Security Information Management Analysis

As recognized by leading research and consulting firms with knowledgeable, skilled management, advanced state-of-the-art IT affords extraordinary opportunities for greater efficiencies, cost reduction, higher productivity, customer satisfaction, and profitability. Sophisticated IT applications realize their full potential with highly specialized technical knowledge and management skills readily available only in smaller firms focused primarily or exclusively on such applications. Through State of the art IT Security Management (ITSM) processes such as threat management, auditing, encryption and customer education will be used to prevent misuse and/or abuse of Finman’s IT resources or services.

Users are assigned a unique user name and password. Passwords are required to be complex, changed frequently and will lockout after a predetermined number of invalid attempts. User sessions are required to re-authenticate after periods of inactivity. MC performs routine user account review to ensure appropriate entitlements and the removal of dormant accounts. All servers and workstations are built and hardened to the MC baseline standard with servers performing a single role (e.g. IIS). MC employs antivirus on all desktops and servers. Antivirus is centrally managed with definition updates pushed daily. MC performs routine vulnerability scans and monthly patch management. A third party external penetration test is performed annually. MC requires all sensitive data transmissions to be encrypted through web (e.g. HTTPS), bulk file transfer (e.g. Secure FTP) and email transmission (e.g. TLS) using industry recognized algorithms. Sensitive data is encrypted within the database. End users are restricted from writing to USB and CD-R. MC has deployed Security Incident Event Manager (SIEM) throughout the environment. The SIEM generates alerts which are reviewed by designated members of

Tripwire application for managing incident detection, security policy enforcement, reduce the attack surface and automate regulatory compliance.

___________________ is a global provider of security, risk, and compliance solutions for enterprise environments. Their products include identity assurance, data loss prevention, encryption, and tokenization devices. They also provide specific training and certifications to help security professionals acquire and demonstrate the knowledge and skills to use their products effectively.

It becomes in reality the enterprise security architecture, and it is central to the success of a strategic program of information security management within the organization.

The world of cyber security continues to introduce new threats each year against network infrastructures and computer devices. In the recent years, the impact from cyber-attacks has wreaked havoc on many company brands and organizational reputations. As this issue grows so does the technology to prevent and protect against these malicious attacks. It is absolutely crucial for organizations and businesses to shift focus from defense for different types of attacks to improving safeguards to mitigate the loss of sensitive data when an attack occurs. In addition to the traditional security technology used to detect an attack, companies will have to include

The best way to address this issue is the use of a threat intelligence management platform. The “threat intelligence management platform” filters, gathers and analyzes data, and then delivers it in a standard format for inclusion in a variety of security systems and appliances (Comparing). Finally, it is important to remember that the organizations budget will play a major role in the choice of selecting threat intelligence services. The appropriate choice is to strive for consistency when interviewing potential service providers.

The National Institute of Standards and Technology (NIST) defines Information Security Continuous Monitoring as “maintaining ongoing awareness of information security, vulnerabilities, and threats to support organizational risk management decisions” (Dempsey, et al., 2011). NIST advocates for continuous monitoring of information security systems, by the process of defining the program, establishing it, implementing the program, analyzing and reporting findings, responding to the findings, and reviewing and updating the program. Additionally, they believe that in order to be more cost effective, and to improve efficiency and reliability of the monitoring program, automation would be the way to go. By making use of the latest trends in technology such as machine learning and data mining, algorithms can be developed to detect patterns, which would ordinarily be missed by the human eye. This is especially true of voluminous data where it is time consuming and just plain difficult for personnel to sift through. Such implementations leaves the security professionals with time to tackle the issues which would require human involvement (Dempsey, et al., 2011). One example of an automated monitoring system is a firewall. The job of a firewall is to monitor and regulate the network traffic coming into and out of a system, which could be as small as a single home computer connected to the internet, to several thousands of devices in an organization the size of Amazon or

The Federal government is moving to continuous monitoring to improve the security posture of government agencies by maintaining an ongoing awareness of threats and vulnerabilities to support near-real time risk management decisions. Requirements and guidance for implementing continuous monitoring can be found in the Cross-Agency Priority (CAP) goals, the Office of Management and Budget Memorandum 14-03, NIST SP 800-137, and other publications listed in the Applicable Laws and Guidance section of this document. The following paragraphs provide an overview of these

Deploying the right security products – IT security today has a wide range of technologies that are aimed specifically at lowering risks and threats.

The underlying principle of a SIEM system is that data is generated throughout the enterprise and being able to gather this data in a single location enabling the identification of trends and out of the ordinary patterns is critical to the security of the enterprise.

For businesses to keep pace with the latest technology, threats and to remain in compliance with current and future regulations or policies need to have effective management of information security in their organization. Information Security Management Frameworks are based on existing accepted standards, guidelines, and collections of practices that should be implemented in an IT department. I will discuss some frameworks of information security management, their pros and cons, some major

Miller Inc. which is in the business of providing data collection and analytics services relies majorly on network security to keep its competitive advantage. This is because the customers that rely on the company's system trust that since there are sufficient security measures that have been ensured, they can store their data securely. Each of the functional models of the system should have sufficient security measures to ensure that complete security of the whole system architecture is achieved. The three functional modules are the backend module, services or operation module and customer access module. The major relationship between infrastructure and security comes in the role they play to ensure that the end user gets the data that they need when they need it and in the best way possible. Therefore for the three modules, there is a need to balance security with the right infrastructure.

There were a number of factors that contributed to the breach, which had they been addressed or had corresponding mitigation responses in place, would have reduced the likelihood that the breach would have taken place, or at a minimum reduce the impact of the attack. These items range from policy related issues, technology implementations, and security management and maintenance. Although I believe a number of these areas were in the process of being addressed, based on the information gathered regarding the details of the incident, it appears that it was still in many areas insufficient and would not have prevented an incident even if there had been more time available to perform the implementations.

Answer: Information Security is the practice of defending (guiding) information by considering the CIA Triad Principles which are Confidentiality (Authorize access), Integrity (Accuracy and Completeness) and Availability.