectiveness of the current security measures and the ability of IT department employees to deal with an active threat, I would recommend a penetration test. The probable best solution is to conduct both testing methods, with the vulnerability test conducted first, with the penetration test being conducted to determine the effectiveness of the vulnerability test after actions.

The periodic assessment of risk to agency operations or assets resulting from the operation of an information system is an important activity. It summarizes the risks associated with the vulnerabilities identified during the vulnerability scan. Impact refers to the magnitude of potential harm that may be caused by successful exploitation. It is determined by the value of the resource at risk, both in terms of its inherent (replacement) value, its importance (criticality) to business missions, and the sensitivity of data contained within the system. The results of the system security categorization estimations for each system, is used as an aid to determining individual impact estimations for each finding. The level of impact is rated

* Identify risks, threats, and vulnerabilities in the 7 domains of a typical IT infrastructure

A vulnerability assessment is a risk testing process which finds, quantity and rank possible vulnerabilities to threats in as many security defects as possible in a given timeframe. Depend upon organization scope there are many way to conduct vulnerability assessment. This assessment may involve automated and manual techniques.

Risk assessment and threat assessment should go hand-in-hand.The outcome of the risk assessment and threat assessment should provide recommendations that maximize the protection of confidentiality, integrity and availability while still providing functionality and usability. The purpose of a risk assessment is to ensure sensitive data and valuable assets are protected. An organization should take a hard look at who has access to sensitive data and if those accesses are required. The security audit should monitor the companies systems and users to detect illicit activity.The security audit should

Lab #1 – Part A – List of Risks, Threats, and Vulnerabilities Commonly Found in an IT Infrastructure

Objective: Assess the security vulnerabilities of an organization's computer/network operating systems along with the techniques used to protect them.

Without an Internal Audit Group to shepherd the IT's activities and guarantee that they stay agreeable with the security administration systems to which the association has submitted, the presentation of danger could be intemperate and a genuine risk to the fruitful operation of the association. The Audit's presentation and Compliance Framework denote a noteworthy change in the Office's audit hones. Further, it reasoned that the presentation of the graduated danger based methodology has met global principles and speak to best work on, bringing about a viable and effective audit

In the current society, business, organizations and government are very dependent on computers and Internet. Adequately protecting an organization 's information assets is a requisite issue. Many organizations have deployed security software or devices, such as firewalls or intrusion detection systems, to help protect their information assets and to quickly identify potential attacks. IBM Systems Journal states that "some organizations came to realize that one of the best ways to evaluate the intruder threat to their interests would be to have independent computer security professionals attempt to hack into their computer systems" (IBM 2001). This might be a good way to evaluate the system vulnerability. However, to allow a penetration test team break into their systems, the organization may have faces some risks. For example, the penetration test team may fail to identify significant vulnerabilities; sensitive security information may be disclosed, increasing the risk of the organizations being vulnerable to external attacks (The Canadian Institute of Chartered Accountants). Some organization even send their system administrator to be trained Ethical Hacking as a career course in Tertiary

After the information system is installed, the IS security controls must be monitored and assessed on a continuous basis. Continuous monitoring ensures the security controls in place are effective. In this step, there are five tasks. The first task requires managers to determine the security impact based on the threat environment. The second task is conducting assessments on certain security controls as outlined in their Continuous Monitoring Strategy. The third task is correcting discrepancies found in the assessment. The fourth task requires updating the Security Authorization package based on the previous results. The fifth task requires the appropriate officials to make a risk determination and acceptance by reviewing the reported security

Application of context to scan results – to determine which infrastructure vulnerabilities should be targeted first and most aggressively.

In Case study number one (Dhillon, 2007), Stellar University(SU), which is public education institution, had a system breach in its Information Systems(IS). The IS of SU contained many types of IT such as Mainframe, AS400, Linux, VAX, Unix, AIX, Windows(3.1 and up to 2003), Apple, RISC boxes Storage Area Networks(SAN), Network Attached Storage(NAS) and much more. Sadly, SU has had a security breach on some of its systems. Even though everything was fixed but there are issues that need to be discussed about this breach. The first issue is adequacy of organization's long-term counter attack actions. The second issue is helpfulness of immediate counter attack actions. Hopefully, the discussion will be concise and to the point.

Information security professional’s job is to deploy the right safeguards, evaluating risks against critical assets and to mitigate those threats and vulnerabilities. Management can ensure their company’s assets, such as data, remain intact by finding the latest technology and implementing the right policies. Risk management focuses on analyzing risk and mitigating actions to reduce that risk. Successful implementation of security safeguards depends on the knowledge and experience of information security staff. This paper addresses the methods and fundamentals on how to systematically conduct risk assessments on the security risks of information systems.