Essay On Cyber Security

a. When is the project estimated to be completed? How many working days will it take?

No matter what an organization’s cybersecurity posture, it needs data on which to base its security decisions. However, lack of data and uncertainty about the data frequently inhibit sound corporate decisionmaking. One significant problem is the lack of standards in defining, tracking, and reporting security incidents and attacks.

The National Institute of Standards and Technology (NIST) has a number of guidelines and best practices for cybersecurity concerns across industries; one of their most well-known guides is their Cybersecurity Framework, originally created in February 2014, with a major revision underway as of January 2017. This Framework was penned specifically for critical infrastructure organizations "to better manage and reduce cybersecurity risk,” and it outlines key cybersecurity concepts and processes needed to:

Since the optimistic and pessimistic estimates for project tasks are unknown, the following table assumes an optimistic estimate of 90% and a pessimistic estimate of 130% of each task’s original duration

2. DSB Task Force, “Resilient Military Systems and the Advanced Cyber Threat,” Defense Science Board, 18 January 2013, http://www.acq.osd.mil/dsb/reports/ResilientMilitarySystems. CyberThreat.pdf.

I agree with the majority and believe that the estimate is realistic in stating that 20 percent of the project time should be in the initiating and planning process groups. If the time suggested is spent on the two most important processes it’s a greater possibility you will spend less time in execution and the other phases of the project. It’s a big mistake to shortchange the two most crucial phases of the project. Spending a fair amount of time on these two phases can reduce cost, duration, and increase quality throughout the life of the project.

Incident Response (IR) is “where personnel move to further identify the scope of the threat in the network and follow response procedures to contain and eradicate”. A key element in almost all incident response systems is the collection and presentation of potential incident information, more usually described as threat intelligence, which comes with two problems. First, the overall volume of data presented by incident response systems, and secondly the isolated manner in which the intelligence is reported. A common response from CISOs is that “I don’t need more intelligence, I just need better intelligence.” That “better” intelligence also needs to be “usable” intelligence by different security controls. It is of little surprise that the

According to Department of Defense (2014), the transition from Department of Defense (DOD) Information Assurance Certification and Accreditation Process (DIACAP) to the Risk Management Framework (RMF) has started. RMF reemphasizes the criticality of implementing continuous monitoring according to DOD (2014). In this paper, the shortcomings of DIACAP will be described and analyzed. Courses of action to address the weaknesses will be addressed. It is not clear that the transition to RMF and continuous monitoring alone will completely turn around the trend of ineffective cybersecurity in DOD. Most likely, RMF continuous monitoring will have to be combined with strategies like the consensus audit guidelines where security controls are prioritized and streamlined to those with most effectiveness. Additionally, wasteful spending and ineffective activities must be eliminated so that investments are concentrated on making positive impact to security and operations.

This would take approximately 40 days using a five-day work week. I figured this out by taken each task step by step and adding them together since site preparations will take 3 days, plus setting building footers another 3 days which now equal 6 days. Then I will add the foundation 5 days, plus another 3 days to assemble building, now the total is 14 days. Once the building is assembled there will be two task started at the same time, finish the interior 5 days, and set up an appointment for the final inspection 15 days, now the total is 29 days. Once the interior is done we can start two more task, they are landscaping 7 days, and having the driveway paved 3 days, this will bring the total to 36 days. Once the landscaping and the driveway is paved, then we can start the painting 2 days, finally when all the painting is done and we have done the final inspection, now is the time to arranged the sale which will take 2 days, leaving us with a final total 40 days from start to finish.

Cisco 2014 Midyear Security Report estimates there will be 50 Billion things on the Internet by 2020. Combine this with 91% increase in targeted attacks, 62% increase in data breaches, 552M identities compromised in 2013 reported by Symantec in their 2014 Internet Security Threat Report and visions of cyber security chaos begins to appear. The scope of this paper cannot cover cyber security threat to the entire Internet or such a broad topic as cyber security threat in general. The intent of this paper is to narrow the subject to cyber security threat assessment in the U.S. Department of Defense. Threat assessment is a necessary activity in DOD cyber security. Both the Defense Information Assurance Certification and Accreditation Process (DIACAP) and its replacement the DOD Risk Management Framework (RMF) include steps for threat assessment. There are multiple detailed processes for conducting threat assessment such as the National Institute of Standards and Technology (NIST) (2012). These processes clearly illustrate the need for cyber security threat assessment, but United States Government Accountability Office (GAO) (2011) suggests that DOD is not yet prepared to address the cyber security threat stating that DOD is too large and complex. Meanwhile, United States Government Accountability Office (2011) reports that according to U.S. Strategic Command, DOD is experiencing a cyber security storm with threat actors compromising DOD systems to achieve their goals.

Our packages are based on the time and resources we estimate are required to complete the project.

Once the previous steps has been initiated, there would be a meeting with the corporation is in order to determine the budget for the needed recommendations as well as to determine the length of time the corporation is requiring for the team to be able to finish the proposed upgrades. This is crucial because this will determine the set budget that the team will be obligated to use during the transformation; in which the proposed budget for this operation is set at $150,000. The proposed time will set at three months.

The role of computers in business operations is growing with each wake. Computers have helped entities boost efficiency, speed up service and product delivery and take consumer interaction to another level. However, this new wave has not come without its challenges. Cybercrimes pose a threat to information security and privacy, which is a concern for private and public institutions alike. The United States has developed laws that seek to regulate and improve cyber security across public and private institutions, in an endeavor to ensure national security. Therefore, managers have a new task during the process of decision making as they no longer need to look at their own

As information systems become progressively more complex, attackers also develop increasingly sophisticated attacks that threaten the integrity, confidentiality, and availability of these systems. Consequently, Information Technology (IT) security has become crucial to the survivability of the business. Companies may choose to employ safeguards to protect themselves from such threats, but what happens if these controls fail? Incident Response Plans (IRPs) are often employed as a means to mitigate and contain incidents when they occur, but their effectiveness is only as good as the planning that goes into their development. In response to this need, Intel has devised a strategy they refer to as Defense in Depth (DiDS).

It is important that organizations prepare for, and are proficient in identifying and handling, possible cybersecurity problems. The model proposed by Schultz, Brown and Longstaff presents the six-phase model of incident response including Preparation, identification, containment, eradication, restoration and follow-up (Lucas & Moeller, 2014). The preparation phase allows Sifers-Grayson to prepare an incident response plan prior to an incident. This first step defines the rules, teams up the personnel and