SEC572YouDecideWeek3

Despite the presence of network security devices such as firewalls and other security appliances, today's corporate networks are still vulnerable to both internal and external attacks by hackers intent on creating havoc. By proactively

The business continuity plans guards Confidentiality, Integrity and Availability at all times. Ensure confidentiality by enforcing access to the backups to only the disaster response team and the system administrators in charge. Ensure integrity by verifying and validating the backup snapshots after the backup is completed. Ensure availability by providing dual power to the backup servers so that the business would not be disrupted at any time due to data center disasters.

In such cases, the organization will not have any capital loss, but will lose precious data-sets that is stored in the system. Further, there could be various root causes of such threats. The criminal intentions of the inner employees, the breaching intentions of the hackers and even the poor infrastructure could also be one of the major root causes of such threats. Hence, there is a need to develop solutions that will help to overcome the threats associated with each of the risk

Strong Password Assignment. The password must be a minimum of ten characters in length and must contain alpha, numeric, and special characters. Default passwords should be immediately changed when assigned. Users must never reveal their passwords to anyone. Passwords should not be constructed from obvious personal data, i.e. social security number, telephone numbers, relative’s names, pet’s name, etc.

As part of the network security team, we will be proving IDI with a network security plan to mitigate the vulnerabilities that have been discovered. A secure site will be set up with network intrusion detection and network protection systems will be available to access via the internal network. Policies will be presented for remote access and the use of VPN. Also contained within this report will be strategies for hardening the network and mitigating risks. An updated network layout with increased network security to meet the current needs will be included.

As it was pointed out in a global security survey organizations are “haunted” by threats and that raises the concerns and demonstrates how vulnerable they are to attacks. The 48 per cent it thinks it is exposed to loss of data (information leakage) in another case 46 per cent in phishing and pharming and that pairs with the fact that the weakest link in the security system of an organization that causes failure is humans(such as employees, customers) with 86 per cent (Deloitte, 2009: 29-30). Therefore based on the information provided by these surveys, corporate intranets are the main target of internet attacks

Use the Dallas Router Virtual CLI to define an extended ACL 100 that will deny all TCP services with port numbers above 255 from the Public Server to the Dallas Server while allowing all other traffic. Apply the ACL to the outside (S0/1) interface of the Dallas Router for all inbound traffic. Execute a show running-config command to verify your configuration. Copy these Virtual CLI commands and the command output to your lab document.

As a recently established company ABC Healthcare has a still developing information technology structure that was initialized with a centralized structure in mind. As a centralized structure we can clearly distinguish the data servers as the centralized information unit, managed and maintained by single network administrator, a recently hired IT network security officer who directly reports to the CIO (Chief Information Officer). All nodes on the network connect via a switch that controls incoming and outgoing traffic, posing as a future single point of failure for the system. All working stations and shared devices are currently poorly secured in open cubicles and utilize default access credentials that can easily lead to unauthorized access by a thereat agents (internal or external).

The IT governance framework of iPremier, also did not include security. Since this was not in place prior to the initial attack, it should have been implemented immediately after. Ultimately, this was the responsibility of the CIO, but it seems as though he never took accountability, or put any of these actions in place. In order for the organization to move forward effectively and prevent security breaches in the future, the company security should not be taken lightly after such an attack and many adjustments must be made

Implementation -Implement procedures for existing authentication, access, controls, encryption, and backup. Security features should be configured enabled and verified. A final security review should be performed and engineer staff should test functionality and watch for any errors in configuration at this stage. A monitoring response plan can be put in place so IT knows the procedures when dealing with security breaches.

Minimum 6 characters that contain at least one number, letter and s special character. The system will ask for a change of password every 5 months.

In the InfoSec industry, CTOs have witnessed many inside jobs also known as insider threats. These threats usually comprise of individuals or groups of people in organizations or companies. These individuals may include employees, contractors, business associates or partners. They try to deliberately contribute to or begin to breach the network of the company to sabotage or steal information. Because these people are already inside the company, they have the advantage of being familiar with how the network works in the company, having login credentials, having ways to keep their position in the company without getting caught and being able to access information about clients. These insider

Before my team assessed the efficacy of an insider threat program, we lacked several essential aspects crucial for mitigating, detecting, and preventing insider threats. Our former insider threat program lacked a lot of essential things and thus, made Goliath National Bank vulnerable to insider threats that could have potentially harmed its assets and intellectual property like trade secrets, strategic plans, and other confidential information. In order to protect the organization, Avatar should have placed more emphasis upon behavioral indicators instead of directing most of their effort and attention on technical indicators. If Goliath National Bank had noticed the red flags and realized that the insider threat was a disgruntled employee, he wouldn’t have been able to create and inflict so much damage through espionage. Thus, it is crucial for organizations to monitor their employee’s network on their personal or work device. In addition, our insider threat program lacked two of the five NIST framework core functions (i.e. identify, protect, detect, respond, and recover), which are important for risk management. Our insider threat program failed to address the respond and recover function. Since all the functions are interdependent upon one another and are necessary for proper, prompt, and efficient risk management, without any one of them, a lot of damage can result. The response function is essential because it has to do with the actions needed to be taken after a cyber security threat is detected. An organization has to know prior what specific action they want to take, whether it plans to gather data for law enforcement or take legal action to prevent the situation from escalating. The decision is crucial because it impacts the direction the organization takes. The recover function is crucial because it serves to decrease the impact and restore

This information will be shared with internal workface, senior official, and internal staff to include, Security, HR, Information Systems Administrator. The internal groups will meet to review documentation, interview key personnel, review processes and security issues. The team will focus on prevention, detection and response strategies. Discussion and review practices will include the review of policies, procedures and technologies along with potential vulnerabilities. ECI will understand the assessment and provide the outcome information to all Security offices as

Safety of information is the most valuable asset in any organization particular those who provide financial service to others. Threats can come from a variety of sources such as human threats, natural disasters and technical threats. By identifying the potential threats to the network, security measure can be taken to combat these threats, eliminate them or reduce the likelihood and impact if they should occur.