Technical Vulnerabilities For Global Finance, Inc.

| The security controls for the information system should be documented in the security plan. The security controls implementation must align with the corporate objectives and information security architecture. The security architecture provides a resource to allocate security controls. The selected security controls for the IS must be defined and

The network diagram of Global Finance, Inc. (GFI) depicts the layout of the company’s mission critical systems. The company has two servers (Email and the Oracle database) which are used more than any of their other systems. GFI heavily depend on their network to be stable because of their financial systems that are running and any outage would negatively affect their operations and financial situation. Like all other business, customer satisfaction and the security of GFI’s network is crucial. In order to ensure their network and data is secure,

The trusted computing base (TCB) internal network in the Global Finance, Inc. Network Diagram hosts the company’s mission critical systems without which the company’s operations and financial situation would suffer. The Oracle database and email systems are among the most intensively used application servers in the company. GFI cannot afford system outages because its cash flow and financial systems heavily depend on the network stability. GFI has experienced DOS network attacks twice this year and its Oracle database and email servers had been down for a week. The recovery process required GFI to use $25,000 to restore its operations back to normal. GFI estimated the loss from these network attacks at more than $100,000 including lost customer confidence.

The security plan is formulated to protect the information and important resources from a wide variety of potential threats. This will promote business continuity, reduce business risks and increase the return on investment together with business opportunities. The security of information technology is attained by executing a suitable set of control, efficient policies, processes, organization structures, software and the hardware. These given controls ought to be formulated, put into action, assessed, analyzed and developed for productivity, where necessary. This will allow the explicit security and business objectives of the United States Department of health and Human Services to be accomplished (Easttom, 2006, p.32).

The purpose of this document is to provide guidelines for selecting and identifying security controls for information systems supporting the Department of Defense (DoD). These guidelines have been established to help complete a secure system within the agency. Guidelines provided in the NIST Special Publication 800-53 are relevant to all federal information systems and have been mostly established from a technical view to supplement related guidelines for national security systems.

There are a variety of vulnerability identification factors that are seen as critical. The types of vulnerabilities associated with the Information Technology System depend on the nature of the system itself. Certain rules govern what action should be taken in this step. If the system has not yet been designed, the search for vulnerabilities should concentrate on the security policies of the organization, security procedures, system requirement definitions, vendor and developer’s product analysis. If the system is being implemented the identity of vulnerabilities should to expanded to include more specific information including security features described in the security documentation and results of the security certification test and evaluation. If the system is up and running, then the analysis of the IT system security features and security controls, technical and procedural should be used to protect the system. A table of Security Criteria can be found below:

Blue Moon Financial (BMF) is a large financial services firm. Recently, its information security team has been working in an elevated status to protect BMF from a recent increase in network intrusions suffered by other financial services firms. Unfortunately, even though senior management recognizes the threats posed by cyber incidents, they have not provided the senior security analyst with a high enough budget to retain experienced information security technicians; as a result, the current security team is inexperienced. Additionally, an incident response plan has not been implemented, but is currently being developed.

Having a security access control in place within an IT company will play a vital role in knowing who is where within the entire organization. Therefore, it is necessary to define the credentials required within the organization and to implement them consistently and diligently throughout the

Today, in this highly digitized world, information and data security plays a key role for any organization. And, especially, if the organization is dealing with lots of sensitive data, then it needs to have a robust security system in order to protect the data. For the given organization, the key objective of installing appropriate IT systems will be to deliver better services to its respective customers, keep the track records of all the data that is transacted through the information systems, and thereby subsequently increase the efficiency of all the operational activities of the given organization (Barton, Smith, & Weaver, 2010). It will also help in keeping the financial records of the organization in a more optimized and in a safer way.

The security plan is formulated to protect the information and important resources from a wide variety of potential threats. This will promote business continuity, reduce business risks and increase the return on investment together with business opportunities. The security of information technology is attained by executing a suitable set of control, efficient policies, processes, organization structures, software and the hardware. These given controls ought to be formulated, put into action, assessed, analyzed and developed for productivity, where necessary. This will allow the explicit security and business objectives of the United States Department of health and Human Services to be accomplished (Easttom, 2006, p.32).

This preliminary information security risk assessment for Southern California Design (SCD) is designed to provide a high-level overview of the company’s computer assets, along with the threats and vulnerabilities to those assets. The risk analysis section provides data on existing security controls, the likelihood and consequence of each type of incident, and the risk levels. The risks are then prioritized and nine assets are outlined in the risk register table for ease of reading. Finally, suggested general treatments are provided to address the risks that have been identified. For the extreme and high level risks that result from theft, hacking and malware the company should implement controls to reduce the

To forestall the troubles produced by employee use of information systems and other assets, producing a thorough information security design is almost significant. This program will provide the system with necessary details regarding the role of the organization’s assets.

Designing a working plan for securing the organization s information assets begins by creating or validating an existing security blueprint for the implementation of needed security controls to protect the information assets.  A framework is the outline from which a more detailed blueprint evolves.  The blueprint is the basis for the design, selection, and implementation of all subsequent security policies, education and training programs, and technologies.  The blueprint provides scaleable, upgradeable, and comprehensive security for the coming years.  The blueprint is used to plan the tasks to be accomplished and the order in which

Internet security is not only a continuing problem, but an increasing one. Yet, many companies do not have adequate internet security measures in place. To help businesses thwart cyber criminals operating over the internet, several steps are recommended. First, before deciding to use the internet for business purposes, organizations should articulate how they intend to use the internet (e.g., e-commerce; marketing web site; communication with business partners, customers, suppliers). Once this information is articulated, the company should next assess what risks are associated with each of the uses. Risks are the quantifiable likelihood that a financial investment will result in loss for the investor. A high risk investment is associated with both a higher probability of loss and a possibility of greater return on investment. Risk assessment is the process of determining the potential loss and probability of loss of the organization’s objectives.

The authors of "A Design Theory for Secure Information systems Design Methods" (Siponen, 2006) are advocating for an overall design method that will address problems of a design system in order to create systems with less problems of attacks and ease of use for better organizational systems. By having an overall design method to use as a guide, it will help engineers in developing better systems overall. Many observers feel that integrity, authenticity, reliability, and archiving are requirements for a successful security information system. (Bearman).